Adam Myers:

Hello and welcome to our podcast, Tales from the CyberLab. My name’s Adam Myersm I’m the Sales Director here at CyberLab, and I’ll be your host for today. Joining us is Jon Hope from Sophos. Welcome, Jon.

Jon Hope:

Thank you for having me back.

Adam Myers:

Yeah, I think this is the third time that you’ve been on our podcast. So yeah, the most experience we’ve had so far. So thank you very much for joining us again.

Jon Hope:

My pleasure.

Adam Myers:

Could you just remind our listeners what you do at Sophos and your day-to-day?

Jon Hope:

Of course, absolutely. So my role is two-fold, I suppose. I am our Channel Sales Engineer, which means it’s my role to make sure of our partners are enabled and skilled up and understand what we have available for purchase, what’s coming down the line, and also to spend a lot of time doing things like this. So explaining the research that we do, the solutions that we have, really trying to educate and inform the audience in general as to what we do at Sophos and how we can help organisations stay secure.

Adam Myers:

Amazing. So just moving into our first topic, Jon, this year’s report shows a real shift in malicious email and phishing have overtaken exploited vulnerabilities as the top root causes. What do you think is driving this change and why is identity now such a central theme?

Jon Hope:

Okay, that’s relatively easy to address. So generally speaking, organisations, whichever kind of cyber security technology they put in place, those technologies are better at defending technology-based attacks. So the cyber criminals have essentially had to change tactics. So this is why we see the prevalence of attacks that start with things like phishing or malicious emails or indeed compromised identity, which interestingly in the UK was the highest overall percentage of attacks. The reason that those attacks are now more significant for the cyber criminals is they are ultimately targeting the human in one way, shape or form. So we can patch systems, we can protect with technology, but we can’t really update humans. We can train them for sure, but the cyber criminals know that ultimately we’re all emotional beings. And if you provide the right narrative to a potential victim, potentially giving them a consequence or some kind of incredible reward for doing some kind of action, if you push the right levers, then people do all sorts of crazy things and it’s very difficult for organisations to defend against those kind of attacks. So what we’re seeing is a distinct shift away from technology-driven attacks more towards effectively social engineering in one way, shape or form because it’s much more difficult to contain.

Adam Myers:

Yeah. And I guess if you can find a weakness or I always feel like people are moving from A to B a lot quicker and we’re rushing a little bit or trying to complete tasks. And I think that’s where sometimes you just don’t quite think, do you don’t quite kick in to go, “I should maybe question what this is prompting me to do.”

Jon Hope:

Absolutely.

Adam Myers:

And that’s where they catch that little gap in your defence as a human, I guess, isn’t it?

Jon Hope:

Absolutely. And you’ll find there is a distinct pattern that attacks tend to start with social engineering usually on a Friday, probably Friday afternoon, because we have all effectively mentally checked out by that point. So we’re rushing towards deadlines, we’re finishing the working week off, we’re thinking about our weekend. And that also has an advantage as well because if the cyber criminals get some success, then they’ve always then got the weekend available to them where probably most organisations aren’t functioning and certainly aren’t functioning at full capacity. So it’s that double effect of being more likely to land and then once you’re in, you’ve got a weekend to go at the estate and a lot of people unfortunately come back to the office on Monday morning to find their networks in flames as a result.

Adam Myers:

And also it feels like we share so much more online and we can really target people and users, especially like C-suite, what their hobbies are. There’s real targeted attacks now we’re seeing, aren’t we, where we can really spot a hobby that you might do. We talked about joking about fly fishing early, didn’t we? But if I was to send you something that’s very specific to you as an individual, I don’t sometimes question that in the same way in that environment, would I?

