Blog
Field notes from the SMB security front line.
Practical writing on cybersecurity for SMBs — NIS2, DORA, GDPR, vCISO, training, audit. Written by practitioners, not marketers.
All articles
31 posts and counting.
Business Email Compromise·
Business email compromise needs no malware. The loss is yours by law.
Business email compromise needs no malware, so your security tools miss it, and EU payment law leaves the loss with you. Five rules stop it.
Supply Chain Attack·
Supply chain attacks in 2026: the supplier you never chose
Two of the three supply-chain routes into an SMB in 2026 sit largely beyond what a vendor questionnaire can settle. Here is what to do about them.
Risk Management·
How Much Should an SMB Spend on Cybersecurity? Every Benchmark Answers in Percentages. You Need a Number.
Security benchmarks say 9–11% of IT budget, but enterprise percentages mislead SMBs. What a 50, 150 or 500-person company should budget, in euros.
Virtual CISO·
The Brain, the Hands, and the Specialist: A Buyer's Guide to vCISO vs. MSSP vs. Consultant
SMBs under €50M are really choosing between three things: a leader, an operator, and a specialist. How to tell a vCISO, an MSSP and a consultant apart.
NIS2·
NIS2 and the CRA: two clocks on one factory
NIS2 regulates the plant you run. The CRA regulates what leaves it. Two 24-hour clocks, two different triggers — and in most factories, no owner.
DORA·
Your DORA register got accepted. Now supervisors read it.
Two DORA register of information filings in, 'accepted' means the file parsed. What supervisors now read from it, and what to fix before 31 December.
ISO 27001·
One ISMS, three regulators: the same nine documents
NIS2, DORA and your ISO auditor ask for the same nine documents — and reject them for three different reasons. Here is the pack, mapped.
Vendor Risk Management·
You've Spent Years Answering Security Questionnaires. Here's the One You Should Be Sending.
A 12-question vendor security questionnaire for SMBs — the red-flag answers and a one-page scoring rule, mapped to NIS2 Article 21(2)(d).
ISO 42001·
ISO 42001: your buyers will ask before the regulator does
Buyers are writing AI governance into vendor questionnaires, and ISO 42001 is the established certifiable answer. What it costs an SMB — and why 2026 is early.
Cyber Resilience Act·
CRA reporting is live. You may be the manufacturer.
CRA reporting went live on 11 September 2026: 24 hours to report an exploited vulnerability in something you sold. Manufacturer is a role, not an industry.
Incident Response·
One Incident, Three Regulators: Why Your Real Deadline Is Four Hours, Not 72
Everyone learned 72 hours from GDPR. DORA's first filing is due in four hours and NIS2's early warning at 24. One incident, three clocks, three start times.
AI Act·
On 2 August, Your Chatbot Must Say It's a Bot. The AI Deadline the Omnibus Didn't Move.
Everyone heard the AI Act was delayed sixteen months. Article 50 wasn't. From 2 August 2026, your chatbot must say it's a bot — fines up to €15M or 3%.
Ransomware·
Friday 18:47 to Monday 08:00: Anatomy of a Ransomware Attack on a 50-Person Company
An hour-by-hour reconstruction of a ransomware attack on a 50-person company: from the Friday click to the Monday ransom note, and where it is really decided.
Incident Response·
Incident Response Without a SOC: The 5-Step Playbook a 50-Person Company Can Actually Run
A practical 5-step incident response playbook for SMEs without a SOC — prepare, detect, contain, recover, report. Mapped to NIST 800-61r3, NIS2 and CRA clocks.
Virtual CISO·
What a vCISO Actually Does in Month 1, Month 3, and Month 12 — A Timeline Your Board Can Hold Us To
What a virtual CISO actually delivers in month 1, month 3, and month 12 — a concrete milestone timeline SMB and mid-market boards can hold any provider to.
Virtual CISO·
10 Questions to Ask Before You Hire a vCISO — And the Answers That Should End the Meeting
Ten questions that separate a real vCISO from a templated invoice — and the red-flag answers to listen for. A vendor-neutral buyer's guide for SMB and mid-market boards.
