Blog

Sometimes it’s not doing the simple things...

Wed, 04 Nov 2026 00:00:00 +0000

...that can have a devastating impact

A default password left unchanged -> an exposed controller -> business brought to a standstill.

A fridge does not need access to your customer database to cause a business crisis. Sometimes, all an attacker needs is the ability to stop it keeping things cold.

For supermarkets across Europe, that risk has become painfully real. Recent attacks on connected refrigeration systems have spoiled food, emptied chilled displays and disrupted trading. They are a reminder that cyber security is not just about protecting laptops and email. It is about protecting the equipment your business depends on to operate.

When remote management becomes a route to disruption

In October 2026, hundreds of French supermarket stores were affected by attacks on refrigeration controls. Further incidents were reported across several European countries in early November, with retailers discarding chilled and frozen stock. At least one store reported temperatures reaching 50°C. This was serious disruption at stores across multiple chains, rather than evidence that every affected chain was taken completely offline.

These were not simply domestic smart fridges. Commercial refrigeration systems use central controllers to manage cooling, defrost cycles, monitoring and alarms. Remote access allows contractors to diagnose faults and adjust equipment without visiting every site. The convenience is genuine; the danger comes when powerful management controls are left reachable over the public internet without adequate protection.

Reporting on the French incidents identified legacy technology connected to the internet with default passwords. France’s national cyber response team, CERT-FR, confirmed numerous compromises and explicitly recommended changing default passwords, updating firmware and removing direct internet exposure.

Default passwords are part of the reported picture, but not the whole story. Authentication weaknesses and outdated software also matter, and the official alert does not establish the same entry point for every incident. Changing a password is essential basic hygiene—not a substitute for securing the system around it.

The dangerous assumption: “It’s working, so it must be fine”

A default password is often a shared starting credential, not a secret unique to your business. Leaving it unchanged can mean that someone who knows the product’s standard login knows yours too. The NCSC warns that criminals can use default passwords to access smart devices and potentially the local network.

The deeper problem is complacency. A device gets installed, remote support starts working and the project is marked complete. Security settings, software updates and replacement dates become somebody else’s responsibility—or nobody’s. The equipment may keep doing its job for years while its security falls further behind.

Responsibility can also fall between the business, its IT provider and a specialist installer. Who changes the password? Who maintains the controller? Who checks how the contractor connects? Unless those responsibilities are explicit, everyone can assume someone else has dealt with them.

Changing default credentials is a basic safeguard, but it belongs alongside supported firmware, controlled remote access, monitoring and an agreed owner for each device. A stronger password cannot repair an authentication bypass or make unsupported equipment safe to expose to the internet.

“It’s only a fridge” is not a risk assessment

A refrigeration controller might not look like critical infrastructure. For a food retailer, however, it helps protect the stock the business exists to sell. Its importance comes from the consequences of failure, not whether anyone has formally labelled it critical national infrastructure.

The same principle applies to connected heating, access control, environmental sensors and production equipment. Ask what would happen if a device stopped working—or started following the wrong instructions. Could you still trade, protect your stock, access your premises or deliver your service?

The supermarket incidents show that attackers do not always need to steal data to cause damage. Disrupting the physical operation can be enough.

A device’s importance comes from what happens when it fails—not whether you think of it as IT.

The NCSC’s warning: prepare before the shelves are empty

On 3 November 2026, the National Cyber Security Centre’s warning to businesses was stark: failure to act on known cyber risks can have consequences extending to empty shelves, interrupted services and business failures. Its message was not simply to buy more technology, but to address weak technology and operational foundations that have been tolerated for too long.

You do not have to run a supermarket to take that warning seriously. Every organisation has dependencies. Some sit in a server room; others sit on a wall, above a ceiling or behind a refrigerated cabinet. Overlooking them does not make them less important.

How many connected devices are on your business network?

Think beyond computers and phones. Internet of Things (IoT) equipment can include CCTV cameras, door-entry systems, smart TVs, heating controls, sensors and connected appliances. Commercial controllers are often described as operational technology, or OT. Whatever the label, they need to be included in your security planning.

