Every article by Mauven MacLeod. Straight-talking cybersecurity advice for UK small businesses.https://thesmallbusinesscybersecurityguy.co.uk/en-gbhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-uk-cyber-threats-2026-07-31/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-uk-cyber-threats-2026-07-31/Latest cyber threats and vulnerabilities impacting UK SMBs this July.Fri, 31 Jul 2026 09:00:00 GMTsmb-securityuk-businessremote-accesscloud-securityvendor-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-russian-outlook-attack-npm-worms-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-russian-outlook-attack-npm-worms-2026/Outlook email vulnerabilities and npm package risks highlight threats facing UK SMBs.Thu, 30 Jul 2026 09:00:00 GMTsmb-securityuk-businesssocial-engineeringnation-state-attackssupply-chain-riskcredential-theftMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-flying-eagle-dysphoria-botnet-2026-07-29/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-flying-eagle-dysphoria-botnet-2026-07-29/Flying Eagle Android RAT and Dysphoria Botnet expose UK businesses to mobile fraud and sophisticated C2 threats.Wed, 29 Jul 2026 09:00:00 GMTsmb-securitymobile-banking-fraudbotnetcredential-theftuk-businessMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-helpdesk-hijackers-wordpress-exploits-2026-07-28/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-helpdesk-hijackers-wordpress-exploits-2026-07-28/Helpdesk Hijackers exploit Teams, while WordPress vulnerabilities threaten site security. Act fast!Tue, 28 Jul 2026 09:00:00 GMTsmb-securityuk-businesssocial-engineeringcredential-theftincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-key-vulnerabilities-july-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-key-vulnerabilities-july-2026/Critical vulnerabilities in Microsoft Defender and Java Spring Boot pose risks to UK SMBs. Update now.Mon, 27 Jul 2026 09:00:00 GMTsmb-securityuk-businessvulnerability-managementmicrosoft-defenderjava-spring-bootMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-mistic-fortibleed-2026-07-24/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-mistic-fortibleed-2026-07-24/Mistic backdoor linked to ransomware, and the FortiBleed campaign highlight growing risks. Learn how to protect your SMB.Fri, 24 Jul 2026 09:00:00 GMTsmb-securityransomware-groupscredential-theftsupply-chain-riskbusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-ai-security-risks-uk-smbs-2026-07-23/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-ai-security-risks-uk-smbs-2026-07-23/New AI vulnerabilities like Dolphin X Stealer and rogue ChatGPT agents are targeting UK businesses. Here’s the analysis.Thu, 23 Jul 2026 09:00:00 GMTsmb-securityai-threatsransomware-groupscredential-theftmalwareMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-uk-smbs-cyber-threats-2026-07-22/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-uk-smbs-cyber-threats-2026-07-22/UK SMBs face critical cybersecurity threats from re-extortion ransomware and an exploited Langflow RCE flaw.Wed, 22 Jul 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupscredential-theftcloud-securityvendor-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-qilin-ransomware-vpn-flaw-2026-07-21/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-qilin-ransomware-vpn-flaw-2026-07-21/A critical VPN flaw exploited by Qilin ransomware poses risks to UK SMBs. Urgent action required.Tue, 21 Jul 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsremote-accessvendor-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-servicenow-rce-passkey-vishing-fortibleed-2026-07-20/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-servicenow-rce-passkey-vishing-fortibleed-2026-07-20/Three active threats UK SMBs need to act on today: a critical ServiceNow RCE, passkey enrolment vishing, and a large-scale FortiGate credential harvesting campaign.Mon, 20 Jul 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftremote-accesssocial-engineeringvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-fortisandbox-legacyhive-clickfix-2026-07-17/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-fortisandbox-legacyhive-clickfix-2026-07-17/FortiSandbox flaws are being actively exploited, a Windows zero-day with no patch is now public, and ClickFix attacks are hitting UK businesses daily. Here is what you need to know.Fri, 17 Jul 2026 13:00:00 GMTsmb-securityuk-businessransomware-groupscredential-theftvendor-riskremote-accessincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-scattered-spider-tfl-starland-asyncapi-2026-07-16/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-scattered-spider-tfl-starland-asyncapi-2026-07-16/Five and a half years each for the TfL hackers. A Russian group hiding malware inside legitimate collaboration tools. And a supply chain worm loose in the npm ecosystem. Here is what today actually means.Thu, 16 Jul 2026 14:30:00 GMTuk-businessnation-state-attackssocial-engineeringcredential-theftsupply-chain-riskincident-responsesmb-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/ico-experian-upper-tribunal-loss-data-brokers-signal-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/ico-experian-upper-tribunal-loss-data-brokers-signal-2026/Hello, Mauven here. The Upper Tribunal dismissed the ICO's Experian appeal in April 2024. Here is what the outcome signals about UK data broker regulation.Wed, 15 Jul 2026 09:00:00 GMTsmb-securityuk-businesscompliance-failuredata-protectionpublic-sector-securitybusiness-riskexecutive-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-sharepoint-aitm-npm-supply-chain-2026-07-15/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-sharepoint-aitm-npm-supply-chain-2026-07-15/Three stories today that UK SMBs cannot afford to ignore: SharePoint flaws being actively exploited, a sophisticated AiTM phishing operation, and a poisoned npm supply chain.Wed, 15 Jul 2026 09:00:00 GMTsmb-securityuk-businesssupply-chain-riskcredential-theftsocial-engineeringvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-mfa-bypass-phishing-kits-ai-c2-2026-07-14/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-mfa-bypass-phishing-kits-ai-c2-2026-07-14/Your MFA is not the safety net you think it is. Two new phishing kits are bypassing it right now, and AI is doing the heavy lifting for attackers.Tue, 14 Jul 2026 13:30:00 GMTsmb-securityuk-businesssocial-engineeringcredential-theftcloud-securitybusiness-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-russian-router-exploitation-sharefile-shutdown-2026-07-13/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-russian-router-exploitation-sharefile-shutdown-2026-07-13/The NCSC has joined a Nine-Eyes advisory on Russian state actors targeting poorly configured routers. Meanwhile, Progress ShareFile has ordered an emergency server shutdown over an undisclosed threat.Mon, 13 Jul 2026 13:00:00 GMTnation-state-attacksuk-businesssmb-securityremote-accesssupply-chain-risksocial-engineeringincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-citrixbleed2-silabrat-nhs-2026-07-10/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-citrixbleed2-silabrat-nhs-2026-07-10/Three stories today that together explain exactly how UK SMBs get compromised in 2026. One is a patched vulnerability nobody patched. One is a £3,900-a-month RAT. One is a CC field.Fri, 10 Jul 2026 13:00:00 GMTransomware-groupscredential-theftremote-accesssmb-securityincident-responsevendor-riskuk-businessMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-defender-zero-day-vidar-cyber-essentials-2026-07-09/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-defender-zero-day-vidar-cyber-essentials-2026-07-09/A Defender zero-day with public exploit code, a Vidar infostealer surge hitting developer toolchains, and a quiet but significant change to Cyber Essentials Plus certification.Thu, 09 Jul 2026 14:00:00 GMTsmb-securityuk-businesscredential-theftsocial-engineeringcompliance-failuresupply-chain-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-unifi-coldfusion-active-exploitation-2026-07-08/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-unifi-coldfusion-active-exploitation-2026-07-08/Two