Articles

Weeks two and three covered who's contacting you and what they're asking for. This week is about the surfaces you interact with directly, login screens, and AI tools, because both can now convincingly fake being trustworthy. This is increased if you are not managing your shadow AI risk. A “sign in with Microsoft” window with the right padlock and the right address can be a picture of one, drawn inside an attacker's page rather than a real browser window. Checking for the padl

Week two was about who's messaging you. This week is about what they're asking you to do, because even a genuinely-identified sender can carry a request that shouldn't be trusted at face value. The pattern behind most of this year's costliest fraud is familiar: an email in a thread you recognise, from a supplier you actually use, with an invoice that looks right in every detail except the account number. UK Finance recorded £576.4m lost to authorised push payment fraud last y

Week one asked you to prove things in general. This week gets specific: prove the sender. Whether it arrives as an email or a phone call, the identity attached to a message is the easiest part of it to fake, and the part most of us trust without checking. This is why phishing and vishing awareness is so important. On email, the display name is decoration. Anyone can type anything there; the real address underneath is what matters, and it's the part almost everyone skips, espe

Most awareness months fail by trying to cover everything. Here is a simpler way to run October: one habit, one short nudge a week, and a measure that tells you whether it worked.

Every October, security teams face the same problem: people already know what phishing is. Two thirds of us are confident we can spot a fake email. Fewer than half of us actually check it or report it. Eighty-three percent said last year's training was useful, and still didn't change what they do. That's not an awareness gap. It's a doing gap, and no amount of extra knowledge closes it.

AI governance is one part of a wider shift in UK and EU cyber regulation. Here's what's converging, what applies to whom, and how a Fractional CISO keeps it under control.

The two most expensive cyber events in British history didn't begin with clever code. On current public reporting, they began with conversations. That is the starting point for how we've built our Cyber Security Awareness Month 2026 theme, and it points somewhere quite different from the usual October checklist. The Cyber Monitoring Centre assesses the August 2025 attack on Jaguar Land Rover as the most economically damaging cyber event ever to hit the UK, around £1.9bn, with

Free online readiness assessments for cyber security, data protection, ransomware, PQC and AI governance. Instant scored report, no sales call.

ICA Consultancy turns nine this month. Here's what nearly a decade of advising organisations on security and privacy has actually taught us, including the things we got wrong. Anniversaries invite a certain kind of writing. The kind with a timeline, a photo of the team, and a paragraph about how proud we are of the journey. We are proud of it. But a list of our own milestones isn't much use to anyone reading this. So instead, 9 Security and Privacy lessons, one for each year.

Robust internal security controls mean little if a supplier, contractor, or AI-enabled technology partner is compromised. This guide explains how third-party risk management works in practice: assessing vendor risk, using trust centres to speed up due diligence, understanding AI and fourth-party exposure, and embedding contractual and operational controls into a proportionate framework.

Choosing between Cyber Essentials, ISO 27001, and SOC 2 Type II is one of the most common questions organisations face when building out their security programme. Each framework serves a different purpose and suits a different stage of maturity. This post breaks down what each certification actually covers, the genuine merits and challenges of pursuing it, and how the three relate to one another — so you can decide based on your risk profile and commercial needs, not a sales

Why Your Threat Landscape Matters Before an organisation can protect itself effectively, it needs to understand two fundamental things: what it needs to protect, and what it needs to protect it from. This sounds straightforward, but in practice many organisations invest in cyber security controls without a clear picture of their specific threat landscape. The result is often a mismatch between the risks they face and the defences they have in place. A threat landscape is esse

Five Eyes cyber security agencies — including the UK's NCSC, the NSA and CISA — have issued a joint statement warning that AI is reshaping cyber risk on a timescale of months, not years. The message is clear: AI cyber risk management is no longer a future consideration, it's a board-level priority now. This article breaks down what the agencies are actually saying, why cyber resilience is a business risk rather than just a technical one, and the practical steps leaders should

46% of small UK businesses were breached last year. 65% of medium businesses. Yet fewer than 4 in 10 have anyone at board level owning cyber security. Cyber criminals don't target the biggest organisations. They target the easiest ones. A Fractional CISO gives SMEs the strategic security leadership they're missing — without the full-time cost. Could one protect your business?

AI and Cyber Security: Cutting Through the Noise AI and Cyber Security has become one of those topics that can genuinely feel hard to get clarity on. Ask a security vendor and you'll hear about miraculous detection capabilities. Read the headlines and it's all deepfakes and autonomous hacking tools. Neither picture is quite accurate, and for most organisations, neither is particularly useful. Where we find the conversation most helpful is when it focuses on three practical qu

Every month, security teams run phishing simulations and produce similar reports: X% clicked, Y% submitted credentials, Z% reported. Leadership sees the numbers, nods, and moves on. But that surface-level read of phishing simulation metrics misses the most actionable intelligence sitting inside your campaign data. Here's what I mean. These metrics alone tells you almost nothing useful. A 12% click rate sounds bad. But what happens in the seconds after that click is where the

Post‑Quantum Cryptography (PQC) is moving from “future concern” to board‑level planning topic. Not because anyone needs to predict the exact arrival date of a cryptographically relevant quantum computer — but because cryptographic change is slow, cross‑cutting, and hard to rush.

by Ben de la Salle The G7’s coordinated roadmap for post-quantum cryptography (PQC) migration is a defining moment for financial services. This isn’t a technical bulletin for IT teams. It’s a strategic directive aimed at finance ministries, central banks, regulators, and systemically important institutions. The message is straightforward: migration will take years, and the work must start now. From technical debate to board-level obligation What distinguishes this roadmap fr

Crypto-agility is the foundation of a safe, phased move to post-quantum cryptography. Here’s how the NCSC’s UK roadmap to 2035 translates into practical steps—plus how ICA Consultancy’s Cryptgility services support awareness, governance and readiness.

Cyber security trends for 2026: AI arms race, deepfakes, quantum‑safe cryptography, cloud concentration risk, tightening regulations (NIS2, DORA), nation‑state threats and evolving ransomware. Practical actions for CIOs, CISOs and CROs to build resilience.

This FAQ explains what PQC is, why it matters now, and how your business can prepare, while also addressing key regulatory expectations and steps for building future-proof resilience.

Discover Santa’s hilarious yet practical cybersecurity tips for the holidays—phishing, data breaches, and incident response made festive!

Learn how to choose the right Managed Detection and Response (MDR) provider with our practical guide. Enhance your RFP success with MDR insights.

Why Security Leadership Matters, Even If You’re Not a Big Enterprise Cyber threats don’t discriminate by company size. Whether you’re a...