Jon Hope:

Absolutely. So the best and most sophisticated social engineer attacks always where the cyber criminals have actually done some background research. So they will gather open source intelligence about you as a victim. And like you said, it can be things like what are your hobbies? Where do you live? What is the organisation all about? Where is it located? All these kind of things. Because if you sent somebody a scam that is completely irrelevant to them, for example, you sent out a message about your TFL oyster card to victims in Glasgow, they probably would look at that very quickly and realise it wasn’t legit. But if you’re talking about suppliers and brands that work with that organisation that fits a narrative that you might have, for example, we are doing an event on this particular day, so the cyber criminals might decide that they’re going to impersonate one of your suppliers and say, “Hey, we need to sort out the catering for X, Y, Z.” It’s building that narrative to make it look convincing. We don’t typically see those generic scams like we used to. I have a rich uncle that needs to offload a million dollars from their bank account because we’re all kind of quite savvy to those things. The cyber criminals will very much create a narrative that is convincing so that they get the success. And unfortunately, as you rightly point out, the more that we share online, the more information as background is available to the cyber criminal teams to then create something which is convincing. So always be careful about what you share online is definitely a good takeaway.

Adam Myers:

Yeah. And I’m sure it was a conversation we had on maybe one of the previous podcasts and it always sticks with me around how AI has empowered them to, in terms of the font on brand, everything just looks a lot more real, doesn’t it? And it’s on scale as well now. So you’re seeing this sort of dawn of AI making almost those teams better branded. The colour isn’t quite off, it’s perfect. It’s harder to spot that as well, isn’t it?

Jon Hope:

It is. And AI can do a whole bunch of things. So you can ask it to go do some research on your potential victim and it can go and crawl all the websites. It can get a LinkedIn and Facebook and all those kind of things and gather that intel so we can harvest that information really quickly. And then as you rightly point out, it gets over things like, let’s be candid, most cyber criminals their native languages isn’t English, so it gets over that barrier straight away. But it is deeper than that. It’s brand tone of voice, it’s brand imagery, it’s replicating things so perfectly that people fall for it.

Adam Myers:

And I think that’s why the state ransomware report is so important now, isn’t it? Because we’ve done three now, it’s evolving, isn’t it, from probably what we saw when we were chatting in three years ago to today with AI and where the direction travel is going and more sophisticated attacks. It’s interesting to see the report and what that has generated over the last three years in new narrative and trends.

Jon Hope:

It’s a hugely valuable resource because we can’t go and ask the cyber criminals what they’re doing, but we can infer their tactics based on what we’re observing. So that’s probably a good segue onto talking about identity. So I already gave you the stat that identity is a really significant factor. And what we are observing is cyber criminals actually breaking up their business and having dedicated teams or even dedicated groups of initial access brokers whose sole purpose is to dupe people out of their identities and then actually do nothing with it other than sell it as a commodity. And then obviously another cyber crime gang can come along by the login credential to an organisation. And then you can see really quickly how that becomes an attack, which is incredibly difficult to stop because from a functional perspective, if that user presents the right login details, the right credentials, then as far as the system’s concerned, that is that person. So they get all the access of the individual that they’ve duped those creds out of. And it is literally as simple as going online to the dark web admittedly and buying the access that you want.

Adam Myers:

Yeah, interesting take. So moving into our next topic, over half of ransomware attacks still succeed in encrypting data and MFA on the report was deployed in 97% of credential-based instance. Why is that not enough?

Jon Hope:

That’s an interesting question. So I’ll take the second half of that question first. And the indication that 97% of cases MFA was deployed and yet we still see successful attacks tells us immediately that something’s not quite right. And that could be that an organisation has not completely deployed MFA. And the analogy is still true that your defence is only as strong as its weakest links. If you don’t cover everything with MFA, the criminals will just use the one that they can get ahold of. And it also speaks to the fact that social engineering is happening. So there are plenty of tools like EvilJinx where the cyber criminals can set up a perfectly legitimate looking site. You present your legitimate credentials and you get access to whatever that might be. But in the background, the cyber criminals are stealing the access tokens. That means that they can effectively perform as that user for an extended period of time.

Adam Myers:

We’ve done many a live hack, which if you are watching at home and are interested in maybe how we can help your organisation paint a picture of how we can maybe get those credentials, check us out because we can demonstrate live hacks to your organisation and they are really beneficial in just painting a picture from a cyber awareness perspective. So kind of just going back to the first part of that question, John, over half of ransomware attacks still succeed in encrypting data. Why is that?

Jon Hope:

It’s a combination of factors, but essentially in the survey, almost every organisation was deploying some kind of endpoint protection. It is 2026 and most people know they should be protecting their estate, but not all endpoint protection is equal. So you will find certain cyber security vendors have weaknesses around types of encryption attacks, particularly remote ransomware. That’s obviously something the audience can go and research if you want to go and look into that in more depth. But essentially what a cyber criminals try to do there is find a device that’s vulnerable and then instead of actually encrypting the data on that device, they use it instead as a bridge head to go and attack other devices in the estate, like your servers in particular. Now, most endpoint protection vendors when they’re covering an estate, they don’t really look too much at where the attack comes from. So if the malicious code is not actually executing on the machine they’re covering, then it’s kind of a blind side. It’s a bit of a weak spot, which incidentally Sophos doesn’t have, but that’s a product pitch for another time. But that is a significant attack factor. So again, this is another example where the cyber criminals have realised that one type of attack is being stopped, so they’re changing tactics. So that is one of the underlying factors that means the rate of successful encryption is going up. And another one, although this is pure conjecture, is probably we talked about AI-based attacks and working out how to perform encryption in a way that is not going to get detected. So that’s a combination. It is a bit of a worrying trend because we were consistently seeing the rate of successful encryption going down, and then all of a sudden in 2026 we’ve got this kind of U-turn, which we think is probably related to those two factors. In particular, remote ransomware is becoming more popular to cyber criminals.

Adam Myers:

Yeah. Interesting take. Amazing. So this year’s report has new data on firewalls and detection, Jon. So what does this tell us?

Jon Hope:

Okay. This is a subject that’s really close to my heart. As you probably remember, I joined Sophos through acquisition. I was running the firewall business in the UK and Ireland for a firewall vendor that Sophos bought. So firewalls have always been kind of part of my makeup really. And what this report certainly tells us is the firewall’s place in the network is a really key one, and it’s a privileged position really to see what is coming in and out of the organisation, and it is a great opportunity to detect these attacks and block them. So what we’re seeing is organisations that have a strong firewall policy and have got things set up properly are the ones that are more likely to detect an attack and actually block it in advance of the ransomware detonating. And also those organisations who are maybe not quite as switched on but still have good firewall settings will often find the root cause of the attack later on in the logs and reports. So they’re seeing it, although admittedly not acting on it. And then those organisations that are left behind that the firewall just has been completely blindsided, which is 7% of cases where there’s no evidence inside the firewall logs at all. Those are the organisations that typically have the poorest outcomes when it comes to these kind of attacks. So it tells us that the firewall is not dead by any stretch. It is a key part of an opportunity to block attacks, particularly when as well, interestingly look at the combination of attacks that involve OT type devices, and in many cases, any kind of IOT operational technology stuff doesn’t typically have a Sophos agent on there or vendor X endpoint agent because you simply can’t instal that technology. The only real opportunity then to start monitoring that is through tools like NDR or the firewall. So it is a really good control point for the kind of attacks that are circumventing detection by endpoint by targeting devices that just don’t have endpoint protection installed on them. So the firewall is key, lots of information in there that’s really useful and great opportunity to actually take the intel from your firewall and react in other places across the estate to contain attacks as well.

Adam Myers:

So that’s where I was going to go with this conversation is the firewall telemetry into say XDR and MDR and what that can bring to bringing that into that ecosystem. Can you just expand a little bit on that so where that would help our customers as such?

Jon Hope:

Absolutely. Yeah, of course. So your firewall is obviously creating blogs and recording all the traffic that’s going through. If there are interesting things inside there that could be suspicious, then if you are pointing that at your XDR system, whatever that might be, that will flag up that that needs some kind of investigation because most of these signals are weak signals. And what that’s telling us is this might be suspicious, but you need to provide context around it. So if you see a string of events happening together, then our human brains will look at that and say, well, this is likely to be faces of an attack in a way that technology, maybe AI to an extent can do that, but certainly traditional technologies can’t really do that. So feeding that information into XDR is really useful because then the analysts at the end user organisation can start looking at it. And if you don’t have analysts and you don’t have that kind of security operations team in-house, then maybe what you should be doing instead is diverting that to MDR so that our analysts can then start looking at it and start acting on what they’re seeing from the firewall because the data is, as we mentioned in 93% of the cases, the data is there. And if you’ve got a decent next generation firewall, then it certainly has the capability to be locking all of these things and we just need to then action it.

Adam Myers:

Yeah. So like an early warning system sort of thing, giving you that early telemetry by bringing those two technologies together. I think there’s a real benefit for doing that.

Jon Hope:

Oh, absolutely. I mean in point of facts, the attack has got to come from somewhere and it is unlikely that somebody’s going to walk in your building with a backpack and a laptop or somebody’s going to come in with a USB pen drive. I mean, those things still exist, but that is not a common attack vector. The reality is these attacks will come across the internet. And of course, yes, you’ve probably got users that are working remotely, but in a lot of cases, the firewall back at the office is being utilised as a route to get into the estate, whether it’s actually just passing through, whether it’s actually part of the problem, because we do see cyber criminals actually going after things like your VPNs, like your firewalls and presenting credentials or trying to brute force those technologies. So your firewall can be part of the problem, but it is certainly part of the solution as well because it’s seeing all this traffic coming in and going out.

Adam Myers:

And grouping those attacks together, isn’t it, to say it’s multiple areas that we’re being hit. It’s being able to see that as a grouping and that’s where I guess Sophos Fusion works and how that’s going to knit that all together for our customers, isn’t it as well?

Jon Hope:

Absolutely. Yeah. So it’s one thing to have the data, but if you are in a traditional environment where you’ve got multiple different dashboards from different products and different vendors, that kind of correlation of events is really difficult. Things like XDR will help you present that as a single unified view and give you better context. But yeah, absolutely things like Fusion are great because what Fusion can do very effectively is look at that information from multiple different sources, unify it into a single context lake, but then also orchestrate responses. So we talked about identity-based attacks, for example. If we see an identity-based attack coming in and we can see that John’s account has been compromised, then Fusion could automatically suspend the account without anybody having to get involved in that, and then we can shut the problem down before it really gets any worse. So it’s that automation and operating at the speed of AI, which is really going to make a difference. AI has really accelerated the attacks, but it also gives us credible opportunities to defend ourselves as well. And it’s just about deploying that technology in the right way to orchestrate those responses.

Adam Myers:

Amazing. So ransom demands and payments both keep falling from what I can see with the down 65% over two years. What’s behind that? Can you just expand a little bit, Jon?

Jon Hope:

Yeah, it’s contexture because we can’t ask the cyber criminals, but I think personally that the cyber criminals have over the years being able to work out exactly what the appropriate level of pressure to apply is. They probably realised reasonably early on that hitting Mrs. Megan’s bakery for a million bucks isn’t going to work because they’re a two-person organisation and they don’t have that kind of resource. So I would imagine that there is an element of accuracy about working out how much an organisation can afford to pay effectively and how much that data is actually worth in practical terms. And that’s probably borne out by the fact as well that if you look at how victims negotiate with cyber criminals, that often victims are successful in negotiating a slightly reduced demand, but that disparity is about you end up paying about 90% on average when you negotiate with the cyber criminals. So it tells you that they’ve roughly got the sums right, which I think is probably why that number is levelling out a little bit, but it is only conjecture. And I would caution that if you negotiate with cyber criminals, just be prepared because there is always that prospect that you might end up paying more. Not every cyber criminal wants to enter a dialogue with you in that kind of way. So you’ve got to be real careful and really you probably ought to employ a specialist to do that. So for example, our teams can negotiate on your behalf in a worst case scenario as an example, because it’s a discipline in of itself.