max-severity vulnerabilities are being actively exploited right now. If your office runs Ubiquiti kit or any ColdFusion-backed web infrastructure, read this first.Wed, 08 Jul 2026 09:00:00 GMTsmb-securityuk-businessremote-accessincident-responseinfrastructure-securityvendor-riskbusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-teams-helpdesk-scam-asyncrat-phishing-2026-07-07/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-teams-helpdesk-scam-asyncrat-phishing-2026-07-07/Fake IT support on Teams. Steganographic RAT delivery via phishing. And Capita signed a government cyber pledge. It has been that kind of day.Tue, 07 Jul 2026 14:00:00 GMTsmb-securitysocial-engineeringcredential-theftremote-accessbusiness-riskincident-responseuk-businessMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-coldfusion-cve-2026-48282-vishing-pink-2026-07-06/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-coldfusion-cve-2026-48282-vishing-pink-2026-07-06/CVE-2026-48282 is being exploited in the wild. Meanwhile, a criminal group called Pink is ringing your staff and talking their way past MFA. Here is what both mean for your business.Mon, 06 Jul 2026 14:00:00 GMTsmb-securityuk-businesssocial-engineeringcredential-theftvendor-riskremote-accessincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-artoken-avalon-netnut-botnet-2026-07-03/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-artoken-avalon-netnut-botnet-2026-07-03/Three active campaigns with direct UK SMB exposure: a sophisticated M365 phishing platform, a legal-lure ransomware framework, and a residential proxy botnet the FBI just cracked open.Fri, 03 Jul 2026 13:00:00 GMTsmb-securityuk-businesscredential-theftransomware-groupssocial-engineeringcloud-securityvendor-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-gentlemen-ransomware-artoken-m365-2026-07-01/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-gentlemen-ransomware-artoken-m365-2026-07-01/Two threats. One kills your endpoint security before you know it's there. The other hands your Microsoft 365 to criminals on a subscription basis.Wed, 01 Jul 2026 09:00:00 GMTransomware-groupscredential-theftsmb-securityuk-businesscloud-securitymsp-securityincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-bluehammer-ransomware-simplehelp-rmm-2026-06-30/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-bluehammer-ransomware-simplehelp-rmm-2026-06-30/Ransomware gangs are now exploiting a Windows Defender privilege escalation flaw confirmed by CISA. If your MSP uses SimpleHelp, you have a second problem to deal with today.Tue, 30 Jun 2026 12:00:00 GMTransomware-groupssmb-securitymsp-securityremote-accessvendor-risksupply-chain-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/duaa-data-broker-legitimate-interests-uk-directors-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/duaa-data-broker-legitimate-interests-uk-directors-2026/The Data Use and Access Act 2025 clarifies that direct marketing can be a legitimate interest. The data broker industry is delighted. You should pay attention.Tue, 30 Jun 2026 09:00:00 GMTsmb-securityuk-businesscompliance-failuredata-protectionbusiness-riskexecutive-securitypublic-sector-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-oracle-ebs-drivesurge-uk-smbs-2026-06-29/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-oracle-ebs-drivesurge-uk-smbs-2026-06-29/Oracle's E-Business Suite is being actively exploited right now. And a new initial access broker is turning legitimate websites into malware delivery points.Mon, 29 Jun 2026 14:30:00 GMTsmb-securityuk-businessvendor-risksupply-chain-riskcredential-theftbusiness-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/week-ahead-kev-catalogue-weekly-habit-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/week-ahead-kev-catalogue-weekly-habit-uk-smb-2026/KEV is not interesting. It is known exploited. Turning the catalogue into a five-minute weekly check is the cheapest security upgrade most SMBs can make.Sun, 28 Jun 2026 09:00:00 GMTsmb-securityuk-businessmsp-securityremote-accessincident-responsebusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-mini-shai-hulud-cve-2026-20245-2026-06-26/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-mini-shai-hulud-cve-2026-20245-2026-06-26/Today's focus: Supply chain attacks on npm packages and active zero-day exploitation in Cisco SD-WAN. Crucial for UK SMBs.Fri, 26 Jun 2026 09:00:00 GMTsupply-chain-riskcloud-securitysmb-securityvendor-riskmalwareMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/new-backdoor-fortigate-threats-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/new-backdoor-fortigate-threats-2026/Exploring recent threats: a new backdoor may be linked to ransomware, and a large-scale FortiGate campaign affects security.Thu, 25 Jun 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupscredential-theftsupply-chain-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-mistic-backdoor-2026-06-24/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-mistic-backdoor-2026-06-24/UK SMBs must be aware: Mistic backdoor linked to ransomware broker is active. What this means for your security.Wed, 24 Jun 2026 15:00:00 GMTsmb-securityuk-businessransomware-groupsvendor-riskincident-responsesupply-chain-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/defence-in-depth-not-a-bundle-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/defence-in-depth-not-a-bundle-uk-smb-2026/Buying a firewall, endpoint protection, and a backup product is not Defence in Depth. It is a collection of controls. The difference matters.Tue, 23 Jun 2026 09:00:00 GMTsmb-securityuk-businessmsp-securityremote-accessbusiness-riskcompliance-failureMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/klue-attack-five-eyes-warning-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/klue-attack-five-eyes-warning-2026/Klue's Salesforce breach affects UK SMBs. Dive into supply chain vulnerabilities and AI risks.Tue, 23 Jun 2026 09:00:00 GMTsupply-chain-risksmb-securityuk-businessnation-state-attackscloud-securityvendor-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-cyber-threats-analysis-2026-06-22/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-cyber-threats-analysis-2026-06-22/Analysing key cyber threats affecting UK businesses today. From supply chain attacks to AI risks, stay informed.Mon, 22 Jun 2026 09:00:00 GMTsmb-securityuk-businesssupply-chain-riskransomware-groupscloud-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-npm-supply-chain-splunk-exploit-2026-06-19/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-npm-supply-chain-splunk-exploit-2026-06-19/Your developers' tools and your logging stack are both under active attack today. Here is what is actually happening and what to do about it.Fri, 19 Jun 2026 14:00:00 GMTsupply-chain-risksmb-securityuk-businesscredential-theftvendor-riskincident-responsemsp-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-fortibleed-socgholish-wordpress-supply-chain-2026-06-18/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-fortibleed-socgholish-wordpress-supply-chain-2026-06-18/73,000 Fortinet VPN credentials leaked, Evil Corp's botnet dismantled, and WordPress plugin supply chain compromised again. Three stories that matter to UK small businesses today.Thu, 18 Jun 2026 14:00:00 GMTsmb-securityuk-businesscredential-theftsupply-chain-riskransomware-groupsvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-dragonforce-teams-joomla-rogueplanet-2026-06-17/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-dragonforce-teams-joomla-rogueplanet-2026-06-17/Three active threats UK SMBs cannot ignore today: ransomware hiding in Microsoft's own infrastructure, a Joomla CMS exploit already in the wild, and an unpatched Defender zero-day.Wed, 17 Jun 2026 14:00:00 GMTsmb-securityuk-businessransomware-groupssocial-engineeringcredential-theftremote-accessincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-dragonforce-teams-fortinet-fortisandbox-2026-06-16/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-dragonforce-teams-fortinet-fortisandbox-2026-06-16/DragonForce is