RichardHam.co.uk Blog

Tag: UK

  • 2026 AI Threats for UK SMEs: What’s Actually Changed

    2026 AI Threats for UK SMEs: What’s Actually Changed

    2026 AI Threats for UK SMEs: What’s Actually Changed
    Published: April 1, 2026

    Every year brings a new round of threat reports telling SMEs that cyber risk is increasing. That’s been true for twenty years. What’s different in 2026 is that AI has genuinely changed the threat landscape — not just the scale of attacks, but the nature of them. The traditional advice still applies, but it’s no longer sufficient on its own.

    Here’s what I’m seeing, and what UK SMEs actually need to be thinking about.

    Phishing Has Crossed a Quality Threshold

    For years, phishing emails were easy to spot if you knew what to look for: odd phrasing, generic greetings, suspicious sender domains, poorly formatted logos. Staff training focused on these signals, and it worked reasonably well.

    AI-generated phishing has removed most of those signals. Emails are now grammatically perfect, contextually appropriate, and personalised using data scraped from LinkedIn, company websites, and previous data breaches. I’ve seen examples targeting UK SME directors that reference their specific clients, their recent hires, and their company structure — all publicly available, all assembled automatically at scale.

    The implication isn’t that training is useless. It’s that training needs to evolve. Spotting typos is no longer the point. The question to train staff on is: was I expecting this request? Does this ask me to do something — click, pay, approve, share credentials — and if so, have I verified it through a separate channel?

    Deepfake Audio and Video Are Becoming Operational

    This was theoretical eighteen months ago. It’s operational now. UK businesses have experienced losses from voice-cloned fraud — attackers using AI-generated audio of a senior person in the business to instruct a finance team member to make a payment.

    The attack is effective because it bypasses the email security controls most businesses have invested in. It’s a phone call. It sounds like the CFO. It says there’s an urgent payment that needs to go today.

    The defence is procedural, not technical: any payment instruction, regardless of how it arrives or who it appears to be from, above a threshold amount requires verification via a pre-agreed method. That policy needs to be written, communicated, and tested.

    Shadow AI Is Creating Data Exposure You Don’t Know About

    Your staff are using AI tools. If you haven’t explicitly told them which tools are approved and what data they can put into them, they’re making those decisions themselves — and the decisions aren’t always good ones.

    I’ve spoken to business owners who didn’t know their team had been pasting client contracts into ChatGPT to summarise them, or putting commercially sensitive proposals into AI writing tools, or using consumer AI assistants for analysis that contains personal data. None of it was malicious. None of it was authorised either.

    The fix isn’t to ban AI — that’s both impractical and counterproductive. The fix is a clear AI use policy: which tools are approved, what data categories can be used with each, and what’s prohibited. It doesn’t need to be long. It needs to exist.

    Automated Vulnerability Exploitation Has Accelerated

    AI tools have significantly reduced the time between a vulnerability being disclosed and active exploitation in the wild. The window between a patch being released and attackers using the underlying vulnerability against unpatched systems is now measured in hours in some cases, not weeks.

    For SMEs running on-premise infrastructure or self-managed cloud services, this puts a new premium on patching speed. Monthly patching cycles — which were never ideal — are now genuinely inadequate for critical vulnerabilities. Critical patches need a 24–72 hour response window as a minimum.

    If you’re running an MSP or internal IT team, this is worth an explicit conversation: what is your current patching SLA for critical CVEs, and can you demonstrate that it’s being met?

    Prompt Injection Is a Real Risk If You’re Using AI in Your Workflows

    This one is less widely understood but increasingly relevant for businesses that have started integrating AI into their operations — customer-facing chatbots, AI-assisted document processing, automated workflows.

    Prompt injection is an attack where malicious instructions are hidden in content that an AI system processes — a document, an email, a form submission — and those instructions cause the AI to behave in unintended ways. In a customer service chatbot, that might mean the AI leaks internal information or gives incorrect advice. In an AI-assisted finance workflow, the implications can be more serious.

    If you’re deploying AI in any operational context, your vendor or developer needs to demonstrate they’ve thought about this. It should be on your checklist when evaluating any AI-powered tool.

