Latest / The HIDDEN Podcast by Babble / Episode 14: The Confidence Trap: What the TPI Data Says About Cyber Readiness in UK SMBs

Transcript

Episode 14: The Confidence Trap: What the TPI Data Says About Cyber Readiness in UK SMBs · The HIDDEN Podcast by Babble

• Mark O'Dell: So confidence tends to track investment, not necessarily the outcomes. So you have a leader that thinks, well, I signed that spend off, but they haven't necessarily checked whether that is working. So that's what creates the gap. "We bought security" becomes "we are secure". But there's a reality check at the end when it comes to recovery, and only 28% think they would be back within a week. So my advice is to review how it's working, go out and test it. Lynn: Welcome to the HIDDEN Podcast, where we simplify cyber security and all things tech for those of you who, like me, need it to be explained without all the jargon. So if you've ever wondered why you still feel vulnerable, even though you've bought all the fancy tools, you've come to the right place. I'm your host, Lynn Murape, and my job is to take one of our resident experts and help them translate their cyber expertise into plain English. This means having practical conversations usually built around Babble's HIDDEN cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Joining me once again in the virtual studio today is Mark O'Dell EVP of Products and Solutions here at Babble. Mark, a warm welcome back. Mark O'Dell: Hi Lynn, good to be back. Lynn: Great to have you back. So, right back in episode one, we unpacked why the UK is one of the most targeted countries for cyber attacks in the world. And the last time you joined us in episode nine, you and Jeremy Langley, our CMO, walked us through the TPI research itself. We spoke about the tech vanguards, emerging adopters, and the bystanders and what sets them apart. So now today we've got fresh cyber security data from that same research to discuss. But before we do do for anyone new to the show or catching up that didn't see those two episodes, do you mind quickly sharing what you do here at Babble and how your role keeps you close to the cyber security side of the business? Mark O'Dell: Yeah, sure. It's good to be back in the hidden hot seat. So I I lead products and solutions here at Babble and really my role is to ensure that we're not just handing out technology to customers, but we're we're we're there to help them achieve some meaningful outcomes. And cyber security really sits across that whole estate. So it can't be separated from how people connect to their colleagues. It can't be separated from how they perform within their roles. So staying close to the products for me is about speaking to customers, understanding what they're trying to do in their businesses, and looking for gaps that we can help and we can take ownership of for them. Lynn: Alright, so Babble's Technology Performance Index surveyed a thousand UK SMB leaders, and one of the most striking findings sits in the cyber security data. Confidence is high, but the tools and processes behind that confidence often aren't there. 79% of SMB leaders told us their confidence they could identify a cyber attack, yet, only 55% Have actually adopted the cyber security tools to back that up. Now, that gap is what we're unpacking today. Not to scare anyone, but because the businesses that close it are the ones that come out on the other side of an attack still standing. So without further ado, just starting off with this element of the confidence gap. So, Mark, let's start with the headline number, which is 79% of SMB leaders are confident in their ability to identify. a cyber attack and 28% think they could recover within a week if it happened. Reading those numbers, what's your first reaction? Mark O'Dell: Yeah, I y you highlighted it as potentially surprising. Actually I don't I don't think it's that surprising. and I'll tell you because it's easy to feel confident when nothing has gone wrong yet. And so spotting attacks and recovering from them are different tasks. And it's it's that The thing particularly around security is the absence of something happening does not mean that you have got security right. And leaders often sort of fail to spot that. Recovery in particular, when something has gone wrong, and it's very likely to go wrong, can you get back from that? When it's not been tested, when it's not been thought about, and when you don't have the tools, you just don't know the answer. And we we've got this figure of of a week, thinking about a week, could we get back in a week? That's a very long period of time for a business to be disrupted. A week perhaps most businesses can cope, but several weeks, you know, that could be terminal for a business. So the ask I would say to people is, has a business timed and tested actual recovery options or work-round options, or what would they do? Lynn: Yeah. Great. as you were speaking, obviously a lot jumped out at me as usual, but I couldn't help but think of the episode we covered with Steve Hennessy when we were talking about backup not being the same as recovery. You know, yes, we're talking about cyber security as a whole, but you know, a working example is, you know, we have backups in place. But that doesn't mean you'd be able to actually restore those