News

Our Blog

Image to announce Secure360 achieving IASME Cyber Assurance Level One
overlay
18 Aug

Secure360.io achieves IASME Cyber Assurance Level One

Cyber security isn’t only about preventing an attack. Businesses also need to be able to respond, recover and continue operating when something goes wrong. The focus on cyber resilience is becoming increasingly important, with both the UK Government and the National Cyber Security Centre encouraging organisations to look beyond technical defences and consider how they would manage and recover from a cyber incident.

Cyber resilience is also an important part of IASME Cyber Assurance certification, which looks beyond technical controls at how cyber security is managed across an organisation.

This broader approach to cyber security is something we regularly discuss with our clients, so it’s important that we apply the same principles within our own business. With that in mind, .net Highland Ltd, the company behind Secure360, has achieved IASME Cyber Assurance Level One, building on our existing Cyber Essentials Plus certification.

How is it different from Cyber Essentials Plus?

Cyber Essentials focuses on five technical controls designed to protect organisations against common cyber attacks. With Cyber Essentials Plus, those controls are independently tested.

IASME Cyber Assurance takes a wider view. It looks at how cyber security is managed across the business, including who is responsible for it, how risks are managed and how access to sensitive information is controlled.

It also considers staff training, suppliers, backups, business continuity and incident response.

Level One is a verified self-assessment reviewed by an independent Assessor. It isn’t the same as the audited Level Two certification, but it requires an organisation to examine a broader range of security arrangements than Cyber Essentials alone.

Why did we want the certification?

For us, it was important to check that the standards we discuss with clients are reflected in the way we manage security within the business.

IASME Cyber Assurance Level One gave us a structured way to do that. We reviewed our policies, responsibilities, systems, suppliers and processes against the requirements of the standard.

It also meant checking that what is written down reflects what actually happens in practice. Responsibilities need to be clear, and processes need to work when they are needed.

Could IASME Cyber Assurance be useful for your business?

It’s possible to have good technical security in place and still have gaps in the way security is managed across the wider business.

You might already use multi-factor authentication, keep devices updated, protect endpoints and have Cyber Essentials certification. But what happens if a key supplier suffers a cyber incident? Is there a documented process for removing access when an employee leaves? Does everyone know what to do following a data breach? Could the business continue operating if an important system became unavailable? These are the kinds of questions IASME Cyber Assurance is designed to address.

It can be particularly useful if customers are asking for evidence of your security arrangements, you handle sensitive or personal information, or your business forms part of a larger organisation’s supply chain. It can also give directors and trustees a clearer view of how cyber risk is being managed.

For some businesses, many of the right security measures may already be in place, but the processes around them have developed informally over time. Responsibilities may not be documented, or it may be difficult to demonstrate what happens in practice when a customer or another organisation asks for evidence. IASME Cyber Assurance provides a framework for bringing those arrangements together and identifying where more work may be needed.

Going through the process ourselves has also given us first-hand experience of what it involves. When we talk to clients about their own security requirements, we know the questions they’ll need to answer because we’ve had to answer them ourselves.

Helen Kings, Secure360.io

Business growth shown by people shaking hands.
overlay
22 Jul

Why Cyber Resilience Matters for SME Growth

Cyber resilience is becoming a normal part of doing business. Larger clients, insurers and regulated organisations increasingly want to know that the businesses they work with can manage cyber risk, recover from disruption and show what protections they have in place.

The Cyber Security and Resilience Bill, which had its second reading in the House of Lords on 14th July 2026, reflects that wider shift. The Bill is aimed mainly at larger organisations and key service providers, but the expectations behind it are already reaching smaller businesses through contracts, insurance and supplier checks.

For SMEs, the issue is not just whether the Bill applies directly, it is whether they can answer the cyber security and resilience questions now being asked of suppliers.

That does not mean every SME needs enterprise-level security. It does mean knowing what protections are in place, who is looking after them, how the business would recover from an incident, and what evidence could be provided if a client or insurer asked.

Growth brings more questions

A small business can run for years with informal processes and a trusted IT provider in the background. That may work well enough with familiar clients and straightforward operations but growth changes that.

A tender may ask whether you have Cyber Essentials. An insurer may want to know if multi-factor authentication is active across all accounts. A larger customer may ask for evidence of staff training, endpoint protection, backups or incident response planning.

These requests often arrive at awkward moments: during a contract negotiation, renewal, insurance application or procurement deadline. The businesses that struggle are not always the ones with no protection in place. More often, they have tools in place but cannot easily show how they are configured, monitored or reviewed. That creates delays at exactly the point where the business is trying to move forward.

Supplier cyber security is under closer scrutiny

The National Cyber Security Centre has warned that weaknesses in suppliers can affect the security of wider supply chains. Larger organisations know this, which is why cyber security checks are becoming a routine part of approving, renewing or expanding supplier relationships.

