Blog

What Businesses Can Learn from the Major Google Cloud Outage in the UK

Wed, 21 Oct 2026 00:00:00 +0000

On Tuesday, 20 October 2026, businesses across the UK experienced disruption linked to a major Google Cloud service outage in the London region, identified as europe-west2-b. The incident was reportedly caused by a power event at a third-party facility supporting the region.

For organisations that rely on Google Cloud to host applications, store data, manage operations or support customer services, the outage demonstrated how quickly an infrastructure incident can affect day-to-day business. It also highlighted the importance of understanding cloud dependencies and maintaining a tested continuity plan.

What happened?

The outage affected the Google Cloud London region on Tuesday, 20 October 2026. The reported cause was a power event at a third-party facility supporting europe-west2-b.

Google Cloud regions are designed to provide reliable infrastructure, but individual zones within a region can still be affected by events involving power, networking, cooling or other supporting systems. Where applications are concentrated in one zone, or where services have not been configured for resilience across multiple zones or regions, an incident can result in service interruption or reduced performance.

The scale and duration of disruption can vary between customers. Some organisations may have experienced a complete loss of availability, while others may have seen intermittent access, delayed processing, failed deployments or problems with services that depended on affected infrastructure.

Which services and systems may have been impacted?

The effect of the outage depended on the Google Cloud products, zones and architectures used by each organisation. Potentially affected areas included:

Compute and hosted applications: Virtual machines, containerised workloads and applications operating in the affected zone may have become unavailable or experienced degraded performance.
Storage and databases: Applications relying on zonal storage, databases or data-processing services may have encountered delays, connection failures or reduced access.
Networking: Load balancing, connectivity between services and access to applications hosted in the London region may have been disrupted.
Identity and access: Businesses using cloud-based authentication, permissions or service accounts may have experienced difficulties accessing applications or administrative tools.
APIs and integrations: Customer-facing websites, mobile applications and internal systems that depended on affected Google Cloud APIs may have returned errors or processed requests slowly.
Data and analytics: Reporting, data pipelines and scheduled processing jobs may have been delayed where they depended on resources in the affected region.
Backups and recovery services: Organisations whose backup or disaster-recovery resources were located in the same region may have found that their recovery options were less available than expected.

This is not necessarily a complete list of affected Google Cloud products. The precise impact depended on the services running in europe-west2-b, the way those services were configured and whether workloads were distributed across multiple zones or regions. Businesses should refer to Google’s official incident report and service-status information for the confirmed list of affected products and the final incident timeline.

How did the outage affect businesses?

The consequences for businesses ranged from temporary inconvenience to significant operational disruption. If a website, application or customer portal was hosted in the affected zone, customers may have been unable to access services or complete transactions. Businesses may also have faced increased support requests, abandoned purchases and damage to customer confidence.

Internal teams could have been affected as well. Employees may have lost access to business applications, shared data, dashboards or automated workflows. Where cloud systems supported stock management, scheduling, billing, order processing or customer relationship management, even a short outage could create a backlog that continued after services were restored.

Technical teams may have had to investigate whether the problem originated in their own application, network configuration or Google Cloud infrastructure. This can make incident response more difficult, particularly when several dependent services fail at the same time.

The outage also exposed the risks of placing too many critical systems in one availability zone or relying on a single cloud region. A business may believe it has adopted a resilient cloud strategy while still having a hidden single point of failure in its hosting, database, authentication or backup arrangements.

How businesses can mitigate a future outage

No organisation can prevent every infrastructure incident, but businesses can reduce the likelihood and impact of disruption by taking practical steps.

Distribute workloads across zones: Where appropriate, deploy critical applications across multiple availability zones rather than relying on one zone within a region.
Consider multi-region resilience: For systems that require a higher level of availability, assess whether a secondary region should be available for failover.
Test failover procedures: A recovery design is only useful if it works in practice. Test failover regularly and record the results.
Protect data independently: Maintain tested backups and ensure that critical recovery data is not held exclusively in the same infrastructure location as the primary system.
Map service dependencies: Document the relationship between applications, databases, APIs, identity systems, networking and third-party providers.
Prepare alternative processes: Establish manual or offline procedures for essential work, including customer support, order handling and internal approvals.
Maintain alternative communication channels: Keep an approved secondary method of contacting staff, customers and suppliers if primary systems become unavailable.
Monitor systems proactively: Use independent monitoring to identify availability problems quickly and distinguish a cloud-provider incident from a local fault.
Define an incident-response plan: Establish clear responsibilities, escalation routes and decision-making authority before an outage occurs.
Review provider arrangements: Understand service-level commitments, support options, recovery objectives and the practical limitations of each cloud service.

