13:03

Nov 13, 2026

Device Code Phishing: When Doing Everything Right Goes Wrong

Device Code Phishing: When Doing Everything Right Goes Wrong Microsoft 365 users endured widespread outages this week, and attackers are already preparing to exploit the chaos. KnowBe4’s latest phishing report reveals a troubling evolution: criminals have stopped building fake websites and started borrowing real ones. In this episode, Noel Bradford dissects volume eight of the Phishing Threat Trends Report, examining device code flow attacks where victims check the URL, complete their MFA, sign in on legitimate Microsoft pages, and still hand over account access. He questions the report’s statistical claims, offers KnowBe4 a right of reply, and provides five practical Monday-morning actions for blocking these attacks before they become widespread. The old security advice centred on inspecting web addresses. The web address is now the one honest element in the attack. It’s time to teach your team better questions. Chapters Welcome Noel introduces the episode against the backdrop of this week’s Microsoft 365 outages. He previews his assessment of KnowBe4’s October 2026 Phishing Threat Trends Report: one valuable insight, questionable statistics, and a product pitch. KnowBe4 receives an open invitation to respond. The Idea That’s Right Attackers have abandoned fake websites in favour of borrowing legitimate ones. Device code flow attacks exploit a Microsoft authentication feature designed for devices without keyboards. Victims check the URL (it’s genuine Microsoft), complete MFA, and unknowingly grant access to an attacker’s device. OAuth consent phishing works similarly: malicious apps receive standing permissions that survive password resets. KnowBe4’s data suggests device code attacks represent two per cent of toolkit-driven phishing, but the door should be closed before that percentage rises. The Awkward Bit KnowBe4 built its reputation on security awareness training, yet this report acknowledges that victims of device code attacks did everything correctly. The training worked, the attacker succeeded anyway, and the document concludes by promoting KnowBe4’s email filtering product. The lesson for defenders shifts from inspecting web addresses to asking a new question: did I initiate this sign-in request? The Numbers I Wouldn’t Repeat The report claims a 60.7 per cent likelihood of attack following major UK news coverage, but provides no time window, attack definition, baseline comparison, or methodology. Without these details, the statistic cannot be independently verified. The underlying behaviour (criminals exploiting breaking news) is plausible and supported by examples, but the percentages lack rigour. This week’s Microsoft outages create ideal conditions for device code attacks disguised as account restoration messages. Noel invites KnowBe4 to publish the methodology behind its figures. Monday Morning Five immediate actions: ask your IT provider whether device code flow is blocked via Conditional Access; confirm who can approve new app permissions; enable the admin consent workflow; audit existing app permissions quarterly; update incident response plans to include revoking sessions and checking app permissions alongside password resets. Staff should be warned that legitimate sign-in pages can be weaponised, and that post-outage restoration never requires typing codes sent by others. Outro Noel summarises the report’s value and limitations, directs listeners to Microsoft guidance in the show notes, and encourages sharing the episode with IT providers. He closes by reframing the security question: Dave did everything right, so we need to give him better questions to ask. Links https://www.knowbe4.com/phishing-threat-trends-report https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-device-code-flow https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow

9:43

Oct 28, 2026

Broccoli2Shell: When Patching the Server Doesn't Fix the App

Broccoli2Shell: When Patching the Server Doesn’t Fix the App A Microsoft out-of-band update for CVE-2026-111497 highlights a frustrating gap in business IT maintenance. The Brotli compression flaw affects .NET runtimes, Node.js, and other platforms, but patching the host server doesn’t automatically fix self-contained applications or containerised workloads. Noel Bradford walks through what the vulnerability actually does, why one shared component means multiple suppliers fixing on separate timetables, and how bundled runtimes can sit unchanged inside applications long after the underlying server receives its updates. Using the example of a small Horsham firm whose booking app could remain vulnerable despite monthly server patching, the episode makes the case for asking suppliers four specific questions: which systems contain the flaw, what can reach it, who owns each fix, and how will you prove the live application now runs the corrected component. The episode closes with a reminder that green ticks on infrastructure reports mean very little if nobody checks whether the software customers actually use received the update. Chapters Cold Open A server can be patched and an application supported, yet vulnerable code remains exactly where it was, still running and still wearing a green tick on someone’s report. What the Vegetable Actually Does CVE-2026-111497 sits in the Brotli decompression routine. A specially crafted compressed stream can write past allocated memory, risking code execution if an application processes attacker-controlled Brotli data. One Flaw, Lots of Copies Google, Node.js, and Microsoft each ship fixes for their own copy of Brotli on separate timetables. For .NET, affected versions are 8.0, 9.0, 10.0, and 11 preview; .NET Framework is unaffected, and automatic decompression is off by default. The Patch That Never Reached the App Self-contained deployments and containers carry their own runtime. Updating the server does nothing for them. A Horsham heating firm could receive monthly green reports while its booking app still runs an unchanged, bundled runtime from the original publish date. It Can Arrive with the Reply Outgoing connections still bring data back. Any feature that fetches external resources and decompresses the reply could reach a vulnerable decoder, regardless of firewall rules for incoming ports. Please Spare Us the Apocalypse Sales Pitch Red Hat rates the flaw important with no public reliable proof of concept for remote code execution. An independent site reports a public crash PoC and one team achieving code execution without publishing method. No attacks reported in the wild as of 22 October. The Questions That Earn Their Keep Four supplier questions: Have you assessed our systems for CVE-2026-111497? Which contain an affected component that can process external Brotli data? Who owns each fix and when will it deploy? How will you prove the live application runs the corrected component? The Payoff The server can be updated, the supplier aware, and the ticket closed, yet the application customers and staff depend on may remain unchanged. Evidence must show the fix reached the thing we actually run. Links https://nvd.nist.gov/vuln/detail/CVE-2026-111497 https://nodejs.org/en/blog/vulnerability https://github.com/google/brotli https://msrc.microsoft.com/update-guide https://access.redhat.com/security/cve/cve-2026-111497 https://broccoli2shell.com

11:35

Oct 22, 2026

PHP2Shell Escalates: Millions of Attacks and the AI Discovery Nobody Saw Coming

PHP2Shell Escalates: Millions of Attacks and the AI Discovery Nobody Saw Coming Twenty-four hours after emergency fixes were released for two critical PHP vulnerabilities, governments have taken websites offline, banks have suspended services, and Cloudflare reports millions of exploitation attempts. The flaws, known as CVE-2026-109618 and CVE-2026-109619, score 9.2 out of 10 for severity and allow attackers to potentially execute code on vulnerable servers without authentication. What makes this incident particularly significant is that artificial intelligence helped researchers discover vulnerabilities in code that had survived years of human review. This episode examines the confirmed global response, explains the technical nature of the threat in plain language, explores the implications of AI-assisted vulnerability discovery, and provides urgent guidance for small businesses that need to verify whether their systems are patched and check for signs of prior compromise. Installing a security update does not automatically remove an attacker who gained access beforehand. The fundamental question has shifted from who is responsible for patching your website to whether they patched it in time, and whether anyone was already through the door. Chapters Cold Open Governments have taken websites offline and Cloudflare reports millions of exploitation attempts following yesterday’s emergency PHP security fixes. The vulnerabilities were discovered with help from artificial intelligence, raising uncomfortable questions about the speed of attack discovery versus organisational response times. Yesterday’s Warning, Today’s Headlines CVE-2026-109618 and CVE-2026-109619 both score 9.2 out of 10 for severity. European government websites went offline, Japan’s largest banking group suspended services, South Korea raised its alert level, and the UK NCSC advised taking vulnerable systems offline. Cloudflare recorded thousands of exploitation attempts before the public announcement, escalating to millions within hours. What We Now Know The vulnerabilities exist in PHP’s memory handling during error conditions, potentially allowing remote code execution before application-level security checks run. There are no complete workarounds. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older unsupported versions require proper vendor-supported security fixes or upgrades. The AI Detail Nobody Should Ignore Artificial intelligence helped researchers discover vulnerabilities in PHP code that had survived decades of human review. The discovery was defensive research conducted responsibly, but the same technological advances that assist defenders can also help attackers find weaknesses and develop exploits faster, fundamentally changing the economics of vulnerability discovery. The Patch Is Out: Are You Actually Safe? Installing a security update does not automatically remove an attacker who gained access beforehand. Businesses must verify that PHP has been patched, review security logs for suspicious activity, and investigate signs of compromise. Cloudflare’s firewall protections are helpful but do not replace the need to patch vulnerable systems directly. The Final Payoff Businesses should not require a global security emergency to establish who is responsible for maintaining their website. The challenge is to obtain written confirmation that PHP is patched and systems have been checked for suspicious activity before the end of the day. If nobody can confirm this, escalate immediately. Links https://www.php.net/archive/2026.php#2026-10-22-1 https://nvd.nist.gov/vuln/detail/CVE-2026-109618 https://nvd.nist.gov/vuln/detail/CVE-2026-109619 https://blog.cloudflare.com/php2shell-incident-report-2026 https://www.ncsc.gov.uk/news/php-critical-vulnerabilities-oct-2026 https://www.wiz.io/blog/php-memory-corruption-rce-discovery