backups without having tested them as well. And you don't want to be in the middle of an incident to find out, right? So now going back to the research, we found Mark O'Dell: Yeah, and and on that point then. recovery recovery can mean, like you say, literally a backup scenario. We're or we're talking recovery of some sort of cyber event takes down a system and how do we get that system back online or how do we work round the fact that it's down and and get another system online? So it's it let's not be quite so let's let's not give the people the impression of a of a literal literal rest restore, although that's one absolutely valid example. Lynn: Yeah, yeah, definitely. that's why you're the experts anyway. So thank you for adding that. so going back to the research, we found that only fifty-five of those fifty-five percent of those businesses have effectively adopted cyber security tools and integrated them across the entire business. So, Mark, in your opinion, what's usually sitting in that gap between feeling confident and actually being covered? Mark O'Dell: This feeling of having spent money. So spending money on tools feels like process progress, right? and the that tools are necessary. They they exist for a reason. but tools on their own don't solve all the problems and in fact they leave gaps and they could leave they they leave significant gaps because you're not thinking about them. A typical example will be something like unchecked alerts. So we've we've put in place the best security monitoring tool. It's firing off alerts all day, all night, but nobody is watching them, or nobody is acting on them. So the usual gap is around people and processes, not the absence of a technology. Of course sometimes there's an absence of technology, but often they've spent money on technology, which is why they feel confident, but they haven't done the people and process bit, which is why it's misplaced confidence. Lynn: Mm, great points well made as usual. And I couldn't help but think about our last webinar on you know, MXDR, what it is, how you buy it, which is managed detection and risk managed. Extended detection and response. Mark, would you say? Did I got did Mark O'Dell: Right. Yeah. Lynn: I get my acronyms right? Okay, perfect. All right. I couldn't help but think back to that webinar of which you were one of our speakers around yes, you have these tools in place, but you don't always necessarily have that 24-7 monitoring. So it's great that you brought that up. so yeah, and it's also interesting that the EVP of products and solutions is saying tools are not tools on their own, rather. Let me not misquote you, tools on their own are not. Yeah. Right. So yeah, that was very Mark O'Dell: absolutely. Lynn: Yeah, love that. All right. So swiftly moving on. Interestingly, something that we also found around that element of recover within a week, confidence isn't spread out across evenly, right? So, more specifically, among tech vanguards who are the businesses already furthest ahead on the technology spectrum, it jumps to seventy-three percent. So does being more advanced make a business more or less? Mark O'Dell: There's a potential there for them to be to be more exposed as an overconfidence, which is which is counterintuitive to some extent. Because if you're good at adopting technology, which the vanguards have proven they are, it's pretty easy to assume that you're good at everything around it. and that's not always the truth. It's not automatically true. The other thing is that you're you are generally adopting more advanced technologies. And those more advanced technologies can come with greater indep greater dependence on things, greater con sophistication is is a greater complexity. So individually they may do things better, but collectively they are causing more challenges in the business. And then you've got this layer of we're good at adopting technology sitting on top of it, makes you think you you are. So our message is pretty consistent there. It's about applying a business rigour to not just the buying of tools, but the implementation of those and the governance and ongoing management of those as well. Lynn: Nice. All right. So now we're gonna switch gears and talk about the AI arms race. But as we know, it we can easily go down a rabbit hole when it comes to AI. And there will be upcoming episodes where we do just that. But you know, we're just gonna keep things in the context of the TPI. For those of you listening or watching out there that really wanna get into AI, that content is definitely on the way. But bringing us back here, Mark, in the very first episode, we discussed how AI is changing the threat. landscape as we know it on the attacker side too, right? Seen in the rise of automated Mark O'Dell: Really? Lynn: attacks. So in your opinion and from your experience, what does that look like day to day for an SMB when we're talking about automated attacks? Mark O'Dell: So I think we have to be careful not to entirely describe AI as a sort of a whole new category, a whole landscape of threat. Of course it it it plays into a part of that. But in many cases it's exploiting the same risks in broadly the same way that it has been. It's just doing it faster and it's making it easier for the The general criminal as opposed to a