The Small Business Cyber Security Guy | Cybersecurity for SMB & Startups

• The Printer Is Watching: How Your Office Gear Is the Biggest Cyber Threat

  For our 30th episode, we're tackling the cybersecurity blind spot that almost no one discusses but everyone should worry about. You've secured your laptops. You've rolled out multi-factor authentication. Your firewall is properly configured. But what about that office printer quietly storing every contract and payslip you've printed this year on a hard drive nobody ever wipes, with a password an attacker can guess in three tries? This episode reveals the uncomfortable truth about Internet of Things (IoT) devices in your business. We're talking about printers, CCTV systems, smart thermostats, networked door locks, and every other "smart" device you've stopped thinking about as a computer. These forgotten devices are giving attackers a free pass into networks that are otherwise properly secured. We share a real case study from our recent emails about a marketing agency that spent £15,000 on security, passed their audit with flying colours, and still got breached through their office printer. This isn't theoretical paranoia. This is happening right now to businesses that think they've got security sorted. What You'll Learn Why your office printer is possibly the biggest security risk in your building How default passwords on "forgotten" devices create easy access points for attackers The real story of a £15,000 security investment defeated by a £300 printer What network segmentation actually means and why it matters for small businesses How to create and maintain an accurate device inventory Practical steps to secure IoT devices without enterprise budgets Why your CCTV system might be livestreaming to the internet right now How smart thermostats become backdoors into your network Key Topics Covered The Forgotten Device Problem Modern offices are full of computers disguised as other things. Every printer, every CCTV camera, every smart thermostat, and every networked door lock is actually a computer connected to your network. Most businesses secure their obvious computers whilst completely forgetting about these devices, creating perfect entry points for attackers who aren't bothering with sophisticated social engineering when they can just log in with "admin/admin". Real Case Study: The £15,000 Security Investment Defeated by a Printer A 30-person marketing agency listened to our ransomware and authentication episodes, then invested £15,000 in proper security: new firewalls, endpoint protection, hardware authentication keys for every staff member, and a security audit that came back clean. Two months later, they discovered someone had been accessing their client files for weeks through their HP printer that still used factory default credentials. The printer had full network access and stored copies of everything printed. Nobody had changed the password. Nobody had checked it during the audit. Nobody even thought about it. Default Credentials: The Epidemic Nobody Discusses Attackers maintain databases of default passwords for thousands of devices. They don't need to crack complex passwords when they can try "admin/admin" or "admin/password" and gain access to printers, cameras, or thermostats within seconds. These devices often ship with administrative interfaces accessible from the network, and most businesses never change the defaults because they don't think of these devices as security concerns. Network Segmentation Explained (Without Enterprise Complexity) Network segmentation sounds enterprise-level complicated, but the basic concept is simple: not everything on your network should be able to access everything else. Your printer doesn't need access to your accounting server. Your CCTV system doesn't need to reach your customer database. Creating separate network zones for different device types means a compromised printer can't become a stepping stone to your sensitive data. The Device Inventory Challenge Most small businesses have no accurate list of what's actually connected to their network. They know about the laptops and servers but often forget about the smart coffee machine someone plugged in last year, the wireless access points in the meeting rooms, or the networked thermostat the facilities team installed. Without knowing what's connected, you can't secure it. We discuss practical methods for discovering and documenting every device on your network. Practical IoT Security Steps We break down actionable steps that don't require enterprise budgets or dedicated security teams. This includes conducting device audits, changing default passwords, implementing basic network segmentation, regular firmware updates, and creating ownership responsibility for every connected device. The goal is proportionate security that's actually achievable for small businesses. Key Takeaways Every connected device is a computer. If it has an IP address, it's a potential security risk that needs management and protection. Default passwords are attackers' best friends. The first thing to do with any new device is change the administrative password. Never assume factory defaults are acceptable. Network segmentation isn't optional anymore. IoT devices should be isolated from your main business network, even if that means starting with basic VLAN separation. Device inventory is fundamental. You can't secure what you don't know exists. Conduct regular network scans to discover forgotten devices. Ownership matters. Every device needs someone responsible for its security. Don't let devices become "nobody's problem" because that's when they become everyone's problem. Security audits miss IoT devices. Standard security assessments often focus on servers and workstations whilst completely overlooking printers, cameras, and other IoT equipment. Firmware updates apply to everything. IoT devices need security patches just like computers. Many businesses forget this entirely. Your £15,000 security investment can be defeated by a £300 printer. Security is only as strong as your weakest link, and IoT devices are often the weakest links because they're forgotten. Resources & References Mentioned in This Episode Previous Episodes Referenced: Episode 17: Social Engineering - The Human Firewall Under Siege Ransomware episodes (multiple) Authentication episodes featuring Mark Bell Cyber Essentials episodes Electoral Commission accountability episode Hardware Authentication: AuthenTrend hardware keys (mentioned as sponsor) Case Studies: Marketing agency breach via printer (anonymized client) Recommended Reading & Tools NCSC Guidance: National Cyber Security Centre - IoT security guidance Network Discovery Tools: Fing, Advanced IP Scanner, or similar free network scanning utilities Device Documentation: Spreadsheet templates for device inventory available on our website Practical Action Steps This Week: Find your printer's admin interface. Log in. If you can't remember the password, that's probably because it's still set to "admin". Change it. Now. List five connected devices that aren't computers or phones. These are your starting inventory. Check one device's firmware. Is it up to date? When was it last updated? Who's responsible for keeping it current? This Month: Complete device inventory. Use network scanning tools to discover everything connected to your network. Document it all. Change all default passwords. Every printer, camera, thermostat, and access point needs unique, strong credentials. Assess your network segmentation. Can your printer