Blog

Do you know where your business data is?

Wed, 23 Sep 2026 00:00:00 +0000

A lot of people are using AI these days; some people are even using it to help them with their work, but are staff using AI in your business with your knowledge or are they using it under the radar? As we covered in last week's article, a lot of AI models use data to train on, what if a member of staff is using your company data and it's inadvertently being used to train AI which in turn could aid your competitors or leak your business data?

I'm going to go down memory lane, bear with me; a few years ago, we took a frantic call from a business that had suffered a serious data leak. Not because of a hacker. Not because of ransomware. Not because someone inside the company was trying to do harm.

It happened because a well-meaning member of staff wanted to carry on working from home. To make that easier, they uploaded company data into their own free personal Dropbox account. The intention was helpful. The outcome was catastrophic.

The data was now outside the company’s control, outside any proper business agreement, and outside the terms intended for that domestic service. Worse still, it was not protected to the standard the business needed. The result was a major data loss, reputational damage, and a very painful lesson: convenience can be dangerous when it bypasses proper controls.

The same risk has a new name: AI

Fast forward to today and the same pattern is happening again. This time, the tool is not personal cloud storage. It is artificial intelligence.

Staff are using AI tools to write emails, analyse spreadsheets, summarise documents, create proposals, polish reports, draft HR content, troubleshoot technical issues and speed up everyday work. In many cases, they are doing it with good intentions. They want to be faster. They want to be more productive. They want to help the business.

But if they are pasting customer information, contracts, financial data, internal processes, technical details, passwords, source code, sales figures or strategy documents into tools the business has not approved, then your confidential information may already be leaving the building.

Helpful does not always mean safe

The danger is that many employees do not realise what happens after they type or upload information into an AI platform. Some tools may store prompts. Some may use submitted data to improve or train their models. Some may be operated outside the UK. Some may have terms that are suitable for personal experimentation, but not for handling sensitive business data.

The risk is not always malicious. In fact, that is what makes it so dangerous. Your team may believe they are doing the right thing, while accidentally exposing commercially sensitive information to a system the business has not assessed, secured or approved.

Imagine a member of staff asking a free AI tool to summarise a confidential client proposal. Or to rewrite a disciplinary letter. Or to analyse a spreadsheet containing customer records. Or to explain a technical configuration that reveals how your systems are built. In each case, the employee is not trying to leak data. But the data may still be exposed.

Shadow AI is the new shadow IT

For years, businesses have worried about shadow IT: staff signing up for apps, storage services or software without telling the company. AI has made that problem bigger, faster and harder to see. It takes seconds to open an AI tool in a browser. It takes seconds to paste in confidential information. And once that data has gone in, you may have no easy way to get it back.

That creates serious questions for business owners:

Do you know which AI tools your staff are using?
Do your staff know what information they must never enter into AI?
Have you checked the terms, privacy settings and data handling policies of those tools?
Do you have an AI usage policy that is actually understood by your team?
Can you prove that client, employee and business data is being handled properly?
Is your data being processed whilst maintaining GDPR compliance?
Is your business data being used to train the AI model which exposes it to the public domain?

If the answer is “no” or “I’m not sure”, then this is not a future problem. It is a current risk.

AI needs rules, not guesswork

AI can be incredibly useful. Used properly, it can improve productivity, reduce admin, speed up research and help teams work smarter. The answer is not necessarily to ban AI completely. A ban often drives the behaviour underground, where it becomes even harder to manage.

The better approach is to put proper controls in place. Decide which tools are approved. Set clear rules on what can and cannot be entered. Train staff using real-world examples. Review supplier terms. Configure business-grade services correctly. Monitor for risky behaviour. Make AI part of your cyber security and data protection strategy, not an uncontrolled side project.

Most importantly, make sure your people understand the issue. In the same way that uploading business data to a free personal storage account can create a serious data breach, pasting business data into the wrong AI tool can expose information you are legally, commercially and morally responsible for protecting.

Be careful, try not to be too helpful when using AI tools

Let me ask you a simple question. "Would you like to improve this tool to help others?" This sounds like an innocent question, and most people, by their very nature would think "yes, I want to help this tool improve for others" so they select yes, BUT what this question actually means is " we need your permission to use all the data you upload to train the AI model and it could expose your data to the world". If the question were worded as the latter explaining the data will be exposed to the world, then everyone would select no, this is why they are very careful with how they word the question. Be warned.

What does this mean for your business

If your staff are using AI without your knowledge, your business may already have a data protection problem waiting to surface. The good news is that this can be managed with the right policies, tools, training and technical controls. As your MSP, we can help you understand where AI is being used, identify the risks, put sensible guardrails in place and make sure your team can benefit from AI without putting your business data at risk.