The role of The Silver Cloud Business

The Silver Cloud Business can help organisations review their cloud arrangements and identify weaknesses that may not be obvious during normal operations. This can include assessing dependence on a single region or zone, reviewing backup and recovery arrangements, mapping critical service dependencies and helping create a practical continuity plan.

A resilience review can also help businesses decide which systems require rapid failover, which processes can tolerate temporary disruption and where alternative tools or manual procedures may be appropriate. The aim is not to add unnecessary complexity, but to ensure that technology arrangements reflect the organisation’s operational priorities and tolerance for downtime.

Conclusion

The Google Cloud outage affecting the UK on Tuesday, 20 October 2026, was a clear reminder that even sophisticated cloud infrastructure can be affected by events at supporting facilities. Businesses that rely on a single zone, region or provider may face wider disruption than expected when an underlying dependency fails.

By distributing critical workloads, protecting data, testing recovery plans and preparing alternative ways of working, organisations can reduce the operational and financial consequences of a future outage.

What does this mean for you business? The Silver Cloud Business can help you understand your cloud dependencies, improve resilience and prepare practical continuity plans for service disruptions. To discuss how we can support your organisation, call 01722 411 999.

Five FREE Ways to Protect Your Small Business from Internal and External Threats

Tue, 13 Oct 2026 00:00:00 +0000

Small businesses face risks from two directions. External threats include cyber criminals, phishing emails, malware and people trying to gain unauthorised access. Internal threats can come from honest mistakes, weak processes, excessive access rights or, less commonly, deliberate misuse by someone inside the organisation.

The good news is that better protection does not always require a bigger budget.

These five free actions can reduce risk immediately.

1. Turn on multi-factor authentication everywhere you can

Multi-factor authentication adds a second check when someone signs in, such as an approval through an authenticator app. Enable it for email, cloud storage, banking, accounting software, social media and any system holding customer or business data. It helps block external attackers using stolen passwords and limits the damage if an employee accidentally shares their login details.

2. Give people only the access they need

Review who can see, change or delete information across your systems. Remove old accounts promptly when someone leaves, avoid sharing logins and reserve administrator access for the few people who genuinely need it. A simple access review reduces internal risk, prevents accidental changes and gives an external attacker fewer opportunities if one account is compromised.

3. Keep software, devices and browsers up to date

Updates often fix security weaknesses that criminals actively exploit. Switch on automatic updates for computers, phones, tablets, web browsers and business applications. Ask everyone to restart devices when prompted and remove software that is no longer used. This closes common routes for external attacks and stops forgotten tools from becoming unmonitored internal risks.

4. Build a simple “stop, check, report” habit

Make it normal for employees to pause before acting on unusual requests, especially those involving payments, passwords, urgent deadlines or changes to bank details. They should verify the request using a trusted contact method and report anything suspicious without fear of blame. This free habit helps catch phishing and impersonation attempts while also reducing costly mistakes made inside the business.

5. Back up important information and test recovery

Use the backup and version-history features already included with your cloud services and devices. Identify the files your business could not operate without, confirm they are being backed up and test that you can restore a file. Keep at least one backup protected from everyday user accounts where possible. Reliable recovery protects against ransomware, device failure, accidental deletion and deliberate damage.

What does this mean for your business

Strong security starts with consistent basics, not expensive technology.

By taking these five free steps, your business can reduce avoidable disruption, protect customer and company information, and create a culture in which everyone plays a part in managing risk.

If you would like a clear, practical view of where your business is exposed and what to prioritise next, call us on 01722 411 999.

Is your business ready for winter?

Wed, 07 Oct 2026 00:00:00 +0000

It is now the last quarter of 2026 which means that winter is rapidly approaching and with the arrival of winter, it sometimes brings extra challenges that we are not always expecting.

