Category: News, Awards and Industry Recognition

By Glen Williams, Cyberfort CEO

---

When technology looks the same, the real differentiation comes from honesty and long-term relationships

Today, in every corner of the channel, a race is taking place. Businesses are scrambling to attach themselves to the latest technology breakthrough, the newest AI model, or the most eye-catching automation platform. There is a belief that technological novelty alone will secure the next wave of business growth.

But in truth, technology is no longer the great differentiator it once was. AI is becoming accessible to everyone. Automation is no longer a luxury but a standard expectation. The more these innovations level the playing field, the more the real advantage shifts somewhere perhaps less glamorous and far more human: trust.

Trust over technology

Trust needs to become the channel’s ultimate currency. In the noise of competing messages, escalating product complexity, and a market full of solutions that all claim to be good enough, customers are tired. They are overwhelmed by choice, confused by jargon, and increasingly sceptical that a vendor has their best interests at heart.

What they are now seeking, and what they will increasingly value, are partners who act with integrity, who guide rather than simply sell, and who view the relationship as more important than a transaction.

As a channel leader, I have watched the shift happen in real time. The organisations that continue to grow are the ones that understand that trust is not a soft value or a marketing slogan. It is the most strategic asset any partner can build.

Integrity shows up not in what a partner sells, but in how they sell it. Customers can sense the difference between someone pushing a product to hit targets and someone giving clear, expert advice, even when that advice means recommending a different solution or admitting that their own services are not the right fit. The partners who are willing to take short-term losses for long-term honesty almost always build stronger, more profitable relationships over time.

Across the channel, this gap in trust is growing. Nowhere is it more visible than in cybersecurity. Too many companies are being sold inexpensive certifications or basic tools that tick compliance boxes but offer little real protection. It creates a dangerous illusion of safety, one that leaves organisations exposed to threats capable of bringing their operations to a halt.

Many businesses may not fully understand what they are buying or what specific risks they need to defend against. When vendors oversell lightweight solutions or fail to explain their limitations, they widen the divide between perceived security and actual resilience. If the channel is not truthful about what genuinely protects a business, we will never meaningfully secure the systems, data, and assets companies depend on.

This is where the best channel partners stand apart. They are the ones willing to say, “This will not keep you safe, and here is why.” They are transparent about risks, realistic about solutions, and confident enough in their expertise to risk losing a sale to protect a customer. In an industry drowning in noise, honesty becomes a refreshing and memorable differentiator.

Integrity is the new value driver

There is no denying the impact of AI on the channel. Much like cloud computing before it, it is transforming service delivery, accelerating product development, and reshaping how partners support customers. But it is also making many offerings look increasingly similar. When technology becomes commoditised, value shifts from what you provide to how you provide it.

AI can solve many real problems for businesses. But over the last 24 months, the market has been flooded with products hastily rebranded as AI to capitalise on the hype. Too often, the technology underneath has not meaningfully changed at all. Partners and customers are left wondering whether these tools genuinely deliver intelligent capability or whether the label has been added simply to accelerate sales. This opportunistic branding only adds to the noise and deepens the trust issues already growing in the channel.

This is why the partners who will thrive in the next decade are those who weave integrity into every part of their business. They create cultures where honesty is rewarded, not penalised. They train teams not only in product knowledge but in ethical decision-making and long-term thinking. They make transparency part of their everyday language, whether discussing pricing, capability limitations, risks, or alternatives. They invest in deep expertise, certifications, systems and processes so their recommendations genuinely protect customers rather than simply helping them pass an audit.

When trust becomes central to a company’s identity, everything changes. Conversations become more open. Loyalty strengthens. Customers begin to see partners not as suppliers but as advisors, people who act in their interest, provide clarity in complexity, and anchor decisions in truth rather than trends.

The channel’s future will not be defined by who adopts the most AI, automates the fastest, or sells the most security certifications. Those things matter, but they are no longer enough. The real competitive edge now lies in relationships built on transparency, ethics, and consistency. Partners who embrace this shift will find themselves winning not because of the flashiness of their offering but because customers believe in them.

Trust may not seem glamorous, but in a landscape crowded with identical claims and interchangeable technologies, it is the most powerful strategy we have.

