Blogs & Videos - Cyberfort

Written by Declan Thorpe – Cyberfort Information Security Consultant

Cyber incidents rarely begin with a clear warning. Most start with small signals, a login that doesn’t fit a pattern, a process running where it shouldn’t, a connection that looks out of place. The organisations that spot these signals early tend to have more options, more time and more control over what happens next.

The incident Co-op faced in April 2025 highlighted this reality. Public reporting shows that the organisation acted early, intervening before the attackers were able to move deeper into systems or attempt more damaging activity. Early intervention of this kind usually reflects an ability to recognise unusual activity quickly and understand enough about the situation to respond with confidence.

In a year marked by several high-profile retail cyber incidents, Co-op’s response stood out for its steadiness. The organisation acted early, demonstrating the value of understanding your environment well enough to recognise when something is out of place and intervene before the situation grows. The incident reinforced that visibility is more than a technical concept; it is a practical enabler of timely, confident decision-making that can meaningfully influence the trajectory of an incident.

A quick look at what happened

Co-op experienced a cyber-attack that resulted in unauthorised access to personal data belonging to a very large number of its members. Public reporting linked the activity to known threat actor group, DragonForce. While the attackers were able to copy certain data, they were prevented from moving deeper into systems or deploying destructive tools.

Co-op’s leadership later explained that the organisation had clear visibility of the attackers’ activity, describing it as being able to “see every mouse click.” That level of insight, based on what was publicly shared, helped the organisation understand what the attackers had accessed and how far the intrusion had progressed. This clarity supported the investigation and allowed decisions to be made based on observable activity rather than assumptions.

Even with early detection and containment, the attack created operational challenges. Stores experienced stock shortages, some customers encountered payment issues, and the organisation reported a noticeable financial impact. Additional one-off costs were incurred as part of the response and recovery effort.

Despite this, the outcome could have been significantly more severe. Early insight into the intrusion helped prevent escalation, reduce uncertainty and support a more controlled response. It also highlighted the value of understanding what is happening inside an environment before the situation accelerates.

Why this was really a story about visibility and early detection

The Co-op incident illustrated how much difference early detection makes during a cyber-attack. Many organisations focus on recovery, but this case highlighted the decisions that come before recovery even begins, the moment when something unusual is first noticed and teams need to decide what to do next.

Several practical realities became clearer.

Early detection gives organisations more time and more options

Spotting unusual activity early allows teams to intervene before attackers escalate their access or attempt more damaging actions. Time is one of the most valuable assets during an incident, and early detection effectively creates more of it.

Visibility doesn’t require a large budget

A fully staffed SOC is valuable, but not every organisation can afford one. What matters most is understanding your assets, knowing what “normal” looks like and having monitoring in place that highlights meaningful deviations. These fundamentals are achievable for organisations of all sizes.

Informed decisions depend on knowing your environment

When teams understand their systems, dependencies and typical behaviour, they can interpret signals more accurately and avoid acting on assumptions. Visibility supports clarity, and clarity supports better decisions.

Containment is most effective when guided by insight

Containment works best when teams know what the attacker has done and what they haven’t. That clarity comes from visibility, not guesswork. Early insight helps teams act with precision rather than disruption.

The incident showed that visibility is not just a technical capability, it is a foundation for better decision-making. When organisations understand what is happening early, they can respond with greater confidence and reduce the likelihood of a wider operational crisis.

What Organisations Can Learn and Apply Right Now

Incidents like the one Co-op experienced highlight how important it is for organisations to understand what is happening inside their environment before an intrusion has the chance to escalate. The lessons are not unique to retail, they apply across sectors, especially where operations and customer facing systems depend on accurate, timely insight.

The following areas stand out.

Know Your Assets

You cannot detect what you cannot see. Organisations benefit from:

a clear, current view of their systems
understanding which assets matter most
awareness of where sensitive data lives
visibility of external facing services

Asset visibility is the foundation on which detection capability is built, if you don’t know what is in your environment then you don’t know what you are protecting. It reduces blind spots and helps teams recognise when something is out of place.

Monitor What Matters

Monitoring does not need to be complex or expensive. What matters is:

logging activity from key systems
watching for unusual authentication patterns
tracking changes to critical configurations
alerting on deviations from expected behaviour

Even basic monitoring can surface early signals that something is wrong.

Establish Clear Escalation Paths

Early detection only helps if teams know what to do next. Organisations benefit from:

simple, well understood escalation routes
clarity on who investigates alerts
thresholds for when to act
confidence that raising a concern is the right thing to do

This turns visibility into action. It ensures that when something unusual is spotted, it does not sit unnoticed or unaddressed.

Use Early Insight to Guide Containment

Containment is most effective when informed by what you can see. Early insight helps teams:

isolate affected systems
prevent escalation
avoid unnecessary disruption
focus recovery efforts where they matter most

This is where visibility directly shapes the outcome. It allows containment to be targeted rather than broad, controlled rather than reactive.

Build Recovery on a Verified Safe Place

Recovery is easier and safer when systems remain intact, and the organisation has a clear view of the intrusion. Early detection helps preserve the conditions needed for:

restoring from trusted backups
validating system integrity
reintroducing services safely
avoiding reinfection

Safe recovery starts with early insight. When organisations understand what has happened, they can restore services with greater confidence and predictability.

Treat Visibility as a Resilience Capability

Visibility is not just a technical feature; it is a foundation for resilience. It enables:

earlier intervention
clearer decision-making
more accurate scoping
safer recovery
reduced operational impact

Organisations that invest in visibility are better positioned to respond calmly and effectively when the unexpected happens. It is a capability that supports every stage of an incident, from detection to containment to recovery.

A more constructive way to look at It

The Co-op cyber-attack was disruptive, but it also highlighted where organisations can strengthen their resilience. It showed how early detection can shape the direction of an incident, and how understanding your environment supports more confident decision-making.

