Clear-headed cyber defence for UK business leaders
A board cyber exercise is often a comfortable hour in which directors agree they would, of course, cope. This article argues that the value lies not in the scenario but in the decisions it forces, the assumptions it exposes and the documents it changes afterwards. It sets out what UK directors should demand before, during and after the exercise.
Departmental card purchases can place SaaS tools beyond procurement and security review, leaving the board without a reliable map of company and customer data. This article sets out a proportionate control set for UK mid-market boards: spend visibility, risk-based approval, a short security questionnaire and disciplined exit checks.
A domain is not an asset the organisation owns outright; it is a registration held under terms, renewed on a clock and administered through accounts that can be compromised. This article sets out why UK boards should treat domains, DNS and brand impersonation as security controls, and what to ask before the next renewal passes unnoticed.
For UK founders and boards preparing to sell, cyber maturity must be evidenced rather than asserted. This guide sets out how to present a credible position to buyers, avoid the diligence red flags that chip away at value, and use a focused 90-day plan to protect the deal.
A security operations centre visit can be a valuable assurance exercise or a polished distraction. This guide sets out how UK boards can structure the time, question what they observe and convert a day on the floor into evidence that defences work in practice.
Boards rehearse containment far more often than they rehearse disclosure. This guide sets out the pre-agreed thresholds, named decision-makers and evidence discipline that let UK directors notify the ICO, sector regulators and the market promptly, consistently and without manufacturing fresh liability.
UK boards are conversant with joiner, mover and leaver controls for people, yet service accounts, API keys, bots and OAuth tokens often sit outside that discipline. This article offers a board-level framework for governing non-human identities through named ownership, constrained privilege, lifecycle rules, monitoring expectations and a tested containment plan.
Legacy technology rarely announces itself as a board risk. It appears as a maintenance line, a tolerated workaround or a supplier dependency that no one owns. This article offers directors a practical framework for bringing ageing systems into the open and deciding, deliberately, whether to accept, transfer, remediate or retire them.
AI meeting assistants are becoming a routine feature of UK boardrooms, yet few boards have a clear view of where sensitive discussions, privileged advice and personal data are processed or stored. This article sets out a practical standard for approving, configuring and reviewing meeting-recording tools without sacrificing boardroom confidentiality for operational convenience.
Directors' own working habits can bypass controls that the organisation has spent years building. This article sets out a proportionate protocol for approved channels, device hygiene, travel briefings and the valuation of an executive inbox.
Boards tend to measure data by its usefulness, not its exposure. This article sets out how directors can treat retention and deletion as a security control, with practical tests for legal holds, backups, suppliers and board reporting.
Most UK organisations can say when a person left. Far fewer can prove when their access ended. This article sets out why offboarding breaks across HR, IT and line management, what evidence boards should expect, and a practical 30-day control calendar for closing the leaver access gap.
A ransomware demand compresses complex legal, ethical and commercial questions into hours. UK boards can reduce that pressure by agreeing a defensible decision framework long before an incident occurs, with clear prohibitions, escalation routes and an evidence trail that shows reasonable judgement.
Board cyber papers are usually built around disclosure risk, yet in factories, utilities and facilities the controlling concern is whether the line keeps running and whether people stay safe. This article sets out how UK directors can govern operational technology risk without importing IT assumptions into environments that cannot absorb them.
A penetration test informs board decisions only when it is scoped around material business risk, not around a generic checklist. This guide explains how UK leaders should commission the work, challenge severity labels and convert findings into a prioritised remediation plan.
Group cyber policies rarely travel as cleanly as boards assume. This article sets out a practical assurance model for UK groups, using a fictional plc with three acquired businesses to show where subsidiary-level oversight breaks down and what directors should ask for in 2026.
Supplier contracts often determine whether a UK board can evidence control, respond on time and recover its data after an incident. This practical listicle sets out five clauses directors should examine before signature, with example language and questions to ask.
UK boards still tilt cyber spending towards prevention and detection while recovery, continuity and tested backups remain underfunded. This article argues for a recovery-first budget discipline, with a practical challenge checklist for directors ahead of the next incident.
For a decade, cyber regulation in the UK meant a single conversation with the Information Commissioner. Boards now face a spread of supervisors, sector competent authorities and statutory duties, each with its own evidence standard. This guide maps who can act, what credible compliance looks like on paper, and how to be ready before an inquiry lands.
Non-executive appointments are usually assessed in one direction only: the board judges the candidate. Incoming NEDs who apply the same scrutiny to a company's resilience before signing frequently discover gaps that no amount of charm in the interview room can offset. This is a practical framework for asking those questions early.