specialised criminal. It's democratised, but how are we going to hack an SMB? But it's familiar warning signs are there, phishing emails, attempted to socially engineer things that are going on. Careful thing to look out for that has changed. Is that when we look at those phishing emails, signs like bad grammar, spelling, that stuff's starting to disappear because AI has made it so easy to replicate a bank's website perfectly, to to create an email in perfect English and grammar. It's it's opened the doors, as I say, to to to to people doing this that weren't able to do it before. And International element comes in there again. If English isn't your first language, it's not a problem. You can just use an AI tool to help you do it. So you've got a couple of threats there. AI is finding ways in better, and that's the more sophisticated hacking type thing, but then you've got AI tools are just making it easier to create phishing type attacks as well. The same thing happens though. Often a human is a human is at the front of it, a human is making a mistake, and and there's where your problems come from. Lynn: Phishing came up quite often enough, and it reminds reminded me of the fishing simulation that the cyber team here at Babel conducted at the SKO earlier this year, sales kickoff. So did you fall I'm curious, did you fall victim to that one or were you one of the lucky few that got to stay seated in your chair? Mark O'Dell: No, no, I didn't. but I I tell you it reminds me of I you know, I have fallen victim to this in the past. I think it is an important message that, you know, even people that work in this industry, it only takes a moment lapse of of concentration. they are so mass market a lot of these things that they're not trying to be the most sophisticated of the times. I've been around for a long time. My my trip up was Late 90s, early 2000s, falling into one of the very early email campaigns where you know click on the link of this famous star and and then you open it and it suddenly it brings down your mail server because it sent thousands of emails out and a bit of a disaster and embarrassment follows. Lynn: Yeah, it happens to the best of us. My story doesn't date back as far as the nineties, but I think I think a few weeks ago actually, I think this was also the cyber teams doing where they sent out the mass email and they said, Hey, click on this link, you have unclaimed holiday leave, click on this link if you want to claim those days back. otherwise you forfeit them, you know, you need to book within the next week. I'm like, paid time off? Of course. Who wouldn't want to do that? Didn't really do the standard checks that I know better to do with all the Mimecast cast training that we do, you know, on a continual basis, continuously rather. And yep, unfortunately, at least it was a simulation in my case. And it was like, ha, got your moment, but Mark O'Dell: it's good and and look that is the point that we're making here around education is that you have been through a simulation and you you you fell for it. Now there's no shame in that. That that that was a cleverly timed email that the right time of year, it talked about leave, it it gave some figures that were probably broadly right with what you thought you had left. And and it and it just shined. It didn't shine with everyone, it shined with a lot of people. But it's a it's a good example of, I just fell for something. Which means that you as an individual next time are less likely to fall for it. Cause that's in the back of your mind. And that's that's the point of this education. Lynn: Hundred percent. it might be a little bit pessimistic to say, but nonetheless, you know, if something seems too good to be true, it probably is. And you'd rather just be extra, extra sure. So I've definitely learned my lesson the hard way on that one. But coming back to, you know, the TPI research when it comes to cyber, so another finding is that almost half, to be exact, forty eight percent of the SMBs that we surveyed currently aren't using AI enabled tools to strengthen their cyber security posture. So Mark, what are your thoughts on that figure? And secondly, how are the businesses that are using AI defensively putting it to work against AI-generated threats? Mark O'Dell: I think an important point is to distinguish here between AI as part of your security stack and Your security stack acting on AI. And we'll we'll start with as part of your security stack as a start point. I I would actually say many more businesses are using it than have answered that. They just don't know it. Because what's happening in the industry is that the good quality products are building that stuff in because they have to build that stuff in in order to, in order to make it work properly, in order for it to be able to keep pace with the the criminality that's. happening. So you most of modern endpoints will look for behavior and instead of looking for malicious code patterns as they as they once did, they still do that. They're now looking using AI a lot to apply thought. Thought. to to what is actually happening in that in that application or in that scenario. So that so that's one side of thing. The other side is the thinking about applying security to your AI. And I would think the the number there is is actually