hiding ransomware command traffic inside Microsoft Teams. Fortinet FortiSandbox has critical flaws being actively exploited. Here is what UK SMBs need to know today.Tue, 16 Jun 2026 13:00:00 GMTransomware-groupssmb-securityuk-businessremote-accessvendor-riskincident-responsesupply-chain-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-searchleak-cisco-sdwan-2026-06-15/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-searchleak-cisco-sdwan-2026-06-15/Microsoft 365 Copilot has a critical vulnerability chain that lets an attacker steal your mailbox data with a single crafted URL. Cisco SD-WAN is under active exploitation. Both matter to UK SMBs right now.Mon, 15 Jun 2026 13:00:00 GMTsmb-securityuk-businesscloud-securitycredential-theftvendor-risksupply-chain-riskremote-accessMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-ai-phishing-novo-nordisk-breach-2026-06-12/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-ai-phishing-novo-nordisk-breach-2026-06-12/AI-powered phishing is scaling faster than organisations can train against it. Three stories today that UK SMBs cannot afford to ignore.Fri, 12 Jun 2026 14:00:00 GMTsocial-engineeringcredential-theftuk-businesssmb-securityvendor-risksupply-chain-riskcompliance-failureMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-gentlemen-ransomware-ai-phishing-2026-06-12/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-gentlemen-ransomware-ai-phishing-2026-06-12/A high-volume ransomware operation with Russian-speaking roots and an AI-powered phishing platform impersonating trusted brands. Both are active today.Fri, 12 Jun 2026 13:00:00 GMTransomware-groupssocial-engineeringsmb-securityuk-businesscredential-theftbusiness-risksupply-chain-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-vishing-clickfix-rat-uk-smb-2026-06-05/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-vishing-clickfix-rat-uk-smb-2026-06-05/Two active campaigns are hitting organisations that look exactly like UK SMBs. One calls your staff pretending to be IT support. The other fakes LinkedIn and Indeed.Fri, 05 Jun 2026 09:00:00 GMTsocial-engineeringcredential-theftsmb-securityuk-businessmsp-securityincident-responsecloud-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-npm-supply-chain-five-eyes-china-ncsc-2026-06-04/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-npm-supply-chain-five-eyes-china-ncsc-2026-06-04/Three separate threat streams converging today, and all three have direct exposure for UK SMBs and their IT suppliers.Thu, 04 Jun 2026 13:00:00 GMTsupply-chain-risknation-state-attacksuk-businesssmb-securityvendor-riskcredential-theftmsp-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-phaas-nimbus-rat-acer-zero-days-2026-06-03/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-phaas-nimbus-rat-acer-zero-days-2026-06-03/Three active threats converging on UK SMBs today: a mass phishing platform bypassing MFA, a RAT delivered via Microsoft Teams, and two unpatched maximum-severity router vulnerabilities.Wed, 03 Jun 2026 09:00:00 GMTsmb-securityuk-businesssocial-engineeringcredential-theftremote-accessvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-nimbus-rat-teams-oracle-kev-npm-supply-chain-2026-06-02/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-nimbus-rat-teams-oracle-kev-npm-supply-chain-2026-06-02/Three active threats that UK SMBs need to act on today: a Java RAT delivered via Microsoft Teams, a two-year-old Oracle flaw now on the CISA KEV list, and 33 malicious npm packages stealing cloud credentials.Tue, 02 Jun 2026 13:00:00 GMTsmb-securitysocial-engineeringsupply-chain-riskcredential-theftremote-accessuk-businessvendor-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-netlogon-rce-palo-alto-auth-bypass-2026-06-01/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-netlogon-rce-palo-alto-auth-bypass-2026-06-01/Patch windows have closed. Both the Windows Netlogon RCE and Palo Alto GlobalProtect auth bypass are now being exploited in the wild. Here is what that means for your business.Mon, 01 Jun 2026 13:00:00 GMTsmb-securityuk-businessremote-accesscredential-theftincident-responsevendor-riskbusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-forticlient-ems-phoenix-phaas-ai-attacks-2026-05-29/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-forticlient-ems-phoenix-phaas-ai-attacks-2026-05-29/Three active threats converge today: a FortiClient EMS zero-day delivering infostealers, a PhaaS kit with MFA bypass, and AI-assisted espionage campaigns lowering the barrier for every attacker downstream.Fri, 29 May 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftsocial-engineeringvendor-riskransomware-groupsremote-accessMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-blackfile-shinyhunters-voice-phishing-2026-05-28/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-blackfile-shinyhunters-voice-phishing-2026-05-28/Two financially-motivated threat groups are running active campaigns that should concern every UK business with a helpdesk, a SaaS stack, or customers whose data you hold.Thu, 28 May 2026 09:00:00 GMTsmb-securityuk-businesssocial-engineeringcredential-theftvendor-riskincident-responsebusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-blockchain-c2-cpanel-srg-physical-2026-05-27/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-blockchain-c2-cpanel-srg-physical-2026-05-27/Blockchain-based C2 infrastructure, an actively exploited cPanel flaw, and an extortion gang that now shows up in person. Mauven explains what the advisories are not telling you.Wed, 27 May 2026 13:00:00 GMTsmb-securityuk-businesssocial-engineeringcredential-theftsupply-chain-riskremote-accessincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-oauth-phishing-laravel-supply-chain-drupal-2026-05-26/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-oauth-phishing-laravel-supply-chain-drupal-2026-05-26/Three separate threats with direct SMB exposure landed today. One targets Microsoft 365 credentials, one hits developers and their clients, and one is already being exploited in the wild.Tue, 26 May 2026 13:00:00 GMTcredential-theftsupply-chain-risksmb-securityuk-businesssocial-engineeringvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-kali365-laravel-supply-chain-2026-05-25/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-kali365-laravel-supply-chain-2026-05-25/MFA is not the safety net you think it is. The FBI confirmed it this week. Here is what UK SMBs need to do right now.Mon, 25 May 2026 13:00:00 GMTsmb-securityuk-businesscredential-theftsupply-chain-riskcloud-securitysocial-engineeringmsp-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-drupal-sql-injection-ubiquiti-gentlemen-ransomware-2026-05-22/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-drupal-sql-injection-ubiquiti-gentlemen-ransomware-2026-05-22/Active exploitation of Drupal's SQL injection flaw began within 48 hours of disclosure. If your website or your supplier's runs Drupal, this is not a drill.Fri, 22 May 2026 14:00:00 GMTsmb-securityuk-businessransomware-groupsvendor-risksupply-chain-riskincident-responsenetwork-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-fox-tempest-npm-supply-chain-cisco-2026-05-21/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-fox-tempest-npm-supply-chain-cisco-2026-05-21/A malware-signing service is making ransomware harder to detect. npm packages with millions of downloads are compromised. And Cisco just patched a perfect-10 vulnerability.Thu, 21 May 2026 15:00:00 GMTsmb-securitysupply-chain-riskransomware-groupsvendor-riskuk-businessmsp-securityincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/ncsc-bitlocker-tpm-pin-yellowkey-uk-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/ncsc-bitlocker-tpm-pin-yellowkey-uk-2026/The NCSC's Windows guidance has recommended TPM plus PIN for years. Most UK organisations ignored it. YellowKey just changed what that decision costs.Wed, 20 May 2026 09:00:00 GMTsmb-securityuk-businesscompliance-failureexecutive-securitypublic-sector-securitybusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-flowerstorm-phaas-vidar-go-2026-05-19/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-flowerstorm-phaas-vidar-go-2026-05-19/MFA