M3CABridging Media & IT
Cyber essentials without the theatre — Project team reviewing delivery plans around a meeting table

IT — 2025-10-21

Cyber essentials without the theatre

The controls that genuinely reduce risk for a 20 to 200 person business, and the ones vendors sell you anyway.

ITM3CA Security7 min read
All articlesPrevious articleShare on LinkedIn

Small organisations are not attacked by novel techniques. They are attacked by the same four routes, every time.

  • —Phishing into an account without multi-factor authentication.
  • —An unpatched device someone took home a year ago.
  • —A shared admin login nobody has rotated.
  • —A backup that has never been restored from.

Close those four and you have removed more risk than any dashboard you can buy.

The work behind the story

Security work becomes useful when the evidence is ready before the incident. — Security team reviewing evidence packs and control records ahead of an audit
Security work becomes useful when the evidence is ready before the incident.

Previous

Podcasts that survive episode ten

Apply this to your organisation

A useful question should lead to a useful scope.

Brief M3CA

More from the journal

Cyber securitySee relevant security workTraining AI on company data: what to get right before you startAI consultancy in London: what should happen after the contract is signed

Start

Turn the question into a working brief.

Tell us what needs to change, what is fixed and when it needs to be live. We will shape the right scope from there.

Request a quoteSee our work