Incidents like this are not just challenges, they are opportunities to learn. They reveal where visibility can be improved, where monitoring can be strengthened and where preparation makes a meaningful difference. They also remind organisations that resilience is not built on a single control or a single team; it is built on the combined effect of awareness, clarity and the ability to act at the right moment.

For many organisations, the most important lesson is that early detection is achievable. It does not require a large security operation or complex tooling. It requires knowing your environment well enough to recognise when something is out of place, and having the confidence to act before the situation grows. That capability, the ability to notice, interpret and respond, is what turns a potential crisis into a manageable event.

The organisations that take these lessons on board tend to respond with greater confidence and experience less disruption when the unexpected happens. They invest in visibility not because it prevents every incident, but because it gives them the insight, they need to make better decisions under pressure. You need visibility, awareness and the ability to recognise when something isn’t right.

Seeing clearly, and seeing early, can change the entire trajectory of an incident.

For more information about Cyberfort security services contact us at [email protected] and one of our experts will be in touch.

Cyber incidents often make headlines because of the disruption they cause, but they also reveal how organisations operate behind the scenes. The 2025 incident at Jaguar Land Rover (JLR) did exactly that, bringing into focus how closely its operations are connected to suppliers, shared systems and the wider manufacturing ecosystem.

What stood out wasn’t just the interruption itself, but the way it exposed the dependencies that keep a modern automotive operation moving. Supply chains in this sector are highly interconnected, and even a brief pause can surface links that usually sit quietly in the background. The JLR outage made some of those connections more visible and offered a practical reminder of how quickly operational pressures can ripple outward.

Seen through that lens, the incident becomes less about the disruption and more about what it revealed. It highlighted the level of interdependence built into today’s manufacturing environments and pointed to clear opportunities for organisations to strengthen their resilience. The lessons are practical, achievable and relevant far beyond the automotive sector.

A Quick Look at What Happened

When the cyber‑attack occurred, JLR paused parts of its UK production to contain the issue, restore affected systems and verify that operations could resume safely. What initially appeared to be a short interruption extended as teams completed recovery work and confirmed that core processes were stable.

The disruption affected several areas:

Manufacturing: some production lines paused and schedules were adjusted.
Supply chain: suppliers of all sizes experienced delays as orders and timings shifted.
Logistics: movements of parts and finished vehicles were rescheduled, creating knock‑on effects across transport networks.
Retail operations: downstream activity changed as production timelines moved.

Throughout the incident, JLR prioritised system stability and close coordination with partners. Production returned gradually, with a focus on safety and continuity across the manufacturing network.

The pause also offered a clearer view of how operational dependencies surface during unexpected events. It showed:

how quickly changes in one area can influence others
how reliant modern manufacturing is on shared digital processes
how important coordinated communication becomes when operations need to adjust at pace

This helps explain why the incident resonated beyond JLR itself. The effects were felt across a broad ecosystem of businesses, reinforcing the importance of understanding supply‑chain dependencies before they are tested.

Why This Was Really a Supply Chain Story

While the incident was centred on JLR, the wider context sits within the structure of automotive manufacturing. The sector relies on a broad network of suppliers, shared digital platforms and coordinated logistics processes, and any disruption naturally draws attention to how these elements interact in practice.

A few operational realities were highlighted during the pause:

Digital systems support day-to-day operations. Modern manufacturing uses a range of digital tools for ordering, scheduling, supplier coordination and logistics. When these systems are unavailable or slowed, it can influence how physical operations run.
Production processes are tightly timed. Automotive manufacturing typically follows structured, time-sensitive workflows. Even small changes to those workflows can create adjustments elsewhere, simply because the system is designed to move at a steady pace.
Suppliers notice changes quickly. When production activity shifts, suppliers often feel the effects early. Larger suppliers may have more capacity to absorb changes, but smaller businesses can be more exposed to sudden fluctuations.

Taken together, the incident illustrated how interconnected the automotive sector is. When a major manufacturer experiences a disruption, the effects can be felt across organisations of varying sizes and roles. It also provided a clearer view of where resilience measures can make a meaningful difference.

What Organisations Can Learn and Apply Right Now

Incidents like this are disruptive, but they also shine a light on where organisations can improve. The lessons aren’t limited to automotive manufacturing they apply to any business that relies on suppliers, partners or digital systems.

Here are the key takeaways.

Map Your Supply Chain

Most organisations have a list of suppliers. Very few have a clear picture of:

which suppliers rely on which systems
how data flows between them
where the single points of failure are
which suppliers are genuinely critical

A clear supply-chain map doesn’t need to be complicated but it does need to be accurate. And it’s an effective way to spot risks before they become problems.

This is especially important for organisations with complex operations. Without a clear map, it’s almost impossible to understand how a disruption in one area might affect another. JLR’s experience showed how quickly a single incident can ripple across an entire ecosystem.

Set Clear Security Expectations for Suppliers

Security requirements shouldn’t be vague or buried in contracts. They should be:

specific
measurable
regularly reviewed
aligned with your own risk appetite

If suppliers are part of your attack surface, and they are, they need to be part of your security strategy.

This doesn’t mean expecting every supplier to meet the same standards as a global manufacturer. It means setting expectations that are proportionate, realistic and clearly communicated. When suppliers know what’s expected of them, they’re far more likely to meet those expectations.

Limit Supplier Access to What’s Necessary

A common weakness in supply-chain breaches is overprivileged access. Suppliers often have:

more access than they need
access for longer than necessary
access that isn’t monitored

Follow the principle of least privilege:

If someone doesn’t need access today, they shouldn’t have it today.

This isn’t about mistrust; it’s about reducing the number of doors an attacker could potentially walk through. Access should be granted sparingly, monitored closely and removed promptly when no longer needed.

Build Segmentation into Your Architecture

Segmentation is an effective way to contain cyber incidents. If one system goes down, it shouldn’t take everything with it. In JLR’s case, the attack affected production systems across multiple factories a sign that segmentation could have reduced the blast radius.