10:02

Oct 21, 2026

Two Critical PHP Flaws Demand Immediate Action from UK Small Businesses

Two Critical PHP Flaws Demand Immediate Action from UK Small Businesses On 21 October 2026, the PHP security team announced an emergency release to patch two critical vulnerabilities scoring 9.2 out of 10. Security researchers confirmed the flaws could enable remote code execution, and early attack activity has been reported. The UK’s National Cyber Security Centre advised organisations to prepare to patch immediately or consider taking vulnerable systems offline. For small businesses running PHP-based websites and applications (including WordPress, Drupal, Joomla and Magento), the question is stark: who is actually responsible for securing your web infrastructure? This episode cuts through the noise to explain what we know, what remains unconfirmed, and why the biggest risk may not be the vulnerability itself but the absence of clear accountability. Noel Bradford challenges business owners and IT providers to establish who owns website security, verify PHP versions, confirm patching plans, and demand straightforward answers before the next critical flaw arrives. Because paying for hosting is not the same as paying for security, and technical debt has a habit of presenting its invoice at the worst possible moment. Chapters Cold Open Two critical PHP vulnerabilities scoring 9.2 are receiving emergency fixes. The UK National Cyber Security Centre is advising organisations to patch immediately or consider taking systems offline, and attackers have already started probing for exposure. The Clock Is Ticking The PHP security team brought forward its disclosure timetable after researchers confirmed the flaws were real. Remote code execution is possible, but official technical details and affected version ranges have not yet been published. Distinguishing confirmed facts from speculation matters. The Really Nasty Bit Cloudflare reports early attack activity whilst Huntress had not observed exploitation across its partner base. Once fixes are public, attackers can reverse-engineer the vulnerabilities. Many small businesses have no clear answer about who secures their PHP-based websites. What You Need To Do Right Now Identify who is responsible for your website security. Contact them today and ask which PHP version you are running, whether you are affected, and when fixes will be applied. Demand confirmation, not reassurance. If systems cannot be secured promptly, consider restricting access. The Real Problem This is not just a PHP problem but a responsibility problem. Businesses often pay multiple providers yet cannot identify who owns security. If you can name who invoices you but not who secures your website, you have identified a business risk. Final Word Before the end of the day, confirm who is responsible for your website security and what they are doing about these vulnerabilities. If you cannot get a straight answer, you have a bigger problem than two security flaws. Get it sorted before someone else does. Links https://www.ncsc.gov.uk/ https://www.cloudflare.com/ https://www.huntress.com/ https://www.watchtowrcyber.com/ https://www.php.net/

9:02

Sep 12, 2026

Microsoft's September 2026 Patch Tuesday Breaks Remote Desktop Services

Microsoft’s September 2026 Patch Tuesday Breaks Remote Desktop Services Microsoft’s September 2026 Patch Tuesday delivered nearly 1,000 vulnerability fixes, including two actively exploited flaws. Unfortunately, the security updates also triggered widespread Remote Desktop Services failures across Windows Server 2012 through 2025, as well as Windows 10 and 11. Noel Bradford dissects the uncomfortable trade-off administrators now face: leave the patch installed and risk breaking production RDS environments, or remove it and deliberately reinstate known security holes. Microsoft’s current mitigation, stopping and restarting affected servers, highlights the absurdity of the situation. This episode examines what went wrong in testing, why patching remains essential despite these failures, and how organisations can build deployment rings and monitoring that prevent turning users into the first line of incident detection. If your patch strategy is ‘deploy everything at once’, you are not managing risk. You are gambling with availability. Chapters Cold Open A Monday morning scenario: servers patched on schedule, compliance dashboards green, yet Remote Desktop sessions are dropping everywhere. Users cannot sign in, management tools freeze, and the security update that caused the chaos also fixes vulnerabilities attackers are already exploiting. The choice becomes: break the system or reinstall known security holes. But You Cannot Just Rip The Patch Out September 2026 marks Microsoft’s largest Patch Tuesday on record, with approximately 966 to 970 vulnerabilities addressed. Two were already being actively exploited. Uninstalling the update to restore RDS functionality means deliberately reinstalling vulnerabilities under active attack. There is no comfortable option three. Patching Is Not The Villain This incident does not prove patching is dangerous. It proves blindly patching the entire production estate simultaneously is dangerous. Organisations that disabled Windows Update years ago because of one bad experience are practising avoidance, not patch management. Deployment rings, test machines, staged rollouts, and human oversight remain essential. Can We Talk About Testing? Remote Desktop Services is a widely used, business-critical feature. How did a security update that causes RDS to hang on configuration prompts make it through testing? Was the failure mode unseen, or was it deprioritised due to the urgency of fixing actively exploited vulnerabilities? Customers need transparency to make informed decisions. Would You Even Know? If RDS sessions started dropping or authentication slowed today, would monitoring systems alert administrators, or would users ring the helpdesk first? Crowdsourced diagnostics via user complaints is not monitoring. Proper alerting on authentication failures, session drops, and host responsiveness is necessary to detect issues before they escalate. So What Now? Do not panic or indiscriminately remove September updates. Check RDS environments for dropped sessions, sign-in failures, and hanging hosts. Microsoft’s current workaround is to stop, deallocate, and restart affected virtual machines. If systems are stable, continue monitoring. Confirmation of an issue does not mean universal breakage. Closing September 2026 encapsulates modern IT operations: nearly 1,000 security fixes, two actively exploited vulnerabilities requiring immediate patching, and a patch that may break Remote Desktop Services. The job is balancing security versus availability, urgency versus testing. Deployment rings are not optional. If all machines receive updates simultaneously, that is not a strategy. It is a countdown timer. Links https://www.bleepingcomputer.com/