access your file server? It shouldn't. Start planning basic network separation. Assign device ownership. Every device needs someone responsible for its security, updates, and maintenance. This Quarter: Implement basic network segmentation. Even simple VLAN separation is better than everything on one network. Create update schedules. IoT devices need regular firmware updates just like computers. Review and test. Verify your device inventory is accurate. Check that passwords actually changed. Confirm segmentation works. Who Should Listen to This Episode? This episode is particularly relevant for: Small business owners who've invested in cybersecurity but may have overlooked IoT devices IT managers and solo IT staff responsible for securing business networks with limited resources Office managers who purchase and install connected devices without considering security implications Business owners who think they've "done security" but haven't considered printers, cameras, and similar devices Anyone who's ever said "it's just a printer" when security concerns were raised Why This Episode Matters We've covered passwords, multi-factor authentication, ransomware, supply chain attacks, shadow IT, and social engineering across 30 episodes. We've discussed major breaches at household names and examined what it takes to protect heads of state. But we've deliberately avoided IoT security until now because we knew it would make people uncomfortable, possibly angry, and definitely worried. The uncomfortable truth is that whilst you've been securing laptops and servers, your office printer has had full network access, stores every document you print, and still uses the password it shipped with. The CCTV system protecting your premises might be livestreaming to the internet because nobody changed the default settings. The smart thermostat saving you money on heating is potentially giving attackers a way into your network. This isn't theoretical paranoia. We're seeing breaches through IoT devices happen to businesses that have otherwise invested properly in cybersecurity. The marketing agency case study we discuss spent £15,000 on security and still got breached through a printer nobody thought to check during the security audit. IoT security is the blind spot in small business cybersecurity. This episode gives you the knowledge and practical steps to finally address it without enterprise budgets or dedicated security teams. Celebrating 30 Episodes This milestone episode also marks an important achievement for the podcast. Since launching in June 2025, we've: Reached Top 12 in Apple Podcasts Management category worldwide Peaked at 3,500 daily downloads Built an audience that's 47% US, 37% UK despite being a UK-focused show Made cybersecurity almost entertaining whilst maintaining technical accuracy Helped businesses actually implement security improvements, not just understand threats We're genuinely grateful to everyone who's been listening, sharing, and most importantly, doing the work. The chart positions and download numbers are nice, but what matters more is when someone emails to say they've finally sorted Cyber Essentials or retired Dave from IT as a single point of failure. Coming Up Episode 31 (Next Week): Regular episode format continues with another crucial small business cybersecurity topic Episode 32 (22nd December): Christmas Special - a festive take on cybersecurity for small businesses Connect With Us Need Help? If you need direct assistance with IoT device security, Cyber Essentials, network segmentation, or any topic we've covered, contact us at: [email protected] Website & Resources Visit thesmallbusinesscybersecurityguy.co.uk for: Detailed guides on everything we've discussed Step-by-step walkthroughs for printer security, camera configuration, and network segmentation Device inventory templates and checklists All episode show notes and transcripts Subscribe & Follow Apple Podcasts: Currently Top 12 in Management category worldwide Spotify: New episodes every week All major podcast platforms: Search for "The Small Business Cyber Security Guy" Share This Episode Know someone who's ever said "it's just a printer"? They need this episode in their life. Share it with: Business owners who think they've got security sorted IT managers dealing with limited budgets and forgotten devices Office managers who purchase connected devices Anyone responsible for small business network security Support the Show If you've had real value from this podcast: Leave a review on Apple Podcasts or Spotify - tell us what you've actually changed in your business Share episodes with other business owners who need to hear this Tell us what's landing - your feedback helps us create more useful content Subscribe so you don't miss episodes About the Hosts Noel Bradford With over 40 years in IT and cybersecurity across enterprises including Intel, Disney, and BBC, Noel now serves as CIO/Head of Technology for a boutique security-first MSP. He brings enterprise-level expertise to small business constraints, translating million-pound solutions into hundred-pound budgets. His mission is making cybersecurity practical and achievable for resource-constrained small businesses. Mauven MacLeod Former government cyber analyst, Mauven, brings systematic threat analysis and government-level security thinking to commercial reality. With her Glasgow roots and ex-government background, she translates complex security concepts into practical advice for small businesses, asking the questions business owners actually need answered. Graham Falkner Regular contributor and co-host for special episodes, Graham adds additional perspective and helps make complex cybersecurity topics accessible to small business audiences. His role includes managing the legal disclaimers and ensuring content remains grounded in practical business reality. Legal Disclaimer Everything discussed in this episode is for general guidance and educational purposes. It's meant to point you in the right direction but absolutely shouldn't be treated as professional advice tailored specifically to your business. Your situation is unique. What worked brilliantly for one business might be completely inappropriate for another. We do our very best to keep everything accurate and current, but the cybersecurity world moves faster than a caffeinated squirrel. Things can change between when we record and when you're listening, so always double-check critical technical details with qualified professionals before making major changes to your systems. If we've mentioned any websites, products, or services, we're giving you information, not necessarily endorsing them. We can't be responsible for what happens on their end or if things go sideways when you use them. If you're dealing with serious cybersecurity incidents, actual data breaches, or complex compliance issues, please talk to proper professionals rather than just relying on podcast advice. We're here to educate and help you understand the landscape, not to replace your security consultant, solicitor, or IT team. Think of us as your knowledgeable mates down the pub who work in cybersecurity, not your official contracted consultants. We care about your business, but we're not your insurance policy. Stay safe out there, keep learning, and remember: when in doubt, get a second opinion from someone who can see your specific situation. This has been a Small Business Cyber Security Guy production. Copyright 2025, all rights reserved. Episode 30 | December 2025 | The Small Business Cyber Security Guy Podcast