At the very least you should have an AI usage policy for the business just so staff know the business stance on using AI.

If you need help, call us on 01722 411999.

Are You Using AI or is AI Using You

Wed, 16 Sep 2026 00:00:00 +0000

Be Careful What You Share with AI - How to Keep Your Business Data Safe

Artificial intelligence can be a powerful productivity tool, but careless use can create serious data protection and commercial risks.

AI tools are becoming part of everyday business life. They can help draft documents, summarise information, analyse data and speed up routine tasks. Used well, they can save time and improve decision-making. Used carelessly, however, they can expose confidential information, customer data, intellectual property and commercially sensitive material.

Many people do not realise that some AI services may use prompts, uploaded files, chat history or user feedback to improve their systems, depending on the provider’s terms and settings. That means information entered into an AI tool could leave the control of your organisation and create risks around confidentiality, data protection and regulatory compliance. The UK Information Commissioner’s Office states that organisations using AI must consider accountability, transparency, security and data minimisation when personal data is involved.

Why this matters

Business data is valuable. It may include client records, staff information, contracts, pricing, designs, financial forecasts, legal advice, tender submissions or incident reports. If this information is copied into an AI tool without proper safeguards, it could be retained by a third party, accessed outside your approved environment, or used in ways your organisation did not intend.

The risk is not only commercial. If personal data is involved, an accidental disclosure could place the business in breach of data protection obligations. Regulators expect organisations to understand what data they process, why they process it, who can access it and how it is protected. AI does not remove those responsibilities; it can make them more complex.

Common mistakes businesses make with AI

Pasting confidential emails, contracts or reports into public AI tools.
Uploading spreadsheets containing personal, financial or client information.
Assuming that every AI product has the same privacy and retention settings.
Allowing staff to use unapproved AI tools without guidance or training.
Failing to check whether AI-generated outputs contain inaccurate, biased or confidential information.
Using AI outputs in regulated decisions without human review and proper records.

Tips to keep your data safe

Do not enter sensitive information into public AI tools. Treat prompts like external disclosures unless you have checked the provider’s contractual terms, privacy settings and data retention policy.
Use approved business accounts only. Enterprise AI tools often provide stronger controls than free consumer versions, including administration, access management and data protection settings.
Classify your data before using AI. Decide what data is public, internal, confidential or highly restricted, and set clear rules on what can and cannot be used with AI systems.
Remove or mask personal and confidential details. Where possible, anonymise, pseudonymise or summarise information before asking an AI tool to process it.
Check supplier terms carefully. Understand whether your data may be retained, reviewed, used for model training, transferred internationally or shared with subcontractors.
Carry out a risk assessment. For higher-risk uses, especially where personal data is involved, consider a Data Protection Impact Assessment and document the safeguards you have put in place.
Train your staff. Make AI awareness part of your cyber security and data protection training so employees understand the practical risks.
Review AI outputs before use. AI can produce convincing but incorrect information, so human checking remains essential.
Create an AI use policy. Set out approved tools, permitted uses, prohibited data types, escalation points and review processes.

AI should support your business, not expose it

The answer is not to avoid AI altogether. The answer is to use it deliberately, safely and with the right controls. Businesses that put clear rules in place now will be better positioned to benefit from AI while protecting customers, staff, intellectual property and reputation.

If you are unsure whether your current AI use is safe, now is the time to review it. Speak to your IT, compliance or data protection adviser, check your contracts and make sure your team knows what information must never be placed into an AI system.

How does this affect my business

Every business using AI needs to understand what data is being entered, where that data goes, and whether the tool is suitable for the information being processed. A simple review of your AI use, staff guidance and supplier settings can reduce the risk of data leakage, protect your commercial position and help demonstrate that you are taking compliance seriously.

If you would like help reviewing how your business uses AI safely, contact us on 01722 411 999.

Bye bye Microsoft Publisher, it was nice knowing you

Thu, 03 Sep 2026 00:00:00 +0000

Microsoft Publisher is retiring in October 2026. Here is what your business needs to know—and what to do before your .pub files become difficult to access.

For decades, Microsoft Publisher has been the familiar choice for newsletters, leaflets, brochures, labels, business cards and other desktop-publishing jobs. It has been straightforward, flexible and included with many versions of Microsoft Office. But all good things must come to an end.

