Every article by Kathryn Renaud. Straight-talking cybersecurity advice for UK small businesses.https://thesmallbusinesscybersecurityguy.co.uk/en-gbhttps://thesmallbusinesscybersecurityguy.co.uk/blog/state-sponsored-cyber-threats-ai-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/state-sponsored-cyber-threats-ai-uk-smb-2026/State-sponsored attackers are reaching small businesses through the systems they already rely on. Here is how to spot it and respond.Sun, 26 Apr 2026 16:00:00 GMTsmb-securityuk-businessremote-accesscredential-theftsupply-chain-riskincident-responsebusiness-riskKathryn Renaudhttps://thesmallbusinesscybersecurityguy.co.uk/blog/suspect-data-breach-act-now-uk-smb-playbook-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/suspect-data-breach-act-now-uk-smb-playbook-2026/Most of the real damage from a data breach does not happen during the initial compromise. It happens in the scramble afterwards. Someone panics and wipes a server. Someone else coordinates the response through the email account that is already compromised. A well-meaning manager posts on social media before anyone understands what happened. The first hour determines whether this becomes a bad day you recover from or a business-ending week you do not. This playbook walks you through exactly what Sun, 08 Mar 2026 00:00:00 GMTincident-responsedata-breachicouk-gdpruk-smbcontainmentbreach-response72-hour-notificationKathryn Renaudhttps://thesmallbusinesscybersecurityguy.co.uk/blog/duaa-compliance-workflows-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/duaa-compliance-workflows-uk-smb-2026/The Data (Use and Access) Act just went live on 5 February, and if you're only hearing about it now, you're not alone. The commencement regulations were published two days before the provisions kicked in. That's the government's idea of adequate notice. Guest contributor Kathryn Renaud cuts through the panic with something actually useful: four repeatable workflows for DSARs, complaints, cookies, and automated decisions that any UK SMB can build this week with tools they already own. No expensivSat, 14 Feb 2026 00:00:00 GMTuk-businesscompliance-failiure2026-threatssmb-securityduaa-2025Data Protectionbusiness-riskKathryn Renaudhttps://thesmallbusinesscybersecurityguy.co.uk/blog/firewall-vendor-cve-survival-guide-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/firewall-vendor-cve-survival-guide-uk-smb-2026/Your firewall vendor just announced another critical vulnerability. Last week brought two more. Last month? Six. When does "routine security update" become a vendor reliability crisis that threatens your business? For UK SMBs running Fortinet or SonicWall, the CISA Known Exploited Vulnerabilities catalogue tells an uncomfortable story: your perimeter security is under active, documented attack. This isn't vendor marketing or compliance theatre. This is your board-level "do we stay or do we leaveThu, 29 Jan 2026 00:00:00 GMTvendor-riskfortinet-vulnerabilitiessonicwall-vulnerabilitieskev-catalogueuk-smb-securitypatch-managementCyber EssentialsKathryn Renaudhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smbs-cybersecurity-bill-excludes-small-business/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smbs-cybersecurity-bill-excludes-small-business/If you run a small or medium-sized business in the UK, the government just sent you a message: you are on your own. The November 2025 Cyber Security and Resilience Bill protects hospitals and power grids. It does not protect you. Of 5.5 million UK SMBs, exactly zero gained new cybersecurity protection. This was deliberate policy. Meanwhile, 43% of UK businesses experienced breaches last year, costing an average £3,550 per incident. Germany took a different approach—and it works. This article givSun, 21 Dec 2025 00:00:00 GMTCyber EssentialsUK Government PolicyGermany NIS2Board AccountabilityRansomwareInsurance ClaimsCyber Security and Resilience BillSMB Cybersecurity StrategyKathryn Renaud