bypass-as-a-service is now sophisticated enough to defeat most SMB defences. Vidar is back, rebuilt in Go, and harder to detect than ever.Tue, 19 May 2026 13:00:00 GMTsmb-securityuk-businesscredential-theftsocial-engineeringcloud-securitymsp-securitybusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/dsit-breaches-survey-2025-2026-reaction-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/dsit-breaches-survey-2025-2026-reaction-uk-smb-2026/43% of UK businesses breached. Revenue impact doubled. Board engagement finally rising. Mauven MacLeod reads between the lines of the DSIT survey.Tue, 19 May 2026 08:00:00 GMTsmb-securityuk-businesscompliance-failurebusiness-risksocial-engineeringsupply-chain-riskpublic-sector-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-nginx-rift-grafana-breach-2026-05-18/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-nginx-rift-grafana-breach-2026-05-18/A days-old NGINX vulnerability is already being probed and exploited. Grafana's source code was stolen via a single access token. Two stories, one theme: patch windows are collapsing.Mon, 18 May 2026 14:00:00 GMTsmb-securityuk-businessvendor-risksupply-chain-riskcredential-theftremote-accessincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-exchange-zero-day-device-code-phishing-npm-supply-chain-2026-05-15/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-exchange-zero-day-device-code-phishing-npm-supply-chain-2026-05-15/Three active threats converge today: an exploited Exchange zero-day, a surge in device code phishing targeting Microsoft 365, and a supply chain attack that caught OpenAI. All three have direct implications for UK SMBs.Fri, 15 May 2026 14:00:00 GMTsmb-securityuk-businesscredential-theftsupply-chain-risksocial-engineeringincident-responsecloud-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-kongtuke-teams-fragnesia-linux-2026-05-14/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-kongtuke-teams-fragnesia-linux-2026-05-14/An initial access broker is using Microsoft Teams to own corporate networks in five minutes flat. A Linux kernel privilege escalation with working exploit code dropped today. Neither is theoretical.Thu, 14 May 2026 13:00:00 GMTsmb-securityuk-businesssocial-engineeringcredential-theftremote-accessvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-gentlemen-ransomware-supply-chain-2026-05-13/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-gentlemen-ransomware-supply-chain-2026-05-13/A new ransomware operation with Qilin connections is accelerating. Supply chain attacks are poisoning developer tools and AI platforms. Here is what matters today.Wed, 13 May 2026 13:00:00 GMTransomware-groupssupply-chain-risksmb-securityuk-businessvendor-riskcredential-theftincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cheap-it-voids-cyber-insurance-uk-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/cheap-it-voids-cyber-insurance-uk-2026/Hello, Mauven here. Cyber insurance uptake is up. So are denied claims. The common thread is the IT contract that never asked to read the policy.Wed, 13 May 2026 07:00:00 GMTsmb-securityuk-businesscompliance-failurebusiness-riskmsp-securityvendor-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-shai-hulud-supply-chain-etherrat-gentleman-ransomware-2026-05-12/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-shai-hulud-supply-chain-etherrat-gentleman-ransomware-2026-05-12/Signed packages, a six-minute supply chain blitz, and ransomware using blockchain to hide its C2. Today's brief covers two threats that reach well beyond enterprise targets.Tue, 12 May 2026 14:00:00 GMTsupply-chain-risksmb-securityuk-businessransomware-groupscredential-theftvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-ai-exploits-cloud-phishing-trickmo-2026-05-11/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-ai-exploits-cloud-phishing-trickmo-2026-05-11/AI is now writing zero-day exploits. Cloud infrastructure is being weaponised against your staff. And TrickMo just made its banking trojan significantly harder to detect.Mon, 11 May 2026 09:00:00 GMTnation-state-attackssocial-engineeringcredential-theftcloud-securitysmb-securityuk-businessincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-apt28-dns-hijack-ivanti-zerodday-rmm-abuse-2026-05-08/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-apt28-dns-hijack-ivanti-zerodday-rmm-abuse-2026-05-08/APT28 is rewriting your router's DNS settings. Ivanti EPMM has a zero-day with active exploitation. And threat actors are abusing remote management tools to drop malware via phishing. Here is what UK SMBs need to know today.Fri, 08 May 2026 14:30:00 GMTnation-state-attacksremote-accesscredential-theftsmb-securityvendor-riskincident-responseuk-businessMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-panos-zero-day-storm-1175-supply-chain-2026-05-07/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-panos-zero-day-storm-1175-supply-chain-2026-05-07/State-sponsored actors had a month inside Palo Alto firewalls before the advisory came out. Storm-1175 is still moving. And your developers may have already run the poisoned package.Thu, 07 May 2026 09:00:00 GMTnation-state-attacksransomware-groupssupply-chain-risksmb-securityremote-accessvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-panos-zero-day-muddywater-teams-2026-05-06/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-panos-zero-day-muddywater-teams-2026-05-06/A Palo Alto firewall zero-day is being actively exploited right now. And MuddyWater is using Microsoft Teams to walk through your front door. Both matter today.Wed, 06 May 2026 13:30:00 GMTnation-state-attacksremote-accesssocial-engineeringsmb-securityuk-businessvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cyber-awareness-action-gap-uk-small-business-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/cyber-awareness-action-gap-uk-small-business-2026/Awareness went up. Risk assessments went down. Continuity plans dropped 9 points. If concern was a control, the survey numbers would look very different.Wed, 06 May 2026 07:00:00 GMTsmb-securityuk-businessbusiness-riskcompliance-failureexecutive-securityincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-teams-installer-supply-chain-romance-fraud-2026-05-05/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-teams-installer-supply-chain-romance-fraud-2026-05-05/A fake Teams installer is dropping backdoors globally. A third-party analytics vendor handed ShinyHunters 119,000 email addresses. And UK romance fraud hit £102M last year. Three stories, one briefing.Tue, 05 May 2026 13:00:00 GMTsmb-securityuk-businesssocial-engineeringsupply-chain-riskcredential-theftvendor-riskbusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-moveit-linux-pypi-supply-chain-2026-05-04/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-moveit-linux-pypi-supply-chain-2026-05-04/Three high-impact threats landed simultaneously on 4th May 2026. If your business uses MOVEit, runs Linux servers, or has developers using Python, read this now.Mon, 04 May 2026 14:00:00 GMTsmb-securityuk-businesssupply-chain-riskvendor-riskincident-responsemsp-securityremote-accessMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-teampcp-supply-chain-patch-tsunami-2026-05-02/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-teampcp-supply-chain-patch-tsunami-2026-05-02/A supply chain attack on open-source security tooling and a Linux privilege escalation exploit with working code in the wild. Two threats. One uncomfortable Friday.Sat, 02 May 2026 09:00:00 GMTsupply-chain-risksmb-securityuk-businessvendor-riskincident-responsecloud-securitymsp-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-cpanel-teampcp-ncsc-patch-wave-2026-05-01/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-cpanel-teampcp-ncsc-patch-wave-2026-05-01/A critical cPanel flaw is being actively exploited with ransomware already reported. TeamPCP is poisoning open-source security tools. The NCSC says a patch wave is coming. Today is not a quiet day.Fri, 01 May 2026 13:30:00 