Microsoft has confirmed that Publisher will reach end of life in October 2026. Microsoft 365 subscribers can use Publisher until 1 October 2026, but will no longer be able to access the application after that date. Support for the perpetual version of Publisher ends on 13 October 2026, alongside Office LTSC 2021 and Office 2021. The safest business deadline is therefore 1 October 2026: complete your migration before then rather than relying on an unsupported installation.

After retirement, Microsoft 365 subscribers will not be able to open or edit Publisher files in Publisher. Your .pub files will not simply disappear, but keeping them without a supported way to use them creates a serious accessibility and continuity risk—particularly when an old price list, template, certificate or marketing item suddenly needs updating.

Why businesses should act now

Publisher files are often scattered across laptops, servers, archived user folders, OneDrive, SharePoint and Teams-connected document libraries. Some may be obvious; others may sit untouched for years until they are urgently needed. Waiting until the last minute makes it harder to identify an owner, choose the right destination format and check that the converted output still looks correct.

Publisher will no longer be included with Microsoft 365 after the retirement date.
Unsupported software will not receive the protection or technical support expected by a modern business.
Complex layouts, fonts and graphics may not convert perfectly without review.
Historic documents may need preserving, while working templates need an editable replacement.
A rushed migration can lead to missing files, broken layouts and lost business information.

How to prepare: a practical Publisher retirement checklist

Find every .pub file. Search PCs, file servers, network shares, OneDrive, SharePoint, Teams libraries, backups and archive locations.
Assign an owner. Record which person or department understands the purpose of each file.
Classify the content. Mark each publication as active, reusable, historic, duplicate, obsolete or subject to a retention requirement.
Choose the destination. Decide whether the file should become a PDF, Word document, PowerPoint presentation or a design rebuilt in another supported application.
Back up the originals. Preserve an untouched copy of important .pub files and any linked images, logos or fonts before conversion.
Convert in manageable batches. Start with business-critical and regularly updated material rather than attempting everything at once.
Check the result. Compare pages, text flow, fonts, images, hyperlinks, margins, print settings and accessibility with the original.
Test the new workflow. Confirm that the content owner can edit, save, share and print the replacement without Publisher.
Stop creating new Publisher files. Move new work to a supported platform now so the backlog does not continue to grow.
Set a completion date before 1 October 2026. Leave time for exceptions, redesign work and user training.

Which application should replace Publisher?

PDF—for finished documents that only need to be viewed, shared or printed

PDF is usually the best preservation format for completed publications because it maintains the visual appearance and is widely supported. It is not, however, a practical master format where text, prices, dates or images must continue to change.

Open the publication in Publisher.
Select File > Save As and choose a destination folder.
Select PDF as the file type and save it.
Open the PDF and compare it with the original, including every page.
Use an appropriate quality setting for online distribution, office printing or commercial print.

Microsoft Word—for text-led documents that need future editing

Word is well suited to notices, forms, letters, simple newsletters, labels and documents where written content matters more than free-form page design. Microsoft’s suggested editable route is to convert the Publisher file to PDF and then open that PDF in Word. Expect to tidy complex layouts and check graphics carefully.

Export the Publisher file as a PDF.
Open Microsoft Word.
Select File > Open and choose the PDF.
Accept the prompt that Word will convert the PDF into an editable document.
Review page breaks, columns, text boxes, images, fonts and spacing.
Save the result as a .docx file and test printing and sharing.

Microsoft PowerPoint—for posters, signs, flyers and visual layouts

PowerPoint provides flexible placement of text and images and can be a practical replacement for single-page or slide-like content. Rather than trusting an automatic conversion, rebuild a clean reusable template and validate its physical page size before printing.

Create a presentation with the required page orientation and dimensions.
Copy the approved wording and source images from the original publication.
Rebuild the layout using editable PowerPoint objects.
Add branding to the template or slide master where appropriate.
Export a PDF and run a test print before approving the replacement.

Microsoft Designer or a specialist publishing tool—for highly visual work

Modern design tools may suit social graphics, promotional artwork and quick branded content, while layout-critical catalogues, complex brochures and commercial-print projects may justify a specialist desktop-publishing application. Test representative files before committing, confirm licensing and data-handling requirements, and retain the original assets used to create each publication.

Do not confuse preservation with migration

A PDF may successfully preserve the appearance of an old brochure, but it does not automatically give you an easy-to-edit replacement for next year’s brochure. For every file, ask two questions: Do we only need to view this? and Will we need to edit or reuse it? The answer determines both the target format and the amount of rebuilding required.

What does this mean for my business?

Publisher’s retirement is not just a software change; it is a data-discovery and business-continuity project. If you do not know where your .pub files are stored, who owns them or which ones remain operationally important, now is the time to find out.