Segmentation doesn’t eliminate risk, but it buys time. And in a cyber incident, time is everything.

It also helps organisations recover more quickly. When systems are segmented, it’s easier to isolate the affected areas, restore unaffected systems and bring operations back online in stages.

Test Your Response with Supplier Focused Scenarios

Most incident response exercises focus on internal failures. But real-world incidents often start elsewhere.

Useful scenarios include:

a key supplier going offline
a shared platform being compromised
a supplier’s credentials being used maliciously

These exercises don’t just test your technical response, they test communication, decision-making and the ability to keep the business running under pressure. They also help identify gaps that might not be obvious during day-to-day operations.

Strengthen Communication Channels with Suppliers

During a crisis, silence creates confusion. Clear, pre-agreed communication paths help everyone respond faster and more effectively.

This includes:

knowing who to contact
knowing how to escalate
knowing what information to share
knowing how to coordinate recovery

Good communication doesn’t fix the problem, but it makes sure that the people who need to know, do know. It also helps maintain trust both internally and externally.

When suppliers know what’s happening, they can take action to protect their own systems and support your recovery efforts. When they’re left in the dark, they can’t.

Build Contingency Plans for Critical Suppliers

If a supplier goes down, what’s your plan B? Or C? Or D?

Even a basic fallback plan can keep operations moving while the primary supplier recovers. It doesn’t need to be perfect it just needs to exist.

Contingency planning isn’t about expecting the worst. It’s about being prepared for the unexpected. And as JLR’s experience showed, the unexpected can happen quickly.

A More Constructive Way to Look at It

The JLR incident was a reminder that even well-established organisations can face unexpected disruption and that the strength of the response often depends on the preparation done long before anything goes wrong. Cyber incidents will always create challenges, but they also highlight where processes, relationships and systems can be strengthened.

For many organisations, the lesson is clear: resilience isn’t built in the moment of crisis. It comes from having tested response plans, clear communication routes and a realistic understanding of how suppliers, partners and digital systems fit together. The organisations that invest time in this preparation tend to recover more quickly, maintain trust more effectively and minimise the wider impact on their operations.

The JLR case showed how interconnected modern supply chains are and how important it is to be ready for disruption, wherever it originates. Treating supply-chain resilience as a core part of cyber security isn’t just good practice, it’s a practical step towards ensuring that when something unexpected happens, the organisation can respond with confidence rather than scramble to react.

Preparation doesn’t remove risk, but it does shape the outcome. And in a landscape where incidents are increasingly common, that preparation is what allows organisations to absorb the shock, protect their reputation and return to normal operations with far less disruption.

For more information about Cyberfort Supply Chain Security services contact us at [email protected] and one of our experts will be in touch.

Cyber-attacks aren’t a dramatic, once‑in‑a‑lifetime set of events, these days they are part of routine operations and they hit organisations of every size. In 2025 we saw this play out clearly when Jaguar Land Rover, Co‑Op and Marks & Spencer (M&S) all found themselves dealing with serious incidents. It was a blunt reminder that no brand is too established or too well resourced to avoid being caught out.

When something like this happens, the technical response is only half the story. The other half, and often the part that decides whether customers stay calm or start losing trust, is how the company communicates. Clear and honest updates can stop a difficult situation from turning into a reputational mess.

That’s what crisis communications is about: being upfront, cutting through confusion and helping people understand what’s going on without adding to the panic.

In 2025, M&S showed what it looks like when a company takes that responsibility seriously. In this article we review what M&S did well, lessons other organisations can learn from M&S’s response to their cyber-attack, and provide practical, actionable steps for businesses who want to make sure they have the right incident response and communication plans in place should they be attacked.

A Quick Introduction to Crisis Communications

So let’s get started. First of all, what is Crisis Communications and why are they so important in an incident response process?

Crisis communications are the structured approach organisations use to communicate during unexpected, high‑pressure events, anything from a data breach to a product recall to a global pandemic. The goal is simple: protect people, protect trust, and protect the business.

Why does it matter so much today?

Cyber-attacks are increasing in scale and impact. 2025 was more evidence of the notoriety of cyber risk increasing, with attacks deeply affecting economic stability and business continuity.
Customers expect transparency. Silence or vague statements erode trust faster than the breach itself.
Regulators are watching. Poor communication can lead to reputational damage and regulatory scrutiny.
Social media accelerates everything. Misinformation spreads instantly if organisations don’t fill the information vacuum.

Done well, crisis communications can turn a chaotic situation into a moment of leadership. Done poorly, it can turn a technical incident into a reputational disaster.

What Happened: The 2025 Marks & Spencer Cyber Attack

In April 2025, Marks & Spencer disclosed a major cyber-attack that severely disrupted its operations. The incident was identified as a ransomware breach which forced the retailer to shut down automated ordering and stock systems, leading to empty shelves and significant operational strain.

The impact was substantial:

Online sales were brought to a standstill
Food shelves were left bare
The financial hit was enormous
Disruption lasted for months

Despite the severity of the incident, M&S managed to maintain customer trust and protect its brand reputation. And that wasn’t luck, it was through communication.

How M&S Communicated During the Crisis

While the technical details of the attack were complex, M&S’s communication strategy was refreshingly simple: be honest, be visible, and be human.

They Communicated Early and Openly

M&S didn’t wait for rumours to spread or for customers to notice empty shelves. They disclosed the attack promptly, explaining the nature of the disruption and its expected duration.

This early transparency helped:

Set expectations
Reduce speculation
Demonstrate accountability
Build trust during uncertainty

In a world where many organisations still try to “keep things quiet,” M&S chose clarity over concealment.

They Provided Regular, Timely Updates

Throughout the incident, M&S issued ongoing updates to investors, customers, and the media. Timely updates prevented:

Confusion
Misinformation
Customer frustration

And importantly, they showed that M&S was in control, even if at times the situation itself wasn’t.