really low. And by that I mean someone's in your network, one of your users, and they're using say ChatGPT or Claude Do you know what they're doing with that? Have you got any controls over your data? Or are they just freely dragging and dropping your your private company files into there and they're all going out to God knows where that you can no longer control? And are they doing other things? Are they are they partaking in risky behaviours on that AI, not just data? So are they then writing code with that that then you're putting live on your network and your systems that you've got no kind of control over or process? really easy to get tripped up on that, and very few companies are currently doing it because that's not included in default tools a lot of the time. Lynn: Yeah. It also what you've just said reminds me of one of our previous episodes that, you know, we had with Keith Archer where we spoke about, you know, these AI driven attacks as well. And he was talking about prompt injection and, you know, the importance of having governance over, you know, one's AI tech stack as well. And we Mark O'Dell: Yeah. Lynn: went into shadow AI, who which is for those of you who don't know, basically and again, correct me if I'm wrong, Mark, I might be a little rusty on this one. But it's basically, when your various people in your organization are using AI unbeknownst to I IT or leadership's knowledge as well. So to your point, Mark, around okay, you have Chat G BT, Claude, Gemini, whatever in place, but what kind of information are they feeding into it as well? Would you say that also feeds into shadow AI, an element of it? Mark O'Dell: Yeah. I I I I'm sorry, I I I would also say that it's not it's almost not an if. unless you have done something specifically to stop them, I can Pretty much guarantee someone in your business is going to be using one of those tools. ChatGPT has 1.2 billion users currently. So the likelihood that they are not using a tool is very, very small. So the question that you need to be asking is: okay, is that do I care? Maybe, maybe you don't, but make sure you have actually thought about it. And if you do care, which you probably do, or probably Probably should do, then look, then look at locking that down and putting some guidance around it, not just saying, please don't upload our stuff. Actually use using some technology to bridge that gap. Because they they will, because these tools are here to make their jobs easier. We don't want to block that. We just want to do it in a controlled way. Lynn: Yeah, I completely agree. And you know, I would bet everything in my bank account, please do not hold me to it, that you know, the average desk worker is using AI, whether leadership knows it or not, because as they say, you know, the AI is not going to take your job, but the person who uses it better will definitely do so. So yeah, everybody's definitely using it. All right, so the last question that I have for you on AI is if a business isn't using AI defensively. Mark O'Dell: Start looking at the platforms you've got. So understand what's email or endpoint or other security products are already AI enabled, and check that they are enabled. So they might they might have they might have the function, but you haven't enabled it. and this comes back to the point about more tools isn't always better. You often find this with tools is that they evolve over time, but the defaults you were on were here, and the new defaults were there, and you you've missed this gap. Look at how your staff are already using AI and as we've just talked about really, look at that shadow AI, which tools are in use, where's the data? Comes back down to a bit of a a process thing there, but use technology to help you identify it and then use technology to help you lock it down as well. Lynn: Great advice. So now moving on to what you have already introduced in terms of more tools not necessarily equaling more security or being that silver bullet, so to speak, right? So at the crux of it, you know, businesses buy a cyber security solution and assume that the job is done, right? That you mentioned at the beginning of this conversation. So, Mark, why is that assumption so risky? Mark O'Dell: So, analogy that actually we talked about in another show, but my Formula One analogy, which is like giving me the keys to a Formula One car, that does not make me a racing driver. I don't have the skills, the context, or the surrounding processes in order to make that car work. And complicated security tools can do the same thing or have the same problem. Without the people and processes, There can just be con confusion or, as we mentioned earlier, this false sense of security. the other issue is change, right? Cyber security is a is a constant cat and mouse game. we close down a weakness, or the industry closes down a weakness, criminals find another one. That's that's the game. That will always be the case. That's true in physical security and it's and it's true in in cyber security. So if you configure a tool, it was the right tool, it solved everything two years ago, that is not a programme of cyber security. That's a state of play today, is okay. You must evolve that and you must evolve your thinking and you must evolve over time and someone must own it to keep it