The Silver Cloud Business can help. We can search your data repositories—including suitable PCs, servers and Microsoft 365 storage—for Publisher files, help you understand what is there, prioritise business-critical content and plan a controlled move to a supported product before it is too late.

Call The Silver Cloud Business on 01722 411999 to discuss a Publisher discovery and migration review. We can help you turn an approaching deadline into a planned, documented transition—without leaving important business content stranded in an obsolete format.

Preparing Your Business for AI: An AI Readiness Guide

Wed, 02 Sep 2026 00:00:00 +0000

A practical approach to adopting AI securely, responsibly and successfully across your organisation

Artificial intelligence can help staff work faster, improve customer service and make better use of the information a business already holds. However, adopting AI for everyone is not simply a matter of buying licences and switching the technology on. AI can search, summarise and combine information at a speed and scale that exposes weaknesses in permissions, data governance and working practices that may previously have gone unnoticed.

A successful AI programme therefore starts with the business, its people and its data. The objective should be to create a controlled environment in which approved tools deliver measurable value without exposing confidential information, personal data, intellectual property or client records.

1. Establish leadership, ownership and acceptable use

Nominate a senior owner for AI and create a small steering group involving business leadership, IT, information security, data protection and representatives from the teams that will use AI. Define which outcomes matter, such as reducing administration, improving response times or helping staff find information, and agree how success will be measured.

Publish an AI acceptable-use policy covering approved services, permitted data, human review and prohibited activities.
Create a simple approval process for new AI tools, browser extensions, agents, connectors and integrations.
Define accountable owners for each use case and record its purpose, data sources, users, supplier and risk rating.
Set clear rules for customer-facing content, automated decisions and any use involving personal or sensitive information.

2. Discover and classify the information AI could access

Build an information map covering Microsoft 365, line-of-business systems, shared drives, cloud storage, email, collaboration platforms and archives. Identify where personal data, commercially sensitive material, HR records, financial information, credentials and client data are stored. Assign owners and retention requirements, remove redundant data and introduce sensitivity labels where appropriate.

Why this matters: an AI assistant may make information dramatically easier to find, but it does not correct an unsafe permissions model. Content that was technically accessible but difficult to discover can become available through a straightforward natural-language request.

3. Review permissions and reduce oversharing

Carry out a structured permissions audit before connecting AI to business data. Review SharePoint sites, Teams, OneDrive, shared mailboxes, network folders and business applications. Pay particular attention to organisation-wide access, “anyone” links, the “Everyone except external users” group, inherited or broken permissions, guest access, stale accounts and sites without an active owner.

Apply least privilege: staff should have access only to information required for their role.
Replace broad sharing links with named users or controlled groups.
Review privileged roles, service accounts and third-party application permissions.
Remove obsolete content and access left behind by former employees, suppliers or completed projects.
Introduce recurring access reviews rather than treating remediation as a one-off exercise.

4. Assess every AI supplier and service

Do not assume that a free or inexpensive AI service is suitable for business use. The commercial model may depend on retaining prompts, uploaded files or conversation history and using them to improve services or train models.

Even where an opt-out exists, it may depend on the account type, settings or contract. Staff accepting consumer terms on behalf of themselves can unintentionally disclose company or client information outside approved controls.

For each supplier, establish in writing:

Whether prompts, outputs and uploaded data are used for model training or service improvement.
Where data is processed and stored, how long it is retained and how it can be deleted or exported.
Whether administrators can control accounts, sharing, connectors, agents and audit logs.
Which subprocessors are involved and what contractual, privacy and security assurances apply.
How the service handles encryption, incident notification, business continuity and account termination.
Whether the intended use requires a data protection impact assessment, contractual review or client approval.

5. Find and control shadow AI

Shadow AI occurs when employees adopt AI tools, agents, meeting assistants, browser extensions or personal accounts without the knowledge or approval of the business. This may already be happening before a formal AI project begins.

Risks include uncontrolled data transfer, excessive application permissions, poor authentication, unrecorded automated actions, intellectual-property leakage and suppliers that cannot meet the organisation’s legal or contractual obligations.

Survey staff in a constructive, non-punitive way to understand what they use and why.
Review sign-ins, enterprise applications, OAuth consent, browser extensions, network or cloud-security logs and expense claims.
Maintain an approved AI catalogue and give staff a quick route for requesting alternatives.
Block or restrict high-risk services where proportionate, while explaining the approved options.
Revoke unknown integrations and investigate any exposure of confidential or personal information.

6. Put technical guardrails around approved AI

Use business-grade services under centrally managed accounts. Enforce multi-factor authentication, conditional access, least-privilege administration and controlled app consent. Apply data loss prevention, sensitivity labels, retention controls, audit logging and alerting. Limit agents and connectors to approved systems, credentials and scopes; test what information they can retrieve and what actions they can take.

Treat an autonomous or semi-autonomous agent as a privileged digital worker. Give it a named owner, a defined purpose, the minimum data and permissions required, spending or transaction limits where relevant, complete logging, and a reliable method to stop or revoke it.

7. Start with controlled, valuable use cases

Select a small pilot group and begin with repeatable tasks that have clear value and manageable risk: drafting routine communications, summarising approved documents, finding internal procedures or assisting with meeting notes. Establish a baseline, define expected benefits and monitor quality, time saved, adoption, support demand and incidents.

Require human verification of outputs. AI can produce inaccurate, incomplete or fabricated answers, and plausible wording should never be mistaken for evidence. High-impact decisions, legal or financial advice, customer commitments, security changes and publication of sensitive material should remain subject to competent human approval.

8. Train staff and create safe working habits

Training should cover more than prompting. Staff need to understand information classification, approved tools, privacy, copyright and intellectual property, hallucinations, bias, social engineering, secure sharing and how to report a mistake. Use role-based examples and provide reusable prompt patterns that avoid unnecessary personal or confidential data.

9. Prepare for incidents and ongoing assurance

Update incident-response procedures to include accidental prompt disclosure, unsafe output, compromised AI accounts, malicious integrations, agent misbehaviour and supplier incidents. Staff should know whom to contact and should preserve the relevant prompt, output, tool, account and time without redistributing sensitive content.

Review the AI register, permissions, suppliers, logs, policies, training needs and business benefits regularly. Terms, features and risks change quickly, so approval should never be permanent by default.

What does this mean for your business

AI readiness is not about preventing innovation. It is about making sure the organisation understands its information, chooses trustworthy services and gives staff a safe, productive route to use them. Before deploying AI to all staff, your business should consider the following steps:

Appoint an AI owner and agree the outcomes you want to achieve.
Discover and classify the data your organisation holds.
Audit file, folder, site, mailbox and application permissions.
Identify any AI services, agents or extensions already being used.
Create an approved-tools list and an AI acceptable-use policy.
Review supplier terms, privacy, training, retention and data-location commitments.
Implement identity, data-protection, logging and application-control guardrails.
Pilot a small number of low-risk, high-value use cases.
Train staff to use AI safely and verify its outputs.
Measure value, review risk and improve controls continuously.

The Silver Cloud Business can help. Our AI Readiness service can assess your Microsoft 365 and / or server environment, review permissions and data exposure, help to identify shadow AI, evaluate proposed platforms, develop practical policies and create a phased roadmap for secure adoption.

Call us on 01722 411 999 to discuss an AI Readiness Assessment and make sure your organisation is ready to gain the benefits of AI without exposing the data it depends on.

Security threats are no longer just a “computer problem”

Mon, 24 Aug 2026 00:00:00 +0000

Recent real-world vulnerabilities show why businesses need visibility across their entire infrastructure including cloud services, websites and mobile devices and not just their computers.

When people think about cybersecurity, they often picture a laptop with antivirus software, a server needing updates, or a firewall blocking suspicious traffic. Those things still matter, but the modern attack surface is much broader. Today, business systems depend on cloud identity platforms, website plugins and frameworks, smartphones, tablets and third-party services that sit outside the traditional office network.

Three recent security stories make that point very clearly: a critical Microsoft Entra ID remote code execution vulnerability, a serious Elementor Pro WordPress plugin flaw that could allow attackers to upload executable code, and an Apple ImageIO issue fixed in the latest security updates for iPhone, iPad and macOS.

Each one affects a different part of the technology stack, but together they underline the same message: anything connected to your business can become part of your cyber-attack surface risk.

1. Microsoft Entra ID: when the cloud identity layer is the target

Microsoft Entra ID, formerly known as Azure Active Directory, is at the heart of many organisations’ Microsoft 365 and Azure environments. It controls authentication, single sign-on, conditional access and access to cloud applications. That makes it a critical service: if identity is compromised, the knock-on impact can be significant.

The vulnerability tracked as CVE-2026-69836 was reported as a maximum-severity remote code execution issue in Microsoft Entra ID, caused by unsafe deserialization of untrusted data. Microsoft stated that the issue was mitigated server-side and that customers did not need to apply a traditional patch. Some early reporting described the flaw as exploited in the wild, but later reporting noted that Microsoft corrected the exploitation status to say it had not been exploited. Even with that clarification, the incident is a useful reminder that cloud services are not abstract or risk-free: they are software platforms, and they can contain serious vulnerabilities.

For businesses, the lesson is not simply “Microsoft fixed it”. The more important lesson is that your cloud identity platform is now part of your security perimeter.

This is why it is business critical to monitoring sign-ins, reviewing administrator activity, checking conditional access policies and keeping visibility of connected applications are all essential parts of modern IT security.

2. Elementor Pro for WordPress: when website code becomes the doorway

WordPress powers a huge number of business websites, and many of those sites rely on plugins to provide contact forms, page builders, booking systems, e-commerce tools and customer upload features. Elementor Pro is one of the most widely used premium WordPress plugins, and a recent vulnerability showed how a common website feature can become a serious security risk.

The Elementor Pro vulnerability, tracked as CVE-2026-32475, affects versions up to and including 4.2.1 and was fixed in version 4.2.2. The flaw involved the Forms module’s File Upload field. In practical terms, an attacker could potentially use a specially crafted upload request to bypass file checks and place a PHP file into a public directory, creating a route to remote code execution on the website server.

This is not just a WordPress administrator’s problem. A compromised website can be used to steal customer data, redirect visitors, host phishing pages, send malicious emails or damage your company’s reputation.

Website frameworks, plugins and themes should therefore be treated as live business systems that need regular updates, monitoring and regular review, not as something that is “finished” once the site goes live.

3. Apple ImageIO: when a mobile device becomes the target

Mobile devices are now business devices. Staff use iPhones and iPads to access email, documents, Teams, cloud storage, authentication apps and customer information. That means a mobile vulnerability can quickly become a business vulnerability.

Apple’s recent security updates addressed an ImageIO vulnerability, reported as CVE-2026-65346, where processing a maliciously crafted image could lead to arbitrary code execution. ImageIO is a system-level framework used to handle images across Apple platforms, so vulnerabilities in this area matter because images are processed by many everyday apps and services. Apple’s latest iOS, iPadOS and macOS updates included fixes for this issue, reinforcing the importance of keeping mobile devices updated rather than treating phones as separate from the business IT estate.

The key point is simple: your mobile devices are endpoints too. If they access company email, cloud services, shared files or authentication systems, they need the same level of visibility and patch awareness as laptops and desktops.

The bigger picture: security now spans devices, cloud and code

These three examples show that exploitation risk is no longer limited to traditional computers. A business may be exposed through its cloud identity infrastructure, through the code running its website, or through the mobile devices staff use every day. Security therefore has to be broader than installing updates on office PCs. It needs asset visibility, update management, monitoring, alerting and a clear understanding of what is connected to your environment.

For many businesses, the biggest risk is not knowing what is out there. Which devices are accessing your systems? Are staff phones up to date? Are laptops missing critical patches? Is your website running vulnerable plugins? Are cloud services being accessed from unexpected locations or unmanaged devices? These are the questions that need answers before a vulnerability becomes an incident.

What is CVE?

You may have noticed that each incident has an assigned CVE (Common Vulnerabilities and Exposures) number. The Common Vulnerabilities and Exposures is a free, standardised directory and naming system for publicly known cyber-security flaws in both software and hardware. You can access the CVE site here https://www.cve.org

The CVE was created in 1999 and gives every security bug a unique ID so that security teams around the world can discuss and fix the exact same problem. It serves as a critical, early-warning public utility that keeps digital devices, personal data, and infrastructure secure using the following:

Secures Everyday Products: It forces companies to fix flaws in consumer tech like smartphones, routers, smart TVs, and medical devices.
Prevents Massive Data Breaches: Patching CVEs protects large companies and banks, keeping your personal identity, passwords, and credit card data safe from hackers.
Protects Critical Infrastructure: Governments use CVE data to secure vital public systems like power grids, water plants, and hospital networks.
Empowers Smart Consumers: Anyone can search a product before buying it to see its security track record and check if the manufacturer fixes flaws quickly.
Drives Automated Security: Cybersecurity tools built into home operating systems (like Windows Update or Apple iOS updates) use CVE data to download and install security fixes automatically.

What does this mean to your business?

It means cyber-security needs to cover more than the machines sitting on desks, you must think of every component in your infrastructure both physically in your business and much wider such as cloud services or web hosting solutions. It is imperative to have oversight of your entire infrastructure, not just the physical equipment you can see and touch.

The Silver Cloud Business provides remote monitoring and maintenance tools that can help businesses identify devices to ensure they are patched and secure, identify devices accessing the business’s environment, highlight systems that are out of date and alert when action is needed.

