Cyber Security for CEOs: What Every Business Leader Needs to Know
David Pollock, Executive Chairman at CyberLab, on the cyber threat every business leader needs to take personally.
Most UK business leaders are not technologists. They are decision makers. With more than 30 years of experience leading technology businesses, David knows this better than most. And his view is clear: because cyber security can feel like a technical specialism, it drifts to the IT team’s desk rather than staying firmly on the board agenda. That has to change.
Recently, David sat down with CyberLab’s Sales Director Adam Myers to share what 30 years of building, buying, and leading businesses has taught him about cyber risk. His view is direct: cyber security is the single biggest threat.
Cyber Security is Your Number One Risk
The average data breach now costs a UK business £3.29 million, according to IBM’s 2025 Cost of a Data Breach Report. David does not treat that as a vendor statistic. It sits at number one on his personal risk register. He said:
“If you’re a chief exec running any company and cyber security is not number one on your risk list, you’re in danger of losing your job and, more importantly, losing the jobs of all your people.”
The DSIT Cyber Security Breaches Survey shows that 43% of UK businesses experienced a cyber security breach or attack in the last 12 months, yet many boards still treat it as an IT matter rather than a leadership priority.
As NCSC Chief Executive Richard Horne has stated: “Board members have a critical role in ensuring their organisations are able to exploit the opportunities that technology brings in such a way that they build a resilient and secure business.”
Cyber security belongs on the board agenda every single month. If it is not there, the organisation is carrying a risk that could end it.
Why Executives Are the Highest-value Target in Your Organisation
Senior leaders are not incidentally exposed to cyber risk. They are deliberately sought out.
Board members, NEDs and executives carry access to sensitive commercial plans, M&A data, strategic decisions, and wire transfer authority. NEDs operating across multiple companies expand that exposure still further. Criminals understand this and use publicly available information to build detailed profiles before making first contact.
The attack surface for a typical senior leader spans three dimensions:
- Professional: LinkedIn profiles, Companies House records, board bios, event appearances, conference talks, and media interviews. Every public appearance reveals seniority, relationships, and business context. It also provides voice and facial data that AI tools can use to create convincing impersonations.
- Personal: Family members as pivot points – children visible on Instagram, a spouse’s public profile. Information that builds a fuller picture and creates leverage.
- Physical: Home address exposure through property records, electoral roll entries, and domain registration data.
Before you can manage your executive risk exposure, it helps to know what is already out there. HackRisk is CyberLab’s external attack surface monitoring platform. It scans your public-facing assets, monitors the dark web for exposed business credentials, and identifies vulnerabilities across your digital estate – delivered as a board-ready report with a risk score and remediation advice.
When the Chairman Got Caught: What a Phishing Simulation Revealed
David Pollock knows executive vulnerability first-hand. His security team ran a phishing simulation within his own business, sending an email designed to look like a post-Christmas party message from his colleagues. David clicked it.
“I was on the phone immediately going, ‘they’ve got me’,” and they went, ‘don’t worry, we’ve got three layers of security, we can protect you’.”
Two things stand out in that story. First: if the Chairman of a cyber security company can be caught in a controlled simulation, any executive can be caught in a real attack. Second: what made the difference was not just the layered technical defences. It was the culture of transparency. David reported it immediately, and the right systems were in place to contain the damage.
This is precisely why regular phishing simulations matter. They are not designed to embarrass people. They build the muscle memory of recognising and reporting suspicious communications before a real attacker uses the same technique.
“It is the first line of defence in protecting your organisation, teaching your people not to get caught. We all get caught. But the more you are trained, the better your defences become.”
How AI Has Changed Executive Impersonation
Phishing emails are only part of the picture. AI has made the threat to senior leaders significantly more dangerous by enabling attacks that were not possible even two years ago.
Voice cloning now requires as little as three seconds of audio – the kind that is readily available from a conference talk, a podcast appearance, or a LinkedIn video. Voice cloning fraud increased by 700% between 2024 and 2025 (Source: CallerCheck). The average loss per victim is £11,000. In one documented UK energy sector case, a company lost £200,000 to a deepfake audio attack.
The landmark case is Arup (2024). A finance employee received an email from someone purporting to be the UK-based CFO, requesting a series of confidential transactions. Initially suspicious, the employee felt reassured after joining a video call where the CFO and several colleagues appeared on screen. They then made 15 transactions totalling $25 million. Every other person on that call was an AI deepfake. (Source: World Economic Forum).
This type of attack falls under the broader category of Business Email Compromise (BEC) and CEO fraud. According to the FBI’s Internet Crime Complaint Centre, BEC fraud has caused more than $50 billion in global losses. Closer to home, the M&S breach of 2025 was confirmed by its CEO as “a consequence of human error” carried out through “social engineering tactics via a third-party supplier” rather than a failure of technical systems.
Most attacks exploit trust, not code. The attack vectors are email, phone or SMS, and social media. AI has made all three harder to detect and easier to execute at scale.
How to Spot CEO Fraud Before It Lands
Knowing the warning signs is the first layer of defence. When a request arrives by email, WhatsApp, Teams, or phone that combines several of the following, stop and verify before acting:
- A senior leader contacts you via an unusual number or method.
- The request is urgent, with a tight deadline.
- The situation is sensitive or confidential: a merger, a tax issue, a late payment, an accounting error.
- A third party is involved.
- You are asked to make an immediate payment or transfer outside normal processes.
- On a video call: limited facial movement, or audio with an unusual tone or rhythm.
The pattern to recognise is: urgency, plus authority, plus an unusual request. That combination should always prompt a call back on a known, separate number before any action is taken.
Practical Steps to Protect Yourself and Your Organisation
The following controls come from CyberLab’s executive security workshops and Sophos threat intelligence guidance. Many are low-cost. All are high-impact.
Personal actions:
- Use a password manager. Password length matters more than complexity – three random words you can remember is an effective approach.
- Enable Multi-Factor Authentication (MFA) on all accounts. Never approve an MFA prompt you did not initiate.
- Use a VPN on personal devices, particularly when travelling or working in public spaces.
- Keep all software updated across personal and work devices.
- Tighten privacy settings on personal social media to reduce your publicly visible attack surface.
Business controls:
- Implement verbal confirmation codes for any wire transfer or unusual payment instruction.
- Require dual authorisation for all financial transactions above a defined threshold.
- Establish a clear protocol: always call back on a known direct number before approving anything out of the ordinary.
- Never bypass financial controls on the basis of urgency, regardless of who appears to be requesting it.
- Train staff on voice cloning and deepfake fraud, not just traditional phishing.
- Run regular phishing simulations so your team develops recognition through practice, not theory.
Find Out What Data is Already Exposed About You
Most executives assume their business’s external exposure is something IT keeps on top of. In most cases, no one is actively checking. Before making contact, criminal groups map your public-facing assets, search for misconfigured systems, and check the dark web for credentials exposed in past breaches – all before a single message is sent.
HackRisk is CyberLab’s external attack surface monitoring platform. It scans your public-facing assets, monitors the dark web for exposed credentials, and identifies vulnerabilities across your digital estate. You receive a board-ready risk report within 24 hours, with a risk score and prioritised remediation advice – so you can see exactly where you are exposed before an attacker does.
How CyberLab Supports Business Leaders on Cyber Security
- We support 1,200+ UK organisations with their cyber security strategy, from foundational controls through to advanced threat detection.
- Our social engineering and phishing simulation programmes are built to change behaviour, not satisfy compliance checklists.
