Special Guest: Luke Irwin, CEO & Principal Consultant, Aegis Cyber Security

In this episode, Jason Howes is joined by Luke Irwin, CEO and Principal Consultant at Aegis Cyber Security, to unpack the real cyber risks facing small to mid‑market businesses, and what leaders can do today to reduce exposure.

Luke brings a practical, no‑nonsense view of the cybersecurity landscape, drawn from his work with fast‑moving SMEs and mid‑market organisations that don’t have time for red tape, but can’t afford to get it wrong.

🔐 The Current Cyber Threat Landscape

Luke explains that while ransomware gets the headlines, business email compromise remains the most common and damaging attack. These breaches often lead to:

• Invoice fraud and impersonation
• Theft of sensitive data
• Reputational damage that far outweighs the technical impact

The key issue? Many attacks succeed not because of sophisticated hacking, but because basic controls aren’t in place.

🏢 Cybersecurity for Mid‑Market Businesses

For mid‑market organisations, cybersecurity is no longer an IT problem, it’s a commercial and leadership risk. Luke highlights that these businesses often sit in the danger zone:

• Large enough to be targeted
• Not always mature enough in controls or governance

A single incident can disrupt operations, impact supply chains, and erode hard‑won customer trust.

🚨 Incident Response, Recovery & Insurance

The discussion covers why incident response planning matters just as much as prevention. Leaders should know:

• What happens if systems go down
• How quickly operations can recover
• Whether cyber insurance actually covers the real cost of disruption

Cyber insurance is important, but only works when paired with strong controls and documented processes.

🔗 Supply Chain & Reputational Risk

Jason and Luke explore a scenario many businesses don’t consider:
If a cyber incident stops you supplying a major customer, they may be forced to buy from your competitor, and never come back.

Beyond lost revenue, the reputational impact can be career‑limiting for executives and directors responsible for risk oversight.

📊 Data, CRM & Cultural Adoption

Cybersecurity isn’t just about technology, it’s about how people use systems. Poor data management, weak CRM discipline, and low user adoption all increase risk.
A strong security posture requires cultural change, not just tools.

✅ Luke’s Top 3 Cybersecurity Tips You Can Act on Today

1. Enable Multi‑Factor Authentication (MFA)
   One of the strongest and simplest protections available.
2. Back up your data, and test those backups
   A backup that hasn’t been tested is not a backup.
3. Align to a recognised cybersecurity standard
   Luke recommends SMB‑1001, a practical framework designed specifically for small and mid‑market businesses.
   • Five tiers (Bronze to Diamond)
   • Gold is a minimum baseline for businesses with 5+ staff
   • Clear, prescriptive controls that reduce risk without unnecessary complexity

🗞 Industry Insight & Media Commentary

Luke also shares insights from his recent media appearances, including commentary on:

• High‑profile cyber attacks
• Risks to critical infrastructure and education
• The growing need for leaders to engage seriously with cyber risk

His mission is clear: start the conversation early, before an incident forces it.

Cybersecurity is no longer optional, technical, or someone else’s problem.
It’s about protecting customers, revenue, reputation, and careers — while ensuring the business can continue to operate when things go wrong.