Winter disruption rarely arrives as a single, manageable problem. Severe weather can close roads, delay deliveries and prevent staff from reaching the workplace. A local power cut may take systems offline, while a broadband outage can stop a cloud-dependent team in its tracks. If fuel becomes scarce or expensive at the same time, even routine operations can quickly become difficult.

El Niño may add further uncertainty this winter, particularly through indirect effects on global food, energy and supply chains. However, its precise influence on UK weather is difficult to predict, and current national forecasts indicate that Great Britain should have sufficient electricity supply. The sensible response is not panic; it is proportionate preparation for the local outages, transport problems and supplier failures that can happen in any difficult winter.

Your winter business-readiness checklist

1. Power and premises

What would you do if the power went down for several hours—or several days?
Identify the systems that must remain available and how long their battery backup will last.
Check whether uninterruptible power supplies are maintained and sized for essential equipment.
Decide which services should be shut down safely during an extended outage.
Confirm how staff will enter, secure or leave the building if alarms, access controls, lifts or lighting fail.
Keep torches, charged power banks and printed emergency contacts available.

2. Internet, phones and access to systems

What would you do if severe weather took down your internet connection?
Arrange a secondary connection, such as a different broadband provider or managed mobile failover.
Test whether employees can work securely from another location or through mobile data.
Make sure key phone numbers can be diverted and that customers can still reach you.
Identify essential files or procedures that need secure offline access.
Check that multi-factor authentication will still work if a staff member loses access to their usual device or mobile signal.

3. People and communications

Set clear rules for office closure, remote working and travel during warnings or dangerous conditions.
Maintain an up-to-date contact list and agree how urgent messages will be sent if email is unavailable.
Identify deputies for essential roles and avoid relying on one person for critical knowledge or approvals.
Consider the needs of staff with caring responsibilities, disabilities or long journeys.
Run a short exercise so everyone knows where to find the continuity plan and who makes decisions.

4. Suppliers, stock and deliveries

What would you do if weather disrupted your supply chain?
Map the suppliers, couriers and components that your most important services depend upon.
Ask critical suppliers about their own continuity plans and expected lead times.
Qualify alternatives in advance rather than searching during a crisis.
Review minimum stock levels for essential items, while avoiding unnecessary over-ordering.
Agree how you will prioritise customers if stock, transport or staff capacity becomes limited.

5. Fuel, travel and logistics

Identify which journeys and deliveries are genuinely business-critical.
Plan for fuel shortages, poor road conditions and public transport disruption.
Allow key employees to work remotely where practical and safe.
Make agreements with alternative couriers or local partners before demand peaks.
Keep vehicles maintained and ensure drivers have clear escalation procedures.

6. Data, cyber security and recovery

Confirm that backups are automatic, protected and kept separately from live systems.
Test restoring a file or system; a backup is only useful if recovery works.
Keep devices patched and protected, including laptops used away from the office.
Warn staff that criminals may exploit disruption with fake delivery, payment or emergency-support messages.
Document how to report a cyber incident when normal channels are unavailable.

7. Customers, cash flow and insurance

Prepare website, social media and voicemail messages for closures or delays.
Decide what service levels you can realistically maintain and communicate changes early.
Review cash reserves and the effect of delayed sales, deliveries or customer payments.
Check business interruption, equipment and premises insurance, including exclusions and notification requirements.
Store policy details and claims contacts somewhere accessible during an outage.

Turn the checklist into a plan

Assign an owner to each action, set a completion date and record the workaround in plain language. Then test the plan with a simple scenario: the office has no power, the internet is unavailable and a key supplier cannot deliver for 48 hours. The exercise will quickly reveal hidden dependencies and outdated contact details.

What does this mean for your business?

Every organisation has different risks, but every organisation benefits from knowing how it will keep communicating, protect its data and continue serving customers when normal arrangements fail. The Silver Cloud Business can help you review your IT resilience, cloud services, communications, remote-working arrangements, backups and disaster-recovery plans—then turn any gaps into practical improvements.

Do not wait for disruption to test your plan. Call The Silver Cloud Business on 01722 411999 to discuss how prepared your business is for winter.