NIS2·
NIS2 vs DORA vs ISO 27001: which ones apply to you
NIS2, DORA and ISO 27001 are not rival options: two are law, one is a standard. Who each one binds, where they overlap, and which one wins.
AI Act·
AI Omnibus: The 16-Month AI Act Reprieve, and Why Your Real Deadline Just Got Closer
The AI Omnibus is law. It moved the high-risk deadline to December 2027 — and created a new one on 2 December 2026, in the €35M/7% penalty band.
DORA·
You're Not a Bank. DORA Still Applies. And the First Inspections Have Started.
DORA has been fully applicable since 17 January 2025. Most non-banks read that as someone else's problem. In 2026, that misread becomes a supervisory problem.
NIS2·
NIS2 Enforcement Has Started: 8 Questions Your Board Must Answer in the First 30 Days
NIS2 is now enforced across most of the EU. Article 20 puts directors personally on the hook. Eight questions every board must answer in 30 days.
Training & Awareness·
The Human Firewall: How to Turn Your Employees from Your Weakest Link into Your First Line of Defense
Over 90% of breaches start with human error. Treat employees as a security control to invest in, not a problem to mitigate — here is how.
GDPR·
Paper compliance is not security. It isn't compliance either.
GDPR, NIS2, PCI DSS and ISO 27001 now ask whether your controls work. After a breach, a control that exists only on paper fails both tests.
Vendor Risk Management·
Vendor, Partner, Breach: How Third-Party Relationships Are Your Biggest Security Blind Spot
Most SMBs cannot name their critical suppliers, let alone assess them. Why third-party access is the most common breach path — and how to manage it without enterprise overhead.
Cloud Security·
Remote Work, Real Risk: How to Secure a Distributed Team Without a Big IT Budget
Distributed teams demolished the traditional perimeter. Here is the SMB-sized stack — MFA, EDR, ZTNA basics — that delivers most of the protection without enterprise spend.
Incident Response·
5 Signs Your Business Has Already Been Compromised (And Doesn't Know It)
Average breach dwell time is weeks to months. Five concrete indicators of silent compromise — and what to do the moment you spot one.
Cyber Insurance·
Cyber Insurance Isn't Enough: What Insurers Won't Tell You About Coverage Gaps
A cyber policy pays on what you declared, not on what you think you bought. What it pays, what it never will, France's 72-hour rule and a 30-minute check.
Governance·
Do You Actually Own Your Data? A Plain-English Guide to Data Governance for SMBs
You hold the data, but the law treats you as a custodian, not an owner. Five questions every SMB must answer to be defensible under GDPR, NIS2, and beyond.
Roadmap·
Your 90-Day Cybersecurity Roadmap: From Vulnerable to Confident
A pragmatic, three-month plan for SMBs starting from scratch. Quick wins month one, the human firewall month two, governance month three.
Data Breach·
The $50K Mistake: What a Single Data Breach Really Costs a Small Business
A data breach is not a technology failure — it is a business-ending financial event. Where the €50k-€150k goes, line by line, and the prevention math.
Cyber Risk·
Why Small Businesses Are Now the #1 Target for Cybercriminals (And What to Do About It)
Over 43% of cyberattacks now hit SMBs and only 14% are prepared. Why attackers chose this market — and the five-step response that closes the gap.
Browse by topic
Where the writing lands, by theme.
Each topic links to the service or framework page where the analysis from these articles gets put into practice with our clients.
NIS2
Article 21 measures, three-stage notification, supply-chain security, board liability.
Visit pageDORA
Five pillars, four-hour reporting, third-party register, threat-led testing.
Visit pageGDPR
ROPA, DPIAs, data subject rights, breach response, processor contracts.
Visit pageISO 27001
Implementation, internal audit, certification — sized for SMBs, no enterprise bloat.
Visit pagevCISO
When a fractional security executive is the right call, and how to scope one.
Visit pageAwareness
Why annual e-learning fails, what continuous training looks like, how to measure it.
Visit page