    What This Means in Practice

    None of this requires a large security budget. It requires clear thinking about where your exposure is and proportionate controls.

    For most UK SMEs in 2026, the immediate priorities are:

    1. Update your phishing awareness training to reflect AI-generated threats — not just “spot the typo”
    2. Implement a payment verification policy that can’t be bypassed by a convincing phone call
    3. Publish an AI use policy before something goes wrong
    4. Review your patching SLA for critical vulnerabilities with your IT team or MSP
    5. If you’re using AI in any operational workflow, get a basic security review of how it’s been deployed

    If you’re not sure where to start, a Discovery Audit will give you a prioritised picture of your current exposure across all of these areas. The AI-specific side of this — governance, threat modelling, and safe deployment — sits in the AI & Automation Architecture service.

    Book a call to discuss your security position.

  • Your M365 Tenant Has More Exposure Than You Think

    Your M365 Tenant Has More Exposure Than You Think

    Your M365 Tenant Has More Exposure Than You Think
    Published: March 24, 2026

    Most small and mid-sized businesses running Microsoft 365 believe they’re reasonably well protected. They’re paying for the licences, they’ve got MFA turned on (probably), and their IT provider or MSP set it all up. What more is there to do?

    Quite a lot, as it turns out. When I audit an M365 tenant — and I’ve audited more than I can count — I consistently find the same set of misconfigurations and over-permissions. Not because anyone did anything wrong, but because the defaults Microsoft ships aren’t designed for your security posture. They’re designed for onboarding speed.

    Here’s what I typically find.

    Legacy Authentication Is Still Enabled

    This is the single most common finding, and it’s the one that matters most. Legacy authentication protocols — Basic Auth, SMTP AUTH, IMAP, POP3 — don’t support modern multi-factor authentication. If they’re enabled, an attacker who gets hold of a username and password can authenticate without needing to pass MFA at all.

    Microsoft has been moving to block legacy auth for years, but many tenants still have it partially or fully enabled — often because someone needed it for an old application or printer, and nobody ever turned it off again.

    The fix is to create Conditional Access policies that block legacy authentication across the board, with explicit exceptions only where you have a genuine and documented business need.

    Too Many Global Admins

    Almost every tenant I audit has more Global Administrators than it should. In some cases I’ve seen five or six people with Global Admin — in a company of 40 people.

    Global Admin is the highest privilege level in a Microsoft 365 tenant. Anyone with it can create accounts, access all data, modify security settings, and disable MFA. It should be used sparingly, with dedicated admin accounts (not day-to-day user accounts), and protected with phishing-resistant MFA.

    The principle of least privilege applies here. Most people who are Global Admins don’t need to be. Exchange Administrator, User Administrator, and Security Reader roles cover 90% of what people actually need to do.

    MFA Is On, But Not Enforced Everywhere

    MFA adoption in SMEs has improved significantly. But “MFA is enabled” and “MFA is enforced” are different things.

    In many tenants, MFA is configured via the legacy Per-User MFA panel rather than Conditional Access. This approach has gaps — it doesn’t cover service accounts, doesn’t handle different risk levels, and gives users the option to skip registration. I’ve seen tenants where MFA is “enabled” for all users but 20% of them have never actually registered a method.

    Conditional Access gives you proper control: require MFA for all users, all apps, with no exceptions except explicit break-glass accounts. If you’re on Microsoft 365 Business Premium, you have the licences for it. Most businesses aren’t using them properly.

    External Sharing Is Wide Open

    SharePoint and OneDrive external sharing defaults are permissive. In a default or lightly configured tenant, users can share files externally with anyone, with no expiry, no notification to IT, and no audit trail in a place anyone looks at.

    I’ve found tenants where sensitive commercial documents — contracts, financials, client data — had been shared externally via “anyone with the link” and had been sitting that way for two or three years. Nobody knew.

    The fix is to review and restrict your SharePoint sharing settings at tenant level, enable sharing expiry for external links, and configure alerts for broad external sharing events.

    Email Security Is Incomplete

    SPF is usually configured — it’s been standard practice for long enough that most tenants have it. DKIM and DMARC are a different story.