Read the article on IT Pro here: https://www.itpro.com/business/business-strategy/why-trust-not-tech-will-decide-the-channels-future

By Glen Williams, Cyberfort CEO

---

For years, cybersecurity has been filed under the responsibility of the IT department, as if resilience could be achieved through technical controls alone. Yet the greatest weakness facing UK enterprises today is not a new strain of malware but persistent overconfidence in the boardroom. Far too many senior leaders believe their organisations are fully protected, while the operational reality tells a different story. This disconnect leaves businesses exposed in ways they often discover only after an attack.

The challenge is not a lack of technology. It is the misconception at the top that cybersecurity is in hand, when credentials, processes and controls are often outdated or incomplete. This happens not because IT teams are careless, but because they are expected to deliver enterprise-grade protection with limited budgets and little involvement from the wider business. The result is a dangerous mismatch between executive confidence and actual resilience.

Why board confidence rarely reflects reality

Boards usually receive cybersecurity updates in heavily distilled form heat maps, compliance reports or certificate renewals. This creates an illusion of protection. If the business passed its annual assessment, leaders assume the organisation is secure. If an auditor issued a certificate, they believe it represents ongoing protection. Yet certificates do not stop attacks, and they are meaningless if the underlying controls are not actively maintained.

A certificate reflects a moment in time, not the evolving risk position of a complex organisation. Attackers operate continuously while many businesses validate their defences annually. This mismatch leaves leadership teams with a confidence that is rarely justified. They equate compliance with protection, despite the two being very different measures.

Within IT departments, the picture is more complicated. Teams manage legacy systems, incomplete identity controls and cloud environments that have grown faster than governance. They know where vulnerabilities sit, but without adequate investment and cross-functional alignment they cannot address them. Executives assume infrastructure is protected, but those responsible for that protection are often aware of gaps they lack the bandwidth or budget to close.

Minding the communication gaps

A recurring issue is the lack of a shared language between technical teams and business leadership. CIOs and CISOs may outline risks clearly, but by the time those risks reach the board, they are simplified in ways that remove critical nuance. This turns cybersecurity into a tick-box exercise rather than a strategic dialogue.

Another misconception is that having an IT department inherently makes the organisation safe. Cybersecurity relies on every employee, supplier, process and system being aligned to the same standards. Yet many leaders behave as if they have “purchased” safety in the way they might purchase insurance. If you cut the budget, you cut the protection.

Communication gaps worsen the problem. IT teams know when infrastructure is too old to patch or privileged accounts have proliferated, but unless leadership treats this as business-critical intelligence, the issues remain. Without a culture that values transparency, teams stop escalating concerns because they no longer expect change to follow.

Creating a culture of accountability

Resilience begins when leaders recognise cybersecurity as a shared responsibility. Technology alone will not save a business. What matters is governance, ownership and culture. Senior leaders must move cybersecurity to the top of the agenda and empower their CTOs, CISOs and IT teams to implement the processes needed to protect the organisation.

This means aligning budgets to risk, not convenience. It means embedding cyber considerations into every strategic decision, just as financial or legal risks are considered today. It also requires ensuring the technical truth reaches the board without being diluted into a reassuring summary.

The wider workforce also plays a critical role. Employees need clear guidance, practical training and consistent reinforcement. Cybersecurity cannot be left to a single team; it must be lived across the organisation.

Why the Cyber Security and Resilience Bill matters

The government’s Cyber Security and Resilience Bill is a reminder that the UK must raise its defensive posture. The Bill aims to set minimum resilience standards and strengthen supply chain protections. Supply chains remain one of the weakest entry points for attackers. Organisations can invest heavily internally only to be breached through a trusted supplier with inadequate controls.

If boards better understood what the Bill entails and what is missing from their current plans, they would be more able to empower their technical leaders. Understanding regulatory direction allows organisations to invest proactively and promotes accountability across suppliers, lifting standards across the entire ecosystem.

A call to the boardroom

Cybersecurity will only improve when overconfidence is replaced with informed responsibility. Leaders cannot assume they are protected because they have an IT team, a certificate or a budget line. Resilience demands engagement, investment and continuous dialogue. It requires CEOs and boards to treat cybersecurity as a business imperative, not a technical afterthought. Only then will UK organisations be prepared to defend themselves against the threats that evolve around them every day.

Read the article on Networking Plus here: https://networkingplus.co.uk/news-details?itemid=9364&post=the-cybersecurity-blind-spot-at-the-top-915204

Leaders from Bechtle, Cisilion, Computacenter, Cyberfort, Focus Group, Phoenix Software and Softcat weigh in

---

Glen Williams, Cyberfort CEO

Where does Cyberfort stand on peer-to-peer partnerships?