Ask yourself:

What is connected? Do you have an up-to-date inventory, including equipment installed by external contractors?
Who looks after it? Is someone responsible for credentials, updates, supplier access and replacement?
Are default passwords still in use? Have administrative accounts been checked and given strong, unique credentials?
How is it reached remotely? Is access controlled, or is a management interface exposed directly to the internet?
Where does it sit? Does it share the main network with staff computers, servers and sensitive data, or use a properly segmented network?
What happens if it fails? Have you considered operational disruption as well as data theft?

One insecure device can become a foothold inside your network

A connected device does not have to contain valuable information to be useful to an attacker. If compromised, it may provide a foothold from which to attempt access to other systems. That possibility is why the NCSC warns that insecure smart devices can put the local network at risk.

On a flat network, where devices can communicate too freely, an attacker may have opportunities to move sideways towards business systems. Success is not automatic: it depends on permissions, vulnerabilities and other defences. But placing an unnecessarily exposed device beside sensitive systems creates avoidable risk. The breach can move from an overlooked appliance towards the inside of the business.

Segmentation creates boundaries. A dedicated IoT or equipment network, with enforced firewall rules, can restrict access to staff devices, servers and sensitive data. Only the connections needed for the equipment’s legitimate purpose should be allowed. A separate Wi-Fi name or a VLAN alone is not protection if unrestricted traffic can still pass between networks.

Segmentation also does not protect an appliance whose management page remains open to the internet. Remote access must be secured too. CERT-FR recommends restoring refrigeration-management access only through a secure VPN or protected network, alongside vendor security measures.

For operational equipment, agree changes with the relevant supplier so that monitoring, alarms and essential services continue to work. Isolation reduces the potential impact of a compromise; it does not replace patching, strong credentials or replacement of unsupported devices.

What does this mean for your business?

You cannot protect what you have not identified. And you should not have to wait for an incident to discover that an overlooked device had access to far more of your network than it needed.

At The Silver Cloud Business, we can arrange a network discovery scan to help identify the devices connected to your network, investigate unfamiliar equipment and review how it is separated from your business systems. We can then discuss the option of creating a dedicated, restricted network for IoT and other higher-risk equipment, partitioning it away from sensitive data and day-to-day operations.

A scan is a starting point, not a guarantee that every device or weakness will be found. We combine discovery with a review of network records and supplier information, and agree suitable methods for sensitive or older equipment. The aim is a clearer inventory, practical priorities and a proportionate plan to reduce risk.

Call The Silver Cloud Business on 01722 411 999 to discuss a network scan and whether a dedicated IoT network is right for your business.

The simple things are easy to put off. The consequences are not always easy to put right.

Are you accidentally exposing yourself in public?

Wed, 28 Oct 2026 00:00:00 +0000

Your business data belongs in safe hands. Not in an unapproved chatbot with a very relaxed attitude to confidentiality.

Some businesses are running without knowing which AI tools their staff are using, what they are uploading or where that information goes next. Someone is polishing an email. Someone else is summarising a customer contract. A spreadsheet has just gone on an unscheduled trip to a free chatbot.

Meanwhile, the business owner is worrying about the electricity bill, blissfully unaware that confidential information may have left the building without so much as clocking out.

AI can be a brilliant business tool. But using it without clear rules can turn a helpful shortcut into an expensive conversation about data protection. That is why an AI usage policy is no longer something to put on the “one day” list, somewhere between updating the website and sorting out the stationery cupboard.

Free AI: what is the real price?

You have probably heard the warning: “If you’re not paying for the product, you are the product.” With AI, it is a useful reminder to check what you are agreeing to before feeding it your business information.

Some consumer AI services may use prompts, uploaded files and responses to improve or train their models, depending on the product, account and privacy settings. That means “Please summarise this document” could involve more than you bargained for if the document contains customer details, confidential pricing or your next big idea.

However, free does not automatically mean your data is used for training, and paying for a personal subscription does not automatically give you business-grade protection. Some services offer training opt-outs; business products often have different terms. The important question is not simply “Does it cost money?” but “What happens to our data?”

Training is not the same as publishing your documents online, and it does not mean a competitor can simply ask a chatbot to retrieve your accounts. The concern is losing control over confidential information, including how it is retained, reviewed, reused or potentially disclosed. A friendly chat window is not a confidentiality agreement.