Adam Myers:

Yeah. I think a statement I read back and it makes sense is falling demands doesn’t mean falling risk. I think that’s a powerful statement to maybe take away from that. And that we’re seeing that recovery costs are still rising.

Jon Hope:

Absolutely. Yeah. And again, it’s conjecture, but the recovery costs are quite often linked to the quantities of data. And of course, you don’t need me to tell you that we all produce more and more and more data. So there’s more to recover, there’s more to put back into place. The cost of downtime is also going up. Human resources are getting more expensive. So the time that everyone’s sitting around twiddling their thumbs because they can’t work is expensive. The loss of production, the loss of business opportunity. We’re getting better at quantifying what the loss of business opportunity looks like. So you can add those things into the equation. But yeah, overall it is still a really expensive proposition to be hit by ransomware. Yeah.

Adam Myers:

So moving into our next topic. So even with smaller ransoms, the total cost and human toll is still huge. What should leaders understand beyond the demand itself?

Jon Hope:

What should they understand beyond the demand themselves? I mean, really, people have to be more realistic about the fact that they are likely to become a victim. That’s the big takeaway I would suggest. When we first started talking about this, then ransomware was really an enterprise problem, and there was an element of security that existed by being a smaller business because cyber criminals will go after where the money is, and inherently bigger organisations typically have got more money and therefore will give them a better payout. But the dynamics have changed. Over the years that we’ve been doing this, we’ve seen cyber criminals go from individuals operating alone to organised gangs, and that brings with it economies of scale. There are no shortage of cyber criminals out there and easier ways to create attacks that operate on playbooks. And of course, now you’ve got AI as well, just to throw that into the equation. So ultimately all this means is that the cost of mounting an attack from the cyber criminal’s perspective is going down and down and down and down. And the net result is where historically you would’ve looked at how much am I going to get paid versus how much does it cost? Cyber criminals make ROI decisions the same way that we would. They’re going to look at that and think, well, it’s going to take a lot of effort, so therefore I want to go after the big bucks. The dynamics have changed. Now I can mount an attack for very little effort. So all of a sudden the smaller organisations start to come into the firing line and the economies are just different now. So I think the biggest thing that people need to be aware of, and just please do not assume that you are not going to be a victim because your data isn’t interesting and that you’re too small. I mean, do bear in mind, most cases, the cyber criminals aren’t actually interested in your data. They don’t care about your data, but they care that you as a victim care about your data, and that’s what they’re ultimately holding you to ransomware. They don’t want to steal your data because it has intrinsic value, although maybe it has some resale value. What they’re really interested in the fact is that you will pay to get it back again. That’s the motivation.

Adam Myers:

Yeah. And I think for smaller businesses, a good place to start is things like Cyber Essentials and Cyber Essentials Plus. That’s an area that we help a lot of customers with. And I think that for those smaller businesses given a little bit of direction, because the stigma I guess is that you talked about an enterprise grade solution, obviously the cost of that, where there’s a lot of ways that through various Sophos programmes, we can help smaller users with more OpEx costs instead of CapEx models. So there’s ways that we can make cyber security still affordable to that sort of commercial mid-market type organisation, can’t we?