    Without DKIM signing, emails from your domain can be spoofed with a reasonable success rate. Without a DMARC policy at enforcement (p=reject or p=quarantine), you have no mechanism to prevent or monitor spoofing of your domain. Most tenants I audit have DMARC either missing entirely, or set to p=none — monitoring only, no protection.

    For a business of any size, a properly configured email authentication stack (SPF + DKIM + DMARC at enforcement) is non-negotiable. It’s not complex to implement, and the protection it provides against phishing and impersonation is significant.

    Audit Logging Isn’t Turned On Properly

    M365 has a unified audit log that captures sign-in events, admin actions, file access, mail forwarding rules, and much more. It’s invaluable when you’re investigating an incident — or trying to demonstrate compliance.

    In many tenants it’s not enabled, or it’s enabled but the retention period is set to 90 days (the default for most licence types). If you need to investigate something that happened four months ago, that’s a problem.

    Check that unified audit logging is enabled, review your retention settings, and make sure you have alerts configured for high-risk events: impossible travel sign-ins, mass download events, new mail forwarding rules.

    What to Do With This

    None of this is exotic. These are all configurations within the Microsoft 365 Admin Center and the Security portal — no additional tooling required. But they take time to work through properly, and they require someone who knows what they’re looking at.

    If you want to know exactly where your tenant stands, I run a structured M365 security audit that covers all of the above and more, with a prioritised findings report. It typically takes half a day and gives you a clear picture of your exposure. It sits inside the broader Security & Compliance Strategy service.

    Get in touch to discuss an M365 audit for your business.

  • What is a Fractional CISO?

    What is a Fractional CISO?

    What is a Fractional CISO?
    Published: March 17, 2026

    If you’ve started looking at your cyber risk and realised you need someone senior in the room — but a full-time CISO at £120,000–£180,000 a year isn’t on the cards — a Fractional CISO is probably what you’re looking for.

    The term gets used loosely. Let me give you a straight answer about what it actually means, what a Fractional CISO does day-to-day, and how to tell whether you need one.

    The Short Version

    A Fractional CISO is a senior security leader who works with your organisation on a part-time or interim basis — typically one to three days a week, often on a fixed-term engagement. You get the strategic judgement and hands-on experience of someone who has run security at enterprise level, without hiring them full-time.

    The “fractional” model exists because most SMEs and growing businesses don’t need a full-time CISO. What they need is serious security leadership a few days a week — someone who can set the direction, own the risk, talk to the board, and make sure the technical team is pointed the right way.

    What a Fractional CISO Actually Does

    This varies by engagement, but in practice the work falls into a few consistent areas:

    Security strategy and governance — defining your security posture, setting policy, building a roadmap that’s proportionate to your risk and your budget. Not a 200-page document nobody reads. A working plan the business can execute.

    Risk and compliance — owning your risk register, preparing for Cyber Essentials or Cyber Essentials Plus, supporting ISO 27001 if that’s relevant, making sure you’re meeting your contractual and regulatory obligations. For many UK businesses this increasingly means GDPR accountability as well.

    Incident readiness — making sure you have a plan before something goes wrong, not after. Running tabletop exercises, reviewing your backup and recovery position, knowing who calls who at 2am.

    Board and leadership communication — translating technical risk into business language. A board doesn’t need to understand CVE scores. They need to understand what they’re liable for and what it would cost if something went wrong. That’s a skill most technical security people don’t have, and it’s where a good CISO earns their fee.

    Vendor and supplier oversight — reviewing what your MSP is actually doing, checking your cloud configuration, making sure the security tooling you’re paying for is configured correctly. In my experience, most SMEs have the right tools and the wrong settings.

    What a Fractional CISO Is Not

    They’re not a one-off consultant who delivers a report and disappears. That’s a security audit. Useful, but different.

    They’re not a managed security service (MSSP). An MSSP monitors your environment and responds to alerts. A Fractional CISO sets the strategy that determines what you’re monitoring and why.

    They’re not a replacement for a good IT team or MSP. They work alongside your existing technical resource, not instead of it.