We work with your traditional VAR partners. Their security solutions are based on a vendor and some wraparound services, which is very different to doing pen testing, cyber consulting or secure by design work, which is what we do. In essence, we are the cybersecurity experts for some of these partners. Some of them have almost outsourced cybersecurity to us, and we almost white label it.

It’s not extensive, but we’re looking to try and grow it next year.

What’s your top tip for a successful peer-to-peer partnership?

There’s no right or wrong answer. Some people want to have one organisation to deal with. Others want to know they’re working with two companies and one’s an expert in the space. It just depends.

What I’ve seen work better is when they say, ‘this is the expert, and this is why we brought them in’ – typically that works well.

Read the full article on IT Channel Oxygen: https://itchanneloxygen.com/7-partner-leaders-on-rise-of-peer-to-peer-partnerships/3/

Glen Williams at Cyberfort argues that the real cyber-security vulnerability in businesses is leadership, not technology

---

For too long, many organisations have viewed cyber-security as a technical problem that sits squarely with the IT department. This belief has always been misguided, but in today’s modern threat landscape it is actively dangerous. The pace and sophistication of cyber-attacks have risen dramatically, yet many leadership teams remain detached from the operational reality of defending their organisations. Cyber-risk is now not just a technology risk, but a business risk and the C-Suite needs to treat it as such.

When leadership teams put cyber-security solely on the shoulders of IT, they inadvertently set the entire organisation up for failure. Most IT teams are already stretched thin, supporting every corner of the digital environment from infrastructure and devices to data management and software. Many operate with budgets that are already tightly allocated. Expecting them to carry full responsibility for safeguarding the business is neither fair nor feasible. 

A culture of shared cyber-security accountability can only emerge when leaders understand that cyber-resilience is woven into every aspect of the organisation, from finance and operations to human resources and procurement.

Putting cyber-risk on the boardroom agenda 

The first step is to make cyber-risk a standing agenda item at board level. Leaders must receive clear, contextualised reporting on cyber-exposure, emerging risks and the effectiveness of current controls. This reporting should be framed in terms of business impact rather than technical jargon so that conversations become strategic and informed. 

Senior leaders should ask questions, challenge assumptions and make sure that cyber-security decisions align with wider corporate objectives. In doing so, they signal to the entire organisation that cyber-security is not a back-office concern, but a core business priority.

To embed this mindset further, executives must take visible ownership of cyber-security behaviours. When leaders follow secure practices, complete training on time, and talk openly about cyber-security responsibility in staff communications, they demonstrate that cyber-security is a shared obligation that extends well beyond IT. Culture flows from the top, and employees are far more likely to take cyber-security seriously when they see leadership doing the same.

Stop chasing badges and build meaningful governance

Many organisations pour money into certifications and accreditations, believing they offer blanket protection. While frameworks such as Cyber Essentials or ISO standards have their place, they are only as effective as the strategy and partners supporting them. Accreditation without genuine operational understanding creates a false sense of security. A certificate on the wall does not stop a phishing attack, an internal breach or a misconfigured cloud service. Without the right partner to interpret, implement and maintain controls dynamically, these accreditations can become expensive tick-box exercises that lull leaders into dangerous complacency.

Effective cyber-security governance requires more than compliance. It demands clarity around roles, responsibilities and accountability across all levels of the business. Leaders should establish a governance model that connects cyber-strategy to business strategy with defined ownership for each area. This often includes forming a cross-functional cyber-security steering group which brings together representatives from IT, risk, finance, HR and operations. This group can help ensure that decision-making is balanced, informed and aligned with organisational goals rather than being driven by isolated teams.

Investment decisions should also be governed with maturity rather than panic. Many boards fall into the trap of approving new cyber-security tools whenever a new threat emerges. This reactive spending rarely leads to meaningful resilience. What is needed instead is an investment model based on risk, impact and long-term value. Leadership teams should build a clear picture of their threat profile and identify which controls genuinely reduce risk. With the right partner involved early in this process, organisations can avoid costly missteps and build a programme that enhances resilience rather than simply expanding the toolset.

The key message is simple. Responsibility for governance rests with senior leadership. IT can implement controls, but they cannot decide the organisation’s risk appetite, they cannot resolve budget constraints, and they cannot influence culture on their own. Governance becomes effective only when the board is actively involved, asking the right questions and treating cyber-security as a strategic enabler rather than a compliance requirement.