- Our tabletop exercises prepare leadership teams for real scenarios, including deepfake and impersonation attacks on executives.
- Our M365 Security Assessment identifies which controls are active, which are not, and where to focus first across the Microsoft stack.
- Our consultancy team works directly with leadership and board teams to frame cyber risk in business language.
- We are CREST-, CHECK- and NCSC-accredited, with 30+ years of combined expertise and over 1,500 Cyber Essentials and Cyber Essentials Plus certificates issued.
Start the Conversation
Cyber security does not require a technical background. It requires leadership. If you want a clearer picture of your organisation’s risk exposure – or your own personal exposure as a senior leader – CyberLab’s team can help, in plain language and without the jargon.
CyberLab is a CREST-, CHECK- and NCSC-accredited cyber security partner trusted by 1,200+ UK organisations.
How CyberLab Delivered Sophos Taegis MDR to East Lothian Council
Building Modern Security Operations for the Public Sector with Sophos Taegis MDR
Public sector organisations are under unprecedented pressure to defend critical services against an evolving threat landscape, while operating within tight budgets and complex legacy environments. Traditional security operations models often fall short. East Lothian Council partnered with CyberLab to change that.
This success story explores how a leading Scottish local authority modernised its security operations capability with Sophos Taegis Managed Detection and Response (MDR), delivered and supported by CyberLab, to gain 24/7 threat visibility, faster incident response, and the operational predictability that public sector finance and service delivery demand.
Why the Public Sector Is a Prime Target for Cyber Threats
UK public sector organisations remain a high-value target for cyber criminals and nation-state threat actors.
The reasons are well documented:
- They hold vast amounts of sensitive personal data on residents, staff and service users.
- They deliver essential services where downtime has real-world consequences for communities.
- They operate complex digital estates with significant legacy infrastructure.
- They face increasing regulatory expectations under NCSC guidance, the Network and Information Systems Regulations, and sector-specific frameworks.
At the same time, public sector cyber security teams are routinely stretched. Recruiting and retaining specialist security analysts is difficult, particularly in regions outside major commercial hubs. Building a 24/7 internal Security Operations Centre is rarely viable, either operationally or financially. This combination of high target value and limited internal resource makes Managed Detection and Response one of the most effective ways for local authorities to elevate their security posture quickly and sustainably.
About East Lothian Council
East Lothian Council is the Scottish local authority responsible for delivering essential public services across East Lothian, supporting thousands of residents, communities and businesses. As part of its ongoing digital transformation programme, the council operates a growing and increasingly interconnected digital estate, with a clear commitment to maintaining service availability, protecting sensitive information and upholding public trust.
As cyber threats targeting the public sector have grown in sophistication, the council recognised that traditional perimeter-based defences were no longer sufficient. A modern, proactive security operations capability was required to keep pace with the threat landscape and protect the critical services East Lothian residents rely on every day.
The Business Challenge: Visibility, Speed and Operational Readiness
Before partnering with CyberLab, East Lothian Council had a clear set of operational priorities. The council needed to enhance its ability to detect, investigate and respond to cyber threats around the clock, across a diverse and complex IT environment.
The specific challenges were:
- Real-time visibility of malicious activity across the entire digital estate.
- Faster response capability to potential threats, with reduced time from detection to containment.
- Always-on security operations, beyond the working hours of an internal IT team.
- Speed of procurement and implementation, with the ability to assess, procure and deploy an advanced MDR solution within short timescales.
- A partner with deep public sector understanding, capable of supporting rapid deployment without disrupting essential services.
- Predictable total cost of ownership, with clear and consistent budgeting for long-term security operations.
The council needed a solution that elevated its threat monitoring and incident response capability, while respecting the unique operational and financial constraints of a local authority.
Why Sophos Taegis MDR Was the Right Fit for the Public Sector
Working closely with the council’s security and infrastructure team, CyberLab assessed the available Managed Detection and Response options against East Lothian Council’s specific requirements. Sophos Taegis MDR was selected as the foundation for the council’s modernised security operations capability for several reasons.
First, it delivers true 24/7 threat detection, investigation and response. Sophos security analysts work alongside CyberLab’s team to monitor activity continuously, investigate alerts at depth, and contain threats before they escalate. For a local authority that cannot staff an internal SOC around the clock, this is transformative.
Second, Sophos Taegis MDR delivers something traditional SOC and SIEM-based models often fail to provide: budget certainty. Many MDR or SIEM solutions are priced on data ingestion or consumption, leaving organisations exposed to unpredictable costs as activity grows. Taegis MDR offers a predictable total cost of ownership, with no ingestion tuning, no SIEM build complexity, and no surprise charges. For public sector finance teams managing fixed annual budgets, that predictability is essential.
Third, Sophos Taegis integrates broadly with existing security tools, helping the council maximise the value of investments already made and avoid wholesale replacement of working technology.
The CyberLab Approach
CyberLab supported East Lothian Council through every stage of the project, combining technical expertise with a deep understanding of public sector procurement, governance and operational realities.
Rapid Procurement and Proof of Concept
The council operated under a short procurement window. CyberLab accelerated the process through a structured proof of concept, demonstrating Taegis MDR’s capability against the council’s specific environment and use cases. This allowed informed decision-making at pace, without the delays often associated with public sector technology procurement.
Deployment and Configuration
Once selected, CyberLab fully deployed and configured Sophos Taegis MDR across the council’s environment. Integration was tailored to the council’s existing security tools, maximising coverage while avoiding duplication of capability.
Seamless Onboarding
Public sector environments cannot tolerate operational disruption. Schools, social care, planning, refuse collection and dozens of other critical services depend on the digital estate. CyberLab designed the onboarding process to be seamless, transitioning the council into a fully managed MDR operation without interruption to live services.
Ongoing Strategic Support
Beyond deployment, CyberLab continues to provide strategic support and guidance tailored to public sector challenges. The relationship is consultative by design, with CyberLab acting as an extension of the council’s internal security team rather than a transactional vendor.
The Outcome: Greater Confidence, Stronger Defences
The implementation of Sophos Taegis MDR has materially strengthened East Lothian Council’s security operations capability. With real-time threat insights, expert analyst guidance and streamlined incident response, the council can focus on delivering essential services with greater confidence.
The key outcomes the council has realised include:
- Improved threat visibility, providing deeper situational awareness across the digital estate.
- Increased confidence in response capability, supported by expert MDR analysts working 24/7.
- Rapid and effective deployment, enabling operational protection in a short timeframe.
- Reduced operational strain, with CyberLab acting as an extension of internal security staff.
- Proactive vigilance and early threat identification, strengthening the council’s overall security posture.
- Predictable long-term operational costs, providing the budget certainty public sector teams need.
The partnership has enabled East Lothian Council to modernise its approach to security operations and adopt a robust, future-ready MDR foundation that supports a more resilient digital infrastructure for the communities it serves.
In the Council’s Own Words
“East Lothian Council has been working closely with CyberLab to strengthen our security operations capability. Their support in implementing Sophos Taegis as our managed detection and response solution provided significantly improved visibility of threats across our environment and increased confidence in our ability to respond swiftly and effectively.
The procurement process and proof of concept were progressed at an impressive pace, with CyberLab able to facilitate rapid turnaround and accommodate short-notice requirements without disruption. They provide added value through proactive vigilance, consistently practical support, and a genuine understanding of local authority challenges.