17:53

Jul 27, 2026

When Office Printers Join Organised Crime

When Office Printers Join Organised Crime Imagine walking into your office to find all systems locked and the printer spewing ransom notes. This episode of SBCSG Hot Take, hosted by Noel Bradford, explores two significant security breaches. The first organisation made classic mistakes: exposed Remote Desktop and disabled endpoint protection. Attackers used BitLocker to encrypt data, demonstrating how tools meant for protection can be turned against the business. The second business fared worse, misconfiguring an SQL server and leaving credentials exposed, allowing intruders to linger for months. Noel emphasises the importance of response over mere alerts and how organisational oversight often contributes more to breaches than sophisticated hacking tools. Chapters Cold Open A dramatic opening describes ransomware printed from office printers. They Did Not Hack the Printer First Kaspersky’s investigation reveals exposed Remote Desktop led to the breach. The Protection Had Been Disabled Endpoint protection was disabled due to ‘compatibility issues’, leading to a breach. The Second Business Somehow Did Worse A misconfigured SQL server with public credentials allowed attackers entry. The Alerts Worked Security alerts were raised but ignored, demonstrating response gaps. The Attackers Used Proper IT Tools Attackers used legitimate IT tools instead of custom weapons. Then They Destroyed the Evidence In incident response haste, evidence was destroyed, complicating investigations. The Ransom Was Almost Sensible A modest ransom demand hinted at a pragmatic cybercrime model. The Printer Is Still Guilty Printers, as networked devices, remain security risks despite appearing benign. The Hot Take The breaches highlight organisational security failings, not hacker genius. Close The episode concludes with irony as the printer finally functions faultlessly. Links https://www.kaspersky.com

12:49

Jul 10, 2026

FortiBleed, Fortinet, and the Firewall That Became the Failure

FortiBleed, Fortinet, and the Firewall That Became the Failure Noel Bradford unleashes a withering critique of Fortinet following the FortiBleed vulnerability’s impact on British embassies, the Foreign Office, and the British Council. This is not a balanced analysis; it is a controlled explosion aimed at a vendor that keeps appearing in credential exposure stories despite its market dominance and recurring revenue model. Bradford demands answers: why does one of the world’s largest security companies repeatedly feature in edge device exploitation headlines? Why are customers paying annual licences for products that become the risk conversation? And why, in an era when frontier AI models like Anthropic’s Claude Mythos Preview are being deployed to hunt vulnerabilities in critical software, are we still watching firewalls, the devices sold as the safe bit, turn into national security incidents? He dismantles the familiar cycle of advisory, exploitation, and carefully worded apology, and asks whether recurring revenue comes with recurring responsibility or just recurring anxiety. Public bodies, MSPs, and the industry’s talent for turning failure into beige process language all come under fire. This is a rant, a reckoning, and a refusal to pretend this is fine. Chapters Cold Open Noel opens with cold fury, warning listeners this is a rant. FortiBleed has hit British embassies, the Foreign Office, and the British Council. He refuses to deliver the vendor-friendly version or pretend the complexity excuses the pattern. Fortinet’s ubiquity in critical infrastructure makes its repeated appearance in exploitation headlines unforgivable. The Safe Bit The firewall was sold as the safe bit, the thing with the green dashboard and the procurement-friendly quote. It turns out it was just another internet-exposed computer holding keys and terminating VPN sessions. Noel is tired of the cycle: advisory, exploitation, emergency guidance, carefully worded statement, patch advice, shuffle on. The Fortinet Question The question is not just whether customers patched. Fortinet sells security and confidence. Why does one of the largest security vendors on the planet keep ending up in headlines around exploited edge devices, credential exposure, and large scale customer panic? This is a reputational and governance problem. The Price Of Being Big All vendors have vulnerabilities, but frequency, pattern, and blast radius matter. If your kit is everywhere, your mistakes are everywhere. You do not get giant market share and giant recurring revenue, then act wounded when people expect giant levels of assurance. You wanted the market; now carry the weight. Hard Coded Credentials Noel drags the hard coded credentials issue back into the room, referencing Fortinet’s PSIRT entry for dummy testing data in FortiManager and FortiAnalyzer. Hard coded credentials in security software is a phrase that should make eyebrows leave faces. The optics are appalling when your commercial promise is trust. Mythos And Glasswing Anthropic has deployed Claude Mythos Preview, a frontier AI model, to find and fix vulnerabilities in critical software as part of Project Glasswing. Firewalls are critical software. Noel demands to know whether Fortinet has access to Mythos or an equivalent, because edge security appliances should be attacked internally before criminals get the pleasure. The Licence Model Fortinet’s business model is wrapped in recurring licences. Customers pay annually because threats move daily. But recurring revenue must come with recurring responsibility. If you charge every year, your product security has to move every day. Otherwise, what are customers renewing: protection, or access to the next apology? Subscription To Anxiety Customers were sold maturity, scale, and expertise. FortiBleed makes it feel upside down. The firewall became the risk conversation. The security vendor became the source of anxiety. The recurring licence starts to look like a subscription to anxiety with rack ears. Public Sector Trust British embassies, the British Council, and Foreign Office credentials are reportedly in the mix. People give data to public bodies because they have to. They do not get to inspect the firewall first. They just get the email afterwards, the one about an abundance of caution. Caution is never abundant before the breach. MSPs Do Not Get To Hide If you sold this kit, you own the conversation. If you manage it, you produce evidence. Vanishing behind a ticket note saying awaiting customer instruction is cowardice with a service desk reference. The edge is where the attack starts. If your definition of managed is occasionally aware, stop using the word managed. Why I Am Angry Noel is angry because the same story keeps coming back. A company with Fortinet’s scale should be held to a brutal standard. Customers pay recurring money for security and still wonder whether the security product is the problem. Hard coded credentials should haunt people longer than one advisory cycle. Public bodies always find caution after the fact. Final Vent Noel does not want the soothing statement or the partner deck. He wants someone to answer the question: why does one of the biggest security vendors keep ending up in these conversations? What is being done inside the product? Is frontier AI being thrown at the code? The firewall was meant to be the line of defence. FortiBleed made it look like the line of failure. Links https://www.anthropic.com/research/glasswing-ai-for-vulnerability-discovery https://www.fortinet.com/psirt https://www.ncsc.gov.uk/news/ncsc-issues-alert-fortinet-fortigate-vulnerability

10:19

Jul 3, 2026

Why Small Businesses Keep Failing ICO Audits (And How to Fix It This Week)

Why Small Businesses Keep Failing ICO Audits (And How to Fix It This Week) The Information Commissioner’s Office isn’t hunting your business, but that doesn’t stop small organisations from making the same three avoidable mistakes. Host Noel Bradford examines twelve recent ICO enforcement notices to identify the most common failures: no documented breach response process, insufficient staff training on what constitutes personal data, and no record of processing activities. These aren’t exotic compliance gaps requiring expensive consultants or new platforms. They’re basic governance failures that can be fixed with a one-page process document, practical staff training, and a simple spreadsheet. The real exposure isn’t regulatory enforcement, it’s the internal fog that leaves staff unable to recognise or report incidents, managers unclear on ownership, and directors unable to explain what data the business holds. This episode cuts through vendor fear-mongering and compliance theatre to deliver three practical actions any small business can implement immediately, with no budget required. Chapters Cold Open The ICO is not actively hunting small businesses, which makes the persistent compliance failures all the more frustrating. Intro Analysis of twelve recent ICO enforcement notices reveals three recurring, avoidable failures that don’t require consultants or expensive tools to fix. Failure One: No Documented Breach Response Process Organisations freeze when incidents occur because nobody knows who to call, what to document, or when the clock starts. The real damage begins with the paralysis, not the breach itself. Failure Two: No Staff Training on Personal Data Employees cannot recognise breaches if they don’t understand that personal data includes names, addresses, payroll information, and customer records, not just obviously sensitive material. Failure Three: No Record of Processing Activities Businesses cannot answer basic questions about what personal data they hold, why they hold it, where it lives, or how long they keep it. This isn’t bureaucracy, it’s stock control for trust. The Vendor Problem None of these three failures required vendor solutions to prevent. Fear-based marketing keeps small businesses terrified rather than informed, selling tools instead of addressing governance gaps. The Real Exposure The true risk isn’t ICO enforcement but internal fog: staff who don’t know what to report, managers unclear on ownership, and directors unable to explain data holdings when complaints arrive. What to Do This Week Three practical actions requiring no budget: write a one-page breach response process, train staff with real examples from your business, and build a basic record of processing activities. The Team Meeting Test Ask your team three questions: who would you tell if you sent personal data to the wrong person, what would you document, and where is our list of personal data holdings. Silence reveals your incident. Close Read three public ICO notices before your next management meeting to understand what small organisations keep getting wrong and why the fixes are boring, free, and available immediately. Links https://ico.org.uk/for-organisations/report-a-breach/ https://ico.org.uk/for-organisations/accountability-framework/records-of-processing/ https://ico.org.uk/action-weve-taken/enforcement/