current and relevant. Lynn: Completely agree. And I love an analogy over here, as you guys listening or watching know at this point. But yes, Lewis Hamilton, your job is safe. Mark O'Dell is not coming Mark O'Dell: Yeah. Lynn: for it just yet. All right, so let's get specific about what tends to get left out when you know a business is looking to secure its organization, its data, etc. Fewer than half of the 1,000 UK SMBs we surveyed, 45% to be exact, look for a provider to actively manage. detect and respond to threats, MDR, rather than just sell them a tool. So Mark, what's the practical difference between those two things? Mark O'Dell: So a tool will block some threats and it will generate alerts. And the the the the gap again between those two things is where we've got a problem. Because the alert itself doesn't close the risk. So w where where it can block things, great. So I'll give you another analogy on this. So the smoke alarm analogy. So the tools that we're talking about are let's say they're the alarm, and perhaps they're the alarm and sprinkler system. But if if the alarm's going off and the fire hasn't been put out by the sprinkler system and everyone is ignoring it, then we haven't really solved the problem. So we've we've half solved the problem. It's a small fire, great, brilliant. But there's still a massive gap. So The action and the point about a managed service is to take action, to isolate a device, to disable an account, to investigate other things and work out what's going on at two o'clock in the morning rather than Monday morning when you come back into the office. And given the expense of doing that, running a 24-7 operation, very few SMBs could justify that. That's why outsourcing is the the natural That's the natural thing to do. It's the only real way you can solve that problem. Lynn: Yeah, I completely agree. And again, this is something that Mark and my our other esteemed speakers unpacked at length. so I will definitely include a link to the on-demand webinar for you guys to check out. but bringing it back again to this research, only thirty-one percent include of those businesses include employee education in what they look for from a cyber security partner, and just twenty-eight percent of the UK SMBs that we surveyed call for proactive threat intelligence. So Mark of everything that gets skipped usually, which one worries you the most? Mark O'Dell: I think it does come down to education. people are the most common route into a business and I think they always will be. People make mistakes more predictably and can be manipulated, as we've talked about earlier earlier today. And AI AI generated phishing and makes that recognition harder and think that what happens is we people work down checklists often and so they say well we need we need training because our compliance for X tells us that we need training. So they treat it as a as a tick box. As you say, you know y we did one internally. I think that's a just a perfect example of why education is important. You need to people need to feel confident to make that mistake, they need to feel that they're not going to be battered down or fired or or anything if if they do make a mistake. Because speed is really important. And if you now feel okay, I maybe I did make a mistake, but I realise I made a mistake and I'm going to go and phone IT immediately. Hi, I've just clicked on this thing. I don't think it was right. Doing that makes such a difference versus, well, whatever, we'll move on. And and an education or I'm too scared to tell anyone, I'm too scared to tell I might get trouble. But education helps bridge that gap, makes you feel more comfortable out spotting it and what to do with it if you do spot it. Lynn: Absolutely. And you know, that's something that James Gaskell and I unpacked at length in the third episode, which was all about human risk. And I think, you know, yes, the acronym spells out hidden perfectly and all of that, but I love the fact that it starts with humans, right? Because as you said basically to paraphrase you very loosely, humans are either your weakest link, in terms of your line of defense or your strongest line of defense as well. And I couldn't agree more that education lies at the heart of it. And also that company culture as well, you know, not not creating blame. I mean, any and all of us can fall victim to it because they're also not only are they tough to detect, you know, to the human eye, but they also play off of your emotions, like whether it's fear based, whether there's something to gain like extra leave, you know, so yeah, that was that was great to to mention as Mark O'Dell: Yeah. And and it's really that emotion thing is the thing you've got remember is they they're they're sending it to hundreds, thousands, perhaps millions of people in one go. And so they've only got to find one or a couple at that time that happen to be in that emotional state of mind that that thing is relevant to them. It particularly rings a bell or tugs at their heartstrings or whatever. And in the cold light of day, ninety nine times out of a hundred, they would just go, No, that's nonsense, I wouldn't do it. But the the moment they happen to receive it is the moment that they they reacted. And that's all Lynn: Yeah. Mark O'Dell: they need. Lynn: Yeah. Psychological warfare. Crazy times. Yeah. Mark O'Dell: Yeah, yeah. Lynn: All right. So just forty one percent of SMBs have adopted business continuity and disaster recovery technology. If an attack does get through, what does that gap actually cost a business on average, you know? Mark O'Dell: that that means that sixty percent not having adopted that technology, there it that's the difference between recovery and potentially existential risk for a for a business. The impact, staff unable to work, customers unable to make contact, perhaps you've got regulatory exposure depending on the business that you're in. Probably reputational damage, particularly if you've got data loss as a result of that, or just being offline, and and lost business, customers not able to contact you and so on. And and that recovery of a week, if the we talked about it earlier, you know, that th that that it that could be existential. you've got insurers and supply chains are They're asking customers increasingly to demonstrate that resilience. So that external pressure is useful, but just because you don't have that as a business, well I'm I'm not a regulated business, we don't need to worry about that. Well, that's that's not the answer. You should be thinking about this is important to you. What would happen if you woke up, went to work on a Monday morning, and all of your systems were unavailable? Can your business function? And if it can't, what is your route to to getting back? Lynn: Yeah. Great place to ask, and a great question that I'm sure a lot of business leaders shudder to think about but need to think about as well. And speaking of, you know, we're not regulated or this might not affect us or it's not relevant to us, please do check out those of you listening or watching, and you as well, Mark. the previous episode which I spoke about with Mark Weait, our chief revenue officer. We basically at a very high level unpacked the upcoming UK side. Cyber resilience, cyber security and resilience bill. So, yeah, it's very interesting to see that you know, might not think that you are immediately affected by these kinds of regulations, but through that trickle-down effect and supply chains and all of that, you definitely should have this on your radar as well. But coming back to you know this topic of discussion, particularly around you know how IT is not just or cyber security rather is not just. Just IT's problem and it should be, you know, escalated to the board level as well. So our executive chair, Mark Braund, another Mark, put it directly in the research. He said the biggest cyber risk facing SMBs isn't the attack itself, it's a false sense of security, which of course has been the crux of this entire episode. So, Mark O'Dell, in your opinion, does that match what you're hearing from customers? Mark O'Dell: We we tried to stick with the common name standard here about all it helps. Lynn: Yeah. Mark O'Dell: Yeah, it does. Look, we the comfortable answers are we've talked about this, but we booked we bought a product, we we've got an anti-vi antivirus installed, we've got an IT team, or we've never been hit. And and those answers do feel reassuring, of course. Yes, we've got the product. yes, we've got an IC team. no, we've never had an incident. none of that is actual evidence though. And it's the gaps are the ones that become visible are there hopefully in a near-miss incident or a real incident. One of those really, really common assumptions is that. Our either our our IT team or our MSP are monitoring that. They look after our security. And and the reality is that is not true in most cases. And I'm not in any way dissing IT teams or MSPs, but they are generalists. They're looking after the systems. They are not a 24-7 security service. And and so what happens a lot with this with this sense of security is that there's a lot of people assuming things. So the business assumes that the MSP are looking after it, the MSP assumes that the business knows that nobody's looking after it, and then something happens and and everyone's pointing fingers. and just get it out on the table early. Talk about it now. Understand it and decide where your risk is, your risk profile is and what is important to you and what's not. Lynn: Yeah, and if I may just to add to that and also establish who is responsible for what as well, because you know, as we spoke about, I like to plug previous episodes for obvious reasons, Mark O'Dell: Yeah. Lynn: but as we spoke about in a previous episode with Nikoo Fullerton, one of our cyber security specialists, he was saying, you know, how your MSP can still be doing a great job, but just not be responsible at all for Mark O'Dell: That's true. Lynn: any facet of cyber security as well. So it's good to get those SLAs in place, those playbooks, especially. So that, you know, in the event of something going wrong, everyone knows exactly what to do and who to turn to, so that it's not like that Spider-Man meme where like everybody's pointing, all three of them are pointing at each other. I don't know if you if you're familiar with that one, but yeah. All right, so Mark O'Dell: Yeah. Lynn: Mark Braund also talked about cyber security needing the same governance and oversight as any other board level risk, which you've also said and the previous