Your competitors do not need the guided tour

Consider what your business keeps private: margins, tender prices, customer lists, supplier agreements and plans that give you an edge. None belongs in an unapproved AI service just because somebody wants a nicer executive summary.

If that information is exposed through inappropriate sharing, insecure integrations or another disclosure, competitors could gain a view inside your business, warts and all. Your carefully guarded pricing strategy should not become somebody else’s market research.

Where personal data is involved, there are also UK GDPR obligations to consider, including lawful processing, transparency and security. Confidentiality agreements and customer contracts may impose further restrictions. “The chatbot said it was fine” is unlikely to be the explanation anyone was hoping for.

An AI usage policy: clear rules, fewer surprises

A good AI usage policy is not a ban on useful technology. It is a practical guide to using it without accidentally giving away the contents of the filing cabinet. Staff should be able to find clear answers to everyday questions:

Which tools and accounts can I use? Name approved services and specify work accounts, required settings and how to request approval for something new.
What information can I enter? Give examples of permitted tasks, such as improving public website copy, and information that must not go into unapproved tools, such as customer records, payroll details, confidential contracts, passwords and commercial secrets.
Can I connect it to company systems? Require approval before connecting AI apps, agents, browser extensions or meeting assistants to email, files or other business data.
Who checks the answer? Make people responsible for reviewing facts, figures, confidentiality and suitability before AI-generated work is sent out or relied upon. Confident nonsense is still nonsense, even with excellent punctuation.
What if I make a mistake? Explain who to contact immediately if sensitive data is uploaded or shared accidentally. Prompt reporting gives the business a better chance of limiting the damage.

Then explain the policy, train people using realistic examples and review it as tools and working practices change. A policy nobody understands is just a document enjoying a quiet retirement in SharePoint.

Microsoft 365: check the doors before adding AI

Business AI protection and good housekeeping need to work together. Microsoft states that Microsoft 365 Copilot does not use your prompts, responses or organisational data accessed through Microsoft Graph to train foundation models. It also respects the user’s existing access permissions.

That is an important distinction from unapproved consumer tools. But it does not fix permissions that were too generous in the first place. If someone already has unintended access to a sensitive folder, AI may make its contents easier to discover and summarise.

Think of it as a very efficient assistant finding the filing cabinet you forgot to lock. The assistant has not picked the lock. You left the key in it.

That is why reviewing access, sharing and sensitive information before rollout matters, alongside giving staff clear rules. A usage policy tackles behaviour; an AI readiness assessment helps identify technical weaknesses. You need both.

Free AI Usage Policy

Every business that signs up for our £500* AI Readiness Assessment will receive a free AI usage policy to help protect your data.

Our assessment helps identify potential weaknesses in your Microsoft 365 tenant before you introduce or expand AI use. You receive a report showing the issues identified and recommended remediation, so you can understand what needs attention rather than simply hoping everything is fine.

That includes examining sharing and permissions that could allow staff to discover information they should not have access to. The free policy provides a practical starting point for setting out what staff can and cannot do with AI, ready to adapt to your organisation’s approved tools and working practices.

It is a sensible combination: understand the technical risks, decide the rules and give your team the guidance to work safely. No crystal ball required.

What does this mean for your business

AI should help your people work smarter, not leave your confidential information making new acquaintances. Start by finding out which tools are being used, put clear boundaries around business data and check that your Microsoft 365 permissions are ready for AI.

Have an AI readiness scan and recommended remediation report carried out for your business, and we will provide a free AI usage policy. You will have a clearer picture of potential weaknesses and a practical foundation for helping staff understand what they can and cannot do.

Call The Silver Cloud Business on 01722 411 999 for more information and to arrange your AI Readiness Assessment.

Keep the productivity gains. Keep the confidential information confidential. Give your competitors something less useful to read.

^{*plus VAT and subject to our terms and conditions.}

What Businesses Can Learn from the Major Google Cloud Outage in the UK

Wed, 21 Oct 2026 00:00:00 +0000

On Tuesday, 20 October 2026, businesses across the UK experienced disruption linked to a major Google Cloud service outage in the London region, identified as europe-west2-b. The incident was reportedly caused by a power event at a third-party facility supporting the region.