If you would like help understanding your current exposure, improving visibility across your devices, or learning more about our managed IT and security services, please call us on 01722 411999. We would be happy to offer practical advice and help you decide what level of protection is right for your business.

If you still need convincing that there are threats everywhere, call us for a free comprehensive scan of your Microsoft 365 tenant including scanning your email to identify any threats lurking in your email store. It is remarkable what our tools will find and it is also remarkable that these flaws are still there, waiting to be exploited.

Getting started is simple. The scan is FREE, and the insights could prove invaluable and save your business from an embarrassing data leak.

The UK Government Cyber Resilience Pledge: What It Means for Businesses

Wed, 12 Aug 2026 00:00:00 +0000

A practical guide to the declaration, Cyber Essentials, Cyber Essentials Plus, costs and the right route for different business sizes.

What is the UK Government Cyber Resilience Pledge?

The UK Government Cyber Resilience Pledge is a voluntary public declaration for organisations that want to demonstrate a stronger commitment to cyber resilience. It was formally launched at 10 Downing Street on 7 July 2026 and asks organisations to commit to three practical actions: making cyber security a board-level responsibility, signing up to the National Cyber Security Centre Early Warning service, and improving Cyber Essentials coverage across their supply chains.

The pledge is not a certification and it does not prove that a business is secure. Instead, it is a governance and accountability commitment. It tells customers, suppliers, regulators and investors that cyber risk is being treated as a business resilience issue, not just an IT problem. Trust is such an important commodity in business and it is really important that businesses demonstrate that they treat their IT security seriously and demonstrate this to customers and suppliers.

What does the pledge involve?

Organisations that sign the pledge commit to the following:

Make cyber a board responsibility. This means implementing the Cyber Governance Code of Practice and ensuring all board members complete NCSC Cyber Governance Training within three months of signing and then annually.
Sign up to NCSC Early Warning. Organisations must register for the free Early Warning service within one month. This service alerts organisations to signs of potential compromise or malicious activity linked to their networks, domains or IP addresses.
Require Cyber Essentials across supply chains. Organisations must register for the Cyber Essentials Supplier Check Tool within two months, audit Cyber Essentials coverage across their supply chain, present the results to the board and take a risk-based approach to requiring certification from suppliers.

Signatories are also expected to encourage the same actions within their own supply chains, publish the signed declaration on their website within two months, and provide an annual public update on the steps taken to deliver against the pledge.

What is the significance?

For larger organisations, the pledge creates a visible board-level commitment to cyber governance and supply-chain assurance. For smaller suppliers, the impact may be indirect but significant: if their customers sign the pledge, they may increasingly be asked to obtain Cyber Essentials as a condition of doing business.

In practical terms, the pledge is likely to accelerate Cyber Essentials adoption across UK supply chains. It also raises expectations that boards should understand cyber risk, measure supplier assurance, and demonstrate that cyber resilience is part of business continuity planning.

Which businesses have already signed up?

The government has published a live list of organisations that have signed the Cyber Resilience Pledge. Early signatories include M&S, Microsoft UK, Vodafone Group, Deloitte LLP, Accenture UK Limited, Cloudflare, Aviva, Capgemini UK, Computacenter, ITV plc, London Stock Exchange Group, Mastercard Europe, Nationwide, Tesco PLC, Harrods, Whitbread and many cyber security and technology providers working towards adopting the Cyber Resilience Pledge including The Silver Cloud Business.

The reasons for signing will vary by organisation, but the common business drivers are clear:

Reputation and trust: signing demonstrates that cyber resilience is taken seriously at board level.
Supply-chain leadership: large organisations can use the pledge to set expectations for suppliers and partners.
Customer assurance: public commitment can help reassure customers after a period of heightened cyber threat.
Procurement readiness: businesses working with government, regulated sectors or large enterprises can show alignment with the UK’s preferred cyber-security direction of travel.
Incident learning: organisations that have experienced or observed major cyber incidents may see the pledge as a way to demonstrate continuous improvement.

Microsoft UK’s published comment around the launch positioned stronger board-level accountability and supply-chain security as ways for the UK to stay ahead as AI changes both cyber threats and defensive responses. That neatly captures the wider purpose of the pledge: it is about governance, resilience and shared responsibility across the economy.

What would a business need to do before declaring?