Turning cyber-security from a burden into a shared duty

The success of any cyber-strategy, however, depends on how well it is communicated across the organisation. Leadership teams play a critical role in shaping these communications so that cyber-security responsibility becomes an everyday consideration rather than an occasional reminder. Too many organisations rely on one-off training sessions or dense policy documents that fail to resonate with staff. What is needed is a continuous communication strategy that keeps cyber-security relevant and accessible.

Open dialogue should be encouraged about cyber-incidents and near misses. When employees understand that reporting suspicious activity is welcomed rather than discouraged, they become an essential layer of defence. Executives can reinforce this by sharing anonymised case studies or lessons learned from industry breaches. This makes cyber-risk tangible without creating fear. The goal is to foster a culture in which people feel informed, involved and empowered.

Communication must also address the reality of today’s hybrid and decentralised working models. Cyber-security behaviours outside the office are just as important as those inside. Staff need to understand that secure practices extend to home networks, personal devices and remote collaboration tools. Leadership should ensure that communications and policies reflect this, offering guidance that is practical and straightforward.

The long winding road to cyber-protection 

Finally, boardroom members must recognise that cyber-security is not a destination but an ongoing journey. 

Threats evolve, technology evolves and organisations evolve. Maintaining a culture of shared accountability requires consistent communication about progress, changes in risk and improvements being made. This transparency builds trust and reinforces the message that everyone has a part to play.

Organisations that build this communication culture are those that move beyond the outdated notion that cyber-security is an IT problem. Instead, they create an environment where resilience is collective, governance is embedded and investment is aligned with need rather than novelty. In a world where every organisation is a potential target, this cultural shift is not optional. It is the only sustainable path to long-term protection.

The leadership teams that thrive in this era will be those that understand their influence reaches far beyond strategy and finance. They set the tone, define priorities and model behaviour. 

By taking ownership of cyber-accountability, aligning governance with investment and communicating with clarity, they create an organisation where every individual becomes part of the defence. That is how modern resilience is built and how businesses protect not just their systems but their future. 

Read the article on Business Reporter here: https://www.business-reporter.co.uk/management/cyber-security-a-critical-concern-for-the-c-suite

UK based Cyber Security Services provider Cyberfort, today announced the appointment of Kathy Stokes as Chief Revenue Officer. Stokes brings over 25 years of sales experience in the cyber, cloud, and managed services industries, and has worked with FTSE 250 organisations, financial institutions, insurers, public sector, retail and enterprise customers to help them tackle their complex security challenges. Most recently Stokes was Head of Sales at Sapphire, driving growth through strategic partnerships and sustainable customer outcomes.

In her new role, Kathy will oversee all revenue-generating functions and will be responsible for accelerating Cyberfort’s growth trajectory, expanding the company’s market presence.

“I’m excited to be joining Cyberfort and looking forward to helping the company realise it’s growth ambitions,” said Stokes. “The cyber security, cloud and colocation services they provide are crucial to keeping businesses and public sector organisations secure, resilient and compliant. The reason I’ve joined is I see the potential to scale the companies go-to-market strategy and deliver great services to their customers who operate in market sectors where they need expert cyber security, cloud and colocation support. I’m excited to work with this talented team to unlock new revenue streams and deliver exceptional value to our customers.”

Kathy Stokes appointment comes as Cyberfort prepares for its next phase of growth as its looks to expand its service offerings and develop its market presence.

Glen Williams Cyberfort CEO commented “I am delighted to welcome Kathy to the Cyberfort team. She brings business, technical and technology market experience to help us create, manage and deliver all-encompassing cyber security services for our customers. This is an exciting next step forward as Cyberfort evolves and builds on its 20-year history of successfully delivering Cyber Security, Cloud and Colocation Services.”  

About Cyberfort

Cyberfort is an all-encompassing Cyber Security services provider. We are passionate about the cyber security services we deliver for our customers which keeps their people, data, systems and technology infrastructure secure, resilient and compliant.

For more information about Cyberfort please visit https://cyberfortgroup.com.

By Nige Wilkinson, Cyberfort COO

---

The digital landscape is evolving at an unprecedented pace, and with this evolution have come increasingly sophisticated cyber threats. Last year alone cyberattacks on UK Critical National Infrastructure surged by a staggering 93%. This escalation has exposed systemic vulnerabilities within our current framework, particularly in areas where supply chains and digital infrastructures intersect.