How to Protect Your Business from AI-Powered Cyberattacks

Tue, 29 Sep 2026 00:00:00 +0000

A practical guide for business owners who want stronger security without creating unnecessary complexity

Artificial intelligence has not invented cybercrime, but it is making familiar attacks faster, cheaper and more convincing. Criminals can use AI to personalise phishing messages, imitate a trusted person’s voice or image, scan systems for weaknesses and automate large numbers of attacks. At the same time, businesses can expose themselves by adopting AI tools without controlling what data they receive or what systems they can access.

There are further examples of AI breaching systems, with the latest high profile incident being the Australian Government Website being hacked by OpenAI who only notified the Australians three months after the security breach.

The answer is not to avoid AI. It is to combine sound cyber-security basics with a few controls designed for AI-era risks. The following steps will give most organisations a strong starting point.

Make identity harder to steal

Require multi-factor authentication on email, cloud services, banking, remote access and administrator accounts. Where available, prefer phishing-resistant options such as passkeys or security keys. Give each person only the access needed for their role, remove dormant accounts promptly and keep administrator accounts separate from everyday work.

Verify money and access requests out of band

A convincing email, phone call or video meeting is no longer proof of identity. Set a written rule that supplier bank-detail changes, urgent payments, password resets and requests for sensitive data must be checked through a second, trusted channel. Staff should call a known number from company records rather than one supplied in the message. Use dual approval for high-value or unusual transactions.

Update staff training for AI-enabled scams

Old advice that focuses on spelling mistakes is no longer enough. Train people to question unexpected urgency, secrecy, changes in payment instructions, unusual sign-in prompts and requests to bypass normal processes—even when a message looks polished. Run short, regular exercises covering email phishing, text messages, QR codes and voice or video impersonation. Make reporting easy and reward quick escalation rather than blaming honest mistakes.

Patch, back up and monitor

AI can help attackers find exposed systems more quickly, so prompt patching matters. Keep an inventory of devices, software and cloud services; enable automatic updates where appropriate; and prioritise internet-facing systems. Maintain encrypted backups that are separated from the main network, test restoration regularly and protect backup administration with strong authentication. Turn on logging and alerts for unusual sign-ins, large downloads, new forwarding rules and privilege changes.

Put guardrails around business AI tools

Keep a register of approved AI services and define what employees may enter into them. Do not paste customer records, contracts, credentials, source code or commercially sensitive information into an unapproved public tool. Review suppliers’ security, data-retention, training-data and incident-notification terms. Disable unnecessary plug-ins and integrations, restrict an AI assistant’s permissions, and require human approval before it can send messages, change records, run code or trigger payments.

Test AI systems as if their inputs may be hostile

If your business uses AI to read emails, websites, documents or customer submissions, assume that external content may contain malicious instructions. Test for prompt injection, unsafe tool use and leakage of confidential data. Separate trusted instructions from untrusted content, validate outputs before action, log important AI activity and provide a reliable way to stop or override automated behaviour. If you train or fine-tune models, control who can alter training data and monitor for unexpected changes in results.

Prepare for the incident before it happens

Create a short incident-response plan that names decision-makers, technical contacts, legal and communications support, insurers and reporting routes. Include steps for isolating affected accounts or devices, preserving evidence, contacting customers and restoring operations. Practise a scenario involving a deepfake payment request or a compromised AI assistant, then fix any gaps the exercise reveals.

A 30-day action plan

Week 1: List critical systems, data, suppliers and AI tools; name one person accountable for cyber risk.
Week 2: Enable strong multi-factor authentication, remove unused accounts and patch exposed systems.
Week 3: Introduce call-back checks and dual approval for sensitive changes; publish a simple AI-use policy.
Week 4: Test a backup restoration and run a short incident exercise with leadership, finance and IT.

What does this mean for your business?

There is no single product that can stop every AI-enabled attack. The strongest defence is layered: secure identities, disciplined approval processes, well-trained people, maintained technology, controlled AI use and a rehearsed response. Start with the highest-risk accounts and transactions, measure progress each month and treat cyber resilience as part of normal business management—not just an IT task.

If you would like for information call The Silver Cloud Business on 01722 411 999 and we can help you build an AI resilience plan.

References and further guidance

UK National Cyber Security Centre, “AI and cyber security: what you need to know”.
UK Government and National Cyber Security Centre, “Cyber security guidance for business”.
Information Commissioner’s Office, “Five steps to protect your organisation from AI-powered cyber threats”.
National Institute of Standards and Technology, “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile”

Do you know where your business data is?