GMTsmb-securityuk-businesssupply-chain-riskransomware-groupsvendor-riskincident-responsecompliance-failureMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-cpanel-zero-day-linux-lpe-uk-breach-rate-2026-04-30/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-cpanel-zero-day-linux-lpe-uk-breach-rate-2026-04-30/A critical cPanel authentication bypass has been exploited since February. A new Linux root exploit dropped today. And 43% of UK businesses were compromised last year. Pick your priority.Thu, 30 Apr 2026 13:00:00 GMTsmb-securityuk-businesscredential-theftvendor-riskincident-responsecompliance-failurebusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-cpanel-clickfix-vect-ransomware-2026-04-29/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-cpanel-clickfix-vect-ransomware-2026-04-29/This week's threat brief covers a critical cPanel auth bypass requiring emergency patching, ClickFix phishing campaigns stealing credentials via PowerShell, and VECT ransomware that wipes files it cannot encrypt.Wed, 29 Apr 2026 16:00:00 GMTsmb-securityuk-businesscredential-theftransomware-groupssocial-engineeringvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cyber-resilience-pledge-insider-analysis-uk-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/cyber-resilience-pledge-insider-analysis-uk-2026/I was in the room when the Cyber Resilience Pledge was announced. The speeches were confident. The corridor conversations afterwards were not.Wed, 29 Apr 2026 08:00:00 GMTsmb-securityuk-businesscompliance-failuresupply-chain-riskpublic-sector-securitybusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-blackfile-supply-chain-oauth-phishing-2026-04-28/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-blackfile-supply-chain-oauth-phishing-2026-04-28/Three active campaigns converge on UK small businesses this week: voice-driven extortion, poisoned developer packages, and OAuth phishing that bypasses MFA. Here is what they are not telling you.Tue, 28 Apr 2026 14:00:00 GMTsmb-securityuk-businesssocial-engineeringcredential-theftsupply-chain-riskcloud-securityvendor-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/silentglass-ncsc-hdmi-displayport-security-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/silentglass-ncsc-hdmi-displayport-security-smb-2026/NCSC's SilentGlass is technically sound government kit, now available commercially. But if you're still fighting phishing, it's probably not your next purchase.Tue, 28 Apr 2026 08:00:00 GMTsmb-securityuk-businessnation-state-attackspublic-sector-securityvendor-riskexecutive-securitybusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-pypi-npm-supply-chain-teampcp-2026-04-27/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-pypi-npm-supply-chain-teampcp-2026-04-27/TeamPCP is back. Three concurrent package compromises in one week. Here is what UK businesses using Python or Node.js tooling need to do right now.Mon, 27 Apr 2026 16:00:00 GMTsupply-chain-risksmb-securityuk-businesscredential-theftcloud-securityvendor-riskmsp-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-blackfile-supply-chain-pypi-2026-04-27/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-blackfile-supply-chain-pypi-2026-04-27/Voice phishing plus credential harvesting. Malicious Python packages with 11 million monthly downloads. This is what active UK cyber threats look like today.Mon, 27 Apr 2026 13:00:00 GMTsocial-engineeringcredential-theftsupply-chain-risksmb-securityuk-businessvendor-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-pypi-npm-supply-chain-attack-2026-04-27/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-pypi-npm-supply-chain-attack-2026-04-27/PyPI and npm are under active supply chain attack. If your business uses Python packages or JavaScript tooling u2014 or relies on suppliers who do u2014 this is not a developer problem. It is your problem.Mon, 27 Apr 2026 08:00:00 GMTsupply-chain-risksmb-securityuk-businesscredential-theftcloud-securityvendor-riskmsp-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-uk-cyber-threats-smb-roundup-2026-04-26/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-analysis-uk-cyber-threats-smb-roundup-2026-04-26/A quiet day on the KEV and NVD feeds. Mauven explains why that is not the same as a safe day.Sun, 26 Apr 2026 09:00:00 GMTsmb-securityuk-businessnation-state-attacksransomware-groupsbusiness-riskincident-responsesupply-chain-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/ncsc-protective-dns-private-sector-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/ncsc-protective-dns-private-sector-smb-2026/The NCSC has blocked 1.5 million malicious domains with Protective DNS. Private sector SMBs do not qualify. Here is what that gap means and how to close it.Wed, 22 Apr 2026 08:00:00 GMTsmb-securityuk-businesspublic-sector-securitybusiness-riskvendor-risksupply-chain-riskincident-responseMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/preparing-for-the-next-wave-of-cyber-threats-insights-for-uk-smbs/https://thesmallbusinesscybersecurityguy.co.uk/blog/preparing-for-the-next-wave-of-cyber-threats-insights-for-uk-smbs/63% of UK SMBs faced cyber incidents in 2023. Learn how to prepare and protect your business assets effectively.Sat, 18 Apr 2026 16:00:00 GMTcyber threatspreparationUK SMBsecurityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/lloyds-state-backed-cyber-exclusion-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/lloyds-state-backed-cyber-exclusion-uk-smb-2026/Your cyber policy probably excludes losses from state-backed attacks. You may not have read that clause. If a nation-state campaign sweeps through your sector, it could void your cover entirely.Wed, 08 Apr 2026 06:00:00 GMTcyber-insurancenation-state-attacksuk-businesslloyds-exclusionthreat-intelligencesmb-security2026-threatsMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/out-of-support-software-uk-gdpr-compliance-risk-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/out-of-support-software-uk-gdpr-compliance-risk-2026/Article 32 of UK GDPR requires 'appropriate technical measures' to protect personal data. Running unpatched, out-of-support software is very difficult to defend as appropriate.Wed, 01 Apr 2026 07:00:00 GMTuk-gdprcompliance-failureend-of-life-softwaredata-protectionico-enforcementcyber-essentialssmb-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/understanding-the-risks-of-remote-work-securing-your-home-office/https://thesmallbusinesscybersecurityguy.co.uk/blog/understanding-the-risks-of-remote-work-securing-your-home-office/Your remote workers aren't in your office, but your data still is. Here's why most home working security failures are people problems, not tech problems.Sun, 29 Mar 2026 18:00:00 GMTRemote WorkCybersecurityHome OfficeSmall BusinessMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/confidence-is-not-a-security-control-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/confidence-is-not-a-security-control-uk-smb-2026/Noel left us unsupervised, two bottles of Prosecco, and a microphone. What followed was a serious conversation about the security vulnerability nobody likes to name: overconfidence. The kind that sounds completely reasonable in a meeting — and has preceded some very expensive afternoons.Mon, 23 Mar 2026 11:58:00 GMTSecurity CultureOverconfidenceUK Small BusinessPodcastSMB SecurityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/why-smbs-draw-their-cyber-essentials-scope-around-the-comfortable-parts/https://thesmallbusinesscybersecurityguy.co.uk/blog/why-smbs-draw-their-cyber-essentials-scope-around-the-comfortable-parts/After years observing how organisations navigate security certification, I have reached a fairly uncomfortable conclusion: most scope failures in Cyber Essentials are not technical errors. They are decisions. Somebody looked at the full picture of what should be in scope, felt the weight of what that would require, and drew the line somewhere more manageable. I understand the impulse. I have watched it play out at every scale. But CE v3.3 closes the ambiguities that made that line defensible. AnWed, 11 Mar 2026 00:00:00 