The forthcoming  UK Cyber Security and Resilience Bill is not just a legislative update but a fundamental reshaping of how Britain secures its critical infrastructure amid these mounting challenges.

Whilst our national digital backbone supports essential services across commerce, energy, transport and communication, it has also drawn increasingly resourceful and relentless attackers. A breach in one segment of the vast supply chain network can create a domino effect, raising the stakes for national security. This bill is a response to a clear and present need – to elevate our cyber defences through robust, agile, and interconnected strategies that reflect the critical nature of our modern digital ecosystem.

Key Provisions: 24-Hour Incident Reporting

At the heart of the new bill lies a mandate for 24-hour incident reporting. Under this requirement, any attempted or successful cyber breach must be reported within a day, ensuring that both government bodies and private sector entities can respond swiftly and cohesively. The rationale for this accelerated reporting is self-evident: the quicker a breach is flagged, the more effectively we can contain it and mitigate it.

This unprecedented reporting standard forces businesses to adopt a proactive stance. Instead of reactive measures that often come too late, organisations will be cultivating an environment where early detection and rapid communication are paramount. The result should be a more coordinated national response to cyber threats, reducing downtime and minimising potential damage when breaches occur.

Expanding The Regulatory Scope

One of the most transformative aspects of the Cyber Security and Resilience Bill is its expansive regulatory scope.

Previously, many companies operated under the assumption that they were beyond the reach of strict cybersecurity regulations. However, the new provisions extend mandatory regulatory oversight to thousands of additional businesses that were not traditionally bound by such requirements. Companies that were once beyond the regulatory radar will now be compelled to undergo rigorous cyber assessments, supply chain audits, and adhere to tighter incident reporting deadlines.

This shift represents a significant change in how cybersecurity is viewed across the business landscape: it is no longer solely an IT issue but a critical business imperative that demands the attention of boardrooms across the country.

Business Impact: Challenges & Opportunities

For many businesses, the sweeping changes introduced by the Bill might initially seem daunting. Organisations accustomed to operating under a less stringent regulatory framework will have to overhaul their existing practices quickly. Legacy systems that were never designed to cope with modern cyber threats could face significant challenges during this transition phase. Mandatory cyber assessments and accelerated incident reporting will undoubtedly create short-term compliance hurdles.

However, within these challenges lie substantial opportunities. Cybersecurity is fast becoming a key competitive differentiator. Companies that successfully navigate this regulatory shift will not only bolster their own security defences but also benefit from enhanced reputational standing.

In today’s market, where trust is an invaluable asset, a resilient cybersecurity posture can elevate a company’s profile significantly. Moreover, this new regulatory environment is likely to stimulate innovation within the sector, begetting new technologies, best practices, and a more dynamic approach to cyber defence that benefits everyone involved.

Preparation & Compliance: A Call to Action

The road to compliance with the new legislation demands immediate and strategic action from business leaders. It begins with a thorough reassessment of current cybersecurity policies, followed by a commitment to invest in upgraded risk management strategies. Organisations should prioritise investments in state of the art detection and response tools, ensuring that their systems are equipped to meet the accelerated reporting requirements stipulated by the Bill.

A critical component of this realignment is recognising that cybersecurity is not a one-off exercise but a continuous, evolving process.

Regular audits, ongoing training, and upskilling of staff are essential to building a resilient cyber culture within any organisation. As companies adopt these new measures, they’ll find that the rewards extend beyond mere compliance. A continuous commitment to strengthening cyber defences creates an environment of robust security, ultimately protecting the organisation’s reputation, customer trust, and long-term prosperity.

The Power Of Collaboration

In navigating these transformative changes, collaboration emerges as a linchpin for success. Internally, companies must break down silos, fostering clear communication channels across all departments to ensure that potential vulnerabilities are swiftly identified and remedied. Externally, forging alliances with industry peers and engaging with government bodies can provide valuable insights, pooled resources, and shared best practices that enhance overall security posture.

The Cyber Security and Resilience Bill reinforces the idea that cybersecurity is a collective endeavour. The challenges posed by modern cyber threats can be mitigated not through isolated efforts but through coordinated strategies that encompass both public and private sectors. By establishing and nurturing these collaborative networks, we can create an environment where every player contributes to a stronger, more resilient national defence infrastructure.

