Business email compromise is fraud by impersonation: no malware, no link, just a convincing email asking for a payment. The main variants, why they work, and the process and technical controls that stop them.
The OWASP Top 10 2025 keeps broken access control at number one, moves security misconfiguration to second and adds software supply chain failures and mishandling of exceptional conditions. Each category explained from a penetration tester’s point of view, with what fixes it.
Ransomware attacks are decided in the first two stages: initial access through phishing, weak credentials or unpatched systems, then expansion across the network. What the current data shows, what each stage relies on, and how penetration testing closes those routes before they are used.
Which cyber security obligations apply to a UK small business (UK GDPR, PECR, PCI DSS, Cyber Essentials, sector regulators), what each actually requires, and a ten-point checklist of what to have in place and be able to evidence.
IASME Cyber Assurance builds on Cyber Essentials to cover governance, risk, people and resilience. Level 1 is a verified self-assessment renewed annually; Level 2 is an independent audit valid for three years. Which one you need, and how it compares with ISO 27001.