Jon Hope:

Absolutely. Yes, absolutely. So yeah, it is not always true that you can’t cover yourself, but there may be different ways of doing it. If you’re a big organisation, you might think, well, I’ll employ a bunch of SOC analysts and we’ll run a security team of our own. That isn’t going to work in a small organisation, but instead, this is why services like managed detection and response exist. You outsource that threat hunting element to a vendor like Sophos and we become your security team or we work in conjunction with channel partners like you to make sure that organisations have that telemetry being monitored 24 hours a day, seven days a week in a way that they could never ever hope to do themselves. And of course, then you’ve got Fusion on top of that. So Fusion brings the intelligence from all the 625-ish thousand organisations that use Sophos together. And what we see in one place, we can offer protection really quickly to that same attack for all of our other customers. So we’re almost acting in union to fight the cyber crime attacks. And the more that we can coordinate our defences, then the better place we’ll all be in as a result. So yeah, even a small organisation can benefit from this kind of almost herd immunity through services like MDR. And then you talked about frameworks like Cyber Essentials and Cyber Essentials Plus and all the other things. Those are great benchmarks to make sure you’re at least doing the right things. I would not say that compliance equals security, but it’s a good starting point for sure.

Adam Myers:

Yeah. And you just celebrated 15 years at Sophos, so I’ll get that in there and say, well, congratulations. And I did 15 years last year, so I’m in the same boat. What would be, so I know Jon Hope 15 years ago, what you’re seeing in security versus what you’re seeing today, what would you say is that big shift that you’ve seen over… We kind of touched on it a little bit there in terms of ransom payments and whatnot in smaller businesses and don’t assume you won’t be hit, but what do you see as that as the big step for 15 years?

Jon Hope:

That’s a big question. That is a big question. So what I can tell you is 15 years ago we were selling cyber security solutions that you put them in and you set them up and largely speaking, you book away from them and they will keep you secure or they kept you secure in the old days. This is when most attacks were file-based, and once you’d got a signature for that particular type of malware, then you were protected against it at Infinite. And that was how security worked then. The biggest shift really has been to the fact that so many of these attacks are now human orientated. And the fact that going out and buying traditional static technologies like endpoint protection on their own are not enough because the attacks are constantly evolving, the cyber criminals are masquerading as your users, they’re in your emails redirecting them and changing invoice details and all these kind of really subtle types of attacks That are much more difficult for traditional security technologies to defend against. So if you’d asked me 15 years ago, can I foresee a change? I’ll be honest and say, I probably couldn’t see us moving away from a world where you bought tech. And the idea of running security teams to the kind of scale that we have to do today was probably not something I would’ve been able to contemplate and get my head around. But this is an industry that moves really quickly and all of a sudden going out and buying tech and not having humans look at these weak signals and respond to them is just not enough. So that’s a big shift. I think the other big shift as well is if I go back 15 years ago, vendors really worked in isolation and Sophos was maybe a little unusual here, but if you think back 15 years ago, you’d have bought your endpoint from one vendor, you’d have bought your firewall from another vendor, you’d have bought your identity. Well, identity wasn’t really a thing I suppose then, but let’s go with it. You’d have bought your MFA from another vendor again. And now of course we see all these different vendors consolidating bits of tech together and maybe Sophos started that to an extent. Of course, my personal journey was coming from a firewall vendor into what was traditionally an endpoint vendor at Sophos and that kind of unification, which sent a few ripples through the industry at the time, but now that’s quite commonplace. Really where the industry is going now is towards not just individual products, not just platforms that kind of loosely work together, but we’ve talked about fusion quite a few times over. Fusion is really the next evolution where we’re talking about cyber security systems. So we’re seeing all these maybe disparate vendors or maybe you’ve got Sophos in a few places alongside other vendors, but then feeding it into a unified context and then having that cybersecurity system, then also pulling the strings, pushing the buttons of other cyber security products to then respond. So I gave an example, like John’s identity’s been compromised. Let’s go straight into the identity provider and shut down his account. These things, again, I couldn’t have contemplated that 15 years ago, this idea of interaction. You were very much kind of, I’m selling my product, but now actually what you are selling when we talk about these things is outcomes and sometimes the best outcomes come from collaboration with other vendors.

Adam Myers:

Yeah. It has been a big shift though, hasn’t it? I think in the last three to five years I’ve seen that. I think Sophos have been unbelievable at that. I call you the glue that knits everything together because I do think you have opened up that ability to work with other partners and vendors and that I think creates a much better customer experience. So instead of me as an administrator trying to piece this all together, offloading and working with Sophos to help knit that together, telemetry from different products and solutions has massively changed, I think, with the likes of MDR and now Fusion and where that’s heading.

