How to Build Effective & Affordable Cyber Defences for SMEs
Razorwire Cyber Security & InfoSec InsightsShow Notes
How can small and medium businesses protect themselves from cyber threats without spending a fortune or just ticking boxes for compliance? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I’m Jim and in this episode, we’re taking a look into the challenges faced by SMEs on the journey through cybersecurity compliance and insurance. I’m joined by Lewis Lockwood from Incursion and Josh X of Capsule, who bring experience from the front lines of offensive security and insurance broking. Together, we tackle the misconception that security is prohibitively expensive and explore how smart strategies can strengthen your defences without breaking the bank. Summary We tackle a topic at the heart of SME cybersecurity struggles - from box-ticking compliance to negotiating cyber insurance and surviving data breaches. Lewis Lockwood explains why Cyber Essentials is more than a paperwork exercise and how agility can be a secret weapon for smaller companies. Josh X talks about the realities of selling cyber insurance to resource-stretched businesses, the importance of aligning insurance with actual security posture and the real risks hidden even in smaller businesses. Whether you’re a founder, IT manager or just curious about how attackers think, you’ll get practical advice, cautionary tales and actionable steps you can take today. Key Talking Points Cyber Essentials as Practical Defence, Not Just Compliance Learn why basic frameworks like Cyber Essentials shield SMEs from common attacks, offering affordable, actionable protection that goes well beyond box-ticking. How Insurance and Security Must Work Together Discover the realities of cyber insurance for small businesses, including why your security posture affects premiums and claims, and what actually happens if you’re hit by ransomware or invoice fraud. Learning from Real-World Breaches and SME Pitfalls Hear first hand stories about high profile incidents, negotiation tactics with threat actors and how even a local florist or butcher can be targeted. Understand why continuous education, simple security controls and the right insurance mix can prevent both financial disaster and sleepless nights.
Tune in for a conversation that’s honest, insightful and practical - with takeaways you can put into action immediately, no matter your company size. On the security of key documentation: “Where are you storing your insurance documents? If someone wants to get into your network, the easiest thing to do is to look at their insurance documents and be like, okay, they've got a million pound limit, let me ask for £2 mil.” Josh X, Capsule
Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen
In this episode, we covered the following topics: Cybersecurity Cost Perceptions Why the belief that security is prohibitively expensive for SMEs is misleading and what actually drives costs. The Role of Cyber Essentials How Cyber Essentials provides a practical, affordable security baseline for small and medium businesses without breaking the bank. Insurance as a Safety Net Why cyber insurance can't replace proper security measures and how to understand its role as a last resort, not a first line of defence. SME Agility in Security How smaller organisations can use their size as an advantage to quickly implement fixes and adapt to security recommendations compared to larger enterprises. Rise in Cyber Insurance Adoption What's driving growing awareness and uptake of cyber insurance among SMEs and why certain sectors are slower to adopt. Practical Security Measures Simple, cost-effective steps SMEs can take to drastically reduce risk, including patching, access control and MFA. Fraud and Social Engineering Threats Real-world attack scenarios targeting SMEs, from invoice fraud to phishing, and why user awareness matters more than you think. Incident Respo
More from Razorwire Cyber Security & InfoSec Insights
Awards you have to pay to win, events you have to pay to attend and conferences that expect speakers to work for free. When did recognition and expertise in cybersecurity become something you have to buy? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode I'm joined by security consultant and regular community speaker James Bore and Gary Hibberd, co-founder of Consultants Like Us and the Real Cyber Awards and Conference. Pay to play takes many forms in cybersecurity, from awards that come with entry fees and expensive tickets to events charging vendors thousands for access to decision makers. At the same time, large commercial conferences can expect experienced speakers to give up days of preparation, travel at their own expense and appear on stage in return for little more than exposure. Jim, James and Gary look at where legitimate commercial arrangements end and questionable practices begin. They discuss what gives an award credibility, when paying for access to an event can be worthwhile and why the way cybersecurity treats its speakers could ultimately affect the quality of the events themselves. Three key talking points When recognition comes with a price tag Not every paid award works the same way. From outright offers to buy recognition to free entries followed by expensive ceremony tickets, we look at the different forms pay to play can take and why credibility depends on what happens behind the award. Should cybersecurity speakers be paid? Community events and large commercial conferences operate very differently. We discuss when speaking for free makes sense and why expectations should change when an event is making significant money from exhibitors and attendees. Good speaking takes work A short conference talk can take days of preparation. James and Gary get into the work behind becoming a strong speaker, why experience and preparation matter and what happens when events prioritise sponsored slots over good content. If you're deciding which awards and events deserve your time, or building a reputation as a cybersecurity speaker, this conversation is for you.
If most of your applications no longer run on the endpoint, why are you still managing and securing it as though they do? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this Spotlight on Technology episode I'm joined by James Millington, Healthcare Field CTO for EMEA at IGEL, with more than 25 years' experience across virtual desktops, endpoint security and healthcare technology. The way we use endpoints has changed repeatedly. Computing moved from centralised mainframes to PCs, back towards virtual desktops and then into SaaS and cloud services. Hybrid working accelerated that shift again, while rising hardware costs, Windows upgrades and increasingly distributed workforces are forcing organisations to reconsider what they actually need sitting on a user's device. Jim and James look at why the endpoint may be due another rethink. They discuss the security and cost implications of maintaining traditional operating systems, how immutable endpoints change the approach to endpoint protection and what happens as AI creates another generation of applications and risks for security teams to control. Three key talking points: Do we still need Windows at the endpoint? As applications move into SaaS, VDI and the cloud, the role of the endpoint is changing. We look at whether organisations still need a full traditional operating system on every device and what alternatives become possible when workloads run somewhere else. Moving from detection to prevention Endpoint security has traditionally relied heavily on detecting problems and responding to them. Discover how reducing what can run or change on an endpoint alters that model and removes attack surfaces before they need to be monitored. The endpoint problem AI could make worse Shadow AI gives employees another way to introduce software and move information beyond organisational controls. We discuss how controlling what can execute locally could become increasingly important as AI workloads start moving from centralised services onto endpoints.