CyberLab’s team have been responsive, knowledgeable and easy to work with throughout. Their expertise, combined with the capabilities of the Sophos Taegis MDR platform, has delivered tangible improvements to our overall security posture.”
– Graham Burke, Security and Infrastructure Manager, East Lothian Council
Key Takeaways for Public Sector Leaders
For council CIOs, Heads of IT and security leaders considering how to elevate their security operations:
- MDR removes the need to build an internal SOC, giving public sector teams 24/7 capability without the recruitment burden.
- Predictable pricing matters. Avoid consumption-based MDR models that expose council budgets to unpredictable variance.
- Procurement speed is achievable. With the right partner, even complex MDR deployments can be assessed, procured and operational quickly.
Public sector understanding is essential. Choose a partner who understands legacy environments, service availability constraints, and the realities of local government operations.
How CyberLab Supports the Public Sector
CyberLab works with local authorities, NHS Trusts, central government departments and public sector institutions across the UK.
Our support spans:
- Managed Detection and Response through Sophos Taegis MDR and our Security Operations Centre service.
- Cyber Essentials and Cyber Essentials Plus certification, with over 1,500 certificates issued.
- Penetration testing and red teaming through our CREST and CHECK-approved testing teams.
- Strategic cyber security consultancy as an NCSC Cyber Advisor.
- Long-term partnership and ongoing support, tailored to the operational realities of public sector teams.
We’re trusted by over 1,200 organisations, including more than 60 NHS Trusts, to protect what matters most. Our approach combines technical rigour with practical, hands-on support, helping public sector organisations build modern, resilient security operations that scale with their needs.
Ready to Modernise Your Security Operations?
If you’re a public sector leader looking to strengthen your security operations capability, CyberLab can help.
As an experienced Sophos partner and trusted public sector advisor, we deliver the visibility, response capability and operational predictability that local authorities, NHS Trusts and government departments need.
CyberLab is a CREST-, CHECK- and NCSC-accredited cyber security partner trusted by 1,200+ UK organisations.
CyberLab Named Sophos Public Sector Partner of the Year 2026
CyberLab Named Sophos Public Sector Partner of the Year 2026 and Achieves Sophos Titanium Partner Status
CyberLab today announced it has been named Sophos Public Sector Partner of the Year 2026, and has achieved Titanium Partner status in the Sophos Partner Program. The two recognitions, awarded back to back, mark a significant milestone in CyberLab’s long-standing partnership with Sophos and confirm CyberLab’s position as one of the UK’s leading cyber security partners for public sector organisations.
Together, the award and the Titanium tier recognise CyberLab’s consistent performance, deep technical expertise, and proven track record of delivering measurable security outcomes for customers across the NHS, central government, local authorities, and the wider UK public sector.
A Double Recognition for CyberLab and Sophos
The Sophos Public Sector Partner of the Year award celebrates the partner that has had the greatest impact on protecting public sector organisations over the past year. Titanium is the highest tier of the Sophos Partner Program, reserved for a select group of partners who demonstrate the deepest commitment, capability and customer outcomes across the Sophos portfolio.
CyberLab now sits in both groups: recognised for excellence in a single sector, and elevated to top-tier status across the partnership as a whole.
CyberLab supports more than 60 NHS Trusts and works alongside central government, blue light services, local authorities and the higher education sector. Sophos technology, delivered as a managed service by CyberLab’s UK consultancy team, underpins much of that work.
Sophos Public Sector Partner of the Year 2026
The Public Sector Partner of the Year award recognises the partner that has delivered the strongest outcomes for UK public sector organisations over the past twelve months. The judging criteria considered the breadth and depth of customer protection, the technical sophistication of the deployments delivered, and the partner’s ability to convert Sophos technology into measurable defensive value for the organisations they support.
Public sector cyber security is uniquely demanding. The threat landscape is unrelenting, budgets are tight, and the cost of a successful attack is borne by patients, citizens and frontline services, not just by an IT function. CyberLab’s award win recognises a year of work delivered against that backdrop, including incident response engagements, managed detection and response rollouts, penetration testing programmes and Cyber Essentials certifications across the public sector.
“Winning Sophos Public Sector Partner of the Year is recognition of the work our team puts in every day to protect public sector organisations across the UK. It is not easy. The threat landscape does not stop, budgets are tight, and the stakes are high.
Our partnership with Sophos goes beyond reselling, and this award reflects that. At CyberLab, our mission is protecting the nation, business and people, and this is exactly what that looks like in practice. I could not be prouder of what the CyberLab team has achieved.”
– Gavin Wood, CEO at CyberLab
Sophos Titanium Partner Status
Alongside the award, CyberLab has been elevated to Titanium Partner status in the Sophos Partner Program. The Sophos Titanium tier is reserved for a select group of partners who demonstrate consistent performance, deep technical expertise, and a strong track record of delivering impactful security outcomes for customers.
As a Titanium Partner, CyberLab gains enhanced alignment with Sophos on strategic opportunities, access to advanced resources, and recognition as a top-performing partner within the Sophos ecosystem. For CyberLab customers, that translates into tighter engineering alignment with the Sophos product and threat-intelligence teams, prioritised access to new capabilities, and a more direct route into Sophos’s elite incident response and managed detection and response services.
“Recognizing partners who consistently deliver exceptional value to customers is central to our partner strategy. Our Titanium partners represent the highest level of commitment, expertise, and performance, and we’re proud to work alongside CyberLab to help organizations strengthen their cybersecurity posture and achieve better outcomes.”
– Chris Bell, Senior Vice President of Global Channel, Alliances and Corporate Development at Sophos
What This Means For Our Customers
The combined effect of the award and the Titanium tier is straightforward: CyberLab customers benefit from a closer, deeper and more responsive relationship with Sophos.
In practice, that means:
- Faster routes into Sophos MDR. Sophos’s Managed Detection and Response service is built on a 24/7 elite analyst team backed by Sophos’s threat-intelligence capability. CyberLab Titanium status gives customers a more direct line into that service, including expedited onboarding and tighter integration with CyberLab’s UK consultancy team.
- Deeper engineering alignment. Titanium partners work more closely with Sophos product and engineering teams on capability roadmap, threat hunting techniques, and customer-specific deployment patterns.
- Recognised public sector specialism. Public sector customers benefit from a partner that Sophos has formally recognised as the leading delivery team in that sector. This matters when the threat actor is sophisticated, the data sensitive, and the deadline tight.
- A broader Sophos portfolio, delivered as a managed service. CyberLab delivers the full Sophos portfolio, from endpoint and firewall through to email security and managed detection and response, wrapped in CyberLab’s own UK-based consultancy and 24/7 support function.
How CyberLab Partners with Sophos
CyberLab’s relationship with Sophos goes far beyond reselling. CyberLab delivers Sophos technology as a fully managed cyber security service, supported by an in-house team of CREST-, CHECK- and NCSC-accredited consultants.
That includes:
- Sophos MDR: 24/7 managed detection and response, delivered with Sophos’s global analyst team and overlaid with CyberLab’s UK consultancy.
- Managed Security Support: ongoing health, tuning and posture management of the Sophos estate.
- Posture Assessment: independent assessment of how well a Sophos deployment is configured against current threats.
- Penetration Testing and Red Teaming: validation of how a Sophos-protected estate stands up under realistic adversarial pressure.
- Consultancy: strategic advisory on architecture, migration and ongoing operations.
This combination of accredited consultancy, managed service, and a top-tier vendor partnership is what sits behind the Public Sector Partner of the Year award and the Titanium tier.