    Who Needs a Fractional CISO?

    The businesses I typically work with fit one of a few patterns:

    • Growing SMEs (50–500 people) who have outgrown “IT does security” but aren’t ready to hire a full-time CISO. Often triggered by a new enterprise customer asking about your security posture, or a cyber insurance renewal that suddenly requires evidence.
    • PE-backed portfolio companies where the fund needs consistent security governance across multiple portfolio businesses. One fractional CISO across two or three companies is far more cost-effective than three separate hires.
    • Businesses going through change — acquisition, cloud migration, rapid headcount growth. Security debt accumulates fast in these moments. A fractional engagement through the transition prevents problems that are very expensive to fix later.
    • Businesses post-incident who need someone to come in, stabilise, and build something better. This is the most urgent version of the engagement and usually the most intensive.

    What It Costs

    Engagement structures vary, but a typical fractional CISO arrangement in the UK runs between £3,000 and £8,000 per month depending on days committed and scope. Compare that to the fully-loaded cost of a permanent hire — salary, NI, benefits, pension, recruitment fees — and the economics are usually straightforward.

    For most SMEs, the right entry point is a Discovery Audit: a structured review of your current security posture that produces a prioritised roadmap. It gives you a clear picture of where you stand and what to fix first, and it’s the starting point for any ongoing engagement.

    The Question Worth Asking

    Most businesses don’t call a Fractional CISO until something prompts them — a near-miss, a contract requirement, a board conversation. The ones that get the most value engage before that moment, when there’s time to build something properly rather than fix something broken.

    If you’re not sure whether your business is in a good position, the honest answer is: you probably don’t know, and that’s worth finding out. The way I structure this work is described on the Security & Compliance Strategy service page.

    Book a 30-minute call to talk through your situation — no pitch, just a frank conversation.

  • How Multi-Agent Operations Work in Practice

    e

    Most organisations still treat AI agents like a single chat window with extra buttons. That is fine for a demo. It is not fine when the work touches production systems.

    The difference is operational, not magical. The teams getting value from agents are the ones that add roles, checkpoints, and ownership.

    What works

    A reliable setup usually has four pieces:

    • a coordinator that defines the task and checks the output
    • worker agents that do independent chunks in parallel
    • state that lives somewhere everyone can inspect
    • review points before anything risky moves forward

    That is not glamorous, but it works.

    A simple example

    If three services are acting up at once, a good coordinator breaks the problem apart and sends each service to a separate worker. The workers do not need to talk to each other because the tasks are independent. The coordinator then compares the results and decides whether to approve the fix or escalate.

    That pattern saves time without turning the system into a black box.

    The cost question

    People often assume agent work must be expensive. In practice, the opposite is usually true. The cheap model can do the repetitive work. The better reasoning model is reserved for coordination and review.

    That split matters. It keeps the system affordable and keeps judgment where it belongs.

    What to do first

    1. Decide who owns the outcome.
    2. Identify which tasks can run in parallel.
    3. Make state visible.
    4. Add checkpoints where mistakes would hurt.

    That is enough to get started. The rest is tuning.

  • Does Your Business Actually Need a CISO? An Honest Answer

    Does Your Business Actually Need a CISO? An Honest Answer

    Most of the businesses I talk to ask this question after something has already happened. A contract requirement they didn’t see coming. An insurance renewal that suddenly needs evidence. A near-miss with a phishing attack. A new board member who used to work somewhere with proper security governance.

    The honest answer to “do I need a CISO?” depends on where your business is and what’s about to happen to it. Here’s how to think through it.

    Five Signals You Need One

    1. An enterprise customer is asking about your security posture

    If you’re selling into large organisations — financial services, healthcare, legal, retail, public sector — their procurement and vendor management processes now routinely require you to complete security questionnaires, pass supplier audits, or meet minimum security standards.

    “We take security very seriously” is not an answer to a SOC 2 questionnaire or a CREST assessment. If your current position is that your IT manager handles security alongside everything else, you’re going to start losing contracts to competitors who can demonstrate proper governance.

    A CISO — even fractional — gives you someone who can own this, respond credibly, and make sure your controls match what you’re saying they are.