For organisations that rely on Google Cloud to host applications, store data, manage operations or support customer services, the outage demonstrated how quickly an infrastructure incident can affect day-to-day business. It also highlighted the importance of understanding cloud dependencies and maintaining a tested continuity plan.

What happened?

The outage affected the Google Cloud London region on Tuesday, 20 October 2026. The reported cause was a power event at a third-party facility supporting europe-west2-b.

Google Cloud regions are designed to provide reliable infrastructure, but individual zones within a region can still be affected by events involving power, networking, cooling or other supporting systems. Where applications are concentrated in one zone, or where services have not been configured for resilience across multiple zones or regions, an incident can result in service interruption or reduced performance.

The scale and duration of disruption can vary between customers. Some organisations may have experienced a complete loss of availability, while others may have seen intermittent access, delayed processing, failed deployments or problems with services that depended on affected infrastructure.

Which services and systems may have been impacted?

The effect of the outage depended on the Google Cloud products, zones and architectures used by each organisation. Potentially affected areas included:

Compute and hosted applications: Virtual machines, containerised workloads and applications operating in the affected zone may have become unavailable or experienced degraded performance.
Storage and databases: Applications relying on zonal storage, databases or data-processing services may have encountered delays, connection failures or reduced access.
Networking: Load balancing, connectivity between services and access to applications hosted in the London region may have been disrupted.
Identity and access: Businesses using cloud-based authentication, permissions or service accounts may have experienced difficulties accessing applications or administrative tools.
APIs and integrations: Customer-facing websites, mobile applications and internal systems that depended on affected Google Cloud APIs may have returned errors or processed requests slowly.
Data and analytics: Reporting, data pipelines and scheduled processing jobs may have been delayed where they depended on resources in the affected region.
Backups and recovery services: Organisations whose backup or disaster-recovery resources were located in the same region may have found that their recovery options were less available than expected.

This is not necessarily a complete list of affected Google Cloud products. The precise impact depended on the services running in europe-west2-b, the way those services were configured and whether workloads were distributed across multiple zones or regions. Businesses should refer to Google’s official incident report and service-status information for the confirmed list of affected products and the final incident timeline.

How did the outage affect businesses?

The consequences for businesses ranged from temporary inconvenience to significant operational disruption. If a website, application or customer portal was hosted in the affected zone, customers may have been unable to access services or complete transactions. Businesses may also have faced increased support requests, abandoned purchases and damage to customer confidence.

Internal teams could have been affected as well. Employees may have lost access to business applications, shared data, dashboards or automated workflows. Where cloud systems supported stock management, scheduling, billing, order processing or customer relationship management, even a short outage could create a backlog that continued after services were restored.

Technical teams may have had to investigate whether the problem originated in their own application, network configuration or Google Cloud infrastructure. This can make incident response more difficult, particularly when several dependent services fail at the same time.

The outage also exposed the risks of placing too many critical systems in one availability zone or relying on a single cloud region. A business may believe it has adopted a resilient cloud strategy while still having a hidden single point of failure in its hosting, database, authentication or backup arrangements.

How businesses can mitigate a future outage

No organisation can prevent every infrastructure incident, but businesses can reduce the likelihood and impact of disruption by taking practical steps.

Distribute workloads across zones: Where appropriate, deploy critical applications across multiple availability zones rather than relying on one zone within a region.
Consider multi-region resilience: For systems that require a higher level of availability, assess whether a secondary region should be available for failover.
Test failover procedures: A recovery design is only useful if it works in practice. Test failover regularly and record the results.
Protect data independently: Maintain tested backups and ensure that critical recovery data is not held exclusively in the same infrastructure location as the primary system.
Map service dependencies: Document the relationship between applications, databases, APIs, identity systems, networking and third-party providers.
Prepare alternative processes: Establish manual or offline procedures for essential work, including customer support, order handling and internal approvals.
Maintain alternative communication channels: Keep an approved secondary method of contacting staff, customers and suppliers if primary systems become unavailable.
Monitor systems proactively: Use independent monitoring to identify availability problems quickly and distinguish a cloud-provider incident from a local fault.
Define an incident-response plan: Establish clear responsibilities, escalation routes and decision-making authority before an outage occurs.
Review provider arrangements: Understand service-level commitments, support options, recovery objectives and the practical limitations of each cloud service.