They Used Clear, Accessible Language

M&S avoided technical jargon and focused on what customers needed to know:

What happened
How it affected them
What the company was doing about it
When things would return to normal

This is especially important in cyber incidents, where overly technical explanations can alienate or confuse audiences.

They Demonstrated Leadership Visibility

M&S’s CEO played a prominent role in communications, offering reassurance and outlining recovery plans. His public statements emphasised both transparency and determination, including the company’s intention to use the disruption as an opportunity to accelerate technology transformation

Leadership visibility signals:

Accountability
Confidence
Stability

And it reassures customers that the organisation is taking the incident seriously.

They Maintained a Customer‑Centric Tone

Even while dealing with operational chaos, M&S kept the focus on customer experience. Their messaging acknowledged the inconvenience, explained the impact on stock and online services, and reassured customers that restoring normal service was the top priority.

This empathetic tone helped mitigate the psychological impact of the attack, particularly the anxiety customers feel when their favourite retailer experiences a breach.

Lessons Other Businesses Can Learn from M&S

The M&S incident offers valuable lessons for organisations of all sizes, not just retail giants.

Here are the key takeaways.

Transparency Builds Trust -Customers don’t expect perfection, but they do expect honesty. Being upfront about what happened and what you’re doing to fix it is always better than silence.

Speed Matters –The first 24–48 hours of a cyber incident are critical. Quick communication prevents rumours and demonstrates control.
Consistency Is Key – Regular updates – even if the update is “we’re still working on it” keep stakeholders reassured.
Leadership Should Be Visible – A calm, confident leader can steady the ship and reinforce trust.
Empathy Goes a Long Way – Cyber-attacks are stressful for customers too. Acknowledging their concerns helps maintain loyalty.
Preparation Makes Everything Easier – M&S’s ability to communicate effectively didn’t happen by accident. It happened because they had plans, processes, and trained people.

Cyber‑Focused Advice for Businesses Preparing for Attacks

If the Marks & Spencer incident taught us anything, it’s that crisis communications doesn’t exist in a vacuum. It’s tightly woven into cyber readiness, technical resilience, and the ability to make decisions quickly under pressure. Here’s how organisations can strengthen their cyber posture and their communication capability at the same time.

Build a Real‑World Incident Response Plan

Not a theoretical document. Not a dusty PDF. A plan people can actually use at 2am when the ransomware alarm goes off.

It should include:

Clear roles and responsibilities
Playbooks for the most likely attack types
A rapid approval process for communications
A single source of truth for updates

A good plan removes panic and replaces it with muscle memory.

Know Your Crown Jewels

You can’t protect everything equally. Identify:

Your most critical systems
Your most sensitive data
Your highest‑risk suppliers

This helps you prioritise both your technical response and your communications when something goes wrong.

Train Your People (Not Just IT)

Cyber incidents are cross‑functional events. Everyone needs to know:

How to report suspicious activity
What to say, and what not to say
How to route media or customer enquiries
How to avoid spreading unverified information

For example, Tabletop exercises are a great way to expose gaps and build confidence. At Cyberfort we recommend Incident Response plans are tested on annual basis as a minimum. The crisis simulation exercises undertaken should provide common attack scenarios tailored to your organisations specific sector so you can see where the communication, process and response gaps are in real time before an incident happens.

Prepare Customer‑Friendly Messaging in Advance

When an incident hits, you won’t have time to wordsmith. Pre‑prepare:

Holding statements
FAQs
Internal updates
Regulator‑ready notifications

Keep them simple, human, and jargon‑free.

Establish a Crisis Communications “Battle Rhythm”

Decide in advance:

How often you’ll issue updates
Who approves messaging
Which channels you’ll use
How you’ll coordinate with technical teams

This rhythm keeps everyone aligned and prevents misinformation from filling the silence.

Strengthen Your Technical Foundations

Good crisis communications are easier when your cyber basics are solid. Prioritise:

Access Controls
Regular patching
Network segmentation
Tested offline backups
Endpoint detection and response
Supplier risk assessments
Regular security reviews by a specialist MSSP

These controls reduce the blast radius, and the communication chaos.

Build a Culture of Early Reporting

The sooner you know something’s wrong; the sooner you can contain it. Encourage:

Zero‑blame reporting
Quick escalation
Transparency across teams

Culture is one of the most underrated cyber controls.

Final Thoughts – Communicating Through Chaos

Cyber-attacks are stressful, disruptive, and often expensive. But they don’t have to destroy trust. Marks & Spencer’s 2025 cyber incident showed that even in the face of major operational and financial disruption, strong crisis communications can protect a brand’s reputation and maintain customer loyalty.

By being transparent, timely, empathetic, and consistent, M&S turned a difficult situation into an opportunity to demonstrate leadership and resilience.

And the good news? Any business, large or small, can do the same with a bit of preparation.

Crisis communications aren’t about perfection. It’s about being human, being honest, and being ready.

As the saying goes ‘fail to prepare, prepare to fail’. At Cyberfort we believe ‘now’ is the time for organisations to start making sure they have the right tested incident response plans and crisis communications strategies in place. In today’s threat landscape it’s no longer ‘if’ you will get attacked it’s ‘when’. Those organisations who dedicate the right amount of time and effort to be prepared against cyber-attacks will find themselves with the ability to be more resilient and bounce back with minimal reputational damage.

For more information about Cyberfort Incident Response and Cyber Security Consultancy services contact us at [email protected] and one of our experts will be in touch.

Glen Williams, CEO of Cyberfort Group discusses why UK boards must lead with resilience, beyond compliance, to prevent costly breaches.

Infrastructure-level attacks

Despite growing investment in cybersecurity, many UK businesses remain critically exposed to infrastructure-level attacks.

They are under siege; from state actors, criminal groups and opportunistic attackers exploiting any weakness.

Too many are operating under a concerning illusion of safety, believing being compliant means being secure.

