Why these books matter to us

Cyber security has often been sold as a technology problem. Buy the tool. Install the software. Block the attack. Train the staff once a year. Move on.

That was never enough. It is even less convincing now.

Most real organisations are messy, busy and human. People are under pressure. They are trying to serve customers, look after pupils, care for residents, pay suppliers, answer emails, win work and keep the day moving. Cyber security has to fit into that world, not sit outside it shouting instructions.

These two books helped reinforce something we already believed: people should not be treated as the problem. People should be supported as part of the defence.

Why we moved away from “weakest link” language

The phrase “people are the weakest link” has been repeated in cyber security for years. It is memorable, but that does not make it helpful.

It puts the emphasis in the wrong place. It suggests that people are a weakness to be managed, rather than colleagues, staff, leaders, pupils, carers, clerks, finance teams and business owners who need good systems around them.

It also ignores the reality of how many attacks work. Phishing succeeds because it copies normal working life. A fake invoice looks like a real invoice. A password prompt looks like a real login page. A supplier request arrives during a busy week. A malicious link appears in a conversation that already feels familiar.

When someone clicks, the useful question is not “How could they fall for that?” The useful question is “Why was one click able to create so much risk?”

That question leads to better answers. Multi-factor authentication. Better email security. Password managers. Safer payment processes. Managed endpoint detection and response. Clear reporting routes. Tested backups. Practical training. A culture where people feel able to pause and ask for help.

Culture is not a poster on the wall

Lots of organisations have tried to create cyber security awareness with posters, slogans and annual training. Some of it helps. Some of it disappears into the background.

Culture is different. Culture is what people do when they are busy. It is whether someone feels comfortable reporting a mistake. It is whether a finance assistant can challenge a payment request from someone senior. It is whether staff know how to report a suspicious email. It is whether leaders model the behaviours they ask of everyone else.

In a school, culture might mean staff feel confident checking a strange email before opening an attachment. In a care provider, it might mean people understand why shared passwords are dangerous. In a small business, it might mean invoice changes are always checked through a second route. In a parish council, it might mean councillors and clerks use multi-factor authentication without it becoming a battle.

These are small things, but they add up.

How this shapes our cyber security services

When we recommend tools such as managed endpoint detection and response, password management, email security, backup, patching or security awareness training, we are not trying to build a stack of products for the sake of it.

We are trying to reduce the pressure on people.

Multi-factor authentication helps when a password is stolen. A password manager helps people stop reusing weak passwords. Email security reduces the number of dangerous messages people have to judge. Managed detection and response means suspicious behaviour is watched. Tested backups mean one mistake does not have to become a disaster. Awareness training gives people practical confidence.

The technology matters. But the reason behind it matters more.