Insights and guidance
Cybersecurity and compliance articles.
Practical guidance on regulations, frameworks, and best practices relevant to UK businesses.
-
Windows 10 After 13 October 2026: Extended Security Updates, Cyber Essentials and the Cost of Standing Still
The first year of Microsoft's paid Extended Security Updates for Windows 10 ended on 13 October 2026. Business devices still on Windows 10 now receive security fixes only if Year Two has been bought, at double the Year One price. Without it they are unsupported, which fails Cyber Essentials and is exactly the weakness the ICO cited in its May fine against South Staffordshire.
Read article -
The Cyber Resilience Act's 24-Hour Clock: Vulnerability Reporting for UK Software Firms From 11 September 2026
Since 11 September 2026, manufacturers of software and connected products sold in the EU, including UK firms with no EU office, must report actively exploited vulnerabilities and severe incidents within 24 hours. The duty covers products already on the market. Here is who is caught and how to be ready.
Read article -
The EU AI Act on 2 August 2026: What Actually Applied After the AI Omnibus
The AI Omnibus, published on 24 July 2026, moved the EU AI Act's stand-alone high-risk obligations to 2 December 2027. Transparency duties under Article 50 and enforcement over general-purpose AI still applied on 2 August 2026. Here is what changed, what did not, and what UK organisations should do with the extra time.
Read article -
The Cyber Security and Resilience Bill and Your IT Provider: What Changes for UK Firms That Outsource IT
The Cyber Security and Resilience Bill passed its Lords second reading on 14 July 2026. Its biggest effect on ordinary UK businesses is indirect: medium and large managed service providers come under regulation, with a 24-hour incident notification duty and an obligation to tell affected customers. If you outsource IT, here is what to ask your provider now.
Read article -
The New Data Protection Complaints Duty: What Changed on 19 June 2026 and Why It Starts With Security
Since 19 June 2026, every UK organisation must give people a clear way to complain about how their personal data is used, acknowledge complaints within 30 days and report the outcome. The complaints that hurt most will follow security failures, so the duty is as much a security question as a compliance one.
Read article -
Shadow AI in UK Organisations: The Inventory Problem Nobody Has Solved
Most UK organisations have no idea which AI tools their employees use, what data flows to them, or what the vendor terms of service grant. The first step out of this is not a policy - it is an inventory.
Read article -
From Principles to Enforcement: Where UK AI Regulators Stand in Mid-2026
The UK chose a principles-based, sector-led path to AI regulation. Eighteen months in, the picture is no longer principles - it is enforcement signals from ICO, FCA, PRA, MHRA and SRA. Here is what each regulator actually expects today.
Read article -
The EU AI Act for UK Organisations: Extraterritorial Reach, August 2026 Milestones, and What To Do Now
UK organisations thought Brexit removed EU regulatory risk. The EU AI Act caught up with that thinking. Article 50 transparency obligations, GPAI rules and Commission enforcement powers all enter into force on 2 August 2026 - and the Act reaches UK organisations whose AI output is used in the EU.
Read article -
AI-Augmented BEC: Deepfakes, Look-Alike Domains, and the New Fraud Playbook
Business email compromise was already the most expensive cyber attack category by reported loss. AI has now industrialised the parts that used to fail - voice mismatch, language errors, time-to-target. Mid-market UK organisations need to update their controls or accept the new loss rate.
Read article -
The Hidden Cost of Fragmented IT Vendors: Why Mid-Market UK Organisations Are Consolidating
A typical 100-person UK organisation now runs 15 to 20 separate IT vendors. The licence spreadsheet looks under control. The integration debt, finger-pointing, and contract sprawl underneath it are not. There is a quieter cost than the line items.
Read article -
Cyber Security Breaches Survey 2026: Why Three in Four UK Businesses Still Have No Incident Response Plan
The government's Cyber Security Breaches Survey 2025/2026 finds 43% of UK businesses identified a breach or attack in the past year, yet only 25% have a formal incident response plan. For regulated firms, that gap decides whether an incident is contained or becomes a reportable failure.
Read article -
Cyber Essentials Changes on 27 April 2026: What Regulated UK Firms Must Fix Before Renewal
From 27 April 2026, Cyber Essentials assessments are judged against version 3.3 of the requirements and the new Danzell question set. Missing multi-factor authentication on a cloud service, or missing the 14-day patch window, becomes an automatic fail. Here is what to fix before your renewal.
Read article -
Cyber Essentials Certification: A Practical Guide for UK Businesses
The UK government's Cyber Essentials scheme is now a prerequisite for many public sector contracts. Here's what it covers, who needs it, and how to get certified efficiently.
Read article -
UK GDPR and Cybersecurity: What Boards Need to Know in 2026
UK GDPR places explicit obligations on organisations to implement 'appropriate technical and organisational measures' - which the ICO now interprets as including mature cybersecurity controls. Here's what that means for your board.
Read article
Free consultation
Ready to strengthen your security posture?
Book a free consultation with a senior consultant to discuss your cybersecurity posture and next steps.
Or call 020 3886 3001 or message us on WhatsApp.
What happens next
- 01You tell us briefly what has landed on your desk.
- 02We respond within one business day to arrange a time.
- 03A 30-minute call with a senior consultant, and an honest view of what to do first.