How CyberLab Supports UK Public Sector Cyber Security
CyberLab is one of the UK’s most experienced cyber security consultancies in the public sector.
Specifically:
- We support more than 60 NHS Trusts across the UK
- We are a CREST-, CHECK- and NCSC Cyber Advisor-accredited consultancy.
- We are an IASME-approved certification body for Cyber Essentials and Cyber Essentials Plus, with more than 1,500 certificates issued to UK organisations.
- We provide managed detection and response on Sophos MDR, backed by a UK-based service team.
- We deliver hands-on penetration testing, red teaming, posture assessment and incident response.
- We work directly with public sector procurement frameworks and understand the operational realities of frontline services.
The award and the Titanium tier are independent recognitions of that work, awarded by the vendor whose technology underpins much of it.
“We needed to find a way to meet very tight budget constraints. Of the suppliers we spoke to, only CyberLab demonstrated what we felt was a genuine desire to engage with us to reach a workable solution for both parties. I’d recommend CyberLab not just for their expertise in the whole cyber security area, but for their personalised and professional approach.”
– Mark Smith, Server Support Manager at Nottingham City Council
Ready to Talk to an Award-Winning Sophos Partner?
CyberLab is a CREST-, CHECK- and NCSC-accredited cyber security partner trusted by more than 1,200 UK organisations. With the Sophos Public Sector Partner of the Year 2026 award and Sophos Titanium Partner status, CyberLab is now formally recognised as one of the top Sophos partners in the country and the leading Sophos partner in the UK public sector.
If your organisation runs Sophos, is considering Sophos, or simply needs a stronger managed detection and response capability, we would like to hear from you.
How CyberLab Executed Targeted Attack Simulations in Financial Services
Simulating Real‑World Attacks to Strengthen Financial Services Security
Financial services organisations operate in one of the most heavily targeted sectors globally. As threat actors continue to evolve their tactics, techniques and procedures, traditional security testing alone is no longer enough to provide confidence.
This case study explores how a leading UK financial services organisation partnered with CyberLab to validate its cyber defences through Red Teaming and targeted attack simulations, providing real‑world assurance that security controls, people and processes could withstand modern attack techniques.
Why Financial Services Are Prime Targets
Banks, lenders, building societies and financial services providers remain highly attractive to cyber criminals and advanced threat actors due to:
- High‑value financial data and assets
- Complex, interconnected digital environments
- Strict regulatory and compliance requirements
- Heavy reliance on customer‑facing digital services
Attackers increasingly combine technical exploitation with social engineering, targeting both systems and people. This makes realistic attack simulation a critical component of modern Cyber Security strategy.
About the Organisation
The organisation is a leading UK financial services provider, serving thousands of customers and members nationwide. Operating within a highly regulated environment, it has built a strong reputation based on trust, service excellence and regulatory compliance.
As part of an ongoing digital transformation programme, the organisation recognised that maintaining a resilient Cyber Security posture was essential to protecting customer data, financial assets and brand reputation.
To gain independent assurance of its security maturity, the organisation engaged CyberLab to conduct advanced offensive security testing aligned to real‑world attack scenarios.
How Are Cloud Services Treated Under the Updated Cyber Essentials Requirements?
The Business Challenge Financial services organisations face a dual challenge: enabling digital innovation while ensuring robust protection against increasingly sophisticated threats.
This organisation operated several business‑critical systems, including:
- Customer‑facing web and mobile banking platforms.
- Internal systems supporting lending and mortgage processes.
- Externally exposed infrastructure supporting digital services.
Any compromise could have resulted in:
- Unauthorised access to sensitive customer data.
- Operational disruption.
- Regulatory scrutiny and financial penalties.
- Long‑term reputational damage.
The organisation needed confidence that its preventative, detective and responsive controls would perform effectively under real attack conditions.
Why Red Teaming Matters in Financial Services
Unlike traditional penetration testing, Red Team exercises simulate the behaviour of genuine threat actors over an extended period.
For financial services organisations, Red Teaming helps to:
- Validate security controls across people, process and technology
- Test detection and response capabilities, not just prevention
- Identify gaps that only emerge during multi‑stage attacks
- Provide evidence of security maturity to regulators and stakeholders
This approach supports regulatory expectations around resilience, continuous improvement and proactive assurance.
The CyberLab Approach
CyberLab delivered a multi‑layered offensive security engagement, tailored to the organisation’s threat profile and risk priorities.
Red Team Exercise >
A multi‑week Red Team exercise simulated advanced attack techniques commonly used against financial institutions.
This included:
- Open‑source intelligence gathering
- Targeted spear‑phishing campaigns
- Assessment of user awareness and susceptibility to social engineering
- Attempts to gain initial access and escalate privileges
The objective was to mirror real‑world attacker behaviour and assess how effectively the organisation could prevent, detect and respond to an active threat.
External Infrastructure Testing >
CyberLab specialists conducted penetration testing across the organisation’s externally exposed infrastructure, assessing:
- Network‑level weaknesses
- Misconfigurations Vulnerabilities that could be exploited for unauthorised access
This testing helped identify technical gaps that attackers could leverage as entry points into the environment.
Web and Mobile Application Testing >
In‑depth testing of customer‑facing web and mobile applications was performed, aligned to the OWASP Top 10 where applicable.
Testing focused on:
- Authentication and authorisation controls
- Application logic flaws
- Data handling and exposure risks
Both automated and manual techniques were used to uncover issues that could impact customer trust and service availability.
The Outcome
The targeted attack simulation provided the organisation with clear, independent validation of its Cyber Security controls and overall resilience.
Key Outcomes
Validation of Cyber Security Controls
The organisation gained assurance that existing controls could defend against realistic attack scenarios.
Identification of Vulnerabilities
Technical and human‑centric weaknesses were identified, including areas susceptible to social engineering and control gaps that required attention.
Enhanced Security Posture
Actionable findings enabled targeted improvements to defensive controls, monitoring and incident response capabilities.
Clear Remediation Guidance
Comprehensive reporting provided prioritised recommendations, allowing efficient and effective remediation aligned to risk.
Key Takeaways for Financial Services Leaders
- Red Teaming provides insight that traditional testing cannot
- People remain a critical attack vector alongside technology
- Regulators increasingly expect evidence of realistic testing
- Continuous offensive testing supports long‑term resilience
Conclusion
Through an ongoing partnership with CyberLab, this financial services organisation continues to take a proactive approach to Cyber Security.
Regular Red Teaming and offensive testing enable the organisation to adapt to an evolving threat landscape, strengthen defences year on year and maintain the trust of customers and stakeholders.
By combining deep financial services expertise with real‑world attack simulation, CyberLab helps organisations protect what matters most: their people, their data and their reputation.
Ready to Explore Red Teaming?
If you want to understand how Red Teaming or targeted attack simulations could strengthen your organisation’s Cyber Security posture: Speak to a CyberLab expert today.
Cyber Essentials May 2026 Update: What Businesses Need to Do to Pass Danzell
What the Cyber Essentials Requirements for IT Infrastructure v3.3 and the Danzell Standard Mean for Your Business
Cyber Essentials continues to evolve to reflect the realities of modern Cyber Security. From 27 April 2026, all new Cyber Essentials assessments are being assessed against Danzell (The new IASME standard based on Requirements for Infrastructure v3.3), introducing more rigorous expectations around cloud security, authentication and patching.
This update is more than a routine refresh. It reflects how organisations now operate, with cloud first services, remote working and increasingly sophisticated commodity threats firmly in scope. For businesses planning certification or renewal after May 2026, understanding these changes early is essential.
This guide breaks down what has changed and, more importantly, what practical steps organisations should take to remain compliant and resilient.
We’ve awarded over 1,500 Cyber Essentials and Cyber Essentials Plus accreditations
Why is Multi Factor Authentication now an automatic failure requirement under Cyber Essentials Danzell?
One of the most significant changes in the Danzell standard is the automatic failure of Multi Factor Authentication when not enabled if available.
Where MFA is supported, whether it is free, bundled or paid for, it must be enabled for all users. Failure to do so will now result in an automatic fail.
What this means in practice
Organisations must:
- Audit all user accounts across email, cloud platforms and administrative portals
- Enable MFA consistently, including for privileged and administrative users (where separate accounts should be in place)
- Remove legacy authentication methods that bypass MFA
This change improves accountability and dramatically reduces the risk of credential based attacks, which remain one of the most common causes of breaches.
How are Cloud Services treated under the updated Cyber Essentials requirements?
Under Danzell a new definition has been added ‘any cloud service that stores or processes organisational data is now in scope’. This removes previous ambiguity around excluding Software as a Service platforms.
Practical considerations for business
You should now:
- Ensure a complete inventory of cloud services in use and maintained in accordance with the updated definition
- Apply Cyber Essentials controls consistently against the updated inventory
- Ensure access controls, MFA, firewalls, malware protection and patching responsibilities are clearly defined with suppliers.
This change reflects how critical cloud services have become to day to day operations and ensures security controls keep pace.
What do the new Cyber Essentials scoping rules mean for devices and services?
The previous concepts of “untrusted” or “user initiated” devices have been removed.
The new rule is straightforward: If a device or service owned by the organisation connects to the internet, or manages internet connected data, it is in scope.
Why this matters
This clarity reduces misinterpretation during assessments and ensures organisations take a more holistic view of their environment. Laptops, mobile devices, servers and cloud platforms should all be considered equally when applying controls. BYOD devices should also not be forgotten when accessing organisational data or services.
All legal entities applying must be listed on your Cyber Essentials application.
Can I exclude systems?
Excluded networks must be clearly detailed in new Danzell scoping statements for any partial scope assessments.
How have Application Development requirements changed in Cyber Essentials v3.3?
The scope formerly referred to as “Web Applications” has now evolved into Application Development.
This aligns Cyber Essentials with the UK Government’s Software Security Code of Practice, increasing focus on:
- Secure coding principles
- Timely patching of applications and frameworks
- Managing vulnerabilities throughout the development lifecycle
Guidance for development teams
Organisations involved in application development should:
- Document secure development practices
- Keep third party libraries up to date
- Demonstrate how vulnerabilities are identified and remediated
- This change reinforces that security must be built in, not bolted on
Why is Passwordless Authentication being encouraged by Cyber Essentials?
While not yet mandatory, the Danzell standard actively promotes passwordless authentication such as passkeys and FIDO2 authenticators.
Why organisations should take notice
Passwordless authentication:
- Reduces reliance on weak or reused passwords
- Improves user experience without sacrificing security
- Aligns with the long‑term direction of secure identity management
Adopting passwordless methods now can simplify future compliance and strengthen overall security posture. For further information IASME guidance should be consulted.
What are the changes for Cyber Essentials Plus under Danzell?
No selective remediation:
Sample 1: If high or critical vulnerabilities are detected by the approved scanning tool in the first sample – a mandatory retest (scanning) with new sampled devices is required (Sample 2).
Sample 2: Random sample of devices which had detected vulnerabilities (high or critical) older than 14 days. If the same vulnerabilities are detected as those from Sample 1 a CE+ fail report is issued and CE certificate revoked by IASME.
- If new or different high or critical vulnerabilities (older than 14 days) are detected this will result in an advisory being noted on the CE+ report and a CE+ Pass awarded.
Assessment rules:
Point in time assessment: All version and system information must be supported and meeting the criteria on the certificate issue date.
- Systems must be supported on certificate issue date, not just submission date.
- Version information should be within the 14-day window for patching if build numbers are provided.
Director declaration: now includes ongoing compliance responsibility.
What are the new Backup and Recovery expectations under Cyber Essentials v3.3?
Whilst not required, backup and recovery have received increased emphasis but are highly recommended by IASME.
Organisations should ensure that backups are:
- Robust and documented
- Protected from unauthorised access
- Regularly tested to ensure recovery is achievable
- If automatic backups are available, you should consider turning them on.
Practical steps to take:
Businesses should review:
- Backup frequency and retention policies
- Offline or immutable backup options
- Evidence of routine restore testing
This ensures organisations are better prepared to recover from ransomware or other disruptive incidents.
When does the Cyber Essentials Danzell standard come into effect and what is the deadline?
There is a critical timing consideration for organisations planning certification.
- Assessments set up before 27 April 2026 will follow the previous Willow standard
- Assessments initiated on or after this date must comply with Danzell Standard
For some organisations, this presents a short‑term opportunity. For most, however, preparing for the new requirements is the more sustainable approach.
How can organisations prepare for Cyber Essentials certification after May 2026?
The Danzell update raises the bar, but it also brings clarity. Organisations that take a proactive approach will find that these changes not only support compliance but meaningfully improve resilience.
Key preparation steps include:
- Reviewing MFA and account separation coverage across all systems
- Bringing all cloud services into scope
- Rigorous system wide patching in line with 14-day requirements, implementation of patching tools
- Updating asset inventories and scoping assumptions
- Strengthening backup and recovery processes
- Aligning development practices with secure coding standards
- Mobile device management for both organisation owned devices and BYODs is strongly advised.
How can CyberLab support your Cyber Essentials journey post-May 2026?
Navigating updated Cyber Essentials requirements can be complex, particularly for organisations with growing cloud environments.
CyberLab supports businesses through:
- Cyber Essentials readiness assessments
- Practical remediation guidance
- Ongoing Cyber Security strategy aligned to evolving standards
If you are planning Cyber Essentials certification or renewal after May 2026, now is the right time to act.
Get Cyber Essentials Certified
Show your commitment to cyber security and reduce risk by gaining Cyber Essentials certification – the UK government-backed standard for defending against common threats.
As an IASME-approved assessor for Cyber Essentials and Cyber Essentials Plus, we make the process simple with tailored options to suit your technical capability and business needs.
Join over 120,000 organisations already certified and take the first step towards stronger security today.
How Not To Hit The Headlines in 2026: What Recent Breaches Have Taught Us
What Recent Breaches Teach Leaders about Modern Cyber Risk
In 2025, we saw some of the most recognisable brands in the UK and beyond hit the headlines for all the wrong reasons.
Cyber attacks cost the British economy billions each year and the impact is felt far beyond the organisations that fall victim. When a major business is disrupted, the ripple effects reach suppliers, partners, and entire sectors of the economy.
In a recent webinar, Sales Director Adam Myers was joined by CTO Ryan Bradbury to unpack four major breaches – Marks and Spencer, Co-op, Jaguar Land Rover and Oracle – and what they reveal about the evolving threat landscape.
For IT leaders, CISOs and boards, the lessons are clear; cyber security resilience in 2026 is not just about the right tools; it is about removing blind spots, strengthening human behaviour, and maintaining continuous visibility.
When Trust Assumptions Break, Attackers Walk Straight in
Across all four incidents, one shared truth stood out. Attackers are not only trying to force their way through hardened perimeters, they are also exploiting small gaps in identity, communication, and process.
Rather than relying on malware or brute force, threat actors impersonated employees, targeted pressured help desk teams, and leveraged stolen credentials. These tactics work because they exploit human behaviour and the real-world pressures teams face.
For leaders, this reinforces the importance of a cyber security culture where teams feel confident to pause, challenge and verify – and where processes are stress tested, not just documented.
1. Marks and Spencer: Social Engineering at Scale
Generative AI is changing the game. Is it helping defenders more than attackers? Dive into the risks, opportunities, and real-world impact of AI on cyber security.
Dave Mareels, Senior Director of Product Management at Sophos, joins the podcast to explore how generative AI is reshaping the cyber threat landscape.
2. AI and Human Defenders Working Together
The April 2025 M&S breach began with attackers impersonating employees to a third-party IT provider. Attackers acquired passwords through social engineering, bypassing normal checks, and enabling them to move laterally to access data before launching ransomware.
This incident highlights a reality many leaders recognise. Even with the right technical controls are in place, people under pressure can unintentionally override them. It is why traditional one-off training is no longer enough.
Organisations now need continuous security awareness programmes, realistic phishing simulations, and tabletop scenario testing to prepare teams for high-pressure decisions.
Cyber Security Tabletop Exercises
Turn incident response planning into a focused, hands‑on exercise.
Combine a posture assessment with phishing simulations, Live Hack demo, and a HackRisk.ai scan in an engaging tabletop session for your leadership team – followed by an executive‑ready report and action plan.
Not role‑play. Real data. Real insight.
2. Co–op: When a Pattern Becomes a Playbook
Just weeks later, Co-op faced a near identical social engineering breach. Attackers reused the same techniques because, simply, they work. This reflects a broader trend where criminal groups increasingly share successful approaches, leaked credentials and intelligence, creating an economy built on repetition.
For CISOs and leaders, this means resilience requires continuous reinforcement. Training cannot be quarterly. Help desk teams cannot rely solely on process. Identity verification cannot rest on assumptions that someone “sounds legitimate”.
The point is not to blame teams, but to support them with clear processes, role-specific training, and communication channels that make it easy to raise suspicions early.
3. Jaguar Land Rover: The Hidden Cost of Unknown Exposures
The major August 2025 breach at Jaguar Land Rover was triggered by stolen credentials and allowed attackers to cause a full production shutdown. The real issue wasn’t one single vulnerability, but a chain of exposures that went unnoticed.
Many organisations still lack full visibility of their internet facing assets or whether their credentials have already leaked. By the time a breach becomes visible, attackers may have been conducting reconnaissance for months.
This is where continuous attack surface monitoring, dark web intelligence and automated reconnaissance become essential. Annual assessments may provide a snapshot into security, but modern attackers exploit the other 364 days too.
4. Oracle: A Zero–Day that Exposed Global Organisations
October 2025 saw attackers exploit an unpatched zero-day vulnerability in Oracle’s eBusiness suite, affecting major organisations across the globe. This incident reinforces a tough truth; even highly mature organisations can be vulnerable when assets are not fully inventoried and internet facing systems are not continuously assessed.
For boards, this underlines the value of visibility as a strategic investment. You cannot protect what you cannot see.
What all these Breaches Have in Common
Across all four incidents, one theme appeared again and again; these breaches didn’t stem from a single technical failure. They were the result of gaps between people, process and technology.
Leaders should consider three strategic priorities:
- Strengthen human resilience
Modern attacks target behaviour as much as systems. Regular tabletop exercises, redteam engagements and realistic training programmes help teams think clearly under pressure. - Remove visibility blind spots
Unknown assets, exposed credentials and unmonitored suppliers are now among the most common root causes of major incidents. Visibility is no longer a technical function, but aboard level priority. - Treat cyber security as a continuous journey
Pointintime assessments are valuable, but insufficient. Continuous scanning, dark web monitoring, and real-time risk tracking help organisations act before attackers do.
Services like Sophos MDR provide expert-led 24/7 threat hunting, detection, and response capabilities to automatically block 99.98% of threats.
How HackRisk Supports Leadership Decision-Making
Our HackRisk platform is supporting leaders in building proactive security strategies.
Its six interconnected security modules are designed to provide the visibility and continuous oversight the modern threat landscape demands.
Together, these insights create a security picture leaders can confidently act on. It is the difference between reacting to incidents and preventing them.
Only 13 percent of UK businesses assess cyber risks within their immediate suppliers and just 8 percent assess their wider supply chain. Yet, as the Oracle case study shows, devastating breaches now originate through partners long considered low risk.
HackRisk’s Supply Chain Security tools allow organisations to invite suppliers, review their cyber posture, assess accreditations, issue onboarding questionnaires and even run financial credit checks, all in one place. For boards and CISOs, this brings clarity to an area traditionally full of fragmented data and manual chasing.
Final Thoughts for Leaders
As Ryan concluded:
“Organisations are not failing because they are ignoring cyber security. They are failing because they cannot see where it is quietly breaking”.
– Ryan Bradbury, CTO at CyberLab
Attackers are patient. They observe. They exploit moments where process meets pressure.
Your defences must do the same. Identify blind spots, strengthen your people, and invest in continuous visibility. These are the steps that prevent your organisation from becoming the next headline.
Get Your Free HackRisk Report
AI-powered cyber risk monitoring with secure dashboard and shareable reports, delivered by security experts.
We’ll perform a full external scan and generate your first HackRisk Report, completely free of charge.
You will receive your HackRisk report within 24 hours. No card details necessary.
Securing the Logistics Sector from Cyber Threats: CSH Success Story
A CSH Transport Success Story
How CSH Transport Is Leading the Way in Cyber Resilience
As the logistics industry accelerates its digital transformation, the stakes for cyber security have never been higher. From real-time tracking systems to cloud-based warehousing and sensitive client data, third-party logistics (3PL) providers are increasingly reliant on digital infrastructure to deliver seamless, efficient services. But with this reliance comes risk -and the need for robust, proactive cyber defences.
One company that’s setting the standard is CSH Transport and Forwarding Ltd, a UK-based logistics specialist with over 40 years of experience. Operating from key locations in Blackburn and the Port of Goole, CSH is known for its reliability and expertise in dry freight, liquid bulk, hazardous and non-hazardous chemical distribution, and secure warehousing.
The Cyber Threat Landscape for Logistics
The logistics sector is a prime target for cyber criminals – and the risks are growing more complex by the day.
With increasing reliance on digital systems for fleet tracking, warehousing, and client communications, logistics providers face a unique blend of vulnerabilities. Disruption to transport systems, data breaches involving sensitive contracts or hazardous materials, and ransomware attacks on operational platforms can have far-reaching consequences – not just for the business, but for the entire supply chain.
For CSH Transport, the challenge was clear: protect their Microsoft 365 environment, ensure compliance, and build a cyber security posture that could evolve with the threat landscape. But they didn’t just need a vendor – they needed a partner.
CyberLab delivered more than just tools and technology. They provided a wraparound support model that combined proactive monitoring, strategic guidance, and hands-on expertise. From securing endpoints and hardening Microsoft 365 to guiding CSH through Cyber Essentials certification, CyberLab helped CSH build a cyber security foundation that was not only resilient, but scalable.
This partnership gave CSH the confidence to operate securely in a high-risk sector, knowing they had the visibility, control, and expert support to stay ahead of evolving threats.
A Strategic Partnership for Resilience
CSH turned to CyberLab for a comprehensive, layered security solution. The partnership focused on two key pillars:
- Microsoft 365 Security Support – CyberLab provided continuous monitoring, patching, and proactive threat detection across CSH’s M365 environment. This ensured vulnerabilities were addressed swiftly and systems remained secure.
- Cyber Essentials Certification – CyberLab guided CSH through the certification process, helping them implement essential controls and demonstrate their commitment to cyber hygiene and compliance.
This dual approach not only protected CSH’s systems but also reinforced trust with clients and partners – an increasingly important differentiator in a competitive market.
Visibility, Control, and Confidence
With CyberLab’s support, CSH Transport gained far more than just a cyber security solution – they gained a strategic partner committed to their long-term resilience.
CyberLab provided CSH with real-time visibility into their Microsoft 365 environment through automated reporting and threat monitoring, ensuring that potential risks were identified and addressed before they could escalate. This transparency gave CSH the confidence to make informed decisions about their security posture.
But visibility was just the beginning. CyberLab’s quarterly advisory sessions offered CSH a structured opportunity to review their security landscape, assess emerging threats, and plan proactive improvements. These sessions weren’t just check-ins – they were collaborative strategy reviews, tailored to CSH’s evolving operational needs.
What truly set CyberLab apart was the wraparound security support: a dedicated team of cyber security experts on hand to provide guidance, answer questions, and respond rapidly to incidents. Whether it was navigating compliance requirements like Cyber Essentials or fine-tuning their Microsoft 365 configurations, CSH knew they had a trusted partner in their corner.
This combination of insight, strategic advice, and hands-on support empowered CSH to move forward with confidence – knowing their operations were protected, their team was supported, and their cyber resilience was continuously improving.
“Working with CyberLab has been a seamless and highly effective experience. Their expertise in securing our Microsoft 365 environment and guiding us through Cyber Essentials certification has significantly strengthened our overall security posture. The proactive monitoring and responsive support have given us the confidence to focus on delivering exceptional services to our customers, knowing that our systems are protected by a trusted partner.”
– Chris Haworth, IT Manager, CSH Transport & Forwarding
Lessons for the Industry
CSH’s journey offers a blueprint for other logistics providers navigating the cyber threat landscape:
- Cyber security is not a one-off project – it’s an ongoing strategy.
- Certification frameworks like Cyber Essentials are more than checkboxes – they’re trust signals.
- Partnering with experts can accelerate resilience and free internal teams to focus on core operations.
As the logistics sector continues to digitise, companies like CSH are proving that operational excellence and cyber resilience go hand in hand.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
CyberLab Shortlisted for 'Best Cybersecurity Solution': Comms Business
Comms Business Awards 2025
We’re proud to announce that CyberLab has been shortlisted for Best Cybersecurity Solution at the 2025 Comms Business Awards!
The Comms Business Awards celebrate excellence, innovation, and customer impact across the UK channel.
“Being nominated at the Comms Business Awards is a fantastic recognition of the innovation and dedication that drive CyberLab.
To be shortlisted in such a competitive category is a fantastic recognition of the impact that we have had in helping businesses to thrive in an increasingly hostile digital landscape, and we’re honoured that it is considered among the best in the industry.”
– Gavin Wood, CEO, CyberLab
We demonstrated how our work with Sealey Group progressed from a penetration test to Sophos MDR, Mimecast email security, and firewall management from CyberLab Managed Services, and how it hardened Sealey Group’s defences, reduced the risk of downtime and ensured the uninterrupted flow of operations.
The winners of the Comms Business Awards will be revealed at the ceremony in July, and we look forward to celebrating with peers and partners from across the industry.
In the meantime, if you’re looking for a cyber security partner to expand your offering and improve your customers’ security, speak with an expert from our Channel team today.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Strengthening Cyber Resilience in Fashion AI Technology
A Delvify Success Story
Digital innovation is transforming every industry, and fashion is no exception. Delvify, a UK-headquartered fashion-tech company, is leading the charge – leveraging AI to help brands and suppliers collaborate more sustainably.
But as the company scaled its operations across Singapore, Hong Kong, and Japan, it faced a growing challenge: how to protect sensitive data in an increasingly hostile cyber threat landscape. According to the Sophos State of Ransomware 2025 report, 50% of ransomware attacks resulted in data encryption – down from 70% the previous year, but still a significant risk for organisations handling sensitive data.
“CyberLab’s team thoroughly and efficiently supported us in bringing best practice to our security processes. With a consultative approach, they guided us to modify and improve our existing processes to make Delvify a more robust and more secure organisation.”
– Charles Allard, Founder of Delvify
The Cyber Threat Landscape for Fashion Tech
Fashion-tech companies like Delvify sit at the intersection of creativity, data, and global collaboration. Their platforms are built to be agile, decentralised, and fast-moving – qualities that are essential for innovation but can also introduce significant cyber risk.
Remote-first teams, diverse operating systems, and a reliance on cloud-based collaboration tools mean that the attack surface is constantly shifting. Cyber criminals are increasingly targeting organisations that handle large volumes of sensitive data, and the fashion sector is no exception. The consequences of a breach extend far beyond financial loss; they can disrupt supply chains, erode brand reputation, and undermine the trust that partners and customers place in digital platforms.
The Sophos State of Ransomware 2025 report highlights that exploited vulnerabilities remain the most common technical root cause of ransomware attacks, accounting for 32% of incidents. For fashion-tech businesses, this means that even a single overlooked weakness can have cascading effects across global operations. As Delvify expanded its reach, the leadership team recognised that proactive cyber security was not just a technical requirement – it was a strategic imperative for long-term growth and resilience.
Why Cyber Essentials Was the Right Fit
Delvify recognised that cyber security couldn’t be an afterthought – it had to be embedded into the company’s DNA. That’s why they turned to CyberLab, an IASME-approved assessor, to guide them through the Cyber Essentials certification process.
Cyber Essentials is a UK government-backed standard that helps organisations protect themselves against the most common cyber threats. For Delvify, it offered a clear, structured framework to assess and improve their security posture – without slowing down their pace of innovation.
The certification process provided Delvify with a roadmap for strengthening its defences, covering everything from firewalls and secure configuration to user access control, malware protection, and patch management. CyberLab’s expertise ensured that every step was tailored to Delvify’s unique environment, addressing the specific risks associated with remote work, device diversity, and rapid product development.
By aligning with Cyber Essentials, Delvify was able to demonstrate its commitment to best practices, reassure stakeholders, and position itself as a trusted partner in the fashion-tech ecosystem.
A Tailored Approach to a Complex Environment
CyberLab’s consultative approach began with a deep dive into Delvify’s existing security practices. From there, the team provided tailored guidance to address platform-specific risks, implement best practices, and align controls with Cyber Essentials requirements.
This wasn’t a one-size-fits-all engagement. CyberLab worked closely with Delvify to ensure that security improvements supported the company’s operational agility. From device management and access control to patching and malware protection, every recommendation was designed to strengthen resilience without compromising flexibility.
The partnership was characterised by open communication and a shared commitment to continuous improvement. CyberLab helped Delvify identify gaps in its defences, prioritise remediation efforts, and foster a culture of accountability across technical and operational teams.