A sensible route to signing the pledge would look like this:

Board briefing: explain the pledge, confirm why the business wants to sign, and agree the intended scope.
Assign accountability: nominate a board-level owner for cyber risk and define reporting lines into the board.
Complete cyber-governance training: ensure all directors complete NCSC Cyber Governance Training within the pledge timescale.
Map current controls: assess existing policies, incident response, business continuity, supplier management, patching, identity protection, backups and monitoring.
Register for NCSC Early Warning: identify who will receive alerts, how they will be triaged, and how incidents will be escalated.
Register for the Cyber Essentials Supplier Check Tool: use it to understand supplier Cyber Essentials coverage.
Audit the supply chain: categorise suppliers by criticality, data access, network access and operational dependency.
Set supplier requirements: decide where Cyber Essentials, Cyber Essentials Plus or alternative assurance is required.
Prepare the declaration: have the Chair or CEO sign the pledge, publish it on the company website, and schedule an annual update.

How much does the pledge cost?

The pledge itself is voluntary and does not carry a government certification fee. However, businesses should budget for the practical work needed to meet the declaration commitments.

The pledge areas can be broken down into the following fees and notes:

Pledge declaration - £0 government fee - Internal time to review, approve, sign and publish.
NCSC Early Warning - Free - Requires internal or managed-service time to monitor and respond to alerts.
Cyber-governance training - Free NCSC training - Board time should be planned and recorded.
Supplier audit - Internal time or consultancy - Cost depends on supplier volume and complexity.
Cyber Essentials - Typically around £320–£600 + VAT by organisation size - Assessment fee only; remediation or consultancy is extra.
Cyber Essentials Plus - Commonly from about £1,500 to £4,250+ VAT, sometimes more for complex environments - Includes independent technical testing after Cyber Essentials.

Cyber Resilience Pledge vs Cyber Essentials vs Cyber Essentials Plus

Cyber Resilience Pledge

Type - Voluntary public declaration
Main purpose - Board accountability and supply-chain resilience
Assurance level - Commitment-based
Typical audience - Medium, large and enterprise organisations, especially those with supply chains
Validity - Ongoing public commitment with annual update expected
Cost - No direct government fee, but implementation effort required
Best use - Showing leadership, governance maturity and supply-chain influence

Cyber Essentials

Type - Government-backed certification
Main purpose - Baseline technical controls
Assurance level - Self-assessment reviewed by an assessor
Typical audience - All organisations, especially SMEs and suppliers
Validity - 12 months
Cost - Usually around £320–£600 + VAT depending on size
Best use - Proving basic cyber hygiene

Cyber Essentials Plus

Type - Government-backed certification with technical audit
Main purpose - Independent validation that controls work in practice
Assurance level - External testing and verification
Typical audience - Higher-risk suppliers, regulated sectors, government supply chains and larger organisations
Validity - 12 months
Cost - Usually several thousand pounds depending on size and complexity
Best use - Proving basic controls have been independently tested

The key difference is that the pledge is a promise to govern and influence cyber resilience, while Cyber Essentials and Cyber Essentials Plus are certifications. In most cases, they should not be seen as alternatives. The pledge depends heavily on Cyber Essentials because one of its three core commitments is to drive Cyber Essentials through the supply chain.

Which route is best by business size?

Small business

Cyber Essentials first. Consider the pledge only if customers ask for it or if the business wants to make a public governance commitment. Cyber Essentials gives the strongest value for money and is increasingly useful in tenders and supply-chain assurance.

SME

Cyber Essentials as a minimum; Cyber Essentials Plus if handling sensitive data, providing IT services, bidding for public-sector work or supporting larger customers. SMEs are often supply-chain targets. Certification gives clear evidence of baseline controls and can unlock commercial opportunities.

Medium organisation

Cyber Essentials Plus, plus consider signing the Cyber Resilience Pledge if the organisation has a board structure and meaningful supplier network. Medium organisations normally have enough operational complexity to justify independent technical validation and formal supplier assurance.

Enterprise organisation

All three: Cyber Resilience Pledge, Cyber Essentials, and Cyber Essentials Plus where appropriate across key business units or subsidiaries. Enterprises influence large supply chains, face higher regulatory and reputational exposure, and need both governance commitment and technical assurance.

What does this mean for my business?

For most businesses, the right starting point is Cyber Essentials. It is affordable, recognised and directly aligned with the government’s supply-chain direction. Cyber Essentials Plus is the stronger option where customers, contracts, risk profile or data sensitivity justify independent testing. The Cyber Resilience Pledge is most powerful for organisations with board-level governance and supplier influence, because it shows public leadership and commits the business to raising cyber standards beyond its own perimeter.

The best outcome is not to treat these as competing options. A mature business should use Cyber Essentials to establish the baseline, Cyber Essentials Plus to validate it, and the Cyber Resilience Pledge to show leadership, accountability and supply-chain responsibility.