This is where better cyber security can help an SME commercially.

A business with clear controls, regular reporting and recognised certification is easier to assess. It can answer security questionnaires faster and avoid the last-minute scramble that happens when evidence is requested but no one is sure where to find it.

Cyber Essentials is a useful starting point because it gives SMEs a recognised framework for common security controls. Cyber Essentials Plus adds a technical audit, which can help where clients want a higher level of assurance.

Better security makes the business easier to trust

Cyber security is often discussed in terms of threats and attacks. For growing SMEs, it also matters because it removes friction. It helps with tenders, insurance applications, due diligence and board reporting. It gives staff clearer guidance on what to do when something looks suspicious.

The Cyber Security and Resilience Bill shows that resilience, reporting and supplier risk are becoming standard business concerns. Many SMEs may sit outside the direct scope of the legislation, but they will still feel the effect through the expectations of clients, insurers and regulated organisations.

Radar chart showing Secure360’s cyber security services including email protection, endpoint security, secure browsing, cloud posture, and dark web monitoring, highlighting areas covered and issues identified.
overlay
29 Jun

How AI is changing Cyber Security for UK SMEs

The National Cyber Security Centre (NCSC) has published a series of reports and articles on Frontier AI and what it means for cyber security. The message is clear that organisations should understand both the risks and the opportunities presented by AI, especially if they rely on digital systems.

What is Frontier AI?

The NCSC uses the term Frontier AI to describe the most advanced artificial intelligence models currently available. These systems can analyse large amounts of information, write software, solve complex problems and assist with tasks that previously required significant technical expertise.

Businesses are already using these capabilities to improve productivity. Software developers use AI to write code, marketing teams use it to generate content and organisations use it to automate repetitive work. But the same technology can also support cyber attacks. AI can help criminals generate convincing phishing emails, analyse publicly exposed systems, identify vulnerabilities and automate parts of an attack that once required far more time and effort.

AI is making cyber attacks faster

Cyber criminals are still exploiting many of the same weaknesses they have targeted for years. Weak passwords, missing security updates, exposed remote access and poorly secured Microsoft 365 environments remain common entry points. And AI allows attackers to find those weaknesses more efficiently.

The NCSC is clear that AI cannot independently carry out every stage of a sophisticated cyber attack today. The immediate risk is that it makes skilled attackers faster, more efficient and able to scale their activity more easily.

Instead of manually researching potential targets, they can automate reconnaissance, analyse thousands of internet facing systems and prioritise organisations that appear vulnerable.

The NCSC also highlights the growing importance of vulnerability discovery and exploitation. As AI helps attackers find and exploit weaknesses more quickly, organisations will have less time to apply security updates once vulnerabilities become known.

For businesses, this means vulnerabilities are likely to be discovered sooner than they were in the past. Delays in patching systems, removing unused accounts or reviewing access permissions leave less margin for error.

AI is also changing cyber defence

The same type of AI capability can also be used to improve cyber security. Security platforms increasingly use AI to analyse activity across Microsoft 365, email, user identities, endpoints and cloud services.

AI is looking for behaviour that doesn't fit the normal pattern. For example, it can recognise:

  • A user logging in from two different countries within a short period.
  • An employee granting unexpected permissions to a Microsoft 365 application.
  • Unusual email activity that could indicate a compromised account.
  • Multiple low-level security events that are connected to the same incident.

Any one of those activities might have an innocent explanation. The point is that AI can spot when several of them are happening at once and flag it before anyone has had to go looking.

What this looks like in practice

This is the approach at the heart of the Secure360.io service. Many organisations are overwhelmed by the volume of security alerts they receive. By correlating activity across your environment, our platform filters out much of the noise, helping our team focus on the alerts that genuinely require investigation.

Rather than watching each part of your Microsoft 365 environment in isolation, the platform looks across email, identities, endpoints and cloud activity together because that's where the patterns emerge.

But that doesn't remove people from the process - alerts still require judgement. Our team reviews incidents, investigates unusual activity and provides practical advice on the most appropriate response. AI gives us greater visibility and faster detection. and human expertise provides the context needed to protect your business.

The fundamentals still apply

The NCSC's guidance doesn't suggest organisations need to abandon existing security practices in favour of AI. The controls that reduce risk today will continue to reduce risk tomorrow. Multi-factor authentication, patch management, secure Microsoft 365 configuration, endpoint protection and effective identity management remain the foundation of good cyber security.

What should SMEs think about?

Most SMEs don't need to understand the technical detail behind Frontier AI. They do need confidence that someone is continuously monitoring their environment, identifying unusual behaviour and responding before a small security issue develops into a business disruption.

The businesses that manage this well won't necessarily be the biggest or the best resourced. They'll be the ones that have the basics in place and someone watching what's happening while it's happening and not after the fact.

Secret Link