The role of The Silver Cloud Business

The Silver Cloud Business can help organisations review their cloud arrangements and identify weaknesses that may not be obvious during normal operations. This can include assessing dependence on a single region or zone, reviewing backup and recovery arrangements, mapping critical service dependencies and helping create a practical continuity plan.

A resilience review can also help businesses decide which systems require rapid failover, which processes can tolerate temporary disruption and where alternative tools or manual procedures may be appropriate. The aim is not to add unnecessary complexity, but to ensure that technology arrangements reflect the organisation’s operational priorities and tolerance for downtime.

Conclusion

The Google Cloud outage affecting the UK on Tuesday, 20 October 2026, was a clear reminder that even sophisticated cloud infrastructure can be affected by events at supporting facilities. Businesses that rely on a single zone, region or provider may face wider disruption than expected when an underlying dependency fails.

By distributing critical workloads, protecting data, testing recovery plans and preparing alternative ways of working, organisations can reduce the operational and financial consequences of a future outage.

What does this mean for you business? The Silver Cloud Business can help you understand your cloud dependencies, improve resilience and prepare practical continuity plans for service disruptions. To discuss how we can support your organisation, call 01722 411 999.

Five FREE Ways to Protect Your Small Business from Internal and External Threats

Tue, 13 Oct 2026 00:00:00 +0000

Small businesses face risks from two directions. External threats include cyber criminals, phishing emails, malware and people trying to gain unauthorised access. Internal threats can come from honest mistakes, weak processes, excessive access rights or, less commonly, deliberate misuse by someone inside the organisation.

The good news is that better protection does not always require a bigger budget.

These five free actions can reduce risk immediately.

1. Turn on multi-factor authentication everywhere you can

Multi-factor authentication adds a second check when someone signs in, such as an approval through an authenticator app. Enable it for email, cloud storage, banking, accounting software, social media and any system holding customer or business data. It helps block external attackers using stolen passwords and limits the damage if an employee accidentally shares their login details.

2. Give people only the access they need

Review who can see, change or delete information across your systems. Remove old accounts promptly when someone leaves, avoid sharing logins and reserve administrator access for the few people who genuinely need it. A simple access review reduces internal risk, prevents accidental changes and gives an external attacker fewer opportunities if one account is compromised.

3. Keep software, devices and browsers up to date

Updates often fix security weaknesses that criminals actively exploit. Switch on automatic updates for computers, phones, tablets, web browsers and business applications. Ask everyone to restart devices when prompted and remove software that is no longer used. This closes common routes for external attacks and stops forgotten tools from becoming unmonitored internal risks.

4. Build a simple “stop, check, report” habit

Make it normal for employees to pause before acting on unusual requests, especially those involving payments, passwords, urgent deadlines or changes to bank details. They should verify the request using a trusted contact method and report anything suspicious without fear of blame. This free habit helps catch phishing and impersonation attempts while also reducing costly mistakes made inside the business.

5. Back up important information and test recovery

Use the backup and version-history features already included with your cloud services and devices. Identify the files your business could not operate without, confirm they are being backed up and test that you can restore a file. Keep at least one backup protected from everyday user accounts where possible. Reliable recovery protects against ransomware, device failure, accidental deletion and deliberate damage.

What does this mean for your business

Strong security starts with consistent basics, not expensive technology.

By taking these five free steps, your business can reduce avoidable disruption, protect customer and company information, and create a culture in which everyone plays a part in managing risk.

If you would like a clear, practical view of where your business is exposed and what to prioritise next, call us on 01722 411 999.

Is your business ready for winter?

Wed, 07 Oct 2026 00:00:00 +0000

It is now the last quarter of 2026 which means that winter is rapidly approaching and with the arrival of winter, it sometimes brings extra challenges that we are not always expecting.

Winter disruption rarely arrives as a single, manageable problem. Severe weather can close roads, delay deliveries and prevent staff from reaching the workplace. A local power cut may take systems offline, while a broadband outage can stop a cloud-dependent team in its tracks. If fuel becomes scarce or expensive at the same time, even routine operations can quickly become difficult.