8:49

Jul 2, 2026

When Your Security Stack Becomes the Attack Surface

When Your Security Stack Becomes the Attack Surface Microsoft’s security tools are supposed to protect small businesses, but recent vulnerabilities have turned that premise on its head. GreatXML exploits weaknesses in BitLocker and the Windows Recovery Environment, allowing attackers with physical access to bypass disk encryption protections. RoguePlanet, meanwhile, leverages a race condition in Microsoft Defender’s malware protection engine to escalate privileges to SYSTEM level. Both issues highlight an uncomfortable reality: the integrated security stack that SMBs have been told to trust can itself become part of the threat model. This episode examines what went wrong, where responsibility lies, and why small businesses must stop treating vendor tooling as articles of faith. BitLocker and Defender remain valuable components of enterprise defence, but they require proper configuration, monitoring, and a realistic understanding of their limitations. Physical access attacks matter when laptops travel with staff. Local privilege escalation matters when attackers already have a foothold. And vendor responses matter when defenders are left scrambling to assess risk while corporate statements remain vague. The episode dissects both vulnerabilities, critiques Microsoft’s handling of the disclosure process, questions the researcher’s approach to public release, and ultimately argues that SMBs must move from buying comfort to buying outcomes. Security tools reduce risk; they do not eliminate the need for judgement, hardening, or accountability. Chapters Cold Open Microsoft security tools became part of the attack surface. Intro Setting up the issue: when the safety rails become the attack path, and why small businesses should care. What GreatXML Is Explaining the BitLocker and Windows Recovery Environment vulnerability that exploits unattend.xml and recovery state. What RoguePlanet Is Breaking down the Microsoft Defender race condition that enables local privilege escalation to SYSTEM level. Who Am I Angry At? Assigning responsibility between Microsoft’s process failures and the researcher’s public disclosure approach. The Real Business Lesson Why SMBs must stop buying comfort and start demanding outcomes, configuration discipline, and monitoring. The Closing Punch Final verdict on trust, transparency, and the need for engineering responses over brand management. Links https://nvd.nist.gov/vuln/detail/CVE-2026-50656 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656

10:38

Jun 6, 2026

Your Business Is an Open Book

Your Business Is an Open Book Most small businesses have been building a public intelligence profile for years without realising it. Every LinkedIn update, team photo, and website contact page adds detail to a picture that anyone can view, including those with malicious intent. This episode examines open source intelligence (OSINT) and how publicly available information becomes the foundation for targeted attacks like spear phishing and invoice fraud. Noel Bradford walks through the reconnaissance process, from Companies House filings to social media posts, demonstrating how an attacker can map your business, identify key staff, and craft convincing impersonation emails in under twenty minutes. The episode provides practical steps for auditing your own digital footprint, including what to check on search engines, how to review your Companies House entry, and why listing every software tool on LinkedIn might not be wise. This is not about disappearing from the internet; it is about making conscious choices about what you publish and understanding who else is reading it. Chapters Welcome Introduction to the concept of OSINT and how small businesses inadvertently publish reconnaissance material about themselves through normal business activities. Body A detailed walkthrough of public information sources including Companies House, LinkedIn, business websites, and social media. Explains how attackers use this data to construct targeted spear phishing campaigns, with practical examples of reconnaissance leading to invoice fraud and credential theft. Concludes with five actionable steps for auditing and managing your business’s public profile. Outro Final reminder that OSINT is simply reading publicly available information with intent, and that small businesses can reduce risk by auditing their own footprint and making conscious publishing decisions. Links https://www.gov.uk/government/organisations/companies-house https://www.linkedin.com https://www.ncsc.gov.uk/guidance/phishing

7:48

Jun 5, 2026

Cyber Essentials Platform Transition: What the July Deadline Means for You

Cyber Essentials Platform Transition: What the July Deadline Means for You The Cyber Essentials scheme is transitioning from its Willow platform to the new Danzell version, with a go-live date now set for 6 July. Noel Bradford cuts through the noise to explain what this extension actually means for small businesses holding or pursuing certification. If you are mid-assessment, you need to check with your certification body about completion requirements. If you are planning a new assessment, you will be working under the updated Danzell question set, which brings tightened wording and updated evidence requirements across the five core technical controls. Businesses often hear the word ‘extended’ and relax, but your certificate expiry date has not changed. Contract requirements remain in force. This episode walks through the practical steps you need to take now, whether you are renewing, starting fresh, or supporting clients through the transition. The platform update reflects real shifts in how small businesses operate, from cloud services to remote working. Prepare properly, read the updated guidance, and do not wait for your assessor to chase you. Chapters Welcome Noel Bradford introduces the topic: the Cyber Essentials platform transition, a shifted deadline, and why businesses need to update their plans accordingly. Platform Transition Explained The Cyber Essentials scheme is moving from Willow to Danzell, with a new go-live date of 6 July. Noel explains what each platform is, who runs the scheme, and why the word ‘extended’ does not mean businesses can relax. He covers what the transition means for mid-assessment businesses, those starting fresh, and the practical differences in the Danzell question set. The five core technical controls remain, but wording, scope questions, and evidence requirements have been updated. Noel warns against reusing old templates, stresses the importance of checking your certificate expiry date, and highlights the risk of confusing the platform delay with your personal compliance deadline. He also addresses MSPs and IT support businesses, urging them to communicate the change to clients now rather than waiting for panic calls later. Outro Noel summarises the key actions: talk to your certification body if you are mid-assessment, get the Danzell guidance if you are planning a new assessment, and check your certificate expiry date today. The extension is not a problem; ignoring it is.

11:08

Jun 4, 2026

Passkeys Are Not Magic, But They Are Better Than Passwords

Passkeys Are Not Magic, But They Are Better Than Passwords Noel Bradford examines passkeys, a rare security improvement that reduces phishing risk and removes the burden of password memorisation. Drawing on NCSC guidance, he explains why passkeys are resistant to credential theft, how they use cryptography tied to the service you’re logging into, and why they can be easier for users than traditional passwords. He then offers practical adoption advice for small businesses: prioritise high-value accounts, choose approved credential managers, plan device recovery carefully, and train users without the hype. Passkeys won’t fix bad governance or unmanaged devices, but they do represent a serious upgrade from password-based authentication. For accounts that touch money, data, or admin access, this is progress worth planning properly. Chapters Welcome Noel opens by framing passkeys as a rare security improvement that may make life safer and less annoying. He notes the NCSC recommends using passkeys over passwords wherever they’re available, and describes passwords as tired after decades of asking normal people to behave like flawless security robots. Why Passkeys Are Better Than Passwords Noel explains that passkeys move the security burden from human memory to devices proving identity properly. They are resistant to phishing because they use cryptography tied to the service, so fake sites cannot trick users into handing over reusable secrets. He offers practical adoption advice: prioritise high-value accounts (admin, finance, email, cloud), choose approved credential managers, plan device recovery, train users in plain English, and avoid half-rolled-out projects. Passkeys do not fix bad governance or unmanaged devices, but they do reduce credential theft risk. Outro Noel closes by saying passkeys are not magic, but they are a serious upgrade from passwords. They reduce phishing risk and password fatigue. Check which key business services already support passkeys, prioritise critical accounts, document recovery, train users, and keep strong passwords and multi-factor authentication where passkeys are not yet available. Links https://www.ncsc.gov.uk/collection/device-security-guidance/authentication-policy/use-passkeys-instead-of-passwords https://www.cisa.gov/secure-our-world/use-strong-passwords