Wed, 23 Sep 2026 00:00:00 +0000

A lot of people are using AI these days; some people are even using it to help them with their work, but are staff using AI in your business with your knowledge or are they using it under the radar? As we covered in last week's article, a lot of AI models use data to train on, what if a member of staff is using your company data and it's inadvertently being used to train AI which in turn could aid your competitors or leak your business data?

I'm going to go down memory lane, bear with me; a few years ago, we took a frantic call from a business that had suffered a serious data leak. Not because of a hacker. Not because of ransomware. Not because someone inside the company was trying to do harm.

It happened because a well-meaning member of staff wanted to carry on working from home. To make that easier, they uploaded company data into their own free personal Dropbox account. The intention was helpful. The outcome was catastrophic.

The data was now outside the company’s control, outside any proper business agreement, and outside the terms intended for that domestic service. Worse still, it was not protected to the standard the business needed. The result was a major data loss, reputational damage, and a very painful lesson: convenience can be dangerous when it bypasses proper controls.

The same risk has a new name: AI

Fast forward to today and the same pattern is happening again. This time, the tool is not personal cloud storage. It is artificial intelligence.

Staff are using AI tools to write emails, analyse spreadsheets, summarise documents, create proposals, polish reports, draft HR content, troubleshoot technical issues and speed up everyday work. In many cases, they are doing it with good intentions. They want to be faster. They want to be more productive. They want to help the business.

But if they are pasting customer information, contracts, financial data, internal processes, technical details, passwords, source code, sales figures or strategy documents into tools the business has not approved, then your confidential information may already be leaving the building.

Helpful does not always mean safe

The danger is that many employees do not realise what happens after they type or upload information into an AI platform. Some tools may store prompts. Some may use submitted data to improve or train their models. Some may be operated outside the UK. Some may have terms that are suitable for personal experimentation, but not for handling sensitive business data.

The risk is not always malicious. In fact, that is what makes it so dangerous. Your team may believe they are doing the right thing, while accidentally exposing commercially sensitive information to a system the business has not assessed, secured or approved.

Imagine a member of staff asking a free AI tool to summarise a confidential client proposal. Or to rewrite a disciplinary letter. Or to analyse a spreadsheet containing customer records. Or to explain a technical configuration that reveals how your systems are built. In each case, the employee is not trying to leak data. But the data may still be exposed.

Shadow AI is the new shadow IT

For years, businesses have worried about shadow IT: staff signing up for apps, storage services or software without telling the company. AI has made that problem bigger, faster and harder to see. It takes seconds to open an AI tool in a browser. It takes seconds to paste in confidential information. And once that data has gone in, you may have no easy way to get it back.

That creates serious questions for business owners:

Do you know which AI tools your staff are using?
Do your staff know what information they must never enter into AI?
Have you checked the terms, privacy settings and data handling policies of those tools?
Do you have an AI usage policy that is actually understood by your team?
Can you prove that client, employee and business data is being handled properly?
Is your data being processed whilst maintaining GDPR compliance?
Is your business data being used to train the AI model which exposes it to the public domain?

If the answer is “no” or “I’m not sure”, then this is not a future problem. It is a current risk.

AI needs rules, not guesswork

AI can be incredibly useful. Used properly, it can improve productivity, reduce admin, speed up research and help teams work smarter. The answer is not necessarily to ban AI completely. A ban often drives the behaviour underground, where it becomes even harder to manage.

The better approach is to put proper controls in place. Decide which tools are approved. Set clear rules on what can and cannot be entered. Train staff using real-world examples. Review supplier terms. Configure business-grade services correctly. Monitor for risky behaviour. Make AI part of your cyber security and data protection strategy, not an uncontrolled side project.

Most importantly, make sure your people understand the issue. In the same way that uploading business data to a free personal storage account can create a serious data breach, pasting business data into the wrong AI tool can expose information you are legally, commercially and morally responsible for protecting.

Be careful, try not to be too helpful when using AI tools

Let me ask you a simple question. "Would you like to improve this tool to help others?" This sounds like an innocent question, and most people, by their very nature would think "yes, I want to help this tool improve for others" so they select yes, BUT what this question actually means is " we need your permission to use all the data you upload to train the AI model and it could expose your data to the world". If the question were worded as the latter explaining the data will be exposed to the world, then everyone would select no, this is why they are very careful with how they word the question. Be warned.