El Niño may add further uncertainty this winter, particularly through indirect effects on global food, energy and supply chains. However, its precise influence on UK weather is difficult to predict, and current national forecasts indicate that Great Britain should have sufficient electricity supply. The sensible response is not panic; it is proportionate preparation for the local outages, transport problems and supplier failures that can happen in any difficult winter.

Your winter business-readiness checklist

1. Power and premises

What would you do if the power went down for several hours—or several days?
Identify the systems that must remain available and how long their battery backup will last.
Check whether uninterruptible power supplies are maintained and sized for essential equipment.
Decide which services should be shut down safely during an extended outage.
Confirm how staff will enter, secure or leave the building if alarms, access controls, lifts or lighting fail.
Keep torches, charged power banks and printed emergency contacts available.

2. Internet, phones and access to systems

What would you do if severe weather took down your internet connection?
Arrange a secondary connection, such as a different broadband provider or managed mobile failover.
Test whether employees can work securely from another location or through mobile data.
Make sure key phone numbers can be diverted and that customers can still reach you.
Identify essential files or procedures that need secure offline access.
Check that multi-factor authentication will still work if a staff member loses access to their usual device or mobile signal.

3. People and communications

Set clear rules for office closure, remote working and travel during warnings or dangerous conditions.
Maintain an up-to-date contact list and agree how urgent messages will be sent if email is unavailable.
Identify deputies for essential roles and avoid relying on one person for critical knowledge or approvals.
Consider the needs of staff with caring responsibilities, disabilities or long journeys.
Run a short exercise so everyone knows where to find the continuity plan and who makes decisions.

4. Suppliers, stock and deliveries

What would you do if weather disrupted your supply chain?
Map the suppliers, couriers and components that your most important services depend upon.
Ask critical suppliers about their own continuity plans and expected lead times.
Qualify alternatives in advance rather than searching during a crisis.
Review minimum stock levels for essential items, while avoiding unnecessary over-ordering.
Agree how you will prioritise customers if stock, transport or staff capacity becomes limited.

5. Fuel, travel and logistics

Identify which journeys and deliveries are genuinely business-critical.
Plan for fuel shortages, poor road conditions and public transport disruption.
Allow key employees to work remotely where practical and safe.
Make agreements with alternative couriers or local partners before demand peaks.
Keep vehicles maintained and ensure drivers have clear escalation procedures.

6. Data, cyber security and recovery

Confirm that backups are automatic, protected and kept separately from live systems.
Test restoring a file or system; a backup is only useful if recovery works.
Keep devices patched and protected, including laptops used away from the office.
Warn staff that criminals may exploit disruption with fake delivery, payment or emergency-support messages.
Document how to report a cyber incident when normal channels are unavailable.

7. Customers, cash flow and insurance

Prepare website, social media and voicemail messages for closures or delays.
Decide what service levels you can realistically maintain and communicate changes early.
Review cash reserves and the effect of delayed sales, deliveries or customer payments.
Check business interruption, equipment and premises insurance, including exclusions and notification requirements.
Store policy details and claims contacts somewhere accessible during an outage.

Turn the checklist into a plan

Assign an owner to each action, set a completion date and record the workaround in plain language. Then test the plan with a simple scenario: the office has no power, the internet is unavailable and a key supplier cannot deliver for 48 hours. The exercise will quickly reveal hidden dependencies and outdated contact details.

What does this mean for your business?

Every organisation has different risks, but every organisation benefits from knowing how it will keep communicating, protect its data and continue serving customers when normal arrangements fail. The Silver Cloud Business can help you review your IT resilience, cloud services, communications, remote-working arrangements, backups and disaster-recovery plans—then turn any gaps into practical improvements.

Do not wait for disruption to test your plan. Call The Silver Cloud Business on 01722 411999 to discuss how prepared your business is for winter.

How to Protect Your Business from AI-Powered Cyberattacks

Tue, 29 Sep 2026 00:00:00 +0000

A practical guide for business owners who want stronger security without creating unnecessary complexity

Artificial intelligence has not invented cybercrime, but it is making familiar attacks faster, cheaper and more convincing. Criminals can use AI to personalise phishing messages, imitate a trusted person’s voice or image, scan systems for weaknesses and automate large numbers of attacks. At the same time, businesses can expose themselves by adopting AI tools without controlling what data they receive or what systems they can access.

