What keeps security leaders awake at night?
This Q&A answers the most common and most critical cyber security questions raised in our Cyber Security in Action webinar. It delivers clear, expert advice on preventing the attacks that cause the greatest disruption, helping organisations turn complexity into confident, informed action.
1. How can we attract highly skilled youngsters into ethical hacking rather than cyber crime?
Many of today’s leading ethical hackers developed their skills informally. The priority is early engagement before technical talent is drawn into criminal activity.
Key points:
- Government bodies such as the National Cyber Security Centre (NCSC) and National Crime Agency (NCA) run programmes to retrain individuals into ethical cyber roles.
- Some of the strongest cyber professionals have a background in hacking and malware research.
- Early outreach, education, and ethical pathways are critical to redirect technical talent.
Takeaway: The key is to ensure that as an industry, we are creating apprenticeships, training programmes, and clear career pathways in cyber security to engage technically gifted young people before criminal behaviour becomes an option.
2. Should organisations adopt passwordless authentication?
Yes, where it is practical and supported by organisational infrastructure.
Key points:
- Biometrics (fingerprint, facial recognition) and hardware keys significantly reduce password risk.
- Passwordless approaches are more secure but can be complex to deploy across large organisations.
- Password managers are a strong alternative where passwordless is not feasible.
Recommended practices:
- Use biometrics and hardware tokens where supported.
- Combine with multi-factor authentication (MFA).
- Avoid password reuse across systems.
Takeaway: Passwordless authentication, supported by MFA and hardware-based security, significantly reduces credential risk and should be adopted where technically and operationally feasible.
3. What patch management software should we use?
There is no single solution that suits every organisation.
Key points:
- Patch management should be aligned with your wider IT and infrastructure strategy.
- Internet-facing systems should be prioritised and patched within 7–14 days for critical vulnerabilities.
- Consult your IT or service provider to select a tool that integrates with your environment.
Takeaway: Effective patch management is driven by speed and consistency, not by tool selection, organisations must prioritise critical vulnerabilities and internet-facing systems.
4. Staff dislike awareness training. How can we make it more engaging?
Security awareness training works best when it is practical, short, and relevant to everyday work.
Key points:
- Keep sessions brief and focused on the most relevant threats (phishing, passwords, suspicious activity).
- Run in-person or live sessions where possible for higher engagement.
- Use phishing simulations to create interactive learning.
- Gamify learning (scores, prizes, competitions).
- Reinforce cyber security as a shared responsibility and cultural value.
Takeaway: Security awareness must be relevant, interactive, and embedded into organisational culture to drive lasting behavioural change.
5. How does offline backup work with cloud storage?
Modern cloud backup solutions can provide protection similar to traditional offline backups.
Key points:
- Use immutable backups that cannot be altered or deleted by attackers.
- Ensure backups are logically separated from your production network.
- Regularly test recovery from backups.
- Make sure that you maintain at least one backup copy that cannot be modified by ransomware or malicious actors.
Takeaway: Resilient backup strategies require immutable, segregated backups that are regularly tested to ensure reliable recovery from ransomware and cyber incidents.
6. Has the balance shifted in favour of defenders or attackers? What should leadership change?
Artificial intelligence (AI) is now used by both attackers and defenders reshaping the cyber security landscape.
Key points:
- Attackers use generative AI to produce more convincing phishing emails and fraudulent websites.
- Defenders use AI to enhance threat detection and improve response times at scale.
- While defenders currently retain an advantage, cyber security remains a constant arms race.
- Organisations must introduce clear governance around AI use to prevent sensitive data being shared with public tools.
- Stronger data classification and access controls are required to reduce exposure.
Continued investment in detection, monitoring, and incident response readiness is essential.
Takeaway: Cyber security has become a leadership and governance issue, requiring clear oversight of AI use, data protection, and incident readiness at board level.
For more information on how you can utilise AI going forward click here.
7. What is a trusted long password storage solution?
Password managers provide the most secure and practical approach to storing and managing credentials.
Key points:
- Enterprise-grade password managers such as Bitwarden, Keeper, and 1Password encrypt and securely store credentials.
- Access to password managers should be protected using multi-factor authentication or hardware security keys.
- Credentials should never be stored in spreadsheets or unsecured documents.
- Each system should use a long, complex, and unique password.
Takeaway: Enterprise password managers protected by MFA offer the safest and most effective way to manage credentials at scale while also reducing the risk of compromise through password reuse.
8. Do you recommend using a VPN? Should home workers route traffic via the office firewall?
VPNs play an important role in securing remote access, but their value depends on how they are used within an organisation’s security architecture.
Key points:
- Privacy-focused VPNs used to obscure location are not essential for most business users and are typically a personal choice rather than a corporate security requirement.
- Corporate VPNs that route traffic through organisational security controls are strongly recommended.
Routing traffic through corporate security systems enables greater visibility, policy enforcement, and threat monitoring.
Secure Access Service Edge (SASE) solutions such as Cato Networks and CISCO provide modern alternatives to traditional VPN architectures.
Takeaway: Remote users should access the internet through corporate security controls to maintain visibility, enforce security policy, and reduce exposure to unmanaged home networks.
9. Are Western hacking groups new or simply just more visible?
Western-based cyber crime groups are becoming more visible rather than representing an entirely new threat.
Key points:
- Historically, most major attacks originated from Russia and China.
- Financially motivated attacks have driven increased cyber criminal activity in Western countries.
- Cyber crime continues to expand wherever financial opportunity exists.
Takeaway: Cyber crime is increasingly financially driven and geographically diverse, reinforcing the need for organisations to focus on defence rather than attribution.
10. What attack vector are we not talking about enough?
For most UK organisations, the most significant cyber threats remain ransomware and phishing attacks, which continue to exploit basic security weaknesses, so these are the threats that need the most focus.
Key points:
- Ransomware and phishing are among the most disruptive and costly cyber attacks facing organisations today.
- These attacks are most commonly enabled by weak or reused passwords, phishing emails, and unpatched vulnerabilities.
- The majority of successful attacks rely on exploiting these three entry points rather than sophisticated technical flaws.
Takeaway: By strengthening password controls, improving phishing defences, and maintaining patching discipline, organisations can prevent the vast majority of cyber attacks and significantly reduce overall cyber risk.
For more information on cyber risks affecting businesses in 2026 check out this resource.
Need some help?
We can support you at every stage of your cyber security journey, combining expert consultancy, managed security services, and proven technologies to help reduce risk, improve resilience, and respond effectively to evolving threats. By working with together, we can help you move from reactive defence to proactive protection.