9:53

Jun 3, 2026

MFA Fatigue Is a Management Failure, Not a User Problem

MFA Fatigue Is a Management Failure, Not a User Problem Multi-factor authentication is essential, but not all MFA is equal. When users receive vague, repeated, or poorly explained prompts, they start treating them like cookie banners: accept, accept, make it go away. Attackers exploit this fatigue by triggering prompts under pressure, impersonating IT support, or using social engineering to bypass weak helpdesk processes. This is not a user failure; it is a design and management failure. Businesses must reduce unnecessary authentication noise, use phishing-resistant methods like number matching, train staff to recognise unexpected prompts as attack signals, and strengthen identity verification processes. A reported prompt that turns out to be nothing is a working security culture. A prompt nobody reports because everyone fears looking stupid is how expensive conversations with insurers begin. MFA is a control, not a confession booth. If it fails, look at the whole process: the prompt design, the training, the helpdesk, the call-back procedures, and the culture that prioritises speed over verification. Stop blaming users for predictable mistakes in badly designed systems. Chapters Welcome Noel defends MFA while attacking poor MFA design, lazy user blame, and weak verification processes. Not all MFA is equal: some is clear and strong, some is so noisy and vague that users treat prompts like cookie banners. That is design failure, not user failure. Body Noel explains why MFA fatigue happens and how attackers exploit pressure, urgency, and process gaps. Attackers trigger repeated prompts, impersonate IT, and use social engineering. Businesses must ask why users received repeated prompts, why prompts were unclear, why training was absent, and why helpdesk processes were weak. MFA is a decision point, not a magic forcefield. UK SMBs should use number matching, reduce pointless prompts, teach staff what unexpected prompts mean, and strengthen helpdesk verification. MFA fatigue is often a management failure wearing a user blame costume. People are not the weakest link; unsupported people are. Outro Noel closes by stating that MFA is a control, not a confession booth. If it fails, look at the whole process: the prompt, the training, the helpdesk, the call-back process, the culture. Move away from simple push approval, train staff to report unexpected prompts, reduce authentication noise, and strengthen identity checks. Stop blaming users for predictable mistakes in badly designed systems. Links https://www.ncsc.gov.uk/collection/small-business-guide https://www.cisa.gov/ https://www.ftc.gov/business-guidance/small-businesses https://www.fcc.gov/general/cybersecurity-small-business

12:29

Jun 2, 2026

WiFi Surveillance: When Your Router Becomes a Camera

WiFi Surveillance: When Your Router Becomes a Camera WiFi feels like plumbing. It’s boring, invisible, and trusted by default. But research from Karlsruhe Institute of Technology shows that ordinary WiFi signals can now identify people with near-perfect accuracy, even when they’re not carrying an active device. This isn’t science fiction or a reason to panic. It’s a signal that infrastructure we consider neutral can become surveillance without looking like it. For small businesses, the challenge isn’t the technology itself. WiFi, sensors, CCTV, door access, and meeting room systems can all be genuinely useful. The problem is treating them as operational kit rather than privacy decisions. Noel Bradford walks through the uncomfortable reality that clever dashboards, vendor promises, and boring boxes on the ceiling can quietly collect more data than anyone has thought through. The solution isn’t to rip access points off the wall. It’s to stop assuming that boring infrastructure is harmless infrastructure, and to ask the awkward governance questions before the router starts behaving like a camera. Chapters Welcome Noel introduces WiFi identification research and frames it as an invisible surveillance problem, not a reason to panic. Body Noel explains the WiFi sensing research in plain English and connects it to privacy, small business infrastructure, CCTV-style thinking, and practical governance. Outro Noel closes by saying WiFi surveillance is not a panic story, but it proves infrastructure can become surveillance and needs governance. Links https://www.sciencedaily.com/releases/2026/05/260522.htm

10:01

May 29, 2026

When Your SaaS Dashboard Looks Like Times Square

When Your SaaS Dashboard Looks Like Times Square SaaS dashboards are increasingly cluttered with upsells, AI buttons, trial offers, and partner adverts, turning essential admin portals into noisy digital shopping centres. This creates a serious security problem: when every banner demands attention, users learn to ignore warnings, including genuine security alerts about suspicious logins, new integrations, or privilege changes. For small businesses managing limited admin resources, this clutter destroys the attention needed to spot real threats. The NCSC cloud security principles remind us that shared responsibility means businesses still own access, configuration, and data decisions, even in SaaS environments. SaaS sprawl compounds the issue: too many tools, too many integrations, too many admin accounts, and not enough people asking what each service can actually see. This is not just a usability complaint; it is a governance, supplier risk, and data protection concern. Vendors must stop treating admin portals like marketing real estate and give administrators clarity, exportable logs, and usable security signals. Small businesses, meanwhile, must review their SaaS estate, assign ownership, remove dormant integrations, enforce MFA, and route security alerts to monitored channels. Attention is a finite control, and SaaS clutter is selling it back to businesses one popup at a time. Chapters Welcome Noel opens by attacking the way SaaS dashboards now mix work, adverts, upsells, alerts, and AI clutter, arguing that when every button screams for attention, nobody hears the one that matters. Body Noel explains how cluttered SaaS dashboards create warning fatigue, hide security signals, increase integration risk, and make small businesses worse at managing cloud services. He covers shared responsibility under NCSC cloud security principles, the governance risks of SaaS sprawl, and practical steps for reviewing the SaaS estate, reducing noise, and demanding better vendor transparency. Outro Noel closes by arguing that SaaS clutter destroys attention and that small businesses need ownership, review, and better vendor questions. He provides a checklist: create a SaaS tool list, assign owners, remove unused integrations, route security alerts properly, and ask vendors how they separate security signals from marketing noise. Links https://www.ncsc.gov.uk/collection/cloud/the-cloud-security-principles https://www.cisa.gov/resources-tools/resources/secure-by-demand

10:16

May 28, 2026

AI Vulnerability Discovery Will Make Patch Queues Worse

AI Vulnerability Discovery Will Make Patch Queues Worse AI-assisted vulnerability discovery is accelerating the rate at which security flaws are found and reported. For researchers and vendors, this is progress. For small businesses already struggling with patch management, it means more advisories, more prioritisation pressure, and more noise. Noel Bradford warns that faster discovery will expose weak processes, not fix them. Without a proper asset inventory, clear ownership, agreed maintenance windows, and documented exceptions, businesses risk drowning in patch queues they cannot manage. This episode cuts through the hype to explain why AI-driven vulnerability intelligence demands better fundamentals, not heroic firefighting. UK businesses can start with Cyber Essentials as a baseline for supported software and security updates. US organisations can map similar thinking through CISA’s Secure by Demand guidance. The message is consistent: faster threat intelligence only helps if your business can make faster, informed decisions. Speed without process is just louder failure. Chapters Welcome Noel opens by warning that AI-assisted vulnerability discovery may help defenders, but it will also increase patch pressure for small businesses. Body Noel explains that faster vulnerability discovery means more patch noise, more prioritisation pressure, and a greater need for asset inventory, supported software, and maintenance windows. Outro Noel closes by warning that AI will expose weak patch processes and gives practical SMB actions. Links https://www.ncsc.gov.uk/ https://www.gov.uk/ https://www.ncsc.gov.uk/cyberessentials/overview https://www.cisa.gov/