  --------  

  36:53

  --------

  36:53
• Reverse Benchmarking: Learn from the Biggest Cyber Faceplants

  What if the best way to protect your business isn't copying what the successful companies do, but avoiding what the failures did wrong? Welcome to reverse benchmarking, the cybersecurity equivalent of learning from other people's face-plants so you don't repeat them. In this episode, Noel and Mauven flip traditional benchmarking on its head. Instead of asking "what are the best companies doing?", they explore the far more revealing question: "what did the disasters get catastrophically wrong?" From the Target breach via an HVAC vendor to ransomware attacks on UK holiday parks, the hosts dissect spectacular cybersecurity failures to extract practical lessons for small businesses. You'll discover why copying enterprise best practices often backfires for SMBs, how compliance creates dangerous false security, and practical ways to build your own "disaster library" of lessons learned. Plus, the hosts reveal why some of the worst cybersecurity advice comes from studying successful companies rather than failed ones. This isn't just negativity packaged as strategy. It's a systematic approach to identifying your business's genuine vulnerabilities by examining where others fell through the cracks. Because in cybersecurity, knowing what not to do is often more valuable than copying what others claim works. Why This Episode Matters One in three small businesses were hit by cyberattacks last year. The average cost? A quarter of a million pounds, with some reaching seven million. But here's the crushing statistic: 60% of small businesses close within six months of a cyber incident. Traditional benchmarking tells you to copy what big enterprises do. Reverse benchmarking shows you what kills businesses like yours, so you can avoid becoming the cautionary tale in someone else's podcast. Key Takeaways 1. Traditional Benchmarking Often Fails SMBs Copying FTSE 100 security on a shoestring budget is a losing game Enterprise solutions don't scale down effectively By the time you copy last year's "best practice," threats have evolved Context matters more than copying 2. Compliance ≠ Security Being compliant doesn't mean you're secure Compliance is like passing your driving test - it proves you know the rules, not that you'll never crash Checkbox culture creates dangerous complacency Attackers don't check your certifications before striking 3. The Statistics Are Sobering One third of SMBs hit by cyberattacks annually Average breach cost: £250,000 Some breaches: £7 million 60% of small businesses close within six months post-attack NCSC estimates 50% of UK SMBs will experience a breach each year 4. Real-World Disasters Teach Practical Lessons Target breach: Lost $162 million because HVAC vendor credentials weren't properly segmented Colonial Pipeline: Shutdown of major US fuel infrastructure from weak VPN password UK holiday park ransomware: Peak season attack forced cash-only operations Common thread: Basic security fundamentals ignored 5. Third-Party Risks Are Existential 61% of breaches involve third-party access Small vendors create backdoors into larger networks Your security is only as strong as your weakest supplier Segment vendor access ruthlessly 6. Practical Implementation Steps Build your own "disaster library" of relevant failures Hold quarterly "what went wrong" review sessions Map your business to failed case studies Ask "could this happen to us?" for every breach you read about Create no-blame culture for reporting near-misses Detailed Show Notes Introduction (00:00 - 01:24) Noel poses a simple question: in the pub, what do people talk about? Their wins, mostly. This episode does the opposite by examining failures instead of successes. The hosts introduce "reverse benchmarking" as the Darwin Awards of cybersecurity, learning from others' digital disasters rather than bragging about fancy firewalls. Key Quote: "Learn from other people's face-plants so we don't repeat them." What Is Reverse Benchmarking? (01:24 - 03:46) Traditional benchmarking means copying what successful companies do. Reverse benchmarking flips this around: study the worst failures in your industry and make certain you don't repeat them. The Problem with Traditional Benchmarking: Big enterprises have massive IT teams and unlimited budgets Trying to copy enterprise security on SMB resources is futile Benchmarking looks backwards - by the time you implement, hackers have moved on If everyone in your industry has the same gap, benchmarking won't reveal it Why It Matters Now: One third of SMBs were hit by cyberattacks in the past year Average cost: £250,000, with some reaching £7 million 60% of small businesses close within six months of a cyberattack Most small business owners still think they're too small to be targeted UK Context: The National Cyber Security Centre (NCSC) estimates around half of UK SMBs will experience a breach each year. Coin flip odds. If you're sitting in a board meeting saying "hackers won't bother with us," you might as well hang a sign reading "free Wi-Fi, no password." The Compliance Trap (03:46 - 06:15) Many businesses believe being compliant means they're secure. This is cybersecurity's biggest misconception. Compliance vs Security: Compliance is like passing your driving test - it means you know the rules, not that you'll never crash Or that you're a good driver Microsoft's security GM: "Some SMBs believe being compliant means they're safe. It doesn't." Hackers don't check whether you've got ISO certification before attacking The Checkbox Culture: "We did our annual password change. Job done." Hackers respond: "Challenge accepted." Following checklists creates false sense of security Real security requires ongoing vigilance, not annual tick-boxes The Hidden Risk: If everyone in your industry has the same security gap but meets the same compliance standards, benchmarking against them won't reveal your shared vulnerability. You're all vulnerable together, congratulating each other on your certifications. Case Study 1: The Target Breach (06:15 - 09:42) One of retail history's most infamous breaches demonstrates how third-party access becomes a catastrophic liability. What Happened: December 2013: Hackers stole 40 million credit card numbers and 70 million customer records Entry point: HVAC contractor with network access Attackers used vendor credentials to access Target's corporate network Then moved laterally to payment systems The Aftermath: Direct losses: $162 million