SJ CyberAware

About SJ CyberAware

http://www.sjcyberaware.co.uk

Posts by SJ CyberAware:

20250919_1900_Castle Cybersecurity Metaphor_simple_compose_01k5hht308egg9wng440shhpf3

September 20 2025

Security v Resilience

I am often asked what the difference is between Cyber Security and Cyber Resilience.

It’s a great question, because the two terms are often used interchangeably, but in reality, they mean very different things. Understanding that difference is crucial if you want your business not only to stay safe but also to stay standing when things go wrong.

Cyber Security: Building Strong Defences

Cyber security is all about keeping the bad guys out. It’s the firewalls that block unwanted visitors, the multi-factor authentication that stops password thieves, and the software patches that close off security holes.

The mindset is defensive: “How do we stop an attack before it happens?”

Think of it like locking your doors, setting an alarm, and posting guards around your business. The stronger the locks and guards, the harder it is for anyone to break in.

Cyber Resilience: Surviving and Thriving

Cyber resilience takes a different view. It says: “What if the attacker still gets in?”

Resilience is about continuity and recovery, making sure your business can carry on, adapt, and recover quickly even if an incident occurs. That means:

Having reliable backups and knowing how to restore them,
Running regular incident response drills,
Communicating clearly with staff, customers, and regulators,
Keeping critical services online while the clean-up happens.

The mindset is adaptive: “Even if the worst happens, how do we keep moving?”

Using the same analogy: cyber resilience is like having an escape route, insurance, and emergency supplies, so that even if someone smashes through the door, you’re not paralysed.

The Key Difference in One Line

Cyber Security = protecting against attacks.
Cyber Resilience = preparing to recover when they happen.

Why Both Matter for SMBs

Too often, smaller businesses think cyber security alone will cover them. They install antivirus, set up strong passwords, and call it done. But prevention isn’t perfect.

A phishing email slips through.
A laptop gets stolen.
A supplier suffers a breach that exposes your data.

Without resilience, the ability to respond, recover, and adapt, even a minor incident can snowball into lost clients, regulatory fines, or weeks of downtime.

With resilience, the same event might cause a short disruption, but you bounce back stronger, with customers reassured that you had a plan.

A Castle Analogy

Picture your business as a castle:

Cyber security is the moat, walls, and guards.
Cyber resilience is the emergency tunnel, the food stores, and the rebuilding plan.

One keeps threats out. The other makes sure you survive if they get in.

Cyber Security vs Cyber Resilience

Aspect	Cyber Security	Cyber Resilience
Definition	Protecting systems, data, and networks from attack.	Preparing for, responding to, and recovering from attacks.
Primary Goal	Keep threats out.	Keep the business going.
Mindset	Defensive: “Stop it happening.”	Adaptive: “Cope when it happens.”
Focus Areas	Firewalls, MFA, antivirus, patching, monitoring.	Backup, recovery, incident response, business continuity.
Scope	Mainly IT/security teams.	Whole organisation (boardroom to front line).
Outcome	Reduced likelihood of attack.	Reduced impact of attack.
Analogy	Locks, alarms, and guards around a castle.	Escape routes, emergency supplies, rebuilding plan.
Weakness if Alone	Can fail if attackers find a way in.	Can fail without strong protection in the first place.

The Takeaway

If you only invest in cyber security, you’re hoping your walls never crack.
If you build resilience too, you’re ready for the day they do.

That’s the difference. And in today’s world, it’s not a choice between them, you need both.

September 19 2025

Desk of Doom

SJ CyberAware All, Daily Tips, Protect, SMB

Why Your Messy Workspace Might Be a Cybersecurity Crime Scene

Let’s talk about your desk.

Not the metaphorical “desk” where dreams are born and spreadsheets go to die. I mean the actual desk, the one buried under coffee-stained receipts, half-eaten biscuits, sticky notes with passwords like “Fluffy123,” and that USB stick you found in the car park and thought, “Eh, might be useful.”

Welcome to the frontline of cyber resilience. Population: you. Weapon of choice: a clean desk.

Cyber threats don’t always come from hoodie-wearing hackers in neon-lit basements. Sometimes, they come from Dave in accounting who snaps a photo of your login credentials while pretending to admire your Funko Pop collection, or from the cleaner who innocently plugs in a rogue USB to charge their phone and accidentally unleashes ransomware.

A cluttered desk is a buffet for opportunists:

Passwords on sticky notes = free access.
Unattended devices = unlocked treasure chests.
Sensitive documents = GDPR nightmares waiting to happen.