The result was a security posture that not only met regulatory requirements but also empowered Delvify to innovate with confidence, knowing that its data and systems were protected against emerging threats.
“We run different operating systems on a variety of machines including Linux on MacBooks, as well as our proprietary AI platform. CyberLab was able to identify threats and suggest appropriate fixes to secure our remote teams.”
– Aleksei Bochkov, Chief Engineer at Delvify
More Than a Certificate: A Cultural Shift
Achieving Cyber Essentials certification was a milestone, but for Delvify, it was just the beginning. The process sparked a broader cultural shift within the organisation, encouraging cross-functional collaboration and a shared sense of accountability for cyber resilience.
Security controls were not only implemented, they were embedded into daily operations. Teams became more aware of cyber risks, more proactive in addressing them, and more aligned in their commitment to protecting the company’s data, clients, and reputation.
This cultural transformation extended beyond the IT department, reaching every corner of the business. Employees at all levels were engaged in cyber security training, incident response planning, and ongoing risk assessments.
The certification journey fostered a spirit of collaboration, transparency, and shared responsibility, ensuring that cyber resilience became a core value rather than a checkbox exercise. As Delvify continues to grow, this foundation will support both compliance and innovation, enabling the company to adapt to new challenges and opportunities with agility and confidence.
Final Thoughts
Delvify’s journey with CyberLab demonstrates how proactive cyber security isn’t just about compliance, it’s about building a foundation for trust, innovation, and sustainable growth.
By embedding best practices and achieving Cyber Essentials certification, Delvify has strengthened its resilience, enhanced its credibility with partners, and empowered its teams to collaborate securely across borders.
In a digital economy where threats are constantly evolving, Delvify’s commitment to cyber security sets a new standard for the fashion-tech sector, proving that resilience and agility can go hand in hand.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Defence in Depth: Layered Security Strategy for Modern Cyber Risks
Securing Organisations Against the 2025 Threat Landscape
Cyber security threats in 2025 have become more advanced, with attackers leveraging AI, supply chain vulnerabilities, and geo-political tensions to launch increasingly sophisticated and targeted campaigns.
As cyber threats grow in complexity and capability, Defence in Depth remains one of the most effective strategies to protect organisations against threats and mitigate the advancement of cyber attacks.
What is Defence in Depth?
Defence in Depth is a layered security approach that ensures multiple safeguards are in place to protect against various attack vectors.
Rather than relying on a single security measure, this strategy integrates multiple defensive layers. These defensive layers range from physical and network security to user training and incident response. The benefit of this layered approach to defence is that if one layer is breached, others continue to provide protection.
The 2025 Cyber Threat Landscape
According to the NCSC Cyber Security Breaches Survey 2024, 50% of businesses reported experiencing a cyber-attack or breach in the past year. While larger enterprises remain primary targets, 32% of medium-sized businesses and 27% of small businesses also faced cyber incidents, highlighting the growing need for strong cyber security strategies. [source: NCSC]
Increased Attacks on Critical National Infrastructure & Supply Chains
Nation-state actors and cyber-criminal groups are increasingly targeting essential services such as energy, water, healthcare, and transportation. Supply chain attacks have also surged, with attackers infiltrating widely used software and IT providers to gain access to multiple organisations at once.
Defence in Depth Mitigation:
- Network segmentation to isolate critical assets.
- Continuous monitoring and risk assessment of third-party vendors.
- Zero Trust architecture to limit access to essential systems.
- Incident response planning for handling supply chain disruptions.
Rise in Ransomware & Data Extortion Attacks
Ransomware remains a top threat, with attackers adopting double and triple extortion tactics. The 2024 survey found that 19% of businesses that suffered a breach were targeted by ransomware, often leading to financial and reputational damage.
Defence in Depth Mitigation:
- Regular vulnerability scanning and patch management.
- Penetration testing across the IT estate
- Immutable backups to protect against data loss.
- Network segmentation to limit ransomware spread.
AI-Driven Social Engineering & Business Email Compromise (BEC)
Cybercriminals have now started using AI-powered phishing campaigns, deepfake technology, and social engineering tactics to manipulate employees and executives into revealing sensitive information or transferring funds.
According to the UK Department for Science, Innovation & Technology phishing remains the most common type of cyber incident in 2025, with 74% of businesses and 72% of charities reporting they experienced a phishing incident in the past 12 months.
Defence in Depth Mitigation:
- Email filtering and anomaly detection. Consider AI-powered tools that can intuitively detect and remove even the most advanced phishing emails.
- Multi-factor/2-factor authentication (MFA/2FA) remains the single most effective control against phishing attempts.
- Security awareness training focused on AI-driven threats.
- Verification processes for high-value transactions.
Implementing Defence in Depth: A Multi-Layered Approach
Defence in Depth was originally adapted from an ancient military strategy, designed to slow the advancement of an attacking enemy so that they exhaust their resources and lose momentum.
Translated into the field of cyber security, this strategy can buy targeted organisations vital time to adapt and respond to the incident, ensuring the most sensitive assets remain protected.
To be prepared to face a real cyber incident, organisations must implement a Defence in Depth strategy that covers all aspects of cyber security, including:
1. Physical Security – Secure data centres, restrict access, and implement biometric authentication. Physical penetration testing such as Red Team/Tiger Team exercises should be conducted on physical security measures, assessing access control weaknesses, surveillance blind spots, and the effectiveness of security response procedures. Red Team exercises can simulate real-world intrusions, testing how well physical security controls prevent unauthorised access.
2. Network Security – Deploy firewalls, IDS/IPS, and enforce network segmentation. Regular penetration testing should be conducted against network perimeter defences, external and internal infrastructure, internal network segmentation, and VPN security.
3. Endpoint Security – Use robust endpoint detection & response (EDR) solutions or consider partnering with a managed security services provider (MSSP) for managed detection & response (MDR) services. Testing should evaluate endpoint resilience, including BYOD policies and remote device security.
4. Application Security – Conduct regular security testing and vulnerability assessments of public-facing and internal applications, including any exposed API endpoints.
5. Data Protection – Enforce encryption, access controls, and backup strategies.
6. User Training & Awareness – Conduct ongoing cyber security education to recognise phishing and social engineering threats.
7. Incident Response & Business Continuity – Develop incident response plans, and test them utilising services such as penetration testing and red teaming.
8. Zero Trust Architecture – Use zero-trust architecture and implement strict verification protocols across all access points.
9. Vulnerability Management – Continuously monitor, assess, and remediate security gaps across infrastructure, cloud environments, and operational technology (OT) by using vulnerability management tools, and patching software.
10. Red Teaming & Attack Simulations – Organisations should consider conducting red team assessments, not just against their physical security controls, but to test the overall effectiveness of their Defence in Depth strategy, evaluating how well layers of security work together to detect and respond to advanced persistent threats (APTs) across various sophisticated attack scenarios.
Conclusion: Why Defence in Depth is More Critical Than Ever
As cyber threats become more advanced and widespread, adopting a Defence in Depth approach is no longer optional – it is essential. By implementing multiple layers of security across networks, endpoints, cloud environments, applications, and user domains, organisations can significantly reduce their risk exposure.
Whether securing a nation’s critical infrastructure, a large enterprise, or an SME, a well-planned Defence in Depth strategy ensures resilience against ever-evolving threats.
With AI-powered cyber-attacks, state-sponsored threats, and ransomware innovations reshaping the threat landscape organisations should review their current cyber security strategy today and take pro-active steps to implement a robust Defence in Depth approach.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.