A Vision for the Future & A Call To Action

The introduction of the Cyber Security and Resilience Bill is a watershed moment for the UK’s digital defence strategy, signalling not just a tightening of regulations but a bold commitment to securing our national infrastructure against evolving cyber threats. This legislation is a decisive move to deter breaches and ensure rapid, effective responses when incidents occur, a dual strategy that addresses immediate risks while paving the way for long term stability.

Organisations that view this shift as more than a compliance burden and instead seize the opportunity to invest in the latest technology, enhanced protocols, and robust interdepartmental and industry-wide collaborations will ultimately gain a significant competitive advantage. The benefits extend beyond mere regulatory adherence; a proactive approach to cybersecurity builds trust with customers and partners while contributing to a resilient, agile digital economy.

By fostering a culture where continuous improvement, regular audits, and ongoing staff training are the norm, companies can not only protect themselves in the short term but also help position the UK as a global leader in cyber resilience.

As emerging technologies such as artificial intelligence and blockchain begin to complement these measures, businesses will discover additional innovative pathways to defend against threats. In embracing the Cyber Security and Resilience Bill, we are not just reacting to current challenges but rather actively shaping a safer, more efficient future.

This is an essential step towards building a digital Britain where enhanced vigilance, collaboration, and forward-thinking strategies secure our collective well-being for generations to come.

Read the article on Cyber Security Intelligence here: https://www.cybersecurityintelligence.com/blog/the-cyber-security-and-resilience-revolution-8768.html

By Rob Vann, Cyberfort CSO

---

When a company like Qantas an airline synonymous with safety suffers a high-profile data breach, the message is loud and clear: no brand is untouchable, and no data is sacred. But here’s the real problem: we’re still treating breaches as anomalies. They’re not. Breaches are now a guarantee, and the only variable left is how well or how catastrophically you respond. 

The Qantas breach wasn’t just a failure of security; it was a failure of imagination, of preparation and resilience. If businesses don’t wake up now, they won’t just lose customer trust they’ll lose relevance. This is your blueprint for what to do when, not if, your defences fail and how to ensure your organisation doesn’t become the next cautionary headline. 

Step one: Panic smart – not fast 

When the breach hits, most companies do the same thing: go silent, scramble internally, and throw together a press statement that says, “We take your privacy seriously.” 

Stop. That’s PR autopilot and attackers are counting on it. 

What you need is speed with clarity. Assemble your breach response team legal, security, comms, compliance and ask the hard questions: 

• What exactly was accessed? 
• How long has it been going on? 
• Is the attacker still inside? 

The longer you pretend it’s “under investigation,” the more trust you lose. Transparency isn’t just a legal risk it’s a strategic advantage. 

Consumers don’t wait to be told 

If you’re a Qantas customer (or one of the millions watching nervously), don’t sit around for confirmation. Assume compromise until proven otherwise. Cybercriminals won’t wait for your email to arrive they’ll be monetising your data by tomorrow. 

Verify the breach – don’t fall for the follow-up scam 

Ironically, the breach itself often triggers a second wave of fraud. Phishing emails pretending to be from Qantas will flood inboxes, asking you to “verify your account” or “reset your details.” Never click on email links after a breach. Go directly to the company’s website or app. Trust your paranoia it might save your identity. 

Check if you’ve been exposed – and act accordingly 

Not all data breaches are created equal. A leaked email is annoying. A leaked passport number? That’s catastrophic. 

• Use monitoring tools like HaveIBeenPwned or sign up for dark web scanning through your bank or a cybersecurity provider. 
• For loyalty and travel accounts, scrutinise redemption histories and account logins. Flag anything out of pattern. 
• If ID documents were leaked, report them immediately and request replacements or fraud alerts with the relevant authorities. 

The attackers won’t give you time to think. Don’t give them time to act. 

Password resetting isn’t optional. It’s urgent. 

Still using the same password you created in 2012? Then you’re part of the problem. 

Qantas frequent flyer accounts are a prime target because people reuse those passwords everywhere – banking, email, e-commerce. One breach becomes many. 

Your new password rulebook: 

• Unique for every site. 
• Long (at least 12 characters). 
• Random (not “Qantas123!” or your child’s name). 
• Managed with a password manager. You don’t have to remember 100 passwords – you just need to remember one good one. 

Weak passwords don’t get guessed, they get cracked by bots running billions of combinations in seconds. If you’re still relying on “clever” variations, you’re already compromised. 