But compliance is not resilience and ticking regulatory boxes is no defence strategy.

The biggest vulnerability is not always a firewall or an unpatched system.

Increasingly, it lies at the top. This is the boardroom blind spot – a disconnect between the perceived and actual state of cybersecurity in UK organisations.

Many underestimate the scale, sophistication and speed of cyber-threats.

The result? A slow drift toward crisis – costing money, reputations, operations and in some cases, the very survival of the business.

Leaders must ask the hard questions: If we were breached tomorrow, could we still operate? How fast could we recover – and at what cost?

From airports to automakers: The threat is escalating

Recent attacks on Jaguar Land Rover, major UK airport ransomware incidents and other critical infrastructure show no sector is immune.

Attackers are more organised, more aggressive and increasingly focused on large-scale disruption.

These breaches often succeed not because defences are absent, but because they are insufficient.

Many businesses still assume cybersecurity is ‘being handled’ by internal IT or third-party providers – often generalists, not specialists.

But when facing organised crime groups or state-sponsored actors, general IT skills fall short.

The analogy holds: No one would trust a nurse to perform brain surgery – so why expect an IT generalist to protect the core of a business against elite cyber-threats?

The numbers speak for themselves. Of the 2.7 million registered UK businesses, only around 51,000 meet Cyber Essentials standards.

So basic cyber-hygiene is still being overlooked. With critical infrastructure now a prime target, the stakes are rising fast. Cybersecurity must be led from the top, by boards.

Why compliance does not equal resilience

Regulatory compliance frameworks such as ISO 27001, GDPR, the upcoming UK Cyber Resilience Act and Cyber Essentials serve a valuable purpose.

They set minimum standards and enforce accountability, but structure alone is not protection.

Compliance does not mean a business can detect, respond to or recover from an attack.

In fact, many companies seriously breached in recent years were fully compliant – on paper – but not operationally ready.

It is entirely possible to pass an audit and still be breached the very next day.

Worse, compliance is often used as a proxy for resilience – but it is often a lagging indicator of risk.

True resilience means having expert-led, scenario-tested, continuously evaluated strategies that are regularly refined and adapted to new threats.

Anything less leaves businesses dangerously exposed.

What real cyber-resilience looks like

Cyber-resilience is not a product you buy nor a policy you publish.

It is the organisation’s ability to absorb shocks and continue operating with minimal disruption – even when under attack.

Resilience starts at the board-level. This includes recognising cybersecurity as a core business risk as well as bringing in trusted partners, such as NCSC-assured consultancies who can help prepare organisations before, during and after an attack.

Resilient businesses invest in more than software; they invest in strategy.

They rehearse their response so that when a breach inevitably happens, teams avoid losing time or capability.

Access to experts like virtual Chief Information Security Officers (CISOs) or specialist placements support stronger governance.

Resilience also means going beyond annual assessments to include regular threat modelling, red teaming and incident response drills.

Preparedness must extend across the entire organisation: Leadership, technical teams and non-technical staff alike.

At Cyberfort, resilience is defined not by how quickly companies recover, but by how little it loses in the process – whether that is trust, uptime, data integrity, capital or brand reputation.

Accountability cannot be outsourced

Cyber-risk is business risk – it impacts revenue, reputation, regulatory standing and long-term viability.

Yet this reality is recurringly not landing where it needs to: In the boardroom.

Too often, cybersecurity is viewed as technical – something IT should manage.

This mindset leads to underinvestment, poor response protocols and strategic blind spots in decision-making when it matters most.

Boards are responsible for resilience. Delegating without oversight or mistaking compliance for readiness, is a dereliction of that duty.

Leaders must ask the right questions, challenge assumptions and ensure cybersecurity is embedded in strategic planning.

When cyber is ignored at the top, the entire organisation is left vulnerable.

To close the boardroom blind spot, leaders must first make cybersecurity a standing board agenda item – not as an operational update, but a strategic risk discussion and treated with the same urgency as financial performance or operational risks.

Cybersecurity breaches can impact the balance sheet just as swiftly and severely as a major market event.

Second, boards must invest in education for directors.

While directors do not need to be technical experts, they must understand the business implications associated with cyber-threats.

Finally, success metrics must shift. Instead of measuring success by the absence of incidents, organisations should focus on the speed and effectiveness of detection, containment and recovery efforts.

Don’t wait for the crisis

The time of treating cybersecurity as an IT issue has long passed.

Cyber-risk now permeates every strategic decision – from M&A to supply chains.

The price of inaction is not theoretical – it is real and growing – just ask the companies that did not survive.

The fallout of recent breaches includes broken shareholder value, customer trust and long-term reputational damage that no insurance policy can undo.

Far too many businesses rely on generalist defences in a specialist threat environment.

Boards can no longer afford to sit on the side-lines.

Cybersecurity must be embedded into every strategic decision, not siloed as a compliance exercise.

The question is no longer if a breach will occur, but how well the organisation will be prepared to respond when it does.

Those who wait for the crisis to act will already be too late.

In this video Cyberfort CEO Glen Williams and Chair of Bluprintx Mark Humphries discuss why UK organisations need specialist cyber security support given the 50%+ rise in cyber security incidents in the past 12 months.

The video covers a range of topics which Cyber Security and C-Suite leaders need to be aware of to ensure their businesses remain secure, resilient and compliant in an ever-changing digital world. Watch the video to discover:

Three key pieces of advice for C-Level leaders when they are looking to improve their organisations cyber resilience
Why there has been a significant increase in attacks aimed at UK businesses in the past 12 months and the role AI is playing in this
The importance of undertaking a regular cyber security review from an NCSC assured provider to ensure organisations can benchmark and create continuous improvement plans for cyber security
Why Crisis Simulation Exercises are crucial for C-Suite leaders in making sure the right people, processes and policies are tested and in place before an attack happens
Why more due diligence and investment needs to be made in supply chain cyber security measures to protect an organisation from attack
The importance of partnering with an expert MSSP if your business does not have the right skills, knowledge or expertise in house to remain secure

With daily news dominated by escalating cyber‑risk, geopolitically charged data flows and deep regulatory scrutiny, the old mantra of “cost per rack” when evaluating colocation simply doesn’t cut it anymore.

For organisations delivering mission‑critical infrastructure, choosing a truly ultra‑secure, UK‑sovereign colocation platform demands a broader view: one that factors in not just operating costs, but the cost of data trust, and the costs when things go wrong.

The Typical Cost Conversation and its limitation

On the surface, colocation decisions often boil down to monthly fees: rack space, power draw, bandwidth, remote hands, and connectivity. But focusing purely on “rack cost + power cost” misses three critical elements:

Data Trust & Sovereignty – where is your data, who can access it, under which jurisdiction, and how does that affect client confidence and regulatory compliance?

Security and Resilience Premiums – the incremental cost of higher assurance, isolation, certification, defence‑in‑depth etc.

Failure Costs – what happens if a breach, ransomware event or infrastructure outage occurs? The hidden costs here often dwarf the monthly fees.

Why UK Sovereignty Matters

When your colocation solution isn’t just “UK hosted” but truly UK sovereign i.e. infrastructure, operations, control, support remaining within UK jurisdiction – the number of risk vectors reduces dramatically. The National Cyber Security Centre (NCSC) emphasises the importance of clear governance and data localisation, whilst global hyperscale cloud providers admit they can’t guarantee all data processing remains within the UK.

For organisations with mission-critical or complex data hosting, this means you can offer clients:

Clear control over data jurisdiction and access
Reduced third‑party/global dependency risk
Improved regulatory/compliance alignment – especially for regulated industries (finance, healthcare, defence)
Higher client confidence (and therefore premium positioning)

Expanding the TCO Model: The Value of Trust and Cost of Failure

The Value of Trust. Your ability to guarantee data is held within UK jurisdiction, under UK law, with UK‑cleared support staff, adds value. That trust translates into:

Easier client acquisition (especially in regulated sectors)
Lower risk premium and insurance cost for clients
Strengthened differentiation and higher pricing potential for your services

Underestimating this means you may sell yourself short: a cheaper “generic colocation” may appear less costly but could cost you in lost deals or higher future remediation burden.

The Cost of Failure. Let’s model the kind of costs that hit organisations when things go bad:

Breach / ransomware event: Loss of productivity, incident response, forensic investigation, legal/regulatory fines, customer notification/credit‑monitoring, reputational damage. The UK data‑centre industry estimates outages alone cost the industry “low single‑digit billions £/year”, with knock‑on costs to customers of some £0.7 billion in 2019 data alone.
Data sovereignty breach: If data migrates or is accessed outside the UK (or appears to be), you may face fines under UK GDPR / Data Protection Act 2018, or lose client trust entirely.
Infrastructure failure: If your colocation doesn’t deliver promised resilience (dual power feeds, N+1 cooling, accredited security) you may trigger client SLAs, business interruption losses, SLA credits or client churn.

When choosing colocation with ultra‑secure UK sovereign credentials you’re effectively buying insurance – higher cost now, lower risk later.

Final thoughts

In today’s landscape, an organisation asking “what’s the monthly fee for a rack?” is looking only at half the equation. To truly capture the TCO – and to position your services for strategic, high‑assurance clients – you must look at:

• the cost of trust (and how your choice enables or undermines it);
• the cost of failure (and how your choice prevents or mitigates it); and
• the premium you can charge for differentiated, sovereign assured services.

Choosing a UK‑sovereign colocation service isn’t simply a cost centre: it’s a risk‑reduction investment, a trust accelerator and a powerful sales differentiator. When you build that into your value‑proposition and data centre strategy, you transform colocation from a commodity into a strategic asset.

Once you factor in risk reduction, insurance premium equivalence, increased deal win‑rate and lower failure cost, the net ROI becomes compelling.

For more information about Cyberfort Colocation services contact us at [email protected] and one of our experts will be in touch.

Jim Manuel – Cloud Solutions Consultant – Cyberfort

“In a world where data crosses borders in milliseconds – sovereignty brings control back home.”

For years, organisations have embraced global cloud platforms for their speed, flexibility, and reach. Yet as the world becomes more unpredictable, that global reach has also brought new risk – from shifting regulations to uncertainty about who ultimately controls and accesses critical data. The cloud conversation is changing. Trust and control have become the new foundations of digital confidence.

Across the UK and Europe, the focus is moving from global to local. Gartner recently described this shift as “geopatriation” – the growing move to repatriate workloads from global hyperscalers back to trusted, sovereign, or regional providers. According to the latest research, 61% of Western European IT leaders plan to increase their reliance on local cloud providers in response to geopolitical pressures. By 2030, more than three-quarters of enterprises outside the US are expected to have adopted a formal digital sovereignty strategy.

In this context, the UK Sovereign Cloud is more than an alternative hosting option – it represents a return to confidence, compliance, and control.

The Shift in the Cloud Conversation

The global cloud was built for scale, but scale alone no longer guarantees assurance. Rising compliance demands, increased scrutiny of cross-border data transfers, and the heightened importance of national resilience have pushed sovereignty to the top of boardroom agendas.

For many UK organisations, this evolution is not about rejecting global innovation but about regaining transparency and governance. Data is a strategic asset, and ensuring that it is stored, managed, and protected under UK jurisdiction is now seen as essential to long-term business stability and customer trust.

The UK Sovereign Cloud model blends the agility of modern cloud computing with the assurance of UK-based operation, providing the best of both worlds – performance and protection, scalability and sovereignty.

Why Sovereignty Now Matters

The growing emphasis on sovereignty is being driven by several converging forces.
First, regulation: the UK GDPR and other compliance frameworks continue to demand clarity over where data resides and who has access to it. Second, geopolitics: global tensions have re-ignited questions about data dependency and foreign jurisdiction. Third, customer trust: as cyber threats increase, clients are demanding greater visibility and accountability from their providers.

Sovereignty is not isolation – it’s assurance. When workloads are hosted in sovereign cloud environments, data remains subject to UK law, with transparent access controls, audited processes, and clear accountability. For regulated sectors such as finance, healthcare, defence, and the public sector, this is no longer optional. It’s foundational.

The Trust Factor – Control, Compliance, Confidence

Trust is no longer assumed – it is engineered.

A UK Sovereign Cloud creates trust through three simple principles:

Control – Data hosted, processed, and supported entirely within UK borders by UK-cleared personnel.

Compliance – Alignment with UK GDPR, ISO, and NCSC standards, removing uncertainty in governance and audits.

Confidence – Assurance that your infrastructure is physically, legally, and operationally protected within the UK’s own jurisdiction.

At Cyberfort, these values are built into every solution we deliver – from private cloud and colocation to managed security and business continuity. Our ultra-secure, Tier-3 aligned facilities and cloud platforms are designed to give organisations absolute confidence in their digital environment.

Because in the end, sovereignty is not just about where your data sits – it’s about who stands behind it.

Building Sovereignty into the Cloud

True sovereignty is not a label – it’s a framework.

That framework combines UK-based data centres, UK-operated connectivity, UK governance, and UK expertise. It’s a cloud ecosystem engineered to ensure that compliance, resilience, and innovation can coexist.

Cyberfort’s approach to sovereign cloud is rooted in this philosophy. Every solution we architect is designed around the principles of protection, performance, and partnership. From backup and recovery to dedicated private cloud environments, we enable organisations to modernise with confidence, knowing their operations are both secure and sovereign.

In a world where “geopatriation” is beginning to redefine cloud strategies, this approach gives UK businesses a platform for growth – one built on transparency, trust, and control.

A Fortress for the Digital Era

The metaphor of “the cloud” once implied something intangible – invisible, borderless, untouchable. But data is not weightless. It lives in physical locations, managed by people, governed by policies, and bound by law.

That is why the UK Sovereign Cloud represents far more than a technology trend. It is a movement toward accountability and resilience. It restores the connection between digital innovation and national integrity, ensuring that the data driving our economy is protected under our own laws, on our own soil.

At Cyberfort, we call that The Fortress Approach – because in a complex, uncertain world, your data deserves nothing less.

Your Data. Our Fortress.

For more information about Cyberfort Cloud, Colocation and Data Centre services contact us at [email protected] and one of our experts will be in touch.

Introduction

Secure by Design (SbD) was launched in July 2023 and its already transforming the way government departments and the MOD are implementing security. Perhaps one of the biggest changes to UK Cyber Security processes in the last 15 years, Secure by Design aims to ensure all of your systems, processes and data are secure from concept to its launch and then throughout its full lifecycle.

Before we delve deeper into the blog, it’s important to note that MOD Secure by Design and Governmental Secure by design are different. Despite having the same name, the same premise and the same objectives, their execution, delivery and assurance processes are different. They have different principles, different timelines and different maturity levels, with at present MOD Secure by Design being almost fully introduced into MOD programmes and projects. UK Government Secure by design is following suit and is ready to secure projects and systems with its 10 principles. This article will be looking at the first and most transformative principle, Principle 1: Create responsibility for Cyber Risk.

For the first time, strategic leaders and leadership throughout projects/programmes will be empowered to be responsible and accountable for Cyber Security risk. Some of these positions will have never encountered Cyber Security before. But by spreading the risk ownership and the understanding across the business/program/project, these projects/programmes will be able to deliver far more secure products and processes, with a far greater security lifespan.

Addressing the elephant in the room – businesses have never been the biggest lovers of major change. To understand these large scale governmental Secure by Design changes it’s important to know why these changes are being implemented, and to understand the benefits of Secure by Design.

Unlocking the Benefits of Secure by Design Principle 1 – Create responsibility for Cyber Risk

A key benefit of Secure by Design is how it affects leadership. Leaders at every level are decision makers and greater understanding of Cyber Security and its risks will ensure that leaders make better decisions. By implementing Secure by Design principles leaders are able to make informed decisions, and better decisions will be made when leaders understand cyber risks. This empowerment towards leadership is not just at the executive level, it cascades down, resulting in leaders at all levels having an understanding of cyber risk and ensuring it is understood and mitigated. This creates a much more comprehensive risk understanding and security controls that are better informed, and therefore far more fitting.

Too often there is a disconnect between executive leadership and the technical teams responsible for securing systems. This gap can result in poorly informed decision-making, lack of investment, and incorrect prioritisation of risk mitigation. By clearly assigning cyber security responsibilities to stakeholders, such as CEOs, COO’s as well as Chief Risk Officers and Board Members, organisations ensure that cyber risk is treated alongside financial, legal, and operational risks.

Another major benefit of Secure by Design is that it aims to stop Cyber Security work being siloed, or existing in isolation. Cyber Security attackers will normally attack a wide surface, not just the security function, and so security needs to be in the forefront of everyone’s minds. By empowering security to staff throughout the business, rather than just the security team it not only spreads awareness but deepens the security scrutiny and allows security to be looked at from subject matter experts, potentially highlighting weaknesses that a cyber security team member would not be able to see.

A case study of where specific expertise has been siloed can be seen within NASA in the 1970’s, specifically during the challenger builds. Engineering teams identified that the ‘O rings’, a component of the lower rockets could fail, which could in turn lead to the entire failure of the launch. This severe risk was not fully understood by senior stakeholders’, and their findings were siloed within the rocket engineering team, unable to get their extreme risk findings correctly communicated or mitigated. This tragically led to the destruction of Challenger on launch and the loss of her entire crew.

