SCC Simplify, episode 14. Phil Atkin, Practice Director for SCC’s cybersecurity practice, talks about attacks that now run at machine speed and what it takes to recover from one. Runtime: 22 minutes.
To attack an organisation you used to need serious skill and a lot of time. Now you can buy what you need on the dark web and run it at scale without any technical ability. Phishing emails read like the real thing. Vulnerabilities that took months of human research to find can be found in a fraction of the time.
Phil Atkin has spent 25 years in cybersecurity and his view is that attacker behaviour hasn’t changed. The speed has. That changes the question a board should be asking. Containing an attack matters, but the measure of resilience is how quickly the business gets operationally back on its feet when something gets through, and whether anyone has rehearsed that before it happens.
The conversation starts with the basics. Phil is frank that some organisations still don’t know what they’re protecting, and that an unpatched system lets an attacker in whether or not AI was involved. From there he sets out a practical order of work: know what you’re defending and who from, use a recognised framework to find the gaps you can’t see, put the first pound of budget against the biggest risk and build a plan that improves over time.
WHAT YOU’LL HEAR
- Why boards are moving to “assume breach” and what that means for how you prepare
- The first questions to ask before you spend any budget
- Where AI belongs in defence: triage in minutes rather than an hour, with a person making the final call
- Why a business continuity plan on an encrypted server is no plan at all
- How certifications such as ISO and Cyber Essentials are moving from a point-in-time audit to continuous proof
- What a managed services partner should do for you, and what it shouldn’t
Speak to us today
If your board asked “are we secure?” tomorrow, could you answer with data? Talk to SCC about assessing where you stand and building a resilience plan that fits your organisation.