Knowledge base

Updated: 13 October 2026 What is an effective security awareness programme? A security awareness programme is a set of educational and behavioural activities designed to change employee attitudes and behaviours in relation to information security – enabling staff to recognise and respond appropriately to threats such as phishing, social engineering, and insider threat. Verizon DBIR […]

Read more →

Updated: 1 October 2026 What is the difference between a vulnerability scan and a penetration test? A vulnerability scan is an automated process that identifies known weaknesses in systems – open ports, outdated software versions with published CVEs, misconfigured services. A scan says: “This Apache 2.4.51 server has CVE-2021-41773 with CVSS 9.8.” A penetration test […]

Read more →

When does a company need a vCISO? A company needs a vCISO at the moment information security stops being a “when we get to it” topic – because regulations, clients, audits or a first incident force the issue – while the organisation’s scale does not yet justify a salaried CISO post. If nobody in the […]

Read more →

What does testing AI agents involve? Testing AI agents means verifying the security of systems in which a language model does not merely generate text but plans actions, calls tools (APIs, databases, a browser, a terminal), keeps memory and makes decisions with limited human oversight. The reference points are two OWASP lists: the Top 10 […]

Read more →

What is a vCISO? A vCISO (virtual CISO) is a service in which an experienced expert or team performs the role of an organisation’s head of information security – at a scale and in a model matched to its needs. The client buys outcomes: a security strategy, risk oversight, regulatory compliance and audit readiness – […]

Read more →

What do the first 90 days of working with a vCISO look like? The first 90 days fall into three natural phases: getting to know the organisation and assessing its security posture (days 1-30), building a plan and priorities approved by the board (days 31-60), and establishing the function’s standing working rhythm – reviews, reporting […]

Read more →

How has AI changed phishing? Artificial intelligence has removed phishing’s three historical weaknesses: the cost of personalisation, language errors and confinement to the email channel. Language models write flawless, personalised messages in any language at scale; cloning a voice takes about 3 seconds of audio (McAfee); and live deepfake video can seat a fake CFO […]

Read more →

Updated: 29 September 2026 What is PCI DSS and why does it exist? PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements created by Visa, Mastercard, American Express, Discover, and JCB through the PCI SSC (Security Standards Council), applicable to all organisations that store, process, or transmit payment card data. […]

Read more →

Updated: 22 September 2026 What is an ISO 27001 certification audit and how does it work? An ISO 27001 certification audit is a two-stage process conducted by an accredited certification body, verifying that an organisation has implemented, maintains, and is continuously improving an ISMS (Information Security Management System) conformant with ISO/IEC 27001:2022. Stage 1 is […]

Read more →

Updated: 15 September 2026 What is Zero Trust Architecture? Zero Trust Architecture (ZTA) is a security model that eliminates implicit trust in any user, device, or network segment – regardless of whether they sit inside or outside the traditional network perimeter. The principle “never trust, always verify” originates from a Forrester Research report by John […]

Read more →

Updated: 10 September 2026 What does testing AI agent resilience to prompt injection involve? It involves establishing whether the agent will take an action contrary to the user’s intent after reading content an attacker planted. The critical difference from conventional security testing lies in the object of study. You are not testing a model’s response […]

Read more →

Updated: 8 September 2026 When is changing a Qualified Security Assessor justified? Changing your QSA is justified when the assessor has stopped functioning as a partner verifying real security and has begun functioning as a certificate issuer. The relationship with a QSA can feel difficult to change – the assessor knows your environment, holds the […]

Read more →