Clean Desk = Clear Mind (and Fewer Breaches)

Implementing a clean desk policy isn’t about being a neat freak, it’s about building a culture of intentional security. It says: “We care. We’re switched on. We don’t leave the keys to the kingdom next to the kettle.”

It also:

Reduces accidental data exposure.
Makes it easier to spot suspicious items (like that mystery USB).
Sends a message to staff and visitors: this place takes security seriously.

How to Clean Up Without Killing the Vibe

Let’s be real, no one wants a sterile, soul-sucking workspace. So here’s how to keep it practical, and protected:

Lock away devices and documents when you leave.
Shred sensitive papers like they insulted your mum.
Wipe down surfaces, yes, even the keyboard crumbs.
Memorize passwords or use a password manager. Sticky notes are for passive-aggressive fridge messages only.
Challenge the culture: make clean desks part of your brand. Bonus points for posters that say “Messy Desk, Messy Breach.”

Final Word from the Desk of Doom

Cyber resilience isn’t just firewalls and fancy tech, it’s habits, culture, and the little things that add up. A clean desk policy is your low-cost, high-impact way to stop data leaks before they start.

So next time you leave your desk, ask yourself: If this were a crime scene, what would the evidence say?

September 18 2025

The Rise of the Humble-Brag

SJ CyberAware All

The Rise of the Humble-Brag: A Gen X Reality Check

Something a wee bit different from the usual cyber security posts, a bit of GenX humour and observation.

Back in the 80s and 90s, bragging was refreshingly straightforward. You bought a new pair of Nike Airs, you wore them to school the next day. You got a new car stereo, you cranked it up in the car park. You landed a new job, you told everyone at the pub that night. There was no filter, no self-deprecation, no attempt to sugar-coat the fact that yes, you were absolutely showing off.

Fast forward a few decades, and things have taken a twist. Now, in the age of social media, we’re living through the golden era of the humble-brag.

For the blissfully unaware (lucky you), a humble-brag is when someone disguises a boast as a complaint or a piece of faux modesty! Now you know.

Think:

“Can’t believe I’ve been invited to yet another conference to give a keynote. Honestly, when will I get a break?”
I cant believe I have another promotion, thats 3 in 2 years, I’m exhausted.
“It’s exhausting getting stopped in the street all the time about my new haircut.”
“Wish I wasn’t so hopeless at running marathons, three medals in a year and my knees are shot.”

It’s the art of slipping a little bit of self-praise into your moaning, like smuggling chocolate into a salad.

As a GenXer, I can’t help but laugh at it all. Our generation was raised on a steady diet of sarcasm, eye-rolls, and cynicism. We can spot a humble-brag a mile off.

We grew up waiting a week for a roll of film to be developed, and more often than not half the photos were blurry. We learned patience from dial-up internet. We made mixtapes by sitting next to the radio for hours waiting for the right song. If you wanted to show off, you earned it.

So when someone posts about being “so embarrassed” that their TED Talk went viral, forgive me if I choke on my lukewarm instant coffee.

The humble-brag has flourished because it’s perfect for the social media era. Back in the day, your boasting was limited to whoever was within earshot. Now it’s broadcast to hundreds, maybe thousands of “connections.”

Platforms practically encourage it.

On Instagram, it’s “I woke up like this”, except you didn’t, you woke up, put on three layers of foundation, and angled the ring light just so.
On LinkedIn, it’s “Truly humbled to accept this award”, translation: “Look how shiny my award is!”
On Facebook, it’s “I’m so tired of everyone asking for my recipe”, cue 57 likes and 23 comments begging you to post it.

It’s modesty-as-performance, and audiences eat it up.

We don’t humble-brag. We grumble-brag. It’s bragging with a side of weary cynicism, our natural state.

Examples? Glad you asked:

“Had to fix the Wi-Fi again. Kids think I’m some sort of IT genius.”
“Painted the whole house myself. My back’s wrecked, but admit it, the edges are perfect.”
“Can’t believe I’m old enough to have a kid at uni, although in the right light, I still look 28.”

See, we’re not pretending to be modest, we’re just dressing our pride in a bit of world-weary humour.

Final Thoughts

The humble-brag isn’t going anywhere. It’s part of the modern attention economy, where self-promotion wears the mask of modesty, and honestly, it’s kind of entertaining.

As Gen X, we’ll keep on watching, half amused and half bemused. We’ll raise an eyebrow, mutter “Really?” under our breath, and carry on. Whether you’re humble-bragging, grumble-bragging, or just plain bragging, the truth is the same, we all want someone to notice.

And let’s be honest, deep down, we’re all still that kid at sports day, hoping somebody clapped when we came third in the sack race.

September 17 2025

AI & Cyber Security: The New Dream Team

SJ CyberAware AI, All, Daily Tips, SMB

A very quick and simplistic overview of AI in Cyber Security.

Think of AI in cyber security like a sniffer dog at the airport, it doesn’t replace the security staff, but it spots the dodgy suitcase a mile away.

Instead of sifting through mountains of boring logs and alerts, AI keeps an eye out for the weird stuff: dodgy emails, strange login attempts, or a hacker poking around where they shouldn’t be. It’s like having a super-fast colleague who never gets tired, never takes a tea break, and definitely doesn’t get distracted by TikTok.

But here’s the catch, AI isn’t magic. It still needs humans to set the rules, sense-check the alerts, and make the smart calls. Think of it as a trusty sidekick, not the hero of the story.

Bottom line: AI makes cyber security sharper, faster, and (dare we say it) a little less boring.

20250914_1510_AI Scam Alert_simple_compose_01k548zcv6ekbap4nt8zzvm3e8

September 16 2025

Day 7: AI Scams, the Final Word

SJ CyberAware AI, All, Daily Tips

Wrapping It Up: AI Scams in a Nutshell

If you’ve made it this far, you’ll have spotted the pattern, AI hasn’t just made business tools smarter, it’s made scams slicker, smoother, and a whole lot harder to spot.

Romance scams prove that love isn’t always blind, sometimes it’s expensive.
Deepfakes show us that even your “boss” might not be who they appear to be.
Social media bots remind us that not every five-star review is real (and some “customers” don’t even exist).
Phishing 2.0 polished up the old email con until it looks better than the real invoices in your inbox.
Conversational phishing turned one-off emails into weeks-long “relationships” that slowly drain your trust (and your bank account).
Investment scams shine like gold, but turn out to be little more than tinfoil when the money disappears.

It’s easy to laugh at these when they’re stories in the news, but when they land in your inbox, office phone, or LinkedIn DMs, they don’t feel like jokes. They feel urgent, they feel real, and that’s exactly why they work.

Top Takeaways for SMBs

Trust processes, not appearances. Whether it’s an email, a call, or a video, if money or sensitive data is involved, verify it through a trusted channel.
Make “double-checking” a badge of honour. Build a culture where pausing to confirm isn’t a nuisance, it’s good business.
Train your team, not just your tech. Filters, firewalls, and software help, but human awareness is your first (and last) line of defence.
Slow down. Most scams succeed because people feel rushed. A minute to pause could save months of pain.
Don’t chase shiny promises. If an “opportunity” looks too good to be true, it almost certainly is.

The Final Word

At the end of the day, SMB resilience isn’t about spotting every scam, that’s impossible. It’s about building habits and systems that make scams harder to land in the first place. Think of it like installing good locks on your doors: you can’t stop burglars existing, but you can make your place the hardest one to break into on the street.

AI scams are evolving fast, but so can you. By training your team, tightening your processes, and treating “verify before you trust” as a golden rule, your business can stay one step ahead of the fraudsters.

In the world of AI scams, curiosity and caution aren’t weaknesses, they’re your competitive edge.

September 15 2025

Day 6: Fools Gold, AI Investment Scams

SJ CyberAware AI, All, Daily Tips, SMB

Fool’s Gold 2.0: AI Investment Scams Aimed at Business Owners

Running a small or mid-sized business is tough enough without someone dangling “get rich quick” opportunities in your face. But that’s exactly what AI-driven investment scams do, and they’re getting scarily good at it.

Business owners and directors are prime targets. Why? Because scammers know you control the purse strings, you’re under pressure to grow, and you may be tempted by promises of quick returns, exclusive business loans, or the next big crypto boom.

AI makes these scams look bulletproof. Criminals churn out slick websites, glowing testimonials, and even fake trading dashboards that update in real time. Social media feeds get flooded with “success stories” from supposed investors (who are nothing more than AI-generated faces). If you bite, the scammers don’t just take your money , they take your reputation with it. Imagine explaining to your staff, partners, or clients that business funds vanished chasing a phantom investment.