in the previous episode. So what does that look like for a business without a dedicated security function? Mark O'Dell: Yeah, look it S B covers a whole raft of customers. they don't necessarily need a CISO or a large security department or a department of any kind, but they do need an owner and they do need someone who is accountable and responsible for that. So cyber risks needs to have some authority and it needs to be a period as part of the the discussion at a board level. And I mentioned this earlier about this rigour. We should be applying rigor. to decision making and process around cyber security in the same way that we would in other business decisions. We wouldn't go out to a an accountant, let them as a board member this is, you wouldn't go out to an account, let your accountant give you some facts and figures and just go, okay, that's that's the number. You ask questions about it, you understand how they produced it, you understand what's why that number is now different to how it was last quarter. You look at the detail of what's changed. You don't have to be an expert as a board member. But that's what board members do is they go and probe and they make sure that people are thinking about things in the right way. And that's the kind of rigour that particularly SMBs. often aren't applying to cyber security and that's what they need to do. It doesn't need to take lots of time for them, it just needs to be part of the process. It needs to have an owner and it needs to be fed through as a as a as an important thing, not I leave it to IT. Lynn: Now in the spirit of being rigorous, if a leadership team wanted to close this confidence gap starting this quarter without buying anything new, what's the first honest conversation that they should have? Mark O'Dell: Ask this question. If we were hit tomorrow, what would happen? And do that through the business. Walk through who are they going to phone? What stops working? How long is it unavailable? Who's going to tell the customers? What services must continue? What have we got it we've got working? And then think about your business. What matters specifically to you? If you are a manufacturing business, perhaps the office computers aren't that important every day. You could live without them for a couple of days. But the machines, the computers that control your manufacturing machines, the moment they go offline, your factory is offline. Or perhaps you are a recruitment firm and actually the most important thing to you is to be able to make access your CRM and to be able to make phone calls. Concentrate on those. Test the consequences of losing them and how long. And then once you know the answers to that, you can then go back and make a plan and decide what's important. And it's this. That way you're not looking at a like, my god, we've got to have everything perfect, we've got to make sure that everything is always going to be online, we've got to have seven different backup systems that is going to kick in for this. You just go actually, well that's those are the most important things for us as business. We can survive for X time without those as a business, and and that's what we're going to do in terms of recovery plan. and that's where we're going to put the most importance of protection as well. Lynn: Yeah, and correct me if I'm wrong, but that sounds like putting together at least the foundation of an incident response plan. Mark O'Dell: Absolutely. It's that apply that mentality. If there was an incident, what would a response be? How would we do it? And you work back from that. So you ask the if the bat if the worst happens, what would I do? And you ask it today so that you're not doing it when the worst does happen. Because even if you've done a practice and it wasn't perfect, you're still miles ahead when it does happen. Lynn: Definitely. I mean you have all throughout this conversation you have given such sage advice and all of these what I like to call golden nuggets, you know, and insights and all of that great stuff. But I want to see if I can squeeze out just one more from you with this last question that I have, which is if someone listening or watching this takes away just one thing from this amazing conversation, what should it be? Mark O'Dell: It's I think it probably full circle, it's it's confidence and readiness are not the same thing. Just because you feel confident does not mean you are ready. so to build on that confidence, to understand why you know build a genuine confidence. Move away from have we got the product to have we tested it, who's watching it, how does it work? Close that gap between between knowledge and reality and make sure that you're not just saying, yeah, cyber security, I ticked that box two years ago, let's move on. Lynn: Awesome. All right. So without further ado, I couldn't have thought of a better way to end this. Thank you, thank you, thank you once again, Mark, for being in the hidden hot seat, as you called it. It's been a pleasure as usual to have you. And I'm already looking forward to the next time you join us again. Mark O'Dell: Pleasure. Thanks, Lynn. Lynn: All right, take care. That's a wrap on today's episode of the Hidden Podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. and until next time, don't let your risks stay hidden.