In July, a company called Hugging Face got hacked. Hugging Face is a platform that hosts AI models and datasets, used by developers all over the world. What made this one different is who did the hacking: an AI system belonging to OpenAI, which had been let loose in a test environment, escaped it, and […]
When Your Supplier Has a Bad Day, You Have One Too Read More »
If you’ve ever sat in a meeting where these two terms got used interchangeably, you’re not alone. I hear it all the time, and honestly it’s an easy mix-up to make. Both are about keeping information safe. Both show up in the same policies, the same training programmes, sometimes even the same job title. But
Data Protection and Information Security: What’s the Difference? Read More »
ISO Spaghetti: Making Sense of the Standards You Keep Hearing About If you work in any kind of professional role, you have probably come across ISO standards. They get mentioned in tender documents, supplier questionnaires, job adverts, and LinkedIn profiles. ISO 27001. ISO 22301. ISO 31000. Sometimes all three in the same sentence. But what
ISO Spaghetti: Making Sense of the Standards You Keep Hearing About Read More »
When the Heat is On: the Information Security Risks Nobody Briefs Their Team About I was visiting a client a few summers ago when I noticed the server room door was propped open with a fire extinguisher. A desk fan had been placed just inside the doorway to push cooler air in. It was ingenious,
When the Heat is On: the Information Security Risks Nobody Briefs Their Team About Read More »
Is it a breach, a complaint, or a quality issue? Why getting that wrong matters Here’s a scenario that plays out in organisations more often than most people realise. A customer gets in touch, something has gone wrong, and the person who picks up the call does what feels natural — they apologise, fix it,
Is it a breach, a complaint, or a quality issue? Why getting that wrong matters Read More »
Passkeys in Real Life: Lost Phones, Multiple Devices, and Getting Started A few days ago I put together a visual explainer on how passkeys actually work. It got a brilliant response — but it also generated a couple of very relevant questions: “What if I lose my phone?” and “I use more than one device
Passkeys in Real Life: Lost Phones, Multiple Devices, and Getting Started Read More »
Spot the phish: 5 red flags in a dodgy email Phishing emails are getting better. The spelling mistakes and dodgy formatting that used to give them away? Largely a thing of the past. Today’s phishing attempts can look slick, professional, and entirely convincing — which is exactly what makes them dangerous. The good news is
How Passkeys Actually Work (in Plain English) Last week I wrote about passkeys — what they are, why the NCSC and GCHQ are telling us all to start using them, and what it means for organisations. The post got a lot of attention, and one comment in particular stuck with me. Someone asked: “Can we
Passwords Are on Their Way Out — Here’s What’s Replacing Them If you’ve been anywhere near the news this week, you might have spotted the head of GCHQ giving a fairly blunt message: stop using passwords and start using passkeys. It was part of a much bigger speech about cyber threats and national security, delivered
Passwords Are on Their Way Out — Here’s What’s Replacing Them Read More »
Having an ISO 27001 Certificate Doesn’t Mean Your ISMS Is Working The M&S story has been running for over a year now. The attack happened at Easter 2025, and this week the full-year figures landed: profits down 24%, with the cyber attack costing the business somewhere in the region of £300 million in lost operating
Having an ISO 27001 Certificate Doesn’t Mean Your ISMS Is Working Read More »