    2. You’re going through or approaching a transaction

    M&A, PE investment, fundraising, management buyout — any significant transaction will involve a technology and security due diligence process. Buyers and investors are looking for clean estates, documented controls, and evidence of risk awareness.

    Discovering your security gaps during due diligence is expensive. You either fix them under time pressure (costly), accept a price reduction (painful), or watch the deal fall through (devastating). Engaging a CISO before you reach that stage gives you time to find and address the issues on your own terms.

    3. You’re growing faster than your controls

    Headcount doubling. New offices. First international employees. Acquisitions of smaller businesses with their own IT environments. Cloud adoption running ahead of policy.

    Security debt accumulates faster than almost any other kind of technical debt, and it’s less visible until it isn’t. If your organisation has outrun its original IT setup, you almost certainly have gaps that haven’t been properly assessed.

    4. Compliance is becoming unavoidable

    ISO 27001 is now effectively table stakes for mid-market UK businesses selling B2B. Cyber Essentials Plus is increasingly mandated for government supply chain work. GDPR accountability isn’t going away.

    These programmes can be done without a CISO, but they’re more expensive and less effective when they’re treated as a project rather than an embedded practice. A CISO makes compliance a sustainable capability, not a recurring one-off cost.

    5. You’ve had an incident — or you’ve nearly had one

    A ransomware infection that got contained by luck. A staff member who clicked a phishing link and you only found out weeks later. A data breach notification from a supplier. A security researcher who contacted you about an exposed database.

    Near-misses are warnings. They tell you that something in your environment is porous. Responding well to an incident — containing it, understanding the root cause, communicating appropriately, and improving controls — requires someone with the right experience in the room.

    Three Signals You Don’t Need One Yet

    1. You’re genuinely too small

    If you’re under 20 people, cloud-native, with no regulated data and no enterprise customer requirements, a full CISO engagement is probably not the right tool. What you need is a well-configured Microsoft 365 or Google Workspace environment, Cyber Essentials certification, and a sensible backup and recovery position. That’s a project, not an ongoing leadership role.

    2. Your existing IT partner is doing an adequate job

    Some MSPs and IT providers genuinely include good security oversight in their service delivery. If your provider is actively managing patching, monitoring your environment, advising on configuration, and doing periodic risk reviews — and if you have no external compliance pressures — you may not need a separate CISO function yet.

    The test: can you say what your current security posture is? Can you name the three biggest risks to your business and what’s being done about them? If yes, you may be fine. If not, that’s a gap.

    3. You’re not ready for the conversation

    A CISO engagement only works if the business is willing to make decisions and act on the findings. If your leadership team isn’t prepared to invest in the recommendations, change some established habits, or have difficult conversations with suppliers or staff — the engagement won’t deliver value.

    This isn’t a reason to delay indefinitely. It is a reason to make sure the business is aligned before starting.

    What Most UK SMEs Actually Need

    The reality is that most UK businesses between 50 and 300 people sit in a middle ground. They have genuine security risk, real compliance exposure, and meaningful consequences if something goes wrong — but the workload doesn’t justify a full-time hire.

    What they typically need is:

    • Someone accountable for security at a senior level (not just “IT handles it”)
    • A clear picture of their current posture and the gaps
    • A proportionate roadmap — not a 200-page security programme, but the 10 things that matter most
    • Ongoing oversight to make sure progress happens and new risks are caught

    That’s what a Fractional CISO engagement is designed to deliver. Two days a month might sound minimal, but two days a month of focused senior security leadership is more valuable than fifty days of security-adjacent IT management.

    The entry point for most businesses I work with is a Discovery Audit — a structured two-to-three day review that gives you a clear picture of where you stand and what to prioritise. No commitment to an ongoing engagement. Just a straight answer.

    If you’re trying to decide whether your business needs a CISO and aren’t sure where you sit, get in touch. I’ll tell you honestly whether I can help and what the right starting point is. Most conversations are useful even when there’s no engagement at the end. The full scope of how I work is on the Security & Compliance Strategy service page.

Powered by CookieAdmin