GMTcyber-essentialsscope-managementuk-smbcompliance-behaviourncsccloud-securitydirector-liabilityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/signal-whatsapp-account-hijacking-russia-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/signal-whatsapp-account-hijacking-russia-uk-smb-2026/Hello, Mauven here. Yesterday, Dutch military and domestic intelligence confirmed what European security agencies have been circling for weeks: Russian state-sponsored hackers are running a large-scale global campaign to take over Signal and WhatsApp accounts. Not by breaking the encryption. By asking for the keys. Two governments have now issued formal warnings. Dutch officials have confirmed their own employees are among the victims. And the attack method is devastatingly simple. If your businTue, 10 Mar 2026 00:00:00 GMTsocial-engineeringnation-state-attackswhatsapp-securitysignal-securityaccount-hijackingsmb-securityuk-businessMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/ico-currys-dsg-victory-victims-got-nothing-uk-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/ico-currys-dsg-victory-victims-got-nothing-uk-2026/The ICO's General Counsel called the Currys Court of Appeal ruling "a significant victory." And in strict legal terms, she is right. Lord Justice Warby's judgment closes a dangerous loophole and clarifies that personal data must be assessed from the controller's perspective. But while the lawyers celebrate, roughly 14 million people are sitting with expired limitation periods and no compensation route. The legal system confirmed DSG was in the wrong at the precise moment most victims could no loWed, 04 Mar 2026 00:00:00 GMTico-enforcementdsg-retail-breachdata-breach-victimsuk-data-protectioncompliance-failure2026-threatsuk-businessMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/your-cloud-stack-is-not-just-stationery-the-bet-your-business-made-without-realising-it/https://thesmallbusinesscybersecurityguy.co.uk/blog/your-cloud-stack-is-not-just-stationery-the-bet-your-business-made-without-realising-it/You did not set out to build US-centric infrastructure. You just bought what was on page one of Google. Email, documents, calendars, chat, CRM, help desk, backups, monitoring: all US-owned, all subject to US law, all chosen on price and convenience without a single conversation about jurisdictional risk. Mauven MacLeod explains why your 30-person firm has made exactly the same strategic bet as the NHS and the Ministry of Defence, why "it is just stationery" stopped being true about five years agWed, 25 Feb 2026 00:00:00 GMTsmb-securityvendor-riskuk-businesscloud-securitydata-sovereignty2026-threatsbusiness-riskMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/four-game-changing-cyber-stories-one-episode/https://thesmallbusinesscybersecurityguy.co.uk/blog/four-game-changing-cyber-stories-one-episode/The acting head of America's cybersecurity agency just uploaded government secrets to ChatGPT. Meanwhile, a Dublin IT manager discovered £18,000 worth of unused incident response services sitting in his cyber insurance policy. Passkeys can eliminate phishing attacks completely. And those viral Trump cloud cartoons? They're exposing the infrastructure dependency crisis threatening UK businesses. Four critical cybersecurity stories. Three expert guests. 45 minutes that could transform how your busMon, 02 Feb 2026 00:00:00 GMTpasskeys-authenticationcisa-breachcyber-insurance-discoverycloud-sovereigntygovernment-security-failureauthentication-securityinsurance-servicesMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/us-cloud-sovereignty-infrastructure-dependency-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/us-cloud-sovereignty-infrastructure-dependency-uk-smb-2026/You've seen the memes. Trump is controlling cloud providers like puppets. Trump is literally unplugging Europe from US infrastructure. They're viral because they touch a nerve about something real: UK businesses run on American infrastructure controlled by American laws. But the political framing misses the actual problem. This isn't about any particular president or administration. This is about 15 years of infrastructure consolidation, creating structural dependency that predates and will outlSat, 31 Jan 2026 00:00:00 GMTcloud-securitydata-sovereigntygdpr-compliancevendor-riskinfrastructure-dependencyus-cloud-actsmb-security-realityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/fortinet-security-failures-vpn-breaches-uk-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/fortinet-security-failures-vpn-breaches-uk-2026/Here's a question that should keep every director awake: what happens when the device meant to protect your network becomes the primary way attackers get in? Between 2023 and now, Fortinet's SSL VPN has been exploited three separate times using the same type of vulnerability. Chinese intelligence services stole configurations from 20,000 organizations worldwide. Cyber insurers charge double the premiums for businesses using Fortinet kit. Yet Fortinet posted 50% revenue growth and continues to doFri, 23 Jan 2026 00:00:00 GMTfortinet-vulnerabilitiesvpn-securitynation-state-attackscyber-insurancedirector-liabilitytechnical-debtvendor-accountabilityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/psychology-cyber-risk-denial-why-boards-ignore-breach-statistics/https://thesmallbusinesscybersecurityguy.co.uk/blog/psychology-cyber-risk-denial-why-boards-ignore-breach-statistics/Why do intelligent board members hear "43% of UK businesses got breached" and think "that won't happen to us"? It's not stupidity; it's psychology. Optimism bias makes us believe bad things happen to others. Present bias makes tomorrow's disaster less urgent than today's deadline. Availability heuristic makes personal experience trump statistics. Illusion of control makes certificates feel like protection. Normalcy bias treats "it hasn't happened yet" as evidence. Dunning-Kruger creates confidenWed, 17 Dec 2025 00:00:00 GMTMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cognitive-bias-destroying-uk-business-security-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/cognitive-bias-destroying-uk-business-security-2025/After this week's podcast revelation about the marketing agency losing client files through an unsecured printer, my inbox has been full of variations on the same question: how do intelligent business owners with otherwise solid security miss something this obvious? The answer isn't comfortable, but it's important: IoT security failures aren't about lack of intelligence. They're about systematic psychological blind spots that affect everyone from small business owners to government departments. Wed, 10 Dec 2025 00:00:00 GMTiot-securityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/psychology-cybersecurity-failures-organisational-learning-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/psychology-cybersecurity-failures-organisational-learning-2025/Noel spent Monday and Tuesday explaining what reverse benchmarking is and how to implement it technically. Both excellent. Both necessary. Both completely inadequate if you don't understand why organizations systematically fail to learn from disasters. Here's the uncomfortable truth: most breaches happen not because organisations don't know what to do, but because human psychology actively prevents them from doing it. Normalcy bias makes us believe disasters happen to others. Optimism bias creatWed, 03 Dec 2025 00:00:00 GMTsecurity-psychologyorganisational-behaviourblame-culturesecurity-awarenesshuman-factorsdecision-makinguk-cybersecurityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/psychology-director-liability-cybersecurity-accountability-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/psychology-director-liability-cybersecurity-accountability-2025/After two days discussing frameworks and technical standards, let's examine why personal accountability actually works when corporate fines consistently fail. The psychology is fascinating and explains decades of regulatory success and failure. When British Airways faced a £20 million fine, nobody lost their job. When HSE prosecutes directors, workplace safety transforms