Are cybersecurity events still giving people a reason to turn up, or have too many become expensive sales floors with the same conversations on repeat? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode I'm joined by James Bore, Chartered Security Professional, Gary Hibberd, co-founder of Consultants Like Us and Lisa Ventura, founder of the AI and Cybersecurity Association and Unity Group Solutions. Cybersecurity events have changed. What were once places to discover new technology, catch up with people across the industry and exchange ideas have become a packed calendar of conferences, roundtables, dinners and vendor events competing for people's time. With InfoSec Europe introducing a £50 ticket charge, it raises a bigger question about whether the traditional conference model is still delivering enough value. We look at why experienced security professionals are increasingly choosing community and fringe events, why the same conference conversations keep coming back and what actually makes an event worth attending. From vendor pitches and expensive exhibition stands to better speakers, smaller audiences and conversations in the pub next door, we discuss where cybersecurity events have gone wrong and what could make them useful again. Three key talking points: When a conference stops being worth it A ticket might be free or cost £50, but the bigger investment is your time. We look at why established cybersecurity events are struggling to give experienced professionals a compelling reason to walk through the doors. Why smaller events feel different Community and fringe events come up repeatedly throughout the conversation. Discover why smaller audiences, more focused subjects and speakers who genuinely know their field can create something the biggest conferences struggle to replicate. People don't go to events to be sold to Expensive stands and polished sales pitches do not necessarily build relationships. We discuss why attendees increasingly value access to practitioners, useful conversations and genuine connections over another lap of an exhibition hall.
What does it actually look like to break into InfoSec from the outside, with no technical background, no industry contacts and no idea what half the acronyms mean? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this interview episode, I'm joined by Irina Sordiya, a GRC and compliance professional based in Montreal who came into information security from a finance background. Not everyone who works in information security started out in IT. Irina's route in began at a career fair where she stumbled into a fintech startup looking for someone who could translate financial regulation into language a dev team could understand. From there she moved into auditing at KPMG and eventually crossed to the other side, leading security posture and compliance in-house. This is a conversation for anyone considering a career in InfoSec or in the early stages of one. Irina talks openly about feeling like an outsider, not understanding the acronyms and slowly realising that GRC isn't about technical knowledge, it's about understanding risk, building trust and communicating with people. She and Jim also get into the growing problem of grifters in GRC, where Canadian regulation is heading and why the InfoSec community is one of the most welcoming places to build a career. Three key talking points: You don't need a technical background Irina came from a finance degree with no IT experience and a job interview where she was asked if she knew what an auditor does. She got the job. This episode is proof that soft skills, empathy and a risk mindset can take you further than most people expect. G is for grifter in GRC As regulatory pressure has increased, so has the number of people selling shortcuts. Overpriced courses, AI-generated templates, agents claiming to replace the CISO. Irina and Jim discuss why this preys on people trying to break in and why there's no substitute for doing the work. The risk mindset as a North Star The best advice Irina received early on was to develop a risk mindset. It's what helps you step back from hundred-page policies and ask what you're actually trying to protect, and why it matters more than technical knowledge for anyone in GRC.
Social engineering has been around since humans started talking to each other. The psychology hasn't changed, but AI has made the execution almost unrecognisable. Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, I'm joined by Richard Cassidy, Field CISO at Rubrik, and Bec McKeown, a chartered psychologist specialising in human performance under pressure. Social engineering isn't a technology problem, it's a human one that cybersecurity has inherited. The psychology behind it hasn't changed since Cleopatra was using it to outmanoeuvre empires, but AI has transformed the speed, scale and sophistication of every stage, from automated reconnaissance that builds a complete profile in 30 minutes to real-time voice cloning that references your actual projects and travel schedule. Bec and Richard bring two very different perspectives to the same problem. Bec explains how attackers engineer the conditions in which people make decisions rather than just crafting a convincing message, and why "people are the weakest link" misses the point. Richard shares what he's seeing as a practising CISO, from family members being targeted through gaming platforms to why measuring phishing click rates gives organisations a dangerous false sense of security. Three key talking points: They're not hacking people, they're shaping decisions: Social engineering works because attackers engineer the conditions under which decisions get made, not because people are careless. Bec explains why most security awareness training is solving the wrong problem by focusing on the message rather than the environment in which people are operating. AI has turned social engineering into an automated pipeline: What used to take weeks of manual reconnaissance now takes 30 minutes. AI-powered OSINT can build a complete profile of a target and generate a tailored attack that references their projects, travel and communication style. Combined with real-time voice cloning, these layered attacks are becoming almost impossible to distinguish from a legitimate request. Your family is now part of the attack surface: If the executive is too well protected, attackers go to the people around them. Children on gaming platforms are being cultivated to unknowingly share information about their parents' work and routines, and a compromised family device on a shared home network becomes a route into the corporate environment.