CEO resigned CIO resigned Board chairman resigned Countless hours dealing with breach response, forensics, legal battles The Lesson: Your security is only as strong as your weakest supplier. That HVAC company, plumber, or IT consultant with network access? They're potential backdoors. Target's enterprise-grade security was bypassed through a small contractor's weak credentials. For Small Businesses: 61% of breaches involve third-party access Small businesses often provide services to larger enterprises Your compromise becomes their breach Vendor management isn't optional Practical Actions: Segment vendor access ruthlessly No contractor needs access to your entire network Use separate credentials for third parties Monitor vendor access continuously Regular vendor security audits Case Study 2: Colonial Pipeline (09:42 - 12:28) In May 2021, a single compromised password shut down a major fuel pipeline supplying 45% of the US East Coast's fuel. What Happened: Ransomware attack forced shutdown of 5,500-mile pipeline Entry point: Weak VPN password No multi-factor authentication (MFA) on VPN access Company paid $4.4 million ransom (partially recovered later) The Impact: Fuel shortages across southeastern United States Panic buying, price spikes Emergency government declarations Week-long shutdown of critical infrastructure The Lesson: Credentials are your front door. If you're not protecting them properly, you've left the door unlocked with a welcome mat out for attackers. For Small Businesses: The Colonial Pipeline didn't fail because of sophisticated zero-day exploits or nation-state malware. They failed because they didn't have MFA enabled on remote access. Your Action Items: Enable MFA everywhere, particularly VPN access Enforce strong password policies Monitor for credential compromise Phishing-resistant MFA (hardware tokens or biometrics) for privileged access Regular access reviews The Cost-Benefit Reality: Hardware security keys: £40-70 per user Potential breach cost: £250,000 average MFA prevents 99.9% of automated credential attacks The mathematics are straightforward Case Study 3: UK Holiday Park Ransomware (12:28 - 15:15) Closer to home, a UK holiday park discovered that timing matters when ransomware strikes. What Happened: Ransomware attack during peak summer season All booking systems encrypted Payment processing down Guest check-ins disrupted The Business Impact: Had to operate cash-only during busiest period Couldn't process new bookings Lost revenue during most profitable weeks Guest experience severely compromised Reputation damage The Lesson: Attackers choose timing deliberately. They struck during peak season when the business would be most desperate to restore operations quickly and most likely to pay the ransom. For Small Businesses: Seasonal businesses are particularly vulnerable during peak periods. That's precisely when attackers strike, knowing you can't afford downtime. Your Defence Strategy: Offline, air-gapped backups tested regularly Incident response plan practiced before peak season Alternative payment processing methods ready Staff trained on ransomware procedures Crisis communication templates prepared The Backup Reality: Having backups isn't enough. You need to test restoration procedures. The middle of a ransomware attack is not the time to discover your backups don't work or take three weeks to restore. Why Reverse Benchmarking Works Better (15:15 - 17:45) Traditional approaches focus on aspirational goals. Reverse benchmarking focuses on avoiding catastrophic failures. The Psychological Advantage: Failures provide concrete examples of what not to do Success stories often omit the messy details Disasters reveal the actual attack patterns you'll face Real consequences make lessons stick The Practical Advantage: You learn what actually breaks in the real world Not theoretical best practices that might work Understand attack chains step by step See how small gaps become massive breaches The Cost Advantage: Avoiding one disaster pays for years of modest security investment You don't need enterprise budgets to avoid enterprise mistakes Focus resources on genuine vulnerabilities Not on impressive-sounding but irrelevant controls The Timeliness Advantage: Recent failures reflect current threat landscape More relevant than last year's "best practices" See how threats evolve in real-time Adapt defences to actual attack methods Building Your Disaster Library (17:45 - 19:29) Practical implementation of reverse benchmarking for your business. Step 1: Collect Relevant Failures Focus on breaches in similar-sized businesses Same industry or adjacent sectors Similar technology stack Geographic relevance (UK regulations, threat actors) Step 2: Quarterly Review Sessions "What went wrong" meetings with your team Review recent breaches systematically Ask: "Could this happen to us?" Identify similar vulnerabilities in your environment Step 3: Map to Your Environment For each breach, trace the attack path Identify which elements exist in your business Where are your equivalent vulnerabilities? What would the impact be if it happened to you? Step 4: Prioritise Actions Not every lesson requires immediate implementation Focus on high-probability, high-impact scenarios first Quick wins vs long-term projects Balance cost against realistic risk Step 5: Create Your "Anti-Playbook" Document what you'll never do based on failure analysis Share with team so everyone knows the "forbidden" approaches Update as new disasters emerge Make it living document, not static policy Resources to Monitor: NCSC Weekly Threat Reports Information Commissioner's Office (ICO) breach reports Industry-specific security bulletins UK Cyber Security News Global breach databases with UK filter Creating a No-Blame Culture (19:29 - 20:45) If people hide mistakes, you lose the chance to fix vulnerabilities before an actual breach occurs. The Aviation Model: Airlines improve safety by fostering no-blame culture for near-misses. They want to hear about every close call so they can fix systemic issues before disaster strikes. Applying This to Cybersecurity: If Janet in accounting falls for a phishing test, berating her is counterproductive. Instead, make it a learning opportunity for everyone. Next time, she might be the one to spot a real phishing attempt and save your business. Practical Implementation: "Lessons learned" sessions, not "who screwed up" meetings Focus on systems and processes, not individuals Reward reporting of near-misses Share failures anonymously when needed Celebrate catches of suspicious activity The Payoff: Fear doesn't work. Education does. When people feel safe reporting potential issues, you catch problems early before they become breaches. Summary and Call to Action (20:45 - 21:37) Sometimes the best way to secure your business is by studying the worst failures out there and doing the opposite. Key Principles: Traditional benchmarking can lead you astray for SMBs Reverse benchmarking provides genuine security advantage Study disasters: Target, Colonial Pipeline, holiday park ransomware Build it into regular practice, not one-off exercise Your Mindset Shift: Think of yourself as Sherlock Holmes of cyber failures. Every incident is a case study that makes your business smarter. In cybersecurity, boring is good. If nothing's happening, it means your defences are working. Immediate Actions: Start your disaster library this week Schedule your first quarterly review session Map one recent breach to your business environment Implement one lesson learned from this episode Share this approach with your team Resources Mentioned Statistics and Studies National Cyber Security Centre (NCSC): UK SMB breach probability estimates Microsoft Security: Compliance vs security research Industry reports: 61% of breaches involve third-party access Bernard Ma: Quote on benchmarking limitations Case Studies Referenced Target Corporation data breach (2013): HVAC vendor compromise, 40 million cards stolen, $162 million loss Colonial Pipeline ransomware (2021): VPN password compromise, $4.4 million ransom, critical infrastructure shutdown UK holiday park ransomware: Peak season attack, cash-only operations UK Regulatory and Advisory Bodies National Cyber Security Centre (NCSC): www.ncsc.gov.uk Information Commissioner's Office (ICO): www.ico.org.uk Recommended Reading NCSC Weekly Threat Reports ICO breach notifications and enforcement actions Industry-specific security bulletins UK Cyber Security News aggregators Practical Checklist: Start Your Reverse Benchmarking Practice This Week: Create a folder or document for your "disaster library" Sign up for NCSC weekly threat report emails Identify three recent breaches in businesses similar to yours Schedule your first quarterly "what went wrong" review meeting This Month: Map one major breach to your business environment Identify your equivalent vulnerabilities to the mapped breach Implement one quick-win lesson from disaster analysis Share this approach with your leadership team This Quarter: Hold your first formal reverse benchmarking session Build your "anti-playbook" of forbidden approaches Establish no-blame reporting culture for near-misses Review and update third-party access controls Ongoing: Weekly review of new breach reports Monthly check: "Could this happen to us?" Quarterly team review sessions Annual comprehensive vulnerability mapping Questions for Your Team Use these discussion prompts in your quarterly review sessions: Which recent breach in our industry most closely resembles our business model? Do we have the same entry points that attackers used in [specific breach]? What would be our equivalent business impact if we experienced this type of attack? Which quick fixes could we implement this month to avoid similar failures? What systemic vulnerabilities do we share with failed organisations? Are we making the same assumptions that led to their breach? Would our backup and recovery process work in a real crisis? Do our third-party vendors have access they don't need? Where are we relying on compliance rather than actual security? What's our single point of failure that resembles their weakness? Next Episode Preview Episode 30: The Office Printer Hacker Saga Yes, office printers are a genuine security risk. Sounds hilarious, but it's genuinely scary. We'll explore why that seemingly innocent device in the corner is actually a network-connected computer with hard drives, stored documents, and often the same default admin password it shipped with. You'll discover the printer botnet that attacked an entire city, the university students who made campus printers output memes, and why your MFP (multi-function printer) knows more about your business than you'd be comfortable with. If you think printers are just about paper jams and toner costs, this episode will open your eyes to why printer security belongs in your threat model. Subscribe so you don't miss it. Share Your Story Have you learned from a cybersecurity blunder, either your own or someone else's? We'd love to hear about it. Send your story to us (anonymously if you prefer), and we might feature it in a future episode. Got a cybersecurity dilemma keeping you up at night? Send it our way. We'll tackle it in our down-to-earth style in upcoming episodes. Connect With The Show Subscribe: Available on Apple Podcasts, Spotify, and all major podcast platforms Leave a Review: Your reviews help other small business owners find practical cybersecurity advice Website: thesmallbusinesscybersecurityguy.co.uk Email: [email protected] Legal Disclaimer The views and opinions expressed in this podcast are those of the hosts and do not necessarily reflect the official policy or position of any organisations they work for, employers, advertisers, sponsors, or any other entities connected to the show. This podcast is for general educational and informational purposes only. It should not be treated as professional advice tailored specifically to your business circumstances. Your situation is unique, and you should consult with qualified cybersecurity professionals before implementing significant changes to your systems. Whilst we strive to keep all information accurate and current, the cybersecurity landscape evolves rapidly. Always verify critical technical details with qualified professionals before making major decisions. We cannot accept liability for any losses or problems that may result from following the suggestions in this podcast. Please think of us as knowledgeable colleagues sharing insights, not contracted consultants providing formal advice. When in doubt, get a second opinion from someone who can assess your specific situation. Copyright © 2025 The Small Business Cyber Security Guy. All rights reserved. Episode Tags #Cybersecurity #SmallBusiness #ReverseBenchmarking #CyberThreats #DataBreach #UKBusiness #SMBSecurity #InformationSecurity #ThreatIntelligence #SecurityStrategy #BusinessProtection #CyberResilience #RiskManagement #SecurityPodcast #UKCyber #NCSC #ThirdPartyRisk #ComplianceVsSecurity #CyberEducation #BusinessContinuity

  --------  

  25:26

  --------

  25:26
• Prison for Negligent Directors? Rebooting UK Cyber Enforcement

  In this provocative second instalment of the accountability series, hosts Noel Bradford and Mauven MacLeod lay out a detailed proposal for a UK cybersecurity enforcement regime that balances protection for small businesses with personal liability for negligent directors. They compare the current weak regulatory approach to the Health and Safety Executive model, cite international evidence from Singapore, and explore why criminal consequences — up to fines, disqualification and, in extreme cases, prison — might be necessary to change boardroom behaviour. The episode explains a three-tier framework: Tier 1 (micro and small businesses) protected by Cyber Essentials and criminal liability only for gross negligence; Tier 2 (25–250 employees) required to follow industry-reasonable practice with qualified oversight and documented policies; and Tier 3 (large organisations and public sector) held to the highest standards (ISO/SOC) with lower thresholds for prosecution. The hosts walk through concrete, measurable standards, outcome-based testing, and safe-harbour defences for businesses that engage accredited advisors. Key technical and organisational measures discussed include Cyber Essentials, MFA, patching and backups, incident response plans, staff training, qualified security oversight (fractional CISOs or accredited MSPs), and government-approved lists of assessors. The episode stresses practical testing — inspectors verifying controls actually work — to prevent compliance theatre and ensure certificates match reality. Noel and Mauven outline a phased five-year implementation pathway: publication and guidance, data collection and mandatory reporting, staged enforcement beginning with large organisations, then medium businesses, and finally full enforcement — all accompanied by funded support programs, subsidies, and free advisory services to help firms comply. Costs, benefits and market effects are examined: basic Tier 1 protections are framed as affordable (Cyber Essentials, free MFA), while stronger governance yields lower insurance premiums, preferential procurement, and overall reduced breach costs. The hosts discuss the need to upskill the ICO into a technically capable enforcement agency, political and industry pushback, and international alignment with EU, Singapore and Australia precedents. The episode closes with a call to action for listeners: implement the basics now (Cyber Essentials, MFA, updates), pressure MPs and industry bodies for proportionate enforcement, and spread the conversation. Expect debates about proportionality, false positives, and safeguarding SMEs, but the central case is clear: a calibrated, evidence-based accountability regime could dramatically reduce breaches and force cybersecurity into the boardroom.

  --------  

  37:13

  --------

  37:13
• When Ransomware Kills: Should Directors Face Prison for Cyber Negligence?

  What happens when business negligence causes serious harm to thousands of people? If a faulty ladder injures someone, directors face prison time. If forty million people have their data stolen due to poor security, they receive a strongly worded letter. In this provocative first episode of our two-part series, Noel and Mauven examine the shocking disparity between health and safety enforcement and cybersecurity regulation in the UK. We compare the HSE's tough approach (prison sentences, director liability, millions in fines) with the ICO's gentle touch (guidance, occasional fines, zero criminal consequences). With 40 million voter records compromised at the Electoral Commission resulting in just a formal reprimand, whilst construction directors regularly face 18-month prison sentences for single workplace accidents, we ask the uncomfortable question: why is cybersecurity enforcement essentially performative? This isn't anti-business rhetoric. This is an evidence-based examination of a broken system that fails to protect either businesses or the public, presented through statistics, case studies, and historical precedent, which demonstrates that personal accountability is effective. What You'll Learn The Two Regulators: A Tale of Vastly Different Consequences Why HSE directors face up to 2 years imprisonment, whilst the ICO never imposes criminal penalties How HSE issued 13,424 enforcement notices and 399 prosecutions in 2023-24 Why the ICO issued just £2.7 million in total UK fines, whilst EU regulators issued over £1 billion The legal frameworks that create this enforcement gap The Public-Private Accountability Divide Electoral Commission breach: 40 million records compromised, 14 months of hostile state access, consequence: formal reprimand Construction site failures: single injuries lead to prison sentences and director disqualifications Why do government organisations face minimal consequences for security failures The message this sends about who matters and who doesn't Historical Context: How HSE Transformed Workplace Safety 85% reduction in workplace fatalities since the Health and Safety at Work Act 1974 How personal criminal liability changed director behaviour overnight The construction industry transformation from dangerous to safety-conscious Evidence that accountability actually works when properly enforced Arguments Against Director Liability (And Why They Fail) "Security is too complex for criminal standards" - why doesn't this hold up "Small businesses can't afford proper security" - HSE already handles proportionate enforcement "Innovation will suffer" - data showing the opposite effect in the safety sector "Current system works fine" - statistics proving it demonstrably doesn't The Current State of Inertia Why ICO enforcement focuses on "guidance and support" over punishment Political pressure keeps cybersecurity consequences minimal Business lobby resistance to accountability measures The broken incentive structure that rewards negligence Key Statistics Referenced HSE Enforcement 2023-24: 13,424 enforcement notices issued 399 prosecutions brought £73.8 million in fines Regular prison sentences (average 12-18 months for serious breaches) ICO Enforcement 2023-24: £2.7 million total fines across all UK GDPR violations Zero prison sentences imposed Zero director disqualifications Focus on "guidance and support" over punishment Electoral Commission Breach: 40 million UK voter records compromised The hostile state actor maintained access for 14 months Basic security failures: poor patching, weak passwords, inadequate monitoring Consequence: Formal reprimand only Impact Statistics: 85% reduction in workplace fatalities since the Health and Safety at Work Act 1974 EU regulators issued over £1 billion in GDPR fines (vs the UK's £2.7 million) Keymark Construction director: 18 months' prison for fatal fall (2023) Notable Cases Discussed Health and Safety Enforcement Keymark Construction (2023): Director sentenced to 18 months imprisonment following fatal fall due to inadequate safety measures Corporate Manslaughter Act 2007: Multiple organisations convicted when management failures caused death Cybersecurity Non-Enforcement Electoral Commission (2023-24): 40 million voter records compromised by hostile state actor, 14 months of system access, consequence was formal reprimand with no financial penalty or personal liability British Airways GDPR Fine: Initially £183 million, reduced to £20 million, no director consequences despite preventable security failures Why This Matters for Small Businesses This isn't about attacking business owners. It's about exposing a system that fails everyone: Honest businesses suffer when competitors cut security corners without consequences Directors lack incentive to invest in security when breaches only result in fines the company pays Small businesses become collateral damage when larger organisations treat security as optional The current approach demonstrably doesn't work - breaches increase year on year despite ICO "guidance" Understanding this enforcement gap helps you see why cybersecurity culture hasn't undergone the same transformation as workplace safety culture. Part 2 will explore what accountability with teeth would actually look like, and how to protect SMEs whilst implementing it. Resources Mentioned HSE Annual Report 2023-24: Full enforcement statistics and prosecution details ICO Enforcement Data: Annual reports showing UK GDPR fine totals Health and Safety at Work Act 1974: Foundation legislation that transformed UK workplace safety Corporate Manslaughter and Corporate Homicide Act 2007: Criminal liability framework for organisations Electoral Commission Breach Report: Technical details of 14-month compromise EU GDPR Enforcement Tracker: Comparison of UK vs European enforcement approaches Hosts Noel Bradford 40+ years in IT/Cybersecurity across enterprise and SMB sectors. Former Intel, Disney, BBC. Current CIO/Head of Technology for boutique security-first MSP. Brings enterprise-level knowledge to small business constraints. Mauven MacLeod Ex-NCSC Government Cybersecurity Analyst with deep threat intelligence expertise. Glasgow-based security professional who translates complex government-level security concepts into practical SMB advice. Coming in Part 2 "What If Cyber Had Corporate Manslaughter? The Case for Personal Liability" We'll explore: Specific legislative framework for "Corporate Cyber Manslaughter" SME protection mechanisms (proportionate thresholds) How other countries successfully implement director liability Expected cultural transformations Practical compliance guidance What "reasonable care" actually means for small businesses Take Action Share Your Thoughts: Should directors face criminal liability for gross cybersecurity negligence? Comment on our website or social media. Prepare for Part 2: Start thinking about what security measures you currently have in place. Could you demonstrate "reasonable care" if asked? Review Your Security: Whilst we wait for better enforcement, don't wait to improve your security. Free resources available from NCSC. Subscribe: Make sure you don't miss Part 2, where we build the case for what enforcement with teeth would actually look like. Forward This Episode: Every business owner needs to understand why the current system fails them. Episode Details Runtime: 42 minutes Release Date: November 17th 2025 Series: Part 1 of 2 Category: Cybersecurity, Business, Technology, Policy Content Warning: Discussion of regulatory failures, system criticism, and calls for significant policy change. Evidence-based but provocative examination of current enforcement approaches. Connect With Us Website: thesmallbusinesscybersecurityguy.co.uk LinkedIn: [The Small Business Cyber Security Guy] Email: [email protected] Tags #Cybersecurity #SmallBusiness #UKBusiness #DataProtection #ICO #HSE #RegulatoryEnforcement #DirectorLiability #GDPR #BusinessSecurity #CyberAccountability #SecurityPolicy #UKRegulation #DataBreach #ElectoralCommission #CorporateManslaughter #BusinessCompliance #CyberGovernance #SecurityLeadership #RiskManagement Transcript Full episode transcript available on our website at thesmallbusinesscybersecurityguy.co.uk Support the Show If this episode opened your eyes to the enforcement gap, please: Leave a 5-star review on Apple Podcasts Share with business owners in your network Follow us on LinkedIn for ongoing discussion Subscribe to ensure you catch Part 2 Next Episode: Part 2 - What If Cyber Had Corporate Manslaughter? All Episodes: thesmallbusinesscybersecurityguy.co.uk/podcasts The Small Business Cybersecurity Guy Podcast offers practical, actionable cybersecurity advice for UK small businesses. We translate enterprise-grade security into affordable, implementable solutions for businesses with 5-50 employees. Disclaimer: This podcast provides general information and discussion about cybersecurity and business topics. This is not intended as legal, regulatory, or professional advice. Listeners should consult qualified professionals for personalised guidance tailored to their specific circumstances. © 2025 The Small Business Cyber Security Guy. All rights reserved.

  --------  

  42:13

  --------

  42:13
• November Patch Tuesday Storm: Zero‑Days, Exchange Exploits & WSUS Emergency

  Graham Falkner delivers an authoritative deep dive into November 2025's Patch Tuesday updates, covering the most critical security vulnerabilities affecting businesses of all sizes. This month brings a perfect storm of actively exploited zero-days, critical Exchange Server flaws, and hundreds of patches across Microsoft, Adobe, Oracle, SAP, and third-party vendors. From Windows kernel exploits to e-commerce platform takeovers, November's vulnerability landscape demands immediate attention from IT teams. Key Topics Covered Microsoft Security Updates 89 total vulnerabilities patched (12 critical, 4 zero-days) CVE-2025-0445: Windows Kernel privilege escalation (actively exploited) CVE-2025-0334: Chrome V8/Edge JavaScript engine RCE (actively exploited) CVE-2025-0078: Exchange Server unauthenticated RCE (CRITICAL - affects Exchange 2016/2019/2022) CVE-2025-1789: MSHTML remote code execution via Office documents CVE-2025-59287: WSUS vulnerability (9.8 CVSS, actively exploited, required re-release) 23 remote code execution vulnerabilities across Windows, Office, and developer tools Adobe Security Updates 35+ vulnerabilities patched across multiple products CVE-2025-54236: Adobe Commerce/Magento input validation flaw (9.1 CVSS, actively exploited, Priority 1) CVE-2025-49553: Adobe Connect XSS vulnerability (9.3 CVSS) Patches for Illustrator, FrameMaker, Photoshop, InDesign, Animate, Bridge, Substance 3D Oracle Critical Patch Update (October 2025) 374 new security patches addressing ~260 unique CVEs CVE-2025-61882: Oracle E-Business Suite zero-day (exploited by ransomware groups) 73 patches for Oracle Communications (47 remotely exploitable without authentication) 20 patches for Fusion Middleware (17 remote unauthenticated) 18 fixes for MySQL Updates for PeopleSoft, JD Edwards, Siebel, Oracle Commerce, Database Server SAP Security Updates 18 new security notes plus 1 updated note CVE-2025-42890: SQL Anywhere Monitor hardcoded credentials (10.0 CVSS - PERFECT SCORE) CVE-2025-42887: SAP Solution Manager code injection (9.9 CVSS) CVE-2025-42944: NetWeaver Java insecure deserialisation (updated patch) CVE-2025-42940: CommonCryptoLib memory corruption Mozilla Firefox Updates Firefox 145.0 released November 11th 15 security vulnerabilities fixed (8 high impact) New anti-fingerprinting measures halving trackable users Memory safety and sandbox escape prevention Apple Security Updates iOS/iPadOS 17.1 and macOS 14.1 released 100+ vulnerabilities patched across iPhones, iPads, Macs Critical kernel and WebKit bugs fixed Zero-click exploit prevention Google Security Updates Chrome 142 with 5 security bug fixes Android November 2025 bulletin (patch level 2025-11-01) CVE-2025-48593 and CVE-2025-48581 affecting Android 13-16 Third-Party Critical Vulnerabilities WordPress Post SMTP plugin: CVE-2025-11833 (9.8 CVSS, actively exploited, 200,000+ sites affected) WatchGuard Firebox: CVE-2025-9242 (critical out-of-bounds write, 75,000 devices exposed) Cisco IOS/XE routers: CVE-2025-20352 (SNMP service, actively exploited for rootkit deployment) Critical Action Items for Businesses IMMEDIATE (Deploy Within 24-48 Hours) Microsoft Exchange Server - Apply CVE-2025-0078 patch or isolate internet-facing servers Adobe Commerce/Magento - Deploy CVE-2025-54236 hotfix immediately if running Magento Windows Kernel - Patch CVE-2025-0445 zero-day exploit Edge/Chrome - Update browsers to address CVE-2025-0334 Oracle E-Business Suite - Verify CVE-2025-61882 patch deployed WordPress Post SMTP - Update to v3.6.1 or remove plugin Cisco routers - Apply CVE-2025-20352 patches and check for compromise HIGH PRIORITY (Deploy Within 1 Week) SAP systems - Apply critical patches for CVE-2025-42890 and CVE-2025-42887 WSUS servers - Verify CVE-2025-59287 patch installed correctly Adobe Connect - Update to version 12.10 Firefox, Chrome, Edge - Deploy browser updates organisation-wide Android devices - Deploy November 2025 security bulletin WatchGuard Firebox - Apply CVE-2025-9242 patch STANDARD PRIORITY (Deploy Within 2-4 Weeks) All other Microsoft patches - Complete Windows and Office updates Adobe Creative Suite - Update Illustrator, Photoshop, InDesign, etc. Oracle - Complete October CPU deployment across all Oracle products SAP - Apply remaining security notes across SAP landscape CVE Quick Reference CVE ID Vendor Severity Status Product CVE-2025-0445 Microsoft Critical Actively Exploited Windows Kernel CVE-2025-0334 Microsoft Critical Actively Exploited Edge/Chrome V8 CVE-2025-0078 Microsoft Critical Not Exploited Yet Exchange Server CVE-2025-1789 Microsoft Critical Not Exploited Yet MSHTML CVE-2025-59287 Microsoft Critical (9.8) Actively Exploited WSUS CVE-2025-54236 Adobe Critical (9.1) Actively Exploited Magento/Commerce CVE-2025-49553 Adobe Critical (9.3) Not Exploited Yet Adobe Connect CVE-2025-61882 Oracle Critical Actively Exploited E-Business Suite CVE-2025-42890 SAP Critical (10.0) Not Exploited Yet SQL Anywhere Monitor CVE-2025-42887 SAP Critical (9.9) Not Exploited Yet Solution Manager CVE-2025-11833 WordPress Critical (9.8) Actively Exploited Post SMTP Plugin CVE-2025-20352 Cisco High Actively Exploited IOS/XE SNMP CVE-2025-9242 WatchGuard Critical Not Exploited Yet Firebox Firewalls Resources & Links Vendor Security Bulletins Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide Adobe Security Bulletins: https://helpx.adobe.com/security.html Oracle Critical Patch Updates: https://www.oracle.com/security-alerts/ SAP Security Notes: https://support.sap.com/securitynotes Mozilla Security Advisories: https://www.mozilla.org/security/advisories/ CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Patch Tuesday Resources Microsoft Tech Community: https://techcommunity.microsoft.com/ Patch Tuesday Dashboard: https://patchtuesdaydashboard.com/ Security Week Patch Tuesday Coverage: https://www.securityweek.com/ Small Business Cybersecurity Resources Blog: https://thesmallbusinesscybersecurityguy.co.uk NCSC Small Business Guide: https://www.ncsc.gov.uk/smallbusiness Cyber Essentials: https://www.ncsc.gov.uk/cyberessentials Key Statistics 89 Microsoft vulnerabilities patched 4 actively exploited zero-days (Microsoft) 23 remote code execution flaws (Microsoft) 35+ Adobe vulnerabilities fixed 374 Oracle security patches 18 SAP security notes 200,000+ WordPress sites affected by Post SMTP bug 75,000 WatchGuard devices exposed online Narrator Graham Falkner brings his distinctive voice to The Small Business Cyber Security Guy Podcast's research segments. With a background as a former movie trailer narrator and Shakespearean actor, Graham delivers technical security information with gravitas and authority, providing the factual foundation for Noel and Mauven's practical discussions. About The Small Business Cyber Security Guy Podcast The Small Business Cyber Security Guy Podcast translates enterprise-grade cybersecurity into practical, affordable solutions for small and medium businesses. Hosted by Noel Bradford (40+ years IT/cybersecurity veteran) and Mauven MacLeod (ex-NCSC government analyst), the show combines deep technical expertise with authentic British humour to make cybersecurity accessible, actionable, and entertaining. Target Audience: UK small businesses (5-50 employees) who need practical cybersecurity advice within real-world budget and resource constraints. Connect With Us Website: https://thesmallbusinesscybersecurityguy.co.uk Subscribe: Available on Apple Podcasts, Spotify, and all major podcast platforms Social Media: Follow us on LinkedIn for daily cybersecurity insights Contact: [email protected]   Help us spread the word about practical cybersecurity for small businesses: ⭐ Subscribe to never miss an episode ⭐ Leave a review on Apple Podcasts or Spotify ⭐ Share this episode with other business owners who need to hear this ⭐ Comment below with topics you'd like us to cover next ⭐ Visit the blog at thesmallbusinesscybersecurityguy.co.uk for written guides and resources Disclaimer This podcast provides educational information about cybersecurity topics. While we strive for accuracy, the threat landscape changes rapidly. Information is current as of November 2025 but may become outdated. Always verify patch information with official vendor sources and test updates in your specific environment before deployment. The hosts are not liable for any actions taken based on this information. Always implement cybersecurity measures appropriate to your business needs and risk profile. Next Episode Stay tuned for our next episode where Noel and Mauven discuss practical patch management strategies for small businesses, including how to prioritise updates when you can't deploy everything immediately. Episode Length: 10-11 minutes Difficulty Level: Intermediate to Advanced Best For: IT managers, business owners, MSP clients, anyone responsible for patching The Small Business Cyber Security Guy Podcast - Making Enterprise Cybersecurity Practical for Small Businesses

  --------  

  17:38

  --------

  17:38

More Business podcasts

Trending Business podcasts

About The Small Business Cyber Security Guy | Cybersecurity for SMB & Startups

The Small Business Cyber Security Guy | Cybersecurity for SMB & Startups: Podcasts in Family