12:49

May 27, 2026

Cyber Crime Is a Business Risk, Not Just an IT Budget Line

Cyber Crime Is a Business Risk, Not Just an IT Budget Line Cyber crime has become a mainstream business risk, yet many UK SMBs still treat it as an IT problem to be quietly managed between printer issues and password resets. In this Hot Take, Noel Bradford argues that scams, fraud, ransomware, and account compromise belong on the risk register alongside cashflow, supplier risk, and customer retention. Drawing on recent British Chambers of Commerce data showing that 21% of firms experienced cyber attacks and 20% reported fraud or scams in the past year, Noel challenges the notion that security is an optional grudge purchase. He makes the case that cyber incidents ultimately land in the business, not just the server cupboard, affecting finance, operations, sales, HR, legal, and leadership. The episode reframes security spending as growth protection and resilience, not compliance theatre, and offers practical questions business owners should ask before an incident forces them to learn the hard way. For UK SMBs and US listeners alike, the message is clear: if cyber only lives in your IT budget, leadership has already failed the first test. Chapters Welcome Noel opens by framing cyber crime as a business problem with IT consequences, not just a server cupboard issue. He highlights the real costs: time lost, money lost, trust lost, growth delayed, and staff pulled into incidents they didn’t cause. Cyber Crime as Business Risk Noel unpacks recent British Chambers of Commerce data showing that 21% of UK firms experienced cyber attacks and 20% reported fraud or scams. He argues that cyber incidents, whether ransomware, invoice fraud, or account takeover, all land in the business, affecting finance, operations, sales, HR, legal, and leadership. He challenges the habit of treating cyber as a grudge purchase and calls for it to be budgeted alongside cashflow, supplier risk, and customer retention. The section includes US parallels via FTC and CISA guidance, and closes with practical questions business owners should ask to map risk, assign decision ownership, and plan resilience before an incident strikes. Outro Noel delivers the Hot Take: cyber crime is now a cost of doing business and must be treated as such. He urges leaders to add cyber and fraud to the risk register, review payment controls, assign incident decision owners, map critical systems, and budget for resilience. He warns that firewalls won’t fix weak governance or rebuild trust, and leadership must act before an incident, not during a panicked Teams call. Links https://www.britishchambers.org.uk/ https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2024 https://www.ftc.gov/business-guidance/small-businesses https://www.cisa.gov/resources-tools/resources/small-business-resources

10:55

May 26, 2026

The Backup Lie: Why Green Ticks Won't Save Your Business

The Backup Lie: Why Green Ticks Won’t Save Your Business Most small businesses have backups. Few have tested recovery plans. In this uncompromising episode, Noel Bradford dismantles the dangerous assumption that backup equals recovery readiness. Drawing on NCSC and ICO guidance, he explains why green dashboard ticks, successful job reports, and monthly invoices create false confidence. Businesses fail not from encryption alone, but from downtime, confusion, missing credentials, and broken assumptions. Noel walks through the uncomfortable questions every UK small business must answer: what can you actually restore, by when, from where, and who knows how? He covers the cloud backup gap, the difference between platform availability and data recovery, and why testing turns backup from belief system into evidence. This is not about technology. It is about knowing what happens at 9am on a Monday when your main systems go down. Stop worshipping green ticks. Start proving you can get back to work. Chapters Welcome Noel opens by attacking the comforting myth that having backups is the same as being able to recover. He argues that many small businesses have green ticks, dashboards, and reports, but lack a genuine recovery plan. Body Noel explains why backup success does not prove recovery readiness. He references NCSC ransomware guidance and ICO data protection obligations, then walks through the uncomfortable questions businesses avoid: what can you restore, by when, from where, and who knows how? He covers common failure modes, the cloud backup gap, credential management, and the difference between platform availability and data recovery. Testing, he argues, turns backup from belief into evidence. Outro Noel closes by stating that an untested backup is a rumour and a green tick is false confidence. He gives practical recovery questions for small businesses: what do we restore first, how long will it take, who does the restore, and what happens if the backup system itself is affected? Backups are not the finish line. Recovery is. Links https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks https://ico.org.uk/for-organisations/guidance-on-ransomware/ https://www.cisa.gov/stopransomware

15:49

May 25, 2026

Shadow AI Is Just Shadow IT Wearing a Cape

Shadow AI Is Just Shadow IT Wearing a Cape Shadow AI has already arrived in most UK small businesses, often through browser tabs, SaaS tool sidebars, and helpful buttons that promise to improve text. Staff are using AI to rewrite emails, summarise meetings, polish proposals, and speed up admin tasks, frequently without approval, policy, or controls. This is shadow IT all over again, but faster and with better branding. The problem is not the technology itself, but unmanaged data movement into systems nobody has reviewed. Noel Bradford explains why banning AI without offering safe approved routes will fail, why hope is not an AI governance model, and why businesses need practical data controls that give staff clear lanes: low-risk generic tasks, controlled handling of customer data, and hard stops for sensitive material. UK Government guidance and NCSC advice make clear that AI changes the threat landscape, but the basics still matter. This episode cuts through the hype to deliver straightforward guidance on approved tools, supplier checks, human review, and early mistake reporting. AI policy is not about stopping progress; it is about stopping progress from leaking your business into someone else’s platform. Chapters Welcome Noel opens by calling shadow AI the new shadow IT, warning that most businesses already have unmanaged AI use happening through browsers, SaaS tools, and helpful buttons, even when leadership believes it has been avoided or controlled. Body Noel explains why unmanaged AI creates data governance, supplier risk, and access control problems. He argues that banning AI without offering safe approved routes will fail, and that businesses must give staff clear lanes for low-risk tasks, controlled customer data handling, and hard stops for sensitive material. He emphasises supplier checks, human review, accuracy risks, and early mistake reporting. Outro Noel closes by stating that shadow AI is already in the building and the question is whether businesses manage it properly or discover it during a customer complaint, DSAR, or regulator call. AI policy is not about stopping progress, but about preventing unmanaged workflows from leaking business data into unapproved platforms. Links https://www.gov.uk/government/publications/uk-government-open-letter-on-ai-cyber-threats https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat https://www.ftc.gov/business-guidance/small-businesses/cybersecurity https://www.cisa.gov/securebydemand

10:55

May 24, 2026

Curiosity as a Control: Why Asking Questions Beats Buying Tools

Curiosity as a Control: Why Asking Questions Beats Buying Tools Noel Bradford argues that curiosity is one of the cheapest and most overlooked security controls in small business cyber defence. Many organisations inadvertently train staff to suppress suspicion in favour of speed, creating environments where invoice fraud, phishing, and social engineering thrive. Drawing on NCSC guidance for UK businesses and parallel FTC and CISA frameworks for US audiences, Noel examines why reporting culture matters, how business pressure undermines vigilance, and what practical steps leaders can take to make curiosity socially safe. The episode reframes people not as the weakest link, but as a critical defensive layer when properly supported. Noel challenges businesses to praise false alarms, enforce verification processes for senior staff, and create frictionless reporting routes. This is not soft advice. It is operational security for organisations that cannot afford to reward silence. Chapters Welcome Noel introduces curiosity as the cheapest cyber security control most small businesses actively suppress, setting up the argument that organisational culture often trains people not to notice warning signs. Body Noel examines how UK NCSC guidance encourages reporting suspicious activity, yet many businesses reward speed over judgement. He explores invoice fraud, phishing, and social engineering scenarios where curiosity would prevent losses, and explains why false alarms are evidence of a functioning control. Practical steps include making reporting frictionless, enforcing verification for senior staff, and praising employees who raise concerns. Outro Noel closes by reframing people as a defensive layer when properly supported, not as the weakest link. He challenges businesses to treat curiosity as a control, normalise friction in high-risk processes, and recognise that attackers exploit culture as readily as they exploit technology. Links https://www.ncsc.gov.uk/collection/small-business-guide https://www.ncsc.gov.uk/information/report-scam-email https://www.ftc.gov/business-guidance/small-businesses https://www.cisa.gov/topics/cybersecurity-best-practices

16:24

May 23, 2026

CCTV Is a Networked Computer System with Cameras (and Possibly Microphones)

CCTV Is a Networked Computer System with Cameras (and Possibly Microphones) Noel Bradford challenges the persistent misconception that CCTV sits outside the cyber security estate. Many small businesses still treat cameras, recorders, door access systems and similar connected devices as facilities kit rather than networked computer systems requiring proper ownership, patching, segmentation and access controls. Modern CCTV often ships with audio capability, adding privacy and governance questions that many organisations have never considered. This Hot Take walks through the practical steps UK small businesses should take to inventory connected devices, control remote access, segment networks, disable unnecessary features like audio recording, and assign clear ownership. The episode references UK guidance from NCSC, ICO and DSIT, with parallel observations for US listeners drawing on CISA and FCC frameworks. If a device has an IP address or a microphone, it counts. Bolted to a wall doesn’t mean exempt from reality. Chapters Welcome Noel reframes CCTV as part of the cyber security estate, not just facilities kit, and highlights that many modern cameras ship with audio capability that often goes unmanaged. Body Noel explains why CCTV, NVRs, door access systems, smart screens and similar connected devices need ownership, segmentation, patching and proper remote access controls, with particular attention to audio recording as a privacy and governance question. Outro Noel closes with the core line that connected facilities systems are management problems with network cables and microphones, urging small businesses to treat any device with an IP address or microphone as part of the estate. References Source notes for production review covering NCSC, ICO and DSIT guidance for UK listeners, with parallel observations for US audiences drawing on CISA and FCC frameworks. Links https://www.ncsc.gov.uk/collection/smart-devices https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/ https://www.gov.uk/government/organisations/department-for-science-innovation-and-technology https://www.cisa.gov/ https://www.fcc.gov/

15:55

May 22, 2026

Cyber Security Is Not Broadband

Cyber Security Is Not Broadband Noel Bradford unpacks a vendor meeting that went sideways and exposes a wider problem in the small business cyber market. As the UK’s cyber security sector grows to 2,603 firms generating £14.7 billion in annual revenue, more suppliers are packaging cyber protection like broadband bundles: one monthly fee, one portal, one reassuring product name. But when light services hide behind heavy language, small businesses get packages instead of protection. Drawing on the UK Government’s Cyber Security Sectoral Analysis 2026 and real-world incident management experience, Noel explains the difference between genuine incident response and signposting with a login. He challenges the gap between what vendors promise and what customers actually receive when something goes wrong. This episode asks awkward questions about dark web monitoring, phishing simulation, insurance wrappers, and who really owns the incident when the clock is ticking. If you are a small business owner evaluating a cyber bundle, or a vendor selling one, this is essential listening. Cyber security is not a utility. It is not broadband. And when we sell it like broadband, we make ‘do nothing’ the stronger competitor. Chapters Welcome Noel introduces the episode after being pulled into a vendor meeting cold. He explains that cyber security is being bundled, packaged, and sold like broadband, but the analogy breaks when small businesses need real protection instead of tidy portals. The Cyber Sector Is Booming Noel cites the UK Government’s Cyber Security Sectoral Analysis 2026, which reports 2,603 active UK cyber firms, 69,600 full-time equivalent employees, and £14.7 billion in annual revenue. A bigger sector does not automatically mean better security for small businesses. Dragged Into The Call Noel describes joining a vendor call without context and immediately spotting a small business cyber bundle featuring dark web scanning. He explains when dark web monitoring can be useful and when it becomes a scare lever without follow-through. The Bundle Noel breaks down the bundle components: dark web monitoring, phishing simulation, privacy tools, cyber insurance, and incident response. He explains that none are inherently bad, but stacking five useful-sounding things together does not create a strategy without honest scoping and clear ownership. Incident Response Or Signposting With A Headset Noel explains the difference between real incident management and light advice. Proper incident response involves containment, evidence handling, insurer engagement, legal coordination, and recovery planning. At low five figures, it is not a £25 add-on, and signposting is not the same as ownership. Midroll Bumper Noel resets before moving into the insurance and channel problem. He reminds listeners that cyber security does not have to be expensive, but ignoring it always is. The Insurance Comfort Blanket Noel examines the bundle’s £25 per month price point and limited insurance cover: GDPR breach costs and fines capped at £25,000 per incident. He explains that the fine is often not the expensive part. The response is, and a small insurance wrapper is a sticky plaster, not a strategy. The Pitch Breaks Noel describes how the vendor disengaged when he asked what the service actually did. When a cyber product cannot survive basic questions from an MSP, it is not ready for small business customers. The Wider Channel Problem Noel connects the incident to the wider issue of telcos, insurers, software vendors, and MSPs moving into small business cyber. If sector growth turns into a land grab with light bundles and heavy language, the real competitor, ‘do nothing’, becomes stronger. Outro Noel offers practical advice. Small business owners should ask who owns the incident, who speaks to the insurer, and what the service does at two in the morning. Vendors should stop hiding light services behind heavy language. Cyber security is not broadband. Links https://www.gov.uk/government/organisations/department-for-science-innovation-and-technology https://www.gov.uk/government/publications/cyber-security-sectoral-analysis-2026

15:06

May 21, 2026

Microsoft Authenticator Isn't Magic: The Token Leak Nobody Wants to Talk About

Microsoft Authenticator Isn’t Magic: The Token Leak Nobody Wants to Talk About Microsoft Authenticator has become the identity gatekeeper for millions of Microsoft 365 users, but CVE-2025-41615 exposes a critical flaw that can leak work account access tokens after user interaction. Noel Bradford unpacks why this ‘information disclosure’ vulnerability is really an identity compromise risk, why the CVSS score debate misses the point, and why treating MFA apps as sacred cows instead of managed software creates dangerous blind spots. This episode challenges IT providers to move beyond tick-box security, explains what access tokens actually do, and delivers a practical seven-step response plan for UK small businesses and MSPs. If your defence relies on assuming automatic updates will save you, you’re not managing risk—you’re outsourcing it to hope. MFA is essential, but the app protecting it needs governance, patching, and accountability. Chapters Intro Noel introduces CVE-2025-41615, a vulnerability in Microsoft Authenticator that can expose work account access tokens. He frames the real issue: businesses treat MFA apps as magic instead of managed software that sits inside critical identity infrastructure. What a Token Actually Means An explanation of how access tokens work as temporary proof of authentication, why token theft enables attackers to act as signed-in users, and why ‘information disclosure’ labels hide serious identity compromise risks. Stop Worshipping the Score Noel addresses the CVSS scoring split between Microsoft (9.6 Critical) and NIST (7.4 High), arguing that business risk assessment matters more than score theatre when the affected control is your identity gatekeeper. The Sacred Cow Problem A challenge to IT providers who treat MFA as a magic shield. Noel asks who actually knows what versions users are running, whether admin accounts depend on unmanaged personal devices, and whether providers can prove their users are patched. The User Interaction Excuse Needs to Die Why ‘user interaction required’ is not reassuring when attackers only need busy, distracted humans to approve one malicious request. Includes guidance on denying unexpected Authenticator prompts. What to Do Today Seven practical steps for UK SMBs and MSPs: update Authenticator to safe versions (Android 6.2605.2973+, iOS 6.8.47+), prioritise privileged accounts, verify updates via MDM, review sign-in logs, consider session revocation, tighten Conditional Access, and move towards phishing-resistant authentication. Outro Noel closes with reassurance that MFA remains essential but must be treated as managed software, not magic. He urges businesses to demand evidence and accountability from IT providers instead of accepting assumption as assurance. Links https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-41615 https://nvd.nist.gov/vuln/detail/CVE-2025-41615 https://www.heise.de/news/Kritische-Luecke-Microsoft-Authenticator-koennte-Firmen-Tokens-leaken-10380757.html

15:44

May 19, 2026

Europol Just Admitted Cybercrime Is an Industry

Europol Just Admitted Cybercrime Is an Industry Europol’s IOCTA 2026 report, published on 28 April 2025, describes cybercrime not as isolated attacks but as a connected industrial economy. More than 120 active ransomware brands operated in 2025, with affiliate programmes offering margins of 80 to 85 per cent. Modern extortion has shifted from encryption to data leak threats, making backups necessary but insufficient. Industrial-scale SIM farms, such as the Latvian operation involving seven nationals, 1,200 devices, 40,000 SIM cards, and more than 49 million fraudulent accounts, now underpin the majority of online fraud. The report highlights enablers including residential proxies, bulletproof hosting, and crypto payment rails. Europol identifies a velocity gap: criminals move faster than law enforcement can respond. For UK small businesses, this matters because too much of the security industry still sells compliance theatre rather than defence against an industrial threat. This episode examines what the report actually says, what ransomware now looks like, why SMS authentication is dangerously weak, and three practical actions any small business can take this week. Chapters Intro Noel introduces Europol’s IOCTA 2026 report and argues that cybercrime has industrialised into a market with suppliers, customers, and margins, while too much of the security industry sells comfort rather than defence. What the report actually says Europol describes a connected criminal economy where the same infrastructure supports multiple crimes. Key enablers include residential proxies, bulletproof hosting, and SIM farms. The velocity gap means criminals move faster than law enforcement can respond. Ransomware now has brands More than 120 active ransomware brands operated in 2025. Qilin offered affiliates 80 to 85 per cent of ransom payments. Modern extortion has shifted towards threatening to publish stolen data, making backups necessary but insufficient. The industry response problem Noel argues that the security industry too often sells compliance theatre rather than defence matched to an industrial threat. Cyber Essentials is a necessary baseline, but a certificate is not a security posture. Exhibit A: seven Latvians, forty nine million accounts A Latvian SIM farm case involved seven nationals, 1,200 devices, 40,000 SIM cards, and more than 49 million fraudulent accounts. Industrial-scale SIM farms underpin the majority of online fraud, exposing the weakness of SMS as proof of identity. What to do this week Three practical actions: email your IT supplier to ask if they have read IOCTA 2026 and what they have changed, audit SMS authentication in dangerous workflows, and review your ransomware plan for data leak scenarios. Outro Noel directs listeners to the full write-up on the blog and previews Friday’s long-form investigation into the SIM farm case. Links https://www.europol.europa.eu/publications-events/main-reports/iocta-2026 https://www.europol.europa.eu/media-press/newsroom/news/latvian-sim-farm-operation-busted

10:18

May 17, 2026

The Celebrity Stalkerware Leak: Not Encryption, Endpoint Compromise

The Celebrity Stalkerware Leak: Not Encryption, Endpoint Compromise In late April 2026, headlines screamed about 86,000 private screenshots leaked from a prominent European celebrity’s phone. The story dominated tech press coverage, but crucial context went missing. This was not hackers breaking encryption or sophisticated cyber warfare. It was endpoint compromise: stalkerware capturing screenshots directly from a device after messages had already been decrypted on screen. The database, allegedly linked to the collapsed Cocospy spyware ecosystem, contained WhatsApp chats, Instagram activity, invoices, intimate images and more. Whilst the core reporting appears sound, the framing obscured important truths. A VPN would not have stopped this attack. Encrypted messaging apps could not protect against malware already installed locally. And beneath the sensational headlines lies a grim pattern: commercial spyware marketed as parental monitoring or employee oversight, repeatedly exposed in breaches that reveal its real use in coercive control and domestic abuse. This episode unpacks what actually happened, why the technical details matter, and why we need to stop calling this surveillance software anything other than what it is. Chapters Intro Noel introduces the celebrity stalkerware leak story from April 2026, cutting through sensational headlines to frame what this incident actually was: endpoint compromise, not encryption failure. What The Story Claimed Breaking down the original ExpressVPN report by researcher Jeremiah Fowler, which detailed 86,859 screenshots from a celebrity’s device, including encrypted app content, intimate images and personal data. This Was Not Breaking Encryption Clarifying the critical technical misunderstanding: the spyware did not crack WhatsApp or Signal encryption. It simply captured screenshots after messages were already decrypted and displayed on screen. The Cocospy Bit Unpacking the Cocospy connection. The spyware ecosystem collapsed in 2025 after a massive breach, but leftover infrastructure appears linked to this incident, which targeted one victim rather than millions. The VPN Problem Addressing the uncomfortable commercial context: the story appeared on ExpressVPN’s blog, yet a VPN would not have prevented this attack. Transparency and vendor-owned media ecosystems matter in security reporting. The Bigger Issue Nobody Talks About The depressing normalisation of stalkerware. Marketed as parental monitoring, these tools repeatedly surface in breaches exposing their use in coercive control and domestic abuse, not legitimate oversight. Outro Final verdict: the core story appears accurate, but framing matters. This was endpoint compromise, not encryption failure. And the industry should stop euphemising commercial spyware designed for abuse.

16:48

May 16, 2026

YellowKey and the BitLocker Assurance Problem

YellowKey and the BitLocker Assurance Problem Noel Bradford delivers a direct examination of YellowKey, the reported BitLocker bypass that exploits the Windows Recovery Environment on TPM-only configurations. This episode strips away vendor comfort narratives and green-tick dashboards to focus on what default encryption settings actually protect against when a laptop is stolen or accessed physically. Bradford explains how YellowKey targets trusted recovery paths rather than breaking encryption mathematics, why TPM-only BitLocker represents a convenience trade-off rather than maximum assurance, and how businesses confuse enabled controls with proven protection. The episode provides practical guidance on identifying high-risk devices, reviewing BitLocker protectors, implementing TPM plus PIN where appropriate, locking firmware settings, restricting USB storage, and properly escrowing recovery keys. Bradford argues that physical access remains a normal business risk through stolen laptops, lost devices, and compromised bags, not merely a theoretical attack scenario. The episode challenges boards and decision-makers to move beyond checkbox assurance and ask what their laptop security actually proves under adversarial conditions. Chapters Stop Treating BitLocker Like Magic Bradford opens with a direct challenge to businesses that rely on default BitLocker settings and dashboard indicators as proof of security, arguing that enabled encryption is not the same as proven assurance. This Is About Recovery Explanation of how YellowKey exploits the Windows Recovery Environment rather than breaking encryption mathematics, targeting trusted recovery paths that systems use for legitimate repair operations. TPM Only: The Convenience We Pretended Was a Fortress Bradford examines TPM-only BitLocker as a usability trade-off that protects against some risks but may permit systems to unlock themselves in recovery contexts that attackers can exploit. Physical Access Is Still a Real Business Risk Reframing physical access as normal business risk through stolen laptops, lost devices in taxis, and bags taken from cars or hotels, not merely theoretical attack scenarios. Backdoor Claims and Evidence Bradford addresses the researcher’s reported claim that YellowKey appears deliberate whilst maintaining focus on operational risk management rather than speculation about intent. The Part That Should Make Boards Uncomfortable Examination of shallow security assurance in boardrooms, where checkbox answers to encryption questions fail to address configuration details, recovery key protection, and evidential requirements for regulators and insurers. What You Actually Do Now Practical guidance including identifying high-risk devices, reviewing BitLocker protectors, considering TPM plus PIN for sensitive roles, locking firmware, restricting USB storage, and properly escrowing recovery keys. Substack and Blog: The Safe Receipts Bradford directs listeners to companion materials on the blog and Substack for business impact analysis, mitigation checklists, and ongoing updates without exploit details. The Bigger Lesson: Assurance Is Not a Checkbox Closing argument that configuration, recovery paths, and physical access all matter, and that businesses must prove rather than assume what their laptop security protects against.