Jon Hope:

Absolutely. Yeah. I mean, a couple of really good, just super simple examples, backup and recovery. So Sophos don’t really do backup and recovery as such, but what we can do is we can integrate with those backup partners. If we see the cyber criminals go tamper with your backups, which is really common, because of course you’re not going to pay the ransom if you’ve got a backup, it stands to reason. If we see the cyber criminal going after your backups, then that’s a signal that means you’re likely to be coming under attack. Another example, we talked about business email compromise, this idea of redirecting all the interesting emails that have invoices and orders and then changing the bank details. We would never see that because we’re not doing the fabric of email. Yeah, we might do email security, but we don’t do the routing elements. That’s very much things like Office 365, but we can take signals from Microsoft Office 365 and we can look at it and say, “Well, a redirect rule’s been created here. This is a bit suspicious.” We can proactively call the IT manager and say, “Did you mean to send all this stuff to this weird looking Gmail address because that is not right to us? So either explain that, or if not, then maybe we’ve got ourselves a problem.” And flagging up the kind of attacks that traditionally, when you’re looking at your own small view of the world, you just don’t see. So it opens up that opportunity to get early warnings. It opens up the opportunity to see things that we otherwise wouldn’t see. So I think an open architecture is hugely beneficial.

Adam Myers:

And it’s that how does it compliment Microsoft play? We talked about that. I think Jez and I have done a whole webinar on this, which you can check out if you’re listening to this podcast now, but it is how does it compliment Microsoft? Huge organisations are in that Microsoft ecosystem. Sophos has gone really out the way to improve and help that Microsoft ecosystem hasn’t.

Jon Hope:

Well, absolutely. I mean they’re right at the Colfax, they’re running the operating system. So in terms of where we’re going to get data from, I’m sure Jez probably told you that Microsoft now accounts for our highest percentage of alerts inside our SOC because we’re seeing it from the endpoint, we’re seeing it from the cloud provision, the email services. This is whole plethora of telemetry coming in that tells us that there’s a problem. And let’s be honest, buying a few exceptions of maybe Google houses, Microsoft is pretty much omnipresent.

Adam Myers:

Yeah, very true. So just with it, just to wrap a few things up, what should a CISO or IT leader prioritise over the next year, if you were to maybe summarise that?

Jon Hope:

Wow, that’s a big question.

Adam Myers:

It is a big question.

Jon Hope:

Yeah. So what should you prioritise? Well, first of all, just be realistic. You are potentially going to become a victim, so don’t bury your head in the sand. Have a plan. Make sure that you’ve got an incident response plan, that you test it, that you’ve got backup plan, that you test it, that you’ve got all these things in place. Maybe work with external organisations like yourself to do tabletop exercises so you kind of know what to expect. And the reason I say that over everything else is The mere exercise of going through what it’s like to be a victim will help you see where the gaps are. You might start to realise that maybe we’re not covered in that area, we’re not covered in this area. So it helps you to get a broader view beyond compliance into this kind of, have I got a good security ecosystem?

Is it set up properly? That’s the first port of call. And then just as if I can have two, then if you’re a Sophos customer, just ask CyberLab for a health check. The reason I say that is human factors around misconfiguration are starting to creep up as a percentage. And there’s nothing worse than going out and buying security solutions and then having this perception of being secure, but actually you’ve set it up badly or you’ve missed something. So having an extra pair of eyes look at your config just to make sure it’s all good and it’s all set up properly is just a really good piece of mind exercise.

Adam Myers:

Yeah. Amazing. Well, thank you very much, Jonn. I’ve really enjoyed this recap and running through this for a third time. So who knows, this time next year we’ll have a fourth appearance. So with that, that concludes this episode of Tales from the CyberLab. Join us next time for a brand new episode. Until then, stay secure.