Real-life example: In 2023, UK regulators warned about a wave of AI-powered “green energy investment schemes.” The fraudsters used cloned voices of well-known entrepreneurs in video ads, backed by professional-looking websites showing fake environmental projects. Several small business directors invested both company reserves and personal savings, only to discover the schemes didn’t exist. Losses ran into the millions.

What SMB Owners Can Do

Be sceptical of unsolicited offers. If an opportunity arrives via cold email, DM, or an online ad, assume it’s a scam until proven otherwise.
Check before you commit. Verify the company with the FCA register and run independent searches, don’t rely on the material provided by the promoter.
Separate business from personal. Never blur the line between company funds and your own savings when it comes to “investment opportunities.”
Get independent financial advice. A 30-minute call with a regulated advisor is far cheaper than losing six figures to a scam.
Pause before you leap. If it sounds too good to be true, it probably is.

AI-driven investment scams are the modern fool’s gold. They shine bright, they look convincing, and they’re designed to lure in busy owners chasing growth. For SMBs, the smartest investment isn’t in a flashy crypto pitch, it’s in due diligence and trusted advice.

September 14 2025

Day 5: AI Chatty Scammers

SJ CyberAware AI, All, Daily Tips, SMB

Chatty Scammers: When AI Holds a Conversation to Steal Your Cash

Traditional phishing was like a smash-and-grab, one dodgy email, poorly worded, hoping someone would bite. With AI, criminals have become far more patient and polished. Welcome to conversational phishing, where scammers don’t just send one email, they hold an entire dialogue with your staff.

Picture this, your accounts team gets an email from what looks like a regular supplier chasing a late payment. They reply, and instantly, a polite, natural-sounding response comes back. Over the next few days (or even weeks), the “supplier” keeps chatting, sharing believable details, and sounding utterly convincing. Only later do they slip in the sting, a change of bank details, a link to “settle the invoice,” or a subtle request for confidential data.

For small businesses, this kind of scam is particularly nasty. Unlike big corporates with complex supplier management systems, many SMBs rely on trust and personal relationships with their partners. That trust is exactly what criminals exploit.

Real-life example: In 2023, a UK-based manufacturing firm lost £60,000 after an accounts clerk corresponded with what they thought was a long-standing supplier. The emails stretched over two weeks, building confidence. On the final day, the “supplier” explained they’d updated their bank account and urgently needed payment. The transfer went through and the real supplier only flagged the missing money weeks later.

What SMBs Can Do

Set ironclad rules for bank detail changes. No matter how convincing the email, verify any new payment details using a trusted phone number or direct contact.
Introduce supplier verification steps. A short checklist (e.g., “call before you pay”) can stop scams dead in their tracks.
Train staff to be politely suspicious. If something feels off, sudden urgency, unfamiliar tone, or repeated requests, pause and double-check.
Use shared mailboxes or monitoring. If only one person deals with a supplier, scams are easier to miss. Having a backup pair of eyes helps.

AI has given cybercriminals the patience of a saint and the tongue of a silver-tongued salesperson. But with clear rules and a healthy “verify first, pay second” culture, SMBs can stay one step ahead of the chatty scammers.

September 13 2025

Day 4: Phishing 2.0: AI Scam Emails Look Better Than the Real Thing

SJ CyberAware AI, All, Daily Tips, Phishing, SMB

Phishing 2.0: AI Scam Emails Look Better Than the Real Thing

Remember when scam emails were easy to spot? Dodgy grammar, random capital letters, and a promise of millions from a “Prince” who just needed your bank details? Sadly, those days are gone.

With AI in the mix, phishing emails now look slick, polished, and worryingly convincing. Criminals can generate messages that read like they came from HMRC, your bank, or a trusted supplier. The branding is perfect, the tone feels right, and even the “from” address can look almost identical to the real thing.

For SMBs juggling multiple clients, suppliers, and invoices every week, this is a nightmare. A fake tax notice, an urgent utility bill, or a “customer complaint” can slide into the inbox and look completely legitimate. One click to open an attachment or one rushed payment later, and suddenly your business is dealing with malware, ransomware, or financial loss.

💡 Real-life example: In 2024, several UK SMBs in the hospitality sector were hit with AI-crafted phishing campaigns posing as energy suppliers. The emails looked identical to genuine statements, right down to the logos and reference numbers. Staff under pressure to pay “overdue” invoices wired thousands before realising the supplier accounts were fake.