Two factor authentication isn’t a luxury. It’s a minimum requirement 

Two-Factor Authentication (2FA) is one of the simplest, most effective ways to stop account takeovers. So why aren’t more people using it? 

Excuses like “it’s annoying” or “I don’t want to install another app” don’t hold up when your identity is at risk. 

Here’s what to do: 

• Enable 2FA on every account that offers it—especially loyalty programmes, email, and banking. 
• Use an authenticator app (like Microsoft or Google Authenticator) -NOT SMS, which is easier to hijack. 
• Never share or screenshot your authentication codes. They’re like handing out keys to your digital kingdom. 
• Shop and travel smarter: Assume you’re being watched 
• Cybercriminals love predictable behaviours. Travel is full of them. 
• People use unsecured Wi-Fi in airports and hotels. 
• They receive dozens of emails from travel brands. 
• They’re often distracted, tired, or rushed -perfect conditions for phishing. 

Consumer Tips:
– Don’t shop or log in to sensitive accounts over public Wi-Fi unless you’re using a VPN. 
– Never use the same email/password combo across shopping and travel sites. 
– Use disposable or virtual cards when booking trips or buying online. 
– Set up bank alerts for any purchase or login activity. 
– Treat every digital interaction while travelling like it’s under surveillance—because it probably is. 

For businesses: prevention is dead. Resilience is everything. 

Still thinking cyber “won’t happen to us”? Ask Qantas. Ask MOVEit. Ask anyone who’s had to face the cameras and say, “We’re investigating the incident.” 

You don’t stop breaches with wishful thinking and legacy tools. You stop them with brutally honest assessments, relentless testing, and round-the-clock visibility. Three key steps all organisations should be taking in light of the Qantas breach: 

1. Penetration testing – Simulate the breach before the real one hits 

Static security reviews are useless in 2025. Attackers don’t use checklists, they use ingenuity. Your defences should be tested by people who think like them. 

Use red teams to run real-world attack simulations to expose your blind spots, from credential stuffing to insider threats. If your internal team always passes the test, it’s not a test. It’s theatre. 

2. Managed detection & response (MDR) – Eyes on everything, all the time 

Breaches don’t announce themselves. Without MDR, you might not know you’ve been hit until your data is on the dark web. Market leading MDR platforms use AI to detect anomalies in real time, and expert analysts investigate alerts before they become incidents. Speed matters. Context matters more. If you’re relying on tools alone, you’re not covered, you’re exposed. 

3. Secure cloud backups – Because ransomware doesn’t negotiate 

When all else fails, your backup is your survival plan. But if it’s stored on the same network, with the same credentials, and hasn’t been tested in six months, you might as well not have one. 

A proper backup strategy includes: 

• Isolated, encrypted cloud storage 
• Automated versioning 
• Disaster recovery plans that are rehearsed, not theoretical 

If your board doesn’t know your RTO (Recovery Time Objective), ask why they still have a seat at the table. 

Final word: The real breach is the illusion of control 

Let’s stop pretending we can “prevent” all cyber-attacks. That ship has sailed. What separates survivors from casualties is preparedness, transparency, and relentless resilience. Qantas didn’t choose to be breached, but they did have a choice in how ready they were when it happened. 

For consumers – assume you’ve been compromised and act accordingly. For businesses – build breach response into your DNA. 

This isn’t about fear. It’s about facing reality. Cyberattacks are business attacks, and the cost of not evolving is far greater than the cost of change. 

Because in today’s world, data protection isn’t just a duty, it’s your credibility. 

Read the full September Edition of the Cyber Defense Magazine here: https://cyberdefensemagazine.tradepub.com/free/w_cyba180/prgm.cgi

By Glen Williams, Cyberfort CEO

---

AI isn’t just transforming industries; it’s disrupting the rules of engagement. In cybersecurity, it’s weaponised, decentralised, and accelerating faster than many businesses are prepared for. Organisations still relying on traditional, reactive defences aren’t just lagging behind – they’re becoming prime targets. The time for change is now. 

The new era of cyber resilience demands a different mindset. One where AI isn’t just a buzzword in the boardroom, but a strategic imperative woven into operations, culture, and leadership. It’s no longer about “staying secure” – it’s about staying ahead. At Cyberfort, we believe too many businesses are sleepwalking into an arms race already well underway. 