What does this mean for your business

If your staff are using AI without your knowledge, your business may already have a data protection problem waiting to surface. The good news is that this can be managed with the right policies, tools, training and technical controls. As your MSP, we can help you understand where AI is being used, identify the risks, put sensible guardrails in place and make sure your team can benefit from AI without putting your business data at risk.

At the very least you should have an AI usage policy for the business just so staff know the business stance on using AI.

If you need help, call us on 01722 411999.

Are You Using AI or is AI Using You

Wed, 16 Sep 2026 00:00:00 +0000

Be Careful What You Share with AI - How to Keep Your Business Data Safe

Artificial intelligence can be a powerful productivity tool, but careless use can create serious data protection and commercial risks.

AI tools are becoming part of everyday business life. They can help draft documents, summarise information, analyse data and speed up routine tasks. Used well, they can save time and improve decision-making. Used carelessly, however, they can expose confidential information, customer data, intellectual property and commercially sensitive material.

Many people do not realise that some AI services may use prompts, uploaded files, chat history or user feedback to improve their systems, depending on the provider’s terms and settings. That means information entered into an AI tool could leave the control of your organisation and create risks around confidentiality, data protection and regulatory compliance. The UK Information Commissioner’s Office states that organisations using AI must consider accountability, transparency, security and data minimisation when personal data is involved.

Why this matters

Business data is valuable. It may include client records, staff information, contracts, pricing, designs, financial forecasts, legal advice, tender submissions or incident reports. If this information is copied into an AI tool without proper safeguards, it could be retained by a third party, accessed outside your approved environment, or used in ways your organisation did not intend.

The risk is not only commercial. If personal data is involved, an accidental disclosure could place the business in breach of data protection obligations. Regulators expect organisations to understand what data they process, why they process it, who can access it and how it is protected. AI does not remove those responsibilities; it can make them more complex.

Common mistakes businesses make with AI

Pasting confidential emails, contracts or reports into public AI tools.
Uploading spreadsheets containing personal, financial or client information.
Assuming that every AI product has the same privacy and retention settings.
Allowing staff to use unapproved AI tools without guidance or training.
Failing to check whether AI-generated outputs contain inaccurate, biased or confidential information.
Using AI outputs in regulated decisions without human review and proper records.

Tips to keep your data safe

Do not enter sensitive information into public AI tools. Treat prompts like external disclosures unless you have checked the provider’s contractual terms, privacy settings and data retention policy.
Use approved business accounts only. Enterprise AI tools often provide stronger controls than free consumer versions, including administration, access management and data protection settings.
Classify your data before using AI. Decide what data is public, internal, confidential or highly restricted, and set clear rules on what can and cannot be used with AI systems.
Remove or mask personal and confidential details. Where possible, anonymise, pseudonymise or summarise information before asking an AI tool to process it.
Check supplier terms carefully. Understand whether your data may be retained, reviewed, used for model training, transferred internationally or shared with subcontractors.
Carry out a risk assessment. For higher-risk uses, especially where personal data is involved, consider a Data Protection Impact Assessment and document the safeguards you have put in place.
Train your staff. Make AI awareness part of your cyber security and data protection training so employees understand the practical risks.
Review AI outputs before use. AI can produce convincing but incorrect information, so human checking remains essential.
Create an AI use policy. Set out approved tools, permitted uses, prohibited data types, escalation points and review processes.

AI should support your business, not expose it

The answer is not to avoid AI altogether. The answer is to use it deliberately, safely and with the right controls. Businesses that put clear rules in place now will be better positioned to benefit from AI while protecting customers, staff, intellectual property and reputation.

If you are unsure whether your current AI use is safe, now is the time to review it. Speak to your IT, compliance or data protection adviser, check your contracts and make sure your team knows what information must never be placed into an AI system.

How does this affect my business

Every business using AI needs to understand what data is being entered, where that data goes, and whether the tool is suitable for the information being processed. A simple review of your AI use, staff guidance and supplier settings can reduce the risk of data leakage, protect your commercial position and help demonstrate that you are taking compliance seriously.

If you would like help reviewing how your business uses AI safely, contact us on 01722 411 999.