By having all teams empowered to not just understand security risks but have influence over them gives the opportunity for projects and programmes to be more secure. Most organisations already do this for safety, and so security will now be no different.

The key challenges organisations must overcome

Of course, as with any organisational change there are challenges. The largest challenge so far observed in the Secure by Design rollout is leaders who are newly empowered to be responsible or accountable for cyber security being unwilling or unable to fully immerse themselves into the new role.

Many leaders face busy days, heavy workloads and hold a lot of responsibility already. With the changes being made some are being informed that they must take on more responsibility in an area they may be unfamiliar with. They may not welcome the changes and therefore will not commit to them as intended. A potential sign of this may be them trying to delegate this responsibility to another team member or someone within their team, pushing work deadlines back indefinitely or openly stating that they are going to refuse to partake. This unfortunately will mean that the delegation of security accountability at all levels will not be being implemented correctly, and that person is not only creating risk but a risk themselves.

The best way to remedy this so far has been to educate these leaders in the importance of the security work and the new responsibility they hold, and to ensure that their workload is balanced well enough that they can correctly adapt to the changes.

Final Thoughts

The first principle of Secure by Design sets the tone for the entire framework: security begins with leadership. When executives take ownership of cyber risk, they signal its importance throughout the organisation. They unlock the necessary resources, drive cultural change, and support the technical teams in making security a core part of every decision, and creating programmes, systems and projects that are secure, by their design.

As cyber threats continue to evolve in scale and sophistication, especially with AI and quantum threats on the horizon, creating clear responsibility for cyber security risk is not just good practice, it’s now an essential pillar of resilience.

How Cyberfort can help?

At Cyberfort we specialise in helping organisations understand their comprehensive cyber risk landscape and put the best governance in place. We ensure cyber security and resilience is built into systems, processes and policies from the start of a product or service lifecycle. This enables organisations to align security with business objectives, existing systems, and industry regulations consistently.

Our teams are experienced in aligning business strategy with Secure by Design principles, starting with clear responsibility at the top. If you’re ready to take a proactive approach to cyber resilience, contact us at [email protected] or visit our website here.

The rise of AI tools has been the fastest technology adoption curve in history. In under two years, millions of small businesses have started using tools like ChatGPT, Claude, and Midjourney to write marketing copy, summarise reports, or answer customer questions.

But as AI gets smarter, the risks become sharper and so does the need for governance.

The Double-Edged Sword of AI in SMB’s

AI can turbocharge productivity. It drafts documents, analyses trends, and automates repetitive admin at a fraction of the cost of human time. But behind the promise lies a fundamental truth: AI is only as safe as the data and instructions you feed it.

When staff paste client information, financial details, or internal plans into public AI tools, that data can be stored, processed, and used to train external models. It leaves your organisation permanently exposed, even if the upload was “just a quick test.”

Real-World Warnings

Samsung engineers accidentally leaked confidential source code by asking ChatGPT for help debugging it.
AI-generated phishing and voice cloning are now indistinguishable from the real thing -cybercriminals use these tools to impersonate CEOs and authorise fraudulent payments.
Marketing teams have faced copyright and privacy disputes after publishing AI-generated content built on protected data.
One SME experimenting with agentic AI bots – autonomous systems that act via APIs – accidentally flooded its internal Slack with thousands of automated messages, paralysing workflow for a day.

These aren’t hypothetical. They’re the early warning signs of a new risk class: AI misconfiguration and misuse.

Governance Is the New Firewall

AI governance doesn’t mean bureaucracy; it means boundaries. Businesses need to start taking this seriously and start by mapping where AI touches their business. For example, key questions which should be asked to assess where and how AI is being used in a business include:

What tools are employees using?
What data do they process?
Where do outputs go (to clients, websites, systems)?

Then, once you have answered the questions, a one-page AI Usage Policy should be created covering:

Approved tools and when to use them.

Data rules – never input confidential or identifiable information into public models.

Oversight – who reviews outputs before publication.

Accountability – who owns AI risk in your organisation.

Once you know where AI sits in your workflow, your MSP can help enforce controls like data loss prevention, sandboxing, and access logging.

The “Human in the Loop” Principle

AI is powerful but not autonomous. Even so-called “agentic” systems need human supervision.
Every AI-driven process should have a human checkpoint before any irreversible action happens (emails sent, payments triggered, data deleted).

Think of AI as an intern – fast, tireless, but prone to confidently getting things wrong.

Security Opportunities

There’s good news too: AI can strengthen your defences when used wisely. Modern detection tools use machine learning to identify anomalies faster than human analysts ever could. AI can summarise logs, flag risky behaviour, and help non-technical teams spot patterns they’d otherwise miss.
The difference between risk and reward is control.

Policy, People, and Partnership

The SMB advantage is agility, you can adapt faster than enterprises. Use that agility to get ahead with a few simple practices:

Assign an AI Lead to track developments, risks, and opportunities.
Include AI in your risk register and data governance policies.
Educate your teams: if they don’t understand how AI handles data, they can’t use it safely.
Work with your MSP to implement guardrails, such as API monitoring, MFA, and content-filtering on AI platforms.

Final Thoughts

AI isn’t the enemy. It’s the next evolution of productivity, and those who learn to govern it early will win. But governance can’t lag behind adoption.

As one security researcher put it: “AI doesn’t just make your business faster – it makes your mistakes faster, too.”

The question isn’t whether you’ll use AI; it’s whether you’ll use it safely. For more information about Cyberfort AI governance, risk and security services contact us at [email protected] and one of our experts will be in touch.

In this video Glen Williams (Cyberfort CEO) and Emily Rees (Cyberfort CFO) discuss why directors of UK companies should be focused on addressing the cyber security risks their businesses are facing. The video covers a range of topics including the importance of undertaking a cyber security audit by a specialist cyber security company to assess your company’s security posture, why supply chain cyber security measures should be focused on given the recent attacks on UK businesses and how to embed cyber security into your companies risk register for improved cyber resilience.