overnight. The difference isn't the amount of money. It's whose money gets spent and whose freedom gets threatened. Human psycWed, 26 Nov 2025 00:00:00 GMTMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/psychology-cyber-negligence-synnovis/https://thesmallbusinesscybersecurityguy.co.uk/blog/psychology-cyber-negligence-synnovis/Nobody wakes up and decides to let patients die through cybersecurity negligence. Yet that is precisely what happened at Synnovis. The executives who failed to enable multi-factor authentication were not cartoon villains. They were educated professionals running a critical healthcare organisation. So why did they make a decision that, in hindsight, seems obviously catastrophic? The answer lies in the psychological mechanisms that allow intelligent people to rationalise terrible choices, the orgaWed, 19 Nov 2025 00:00:00 GMTcybersecurity psychologydecision-making biasrisk perceptioncorporate negligenceexecutive accountabilityorganisational behavioursecurity cultureSynnovis analysissystemic failureMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/ofcom-vpn-surveillance-online-safety-act/https://thesmallbusinesscybersecurityguy.co.uk/blog/ofcom-vpn-surveillance-online-safety-act/Ofcom admits it is monitoring VPN use across Britain with a secret AI tool and unnamed data sources. That should worry any small business that relies on encrypted links for daily work. The tool cannot tell a secure office connection from someone dodging age checks. Section 121 still sits in law, ready to force scanning of encrypted chats. Does that sound like a free internet to you? Document your use. Keep your controls tight. Ask your MP why this is acceptable. Do you want regulators watching yTue, 11 Nov 2025 00:00:00 GMTOfcomOnline Safety ActSection 121VPN MonitoringBig BrotherOrwellianVPN SurveillanceMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/nottingham-agency-cloud-cost-disaster-recovery-case-study-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/nottingham-agency-cloud-cost-disaster-recovery-case-study-2025/Twenty-three employees. Eighteen months. Forty-seven thousand pounds wasted on cloud infrastructure they didn't need, SaaS subscriptions nobody used, and auto-scaling rules designed by a consultant who'd never checked back. This isn't a horror story about a massive enterprise with unlimited budget. This is CloudBridge Digital, a Nottingham digital agency that discovered they'd been hemorrhaging cash while Microsoft, AWS, and a parade of SaaS vendors quietly helped themselves to the company bank Fri, 07 Nov 2025 00:00:00 GMTcloud-cost-case-studyuk-smb-failurenottingham-businesscloud-wastecost-recoveryaws-costssaas-spendingfinalsparkbusiness-lessonssmb-cloud-strategyMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/microsoft-three-mile-island-nuclear-ai-data-centres-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/microsoft-three-mile-island-nuclear-ai-data-centres-2025/Three Mile Island. You remember it, right? The 1979 nuclear accident that terrified an entire generation and effectively killed nuclear power plant construction in America for 40 years? Microsoft just spent $1.6 billion to restart Unit 1. Not for clean energy virtue signaling. Because they're bloody desperate. Google committed to 500 megawatts of Small Modular Reactors. Amazon's all-in on multiple nuclear projects. Meta wants up to 4 gigawatts. Billions in nuclear investment. Timeline: 2028 to 2Wed, 05 Nov 2025 00:00:00 GMTMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/british-library-ransomware-mfa-failure-doorman-fallacy-mauvens-take/https://thesmallbusinesscybersecurityguy.co.uk/blog/british-library-ransomware-mfa-failure-doorman-fallacy-mauvens-take/The British Library decided not to implement MFA on administrator accounts. Their reasoning: "practicality, cost and impact on ongoing programmes." That decision cost them £7 million in recovery, 600GB of staff data dumped on the dark web, and over a year of service disruption. This is Mauven's Take on one of the clearest examples of the doorman fallacy in UK history. When cost-cutting decisions focus narrowly on immediate expense whilst ignoring catastrophic downside risk, you get exactly this Wed, 29 Oct 2025 00:00:00 GMTcost-cutting-failuressecurity-trainingmfa-removalcyber-insuranceit-staffbusiness-risksmb-securityuk-businessdoorman-fallacyepisode-24vendor-relationshipsefficency-theatrebritish-libraryransomware-attackmfa-failurerhysida-ransomwarepublic-sector-securityico-enforcementncsc-guidanceMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/aws-dns-outage-october-2025-smart-homes-dumb-boxes/https://thesmallbusinesscybersecurityguy.co.uk/blog/aws-dns-outage-october-2025-smart-homes-dumb-boxes/All right folks, buckle in. Last Monday, the planet just got schooled yet again in why we've put all our digital eggs in one totally cracked basket. AWS US-EAST-1 region had a DNS hiccup and half the world's internet decided it was nap time. Snapchat, Venmo, even the app that tells you if your cat's used the loo, all snuffed out. Why does a digital sneeze in Virginia take out customer payments in Edinburgh? And here's the kicker: this is the third major outage in five years for the same bloody rSun, 26 Oct 2025 00:00:00 GMTaws-outagedns-failuresmart-home-securitycloud-dependencyus-east-1single-point-failurebusiness-continuityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-sme-cybersec-waste-breach-birmingham-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-sme-cybersec-waste-breach-birmingham-2025/Security vendors are playing you for fools, and they're getting rich doing it. Every week I watch UK business owners waste £20,000 on "comprehensive cybersecurity platforms" when they needed £5,000 of basic IT security. The industry deliberately muddies the difference between InfoSec, CyberSec, and IT Security because confused customers pay premium prices for inappropriate solutions. Meanwhile, 50% of small businesses were breached in 2025, proving that expensive confusion doesn't equal protectiWed, 22 Oct 2025 00:00:00 GMTpodcastinfoseccybersecit-securityuk-smb-authenticationfido2hardware-security-keysauthentrendphishing-resistant-mfacyber-essentialsncscsecuity-budgetvendor-confusionit-security-fundamentalsMulti-factor-authenticationuk-business-securitysmall-business-cybersecurityepisode-launchMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/school-multi-factor-authentication-enabled/https://thesmallbusinesscybersecurityguy.co.uk/blog/school-multi-factor-authentication-enabled/Only 30% of schools have Multi-Factor Authentication enabled, but the reality is worse than that statistic suggests. Many schools have "partial MFA" - enabled for head teachers and SENCOs but not teaching assistants or admin staff. From a security perspective, everyone with access needs MFA, or you're not protected. The challenge? Phone-based authenticator apps conflict with safeguarding policies that ban phones near children. Hardware security keys offer the solution. FIDO2-certified tokens froWed, 15 Oct 2025 00:00:00 GMTMFAmulti factor authentication UKHardware TokensFido2Security KeysBiometricsauthentrendMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-ministers-ncsc-cyber-security-warning-2025-business-leaders/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-ministers-ncsc-cyber-security-warning-2025-business-leaders/When the Chancellor, three Cabinet Ministers, the NCSC CEO, and the Director General of the National Crime Agency personally co-sign a letter to UK business leaders, you don't ignore it. The NCSC just reported 204 nationally significant cyber incidents, with 18 highly significant attacks marking a 50% increase for the third consecutive year. Marks & Spencer lost over £300 million. A healthcare attack contributed to a patient death. Empty shelves appeared in supermarkets. The government has gTue, 14 Oct 2025 00:00:00 GMTMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/the-geography-teachers-fatal-mistake/https://thesmallbusinesscybersecurityguy.co.uk/blog/the-geography-teachers-fatal-mistake/Curiosity, access, and a careless password shaped my career. At sixteen I learned