AI threats aren’t emerging – they’re already winning 

Let’s put this plainly: AI-led attacks aren’t futuristic concepts. They’re happening now. And they’re working. Generative AI is being used to craft phishing emails that are indistinguishable from legitimate correspondence – down to tone, grammar, and visual branding.  

We’ve seen real-world cases where attackers impersonated CEOs using deepfake audio to trick CFOs into transferring six-figure sums. AI-coded malware doesn’t just hide, it adapts, mutates, and learns how to beat your systems with each failed attempt. This isn’t theoretical. It’s operational.  

If your security strategy is still focused on static detection rules and perimeter firewalls, you’ve already been outmanoeuvred. AI is giving attackers the ultimate unfair advantage: scale and believability. They don’t need to target millions anymore. They can tailor a single, highly effective attack that slips through every layer of your existing defences. 

From cybersecurity to cyber resilience – predict, don’t just react 

Traditional cybersecurity was built around the idea of reacting: block what you know, respond when you detect. But AI has shattered that model. Reaction is now too slow. The game has changed.  

It’s not about “if” you’ll be breached. It’s about how quickly you can see it coming, how fast you respond, and how well you recover. That’s cyber resilience. 

Organisations are increasingly adopting AI-powered threat prediction models to stay ahead of evolving cyber threats. Machine learning is being leveraged not just to flag anomalies, but to analyse behaviour over time – who is accessing systems, from where, and how usage patterns change. Effective systems trigger alerts both when activity appears malicious and when it deviates from expected norms.  

AI serves as a force multiplier: it reduces noise, increases context, and enables human analysts to focus on the most critical signals. That partnership between human expertise and intelligent systems is essential. Without human intuition, AI can become just automated noise. But human teams without AI – that’s bringing a knife to a gunfight. 

The workforce wake-up call: Reskill or risk everything 

Let’s make one thing clear – you cannot AI-proof your business without an AI-ready workforce. And no, this doesn’t mean hiring a few data scientists and hoping for the best. It means retraining your entire organisation to operate in a world where seeing is no longer believing, and where digital deception is crafted by algorithms, not amateurs.  

Forward-thinking organisations are not just investing in tools, but in their people. This means running deepfake drills, simulating audio impersonation attacks to test how staff respond under pressure – especially when the voice on the line sounds convincingly like their boss. 

This isn’t about paranoia. It’s about preparation. 

Inclusive, neurodiverse security teams are becoming increasingly important as skills like pattern recognition and lateral thinking are more valuable than ever. People who think differently often perceive threats differently. In cyber defence, seeing what others miss is everything. But here’s the kicker, unless leadership supports this change, meaningful change won’t happen. Which brings us to the next uncomfortable truth. 

Leadership – Step up or step aside 

The biggest obstacle to true cyber resilience isn’t legacy tech. It’s legacy thinking. Too many boards still treat cybersecurity as a cost centre. Something to insure against, or a compliance checkbox. Meanwhile, attackers are treating it as their primary attack vector. 

We’ve seen clients turn this around, but only when leadership got serious. This happens when boards understand that breaches aren’t just technical failures, they’re strategic and reputational crises. When CISOs have a seat at the table, security becomes part of the business strategy, not an afterthought. 

AI needs leadership buy-in. Not just funding, but vision. The organisations that will thrive will be those where the C-suite leads by example. They’ll learn how AI works, understand its risks, and champion a culture of security and experimentation. If your leadership team is “waiting to see where the regulations land,” you’re already two years too late. 

Challenge everything: This is your mandate 

The old rules? Rip them up. 

• “Train staff to look for spelling errors” – AI doesn’t make them. 
• “Trust what you see and hear” – deepfakes say otherwise. 
• “Patch and respond when attacked” – by then, the damage is done. 

Challenge everything: your security playbook, your hiring model, your boardroom assumptions, your readiness. Cyber resilience isn’t a goal, it’s a posture – and in an AI-fuelled arms race, it’s your only competitive advantage. 

We’re not just facing smarter threats; we’re facing faster ones. Businesses that embrace AI responsibly, retrain their teams radically, and lead from the top will win. The rest will spend the next five years in recovery mode. Technically secure, but reputationally wrecked. 

AI isn’t just changing cybersecurity. It’s rewriting the rules of business survival. The question is: are you ready to lead, or are you waiting to follow? 

Read the full article on The AI Journal here: https://aijourn.com/the-cyber-arms-race-has-changed-has-your-business/