What SMBs Can Do

Trust but verify. Never approve a payment request or invoice without confirming it through a known, independent channel.
Invest in good email filtering. Modern filters can catch many suspicious emails before they hit inboxes.
Train your team. Staff should know how to spot red flags like urgent tone, unusual requests, or slightly odd sender addresses.
Slow down. Most phishing succeeds because people feel rushed. Taking 60 seconds to double-check could save thousands.

AI has given scammers a new set of tools, but SMBs can fight back with clear processes, good technology, and a healthy dose of caution.

In short: don’t let a well-worded email catch you off guard.

September 12 2025

Day 3: AI-Powered Social Media Bots

SJ CyberAware AI, All, SMB

AI-Powered Social Media Bots (Messing with Your Reputation)

For small businesses, reputation is everything. You live and die by your reviews, your repeat customers, and the trust you’ve built up in your community. Imagine this: one morning you open your phone and see a string of bad reviews, angry comments, or dodgy DMs from “customers” you’ve never met.

Here’s the catch, those “people” might not be people at all. They could be AI-powered bots.

What’s a Social Media Bot?

Think of a bot as a digital puppet. It looks like a real person online, profile picture, posts, even conversations, but behind the strings is just a bit of software. With AI, these bots have gotten smart. They can:

Chat in a way that feels natural.
Like and share posts to look genuine.
Send you messages pretending to be a customer, supplier, or even a fan.

The scary part? They can work in swarms, creating the illusion of a crowd.

Why It Matters for SMBs

Bots can do more than just spam your inbox. They can:

Trash your reputation: Fake one-star reviews can put off potential customers.
Impersonate your clients or suppliers: Sending links that install malware when clicked.
Start false rumours: Making a minor hiccup look like a full-blown crisis.

When you’re running a café, shop, or service firm, you don’t always have a big PR team to fight this. That makes smaller businesses particularly vulnerable.

A Real Story

In 2023, a group of London restaurants suddenly got hit with dozens of “food poisoning” reviews in the same week. Different names, different writing styles, but eerily similar complaints. The owners later found out they were being extorted: “Pay us, or the bad reviews keep coming.”

For big chains, this was a headache. For little independent cafés, it was devastating, bookings dropped overnight. Only after working with Google to remove the reviews did things slowly return to normal.

What You Can Do

Keep an eye on things: Make checking reviews and social mentions part of the daily routine.
Don’t panic-reply: If a message feels off, step back before clicking or replying.
Report it fast: Use the tools on platforms to flag fakes before they spread.
Talk to your team: Remind them that not everyone online is who they claim to be.

The bottom line: Social media bots aren’t just an annoyance, they can chip away at the trust you’ve worked so hard to build. By keeping a watchful eye and reacting calmly, you can stop the fakes from gaining ground.

September 11 2025

Day 2: Deepfake Scams

SJ CyberAware AI, All, Daily Tips, SMB

2. Deepfake Scams (Business Leaders as Targets)

A few years ago, deepfakes were the stuff of sci-fi thrillers or viral internet memes. Funny, a bit weird, but not something most business owners thought they’d have to worry about. Fast forward to 2025, and deepfakes aren’t just entertaining party tricks, they’re precision tools for cybercriminals.

Here’s the scenario, your finance manager gets a video call. On screen is your Managing Director, looking stressed, speaking urgently, “We need to get this supplier paid immediately, no time for the usual checks.” The face looks right. The voice sounds right. Even the little mannerisms are there, the slight head tilt, the hand gestures, the hurried tone. However it’s not your MD! It’s a criminal, armed with AI.

Why it’s so dangerous for SMBs:-

Trust and authority: Staff naturally trust instructions from leaders. Deepfakes weaponise that trust.
Speed and pressure: These scams often involve urgency, “we’ll lose the deal if we don’t act now”, leaving little time to question.
Fewer barriers: Large corporates often require multiple sign-offs for large payments. In SMBs, processes are leaner, and one convincing call could be all it takes.

The consequences? A single fraudulent transfer could drain tens or even hundreds of thousands from your business account, and worse, it’s not always easy to claw that money back.

What SMBs can do to fight back:

Set strict approval processes for payments, even when the request seems to come from the top.
Use out-of-band verification, a quick phone call, face-to-face check, or secure messaging platform, to confirm urgent requests.
Train staff to recognise the red flags: unusual requests, time pressure, or slightly “off” behaviour in a familiar face.

The bottom line? Deepfakes have made “seeing is believing” a dangerous assumption. For SMB’s, the real defence is process and culture: empowering staff to question, verify, and slow down, even if the request looks like it’s coming straight from the boss.