There are further examples of AI breaching systems, with the latest high profile incident being the Australian Government Website being hacked by OpenAI who only notified the Australians three months after the security breach.

The answer is not to avoid AI. It is to combine sound cyber-security basics with a few controls designed for AI-era risks. The following steps will give most organisations a strong starting point.

Make identity harder to steal

Require multi-factor authentication on email, cloud services, banking, remote access and administrator accounts. Where available, prefer phishing-resistant options such as passkeys or security keys. Give each person only the access needed for their role, remove dormant accounts promptly and keep administrator accounts separate from everyday work.

Verify money and access requests out of band

A convincing email, phone call or video meeting is no longer proof of identity. Set a written rule that supplier bank-detail changes, urgent payments, password resets and requests for sensitive data must be checked through a second, trusted channel. Staff should call a known number from company records rather than one supplied in the message. Use dual approval for high-value or unusual transactions.

Update staff training for AI-enabled scams

Old advice that focuses on spelling mistakes is no longer enough. Train people to question unexpected urgency, secrecy, changes in payment instructions, unusual sign-in prompts and requests to bypass normal processes—even when a message looks polished. Run short, regular exercises covering email phishing, text messages, QR codes and voice or video impersonation. Make reporting easy and reward quick escalation rather than blaming honest mistakes.

Patch, back up and monitor

AI can help attackers find exposed systems more quickly, so prompt patching matters. Keep an inventory of devices, software and cloud services; enable automatic updates where appropriate; and prioritise internet-facing systems. Maintain encrypted backups that are separated from the main network, test restoration regularly and protect backup administration with strong authentication. Turn on logging and alerts for unusual sign-ins, large downloads, new forwarding rules and privilege changes.

Put guardrails around business AI tools

Keep a register of approved AI services and define what employees may enter into them. Do not paste customer records, contracts, credentials, source code or commercially sensitive information into an unapproved public tool. Review suppliers’ security, data-retention, training-data and incident-notification terms. Disable unnecessary plug-ins and integrations, restrict an AI assistant’s permissions, and require human approval before it can send messages, change records, run code or trigger payments.

Test AI systems as if their inputs may be hostile

If your business uses AI to read emails, websites, documents or customer submissions, assume that external content may contain malicious instructions. Test for prompt injection, unsafe tool use and leakage of confidential data. Separate trusted instructions from untrusted content, validate outputs before action, log important AI activity and provide a reliable way to stop or override automated behaviour. If you train or fine-tune models, control who can alter training data and monitor for unexpected changes in results.

Prepare for the incident before it happens

Create a short incident-response plan that names decision-makers, technical contacts, legal and communications support, insurers and reporting routes. Include steps for isolating affected accounts or devices, preserving evidence, contacting customers and restoring operations. Practise a scenario involving a deepfake payment request or a compromised AI assistant, then fix any gaps the exercise reveals.

A 30-day action plan

Week 1: List critical systems, data, suppliers and AI tools; name one person accountable for cyber risk.
Week 2: Enable strong multi-factor authentication, remove unused accounts and patch exposed systems.
Week 3: Introduce call-back checks and dual approval for sensitive changes; publish a simple AI-use policy.
Week 4: Test a backup restoration and run a short incident exercise with leadership, finance and IT.

What does this mean for your business?

There is no single product that can stop every AI-enabled attack. The strongest defence is layered: secure identities, disciplined approval processes, well-trained people, maintained technology, controlled AI use and a rehearsed response. Start with the highest-risk accounts and transactions, measure progress each month and treat cyber resilience as part of normal business management—not just an IT task.

If you would like for information call The Silver Cloud Business on 01722 411 999 and we can help you build an AI resilience plan.

References and further guidance

UK National Cyber Security Centre, “AI and cyber security: what you need to know”.
UK Government and National Cyber Security Centre, “Cyber security guidance for business”.
Information Commissioner’s Office, “Five steps to protect your organisation from AI-powered cyber threats”.
National Institute of Standards and Technology, “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile”