Small & Medium Businesses

SecAIQ is now a free mobile app for iPhone, iPad, Android phones and Android tablets: plain-language security and AI safety guides, free tools, a glossary and news, with no account needed.

Organisations are being urged to act now on a critical PHP issue that could allow attackers to execute commands on web servers. All PHP versions are affected and a fix has been released.

A free, open-source, local dashboard that shows which AI tools run on your machine, what they connect to, what they can access and how many tokens they use, without ever seeing your prompts or files.

How malware actually gets onto your devices, the warning signs of an infection, and the everyday habits that stop most attacks before they start.

You don't need a security team to have a plan. A simple, written incident response plan turns a chaotic security event into a manageable one.

The single most effective step you can take to protect an account even if your password is stolen, with step-by-step setup for major platforms.

Updates don't just add features, they close known security holes. A simple, low-effort routine for keeping your phone and computer current.

Why passwords get cracked, what makes a password strong, and practical ways to create passwords that are hard to break but easy to remember.

Fake messages, "act now" pressure, and convincing lookalike websites, learn the common tricks scammers use and how to protect yourself.

Researchers at Gen Threat Labs showed an AI agent can be tricked by email content into running commands and deleting files. A vendor-sponsored article outlines layered defences, from skill vetting to runtime controls.

Researchers have found a worm-like botnet called Carbonato that hijacks Docker servers left open to the internet and installs an AI agent to steal credentials and run commands on the attackers' behalf.

Google says its Gemini model guessed credentials and broke into three companies' websites during a May cyber-security evaluation run by Irregular, in what is thought to be the first known case of Gemini doing so on its own.

Google's new certificate teaches practical, everyday AI skills, communication, research, data analysis, and no-code app building, aimed at closing a wide gap between what managers expect from AI and what workers have actually been trained on.

From smart doorbells to warehouse sensors, connected devices multiply faster than most security programs can track them. A practical guide to keeping the Internet of Things from becoming your weakest link.

Monthly patch cycles work fine until your environment grows past a few dozen systems. A practical framework for configuration and vulnerability management that scales with your organization.

Business email compromise causes more reported financial losses than any other cybercrime category. Understanding how it works is the key to stopping it.

Considering your first penetration test? A plain-language guide to what actually happens, how to scope it properly, and how to get real value out of the report you receive.

A practical guide to combining encryption and backups so your sensitive files are protected both from strangers who steal your device and from the disasters that destroy it.

A practical, step-by-step checklist for implementing the five core technical controls behind Cyber Essentials certification, without the jargon.

A step-by-step walk-through of how a ransomware attack actually unfolds inside an organization, and the decisions that determine whether it becomes a bad day or a business-ending event.

Distributed teams and third-party tools expand an organization's attack surface in ways that are easy to overlook. Here's how testing and vendor awareness help close that gap.

AI tools have made phishing messages more convincing and personalized than ever, and prompt injection adds an entirely new angle. Here's what's changed, and what still works to defend against it.

From laptops to smart cameras to video conferencing hardware, the number of connected devices an organization must manage keeps growing. Here's how to keep visibility as the fleet scales.

Understanding the typical stages of a cyber attack helps you recognize warning signs earlier, and understand why national cyber strategy focuses where it does.

A backup that's never been tested for restoration, or an asset nobody knew existed, can undo months of planning. Here's how to build real continuity, not just a backup schedule.

Most breaches exploit vulnerabilities that already had a fix available. Patch and configuration management turn "we'll get to it" into a repeatable, low-drama process.

The most effective security programs treat people as a defense, not just a risk. Here's how education, practice, and culture combine to make security actually work.

From email to file storage, most of what you rely on daily now lives in the cloud. Here's how to keep those accounts, and the personal data inside them, genuinely secure.

Smart cameras, speakers, thermostats and doorbells all connect to your network, and most ship with weak default security. Here's how to lock them down.

Working from anywhere means your security perimeter now includes home Wi-Fi, video meetings, and the social profiles that reveal more about you than you might think.

Photos, documents and memories can disappear in an instant. A simple approach to backing up your phone (Android/iPhone) and computer.

Anthropic is embedding an invisible statistical watermark in Claude output, giving verification tools a way to flag AI-generated text and images without changing how the content looks or reads.

A survey of application security teams finds AI coding assistants reproducing a distinct, recurring set of flaws, and doing it identically across many unrelated codebases at once.

Vishing attacks using AI-cloned executive voices are rising, with attackers needing only a short public recording to produce a convincing impersonation for a wire-transfer request.

A growing number of organizations have no formal answer to which AI systems they are actually using and who owns the risk. Here is what building that answer from zero tends to look like.

An employee pastes a contract into a free AI tool to get a quick summary. It does not feel like a security incident. It might be one.

Most organizations plan for how to prevent ransomware. Very few plan for what happens in the 48 hours after the note appears. Here is what that actually looks like.

An annual pen test satisfies an auditor. It rarely tells you much about your actual exposure eleven months later.

You do not need a room full of monitors to get most of what a SOC actually does. Here is a scaled-down version that works.

One of the oldest ideas in security. Also one of the most consistently ignored, not out of neglect, usually, but out of convenience.

Our data is encrypted gets treated as a complete answer to is our data secure. It is a necessary layer, not a sufficient one, and the gap has caused real breaches.

Data classification sounds like a large-enterprise exercise with thirty categories and a governance team. A three-tier version works fine for a team of five.

The rule predates both modern ransomware and cloud storage as most people use it. It still holds up, and the reason why has not changed.