FEATURED · VCISO FEATURED · VCISO 
FINTECH Why Fintech Startups Fail Their First Security Questionnaire
Most fintechs fail their first security questionnaire not because they are insecure, but because they cannot prove it. Here is how to prepare. · 8 min read
HEALTHTECH Health Data and GDPR: The Three Mistakes HealthTech Founders Make
Patient data is special-category data under GDPR — the penalties are higher, and the mistakes founders make are usually legal, not technical. · 8 min read
VCISO The First 12 Hours After a Breach: An Incident Response Checklist
What you do in the first 12 hours after a breach determines whether you contain the damage or watch it spread. Here's the checklist we use. · 8 min read
ISO 27001 ISO 27001 for Startups: A 30-Day Roadmap Without the Bloat
Most ISO 27001 guides are written for banks. Here's what a ten-person startup actually needs to do in the first 30 days to reach Stage 1 audit readiness. · 9 min read
GRC NIS2 for Small Companies: Do You Actually Need to Comply?
Most SMEs are not directly in scope for NIS2 — but their enterprise customers are, and that changes everything about what security documentation you need. · 7 min read
ISO 27001 SOC 2 vs ISO 27001: Which One Does Your Buyer Actually Want?
European buyers ask for ISO 27001. North American buyers ask for SOC 2. The control work overlaps — here is how to choose without doing both. · 8 min read
VCISO Does Your SME Need a Full-Time CISO? The Numbers Say Probably Not.
A full-time CISO costs £120K–£180K. Most SMEs under 200 people need 30–40 hours of security leadership a month. Here's when fractional makes sense. · 7 min read
AI SECURITY AI Tools and Company Data: What Your Employee Policy Actually Needs
Employees paste confidential data into AI tools faster than most companies can write a policy. Here is what the policy needs to say, and how to enforce it. · 7 min read
HEALTHTECH NHS GDPR Compliance: A Practical Guide for HealthTech Vendors
Selling into the NHS means processing patient data under GDPR. Here is what HealthTech vendors must prove before a contract is signed. · 9 min read
ISO 27001 The Real Cost of ISO 27001 for a 20-Person Company
Most ISO 27001 cost guides quote enterprise figures. Here is what a 20-person company actually spends, from gap assessment to certificate. · 7 min read
GRC DORA Compliance: What UK Financial Services Need by January 2025
The Digital Operational Resilience Act is now in force. UK financial services firms with EU operations must comply — here is the checklist. · 8 min read
VCISO Ransomware Response: The First 24 Hours
The first 24 hours after a ransomware attack determine whether you recover quickly or lose weeks. Here is the exact timeline we use. · 8 min read
VCISO Why Your Cyber Insurance Claim Got Rejected
Cyber insurers reject more claims than they pay. Here are the five most common reasons — and how to avoid them before you need to claim. · 7 min read
STARTUPS & SMES Password Managers for Teams: Which One Passes a Security Audit?
Not all password managers are created equal. Here is what a security audit actually checks — and which products meet the standard. · 7 min read
STARTUPS & SMES Multi-Factor Authentication: Not All Methods Are Equal
SMS, authenticator apps, and hardware keys all claim to be MFA. A security audit treats them very differently. Here is the hierarchy. · 6 min read
GRC GDPR Article 32: What Technical Measures Actually Look Like
GDPR Article 32 requires appropriate security. Regulators and auditors interpret that as seven specific controls. Here they are. · 7 min read
VCISO Penetration Testing: What You Get for £3,000 vs £15,000
Penetration testing prices vary by 5x for the same scope. Here is what the difference buys you — and what most SMEs actually need. · 7 min read
STARTUPS & SMES Cloud Security for Startups: AWS, Azure, or GCP?
All three clouds are secure enough for most startups. The difference is in the defaults, the compliance certifications, and what your buyer accepts. · 7 min read
GRC Data Retention Under GDPR: How Long Can You Actually Keep Data?
GDPR says data cannot be kept indefinitely. Most companies have no idea what their retention periods should be. Here is how to decide. · 7 min read
GRC The NIS2 Supply Chain Security Checklist for SMEs
NIS2 makes your enterprise customers responsible for your security. Here is the 10-point checklist that answers their questionnaire. · 7 min read
FINTECH Blockchain Security: Key Management for Digital Asset Companies
The security problem that shuts down crypto businesses is not a smart contract bug. It is key management. Here is how to do it properly. · 8 min read
STARTUPS & SMES Remote Work Security Policy: What Changed After 2020
Remote work is no longer temporary. Most SMEs still use the emergency policies they wrote in March 2020. Here is what a 2025 policy needs. · 7 min read
VCISO Vendor Risk Management: How to Assess a Supplier in 30 Minutes
You cannot audit every supplier like a Big Four firm. But you can spot the dangerous ones in 30 minutes with the right questions. · 6 min read
VCISO Business Continuity vs Disaster Recovery: The Difference That Matters
Business continuity and disaster recovery are not the same thing. Most SMEs conflate them — and fail both audits as a result. · 6 min read
GRC GDPR Data Subject Access Requests: How to Handle Them in 48 Hours
DSARs are growing in volume and complexity. Most SMEs take weeks to respond. Here is how to do it in 48 hours without breaking your operations. · 7 min read
STARTUPS & SMES Security Awareness Training: What Actually Works
Most security training is forgotten within a week. Here is what the research says — and how to build a programme that changes behaviour. · 7 min read
STARTUPS & SMES Email Security for Small Business: SPF, DKIM, and DMARC Explained
Email spoofing is the entry point for most breaches. SPF, DKIM, and DMARC are your defences — and most SMEs have only one of three configured. · 6 min read
STARTUPS & SMES Mobile Device Management for BYOD Companies
Bring-your-own-device policies save money but create security gaps. Here is how to secure personal devices without invading employee privacy. · 6 min read
AI SECURITY The EU AI Act: What It Means for Your Security Programme
The EU AI Act classifies AI systems by risk. High-risk systems — including many used in healthcare and fintech — face new security obligations. · 8 min read
GRC Logging and Monitoring: What Regulators Expect to See
Every security framework requires logging. But most SMEs collect logs they never review. Here is what auditors and regulators actually check. · 7 min read
STARTUPS & SMES Encryption at Rest vs in Transit: When Each One Matters
Every security questionnaire asks about encryption. But not all data needs both types. Here is how to answer correctly without over-engineering. · 6 min read Nothing published yet Roberto writes these himself, so they arrive when there is something worth saying. Ask him directly in the meantime. Ask a question →