the simplest attack works best. I watched a teacher type admin123! and saw the whole network open up. No exploits. Just human nature. That is the insider threat in plain sight. People bypass clumsy controls to get work done. Do your policies help or hinder? Make secure the easy path with least privilege, SSO, MFA, logging, and coaching. Treat incidents as data, not drama. Channel curiosity before it goes undergrounWed, 01 Oct 2025 00:00:00 GMTinsider threats ukshoulder surfing passwordhuman centred securityleast privilege mfastudent hackers schoolsMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/dora-compliance-crisis-collins-aerospace-jlr-cyberattacks/https://thesmallbusinesscybersecurityguy.co.uk/blog/dora-compliance-crisis-collins-aerospace-jlr-cyberattacks/September 2025's Collins Aerospace and JLR cyberattacks weren't just operational disasters - they triggered Europe's first cross-border regulatory crisis under DORA. While aviation experts focused on flight delays, they missed the real story: EU authorities now have direct oversight powers over US companies like Collins Aerospace serving European financial infrastructure. DORA's January 2025 implementation created unprecedented cross-border enforcement mechanisms that most businesses don't underWed, 24 Sep 2025 00:00:00 GMTDORA Regulationcybersecurity compliancedigital operational resilienceEU financial regulationCollins Aerospacecritical infrastructureMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/it-horror-stories-single-manager-model-failures/https://thesmallbusinesscybersecurityguy.co.uk/blog/it-horror-stories-single-manager-model-failures/Let's examine the data: 30 years of single IT manager failures. The patterns are consistent, the outcomes predictable, and the business impact devastating. Here's what happens when your "Dave from IT" model reaches its inevitable breaking point.Wed, 24 Sep 2025 00:00:00 GMTDave From ITRisk ManagementBusiness ContinuityMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/five-questions-strategic-it-leadership-assessment-uk-smb-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/five-questions-strategic-it-leadership-assessment-uk-smb-2025/Most UK businesses think they're fine without strategic IT leadership until they're not. These five diagnostic questions expose the difference between thriving with technology and merely surviving despite it. Question 1: Are technology decisions made strategically or reactively? If you're replacing servers because they died rather than planned refresh cycles, you need help. Question 5: Will current systems scale gracefully as you grow? Planning to double in size without considering technology imWed, 17 Sep 2025 00:00:00 GMTMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/why-small-businesses-must-rethink-cybersecurity-uk-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/why-small-businesses-must-rethink-cybersecurity-uk-2025/Cybersecurity is not just an enterprise problem. With 96% of attacks targeting small businesses and 60% of victims closing within six months, UK SMEs face a survival crisis. This article exposes the myths keeping businesses vulnerable, the real financial impact of attacks, and the role of supply chain risk. It explains why Cyber Essentials and board-level governance are no longer optional, but essential. Written for directors and leaders, it lays out practical steps to protect your business befoWed, 10 Sep 2025 00:00:00 GMTMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/psychology-cyber-essentials-smart-people-terrible-security-decisions/https://thesmallbusinesscybersecurityguy.co.uk/blog/psychology-cyber-essentials-smart-people-terrible-security-decisions/Hello, Mauven here. After Monday's podcast and yesterday's technical deep-dive, I want to tackle the elephant in the room: if Cyber Essentials is so brilliant, why do smart business owners avoid it like a tax audit? The answer isn't ignorance or stubbornness - it's human psychology. Our brains evolved to make quick survival decisions, not manage enterprise cybersecurity frameworks. We're fighting millions of years of evolution with documentation requirements and compliance deadlines. UnderstandiWed, 30 Jul 2025 00:00:00 GMTMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cve-2025-53770-sharepoint-crisis-psychology-security-response/https://thesmallbusinesscybersecurityguy.co.uk/blog/cve-2025-53770-sharepoint-crisis-psychology-security-response/After analyzing the global response to CVE-2025-53770, the critical SharePoint zero-day that's compromised 75+ organizations in 48 hours, I'm convinced this isn't about technical competence. It's about human psychology. Right now, IT administrators who know their systems are vulnerable (CVSS 9.8) are doing nothing because of normalcy bias, sunk cost fallacy, and optimism bias. The organizations getting breached aren't those lacking knowledge - they're the ones whose psychology prevents acting onTue, 22 Jul 2025 00:00:00 GMTMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/technical-debt-psychology-smart-teams-security-problems-july-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/technical-debt-psychology-smart-teams-security-problems-july-2025/After this week's podcast on technical debt and supply chain failures, I want to examine why intelligent, well-meaning IT teams consistently create tomorrow's security disasters. Technical debt isn't just a coding problem - it's a psychological trap that 78% of UK businesses fall into repeatedly. We take shortcuts under pressure, defer security updates for stability, and convince ourselves that "temporary" solutions won't become permanent vulnerabilities. Understanding the cognitive biases behinWed, 16 Jul 2025 00:00:00 GMTMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/catwatchful-stalkerware-exposed-ncsc-analysis-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/catwatchful-stalkerware-exposed-ncsc-analysis-2025/Former UK Government Cyber analyst Mauven MacLeod exposes the disturbing Catwatchful stalkerware operation that suffered a massive breach in June 2025, revealing 62,000 customer accounts and 26,000 monitored victims across seven countries. This isn't just cybersecurity failure - it's weaponised surveillance technology enabling domestic abuse and stalking. The breach exposed plaintext passwords, comprehensive victim data dating to 2018, and the operation's Uruguay-based administrator. From a government security Sun, 06 Jul 2025 00:00:00 GMTMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/password-psychology-smart-people-terrible-choices-june-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/password-psychology-smart-people-terrible-choices-june-2025/After Monday's podcast and yesterday's NCSC deep-dive, I want to tackle the elephant in the room: if three random words are so brilliant, why do smart business owners still use "password123"? Why does 78% password reuse persist despite constant breach warnings? The answer isn't technical ignorance - it's human psychology. We're fighting millions of years of evolution with spreadsheets and complexity requirements. Our brains aren't wired for digital security, they're wired for survival shortcuts.Thu, 26 Jun 2025 00:00:00 GMTpassword-psychologyhuman-behaviourcybersecurity-psychologymauven-macleodbehavioural-securityPassword-ManagementMauven MacLeodhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-small-business-cybersecurity-middle-east-threats-2025/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-small-business-cybersecurity-middle-east-threats-2025/Last Friday, it was someone else's war. Over the weekend, Iranian hackers considered your Microsoft 365 account enemy infrastructure. American B-2 bombers dropped 14 bunker-busters on Iranian nuclear facilities over the weekend. The cyber retaliation has already begun, and UK small businesses as we all use US cloud services are the in the firing line primary targets. Remember NotPetya? Ukrainian attack, global devastation. Windows is Windows regardless of location. Your customer database could bTue, 24 Jun 2025 00:00:00 GMTpodcast-previewSmall Business Cyber SecurityMauven MacLeod