The HIDDEN Podcast by Babble

New regulation is on its way. But will it affect your business, your suppliers, or what your customers expect you to prove?

In this episode, Lynn is joined for the first time by Mark Weait, Chief Revenue Officer at Babble, to unpack the UK Cyber Security and Resilience Bill: what it proposes, where it stands in Parliament, and why it matters well beyond the organisations it directly regulates.

It isn’t law yet, and the detail is still being worked through. That’s exactly why now is a useful time to ask questions, while there’s still time to prepare.

Mark explains why the real ripple effect is likely to be felt through supply chains, where customers and insurers may start asking for evidence of good cyber governance long before a regulator does. The conversation covers what that evidence might look like, why “we’re not directly regulated” isn’t the same as “this doesn’t affect us”, and why relying on a provider doesn’t mean you can stop asking questions.

This isn’t a story about panic or box-ticking. It’s about the difference between meeting a minimum and being genuinely resilient, and the practical questions leadership teams can ask today.

We’ve linked further reading below if you’d like to dig into the legislation yourself.

Further reading:

• UK Parliament bill tracker (current stage and amendments): bills.parliament.uk/bills/4035
• NCSC Cyber Assessment Framework: ncsc.gov.uk/collection/CAF

Mentioned in this episode: watch our managed detection and response webinar on demand → Managed Cyber Security: What to Buy, and How to Buy It

Key takeaways:

• Why this isn’t only a compliance story
• Where the Bill stands and what it proposes, in plain English
• Why businesses that aren’t directly regulated may still feel the effects
• What customers and insurers may start asking you to demonstrate
• Three questions leadership teams can ask today
• The difference between meeting a minimum and being genuinely resilient

Chapters:

00:00 This isn’t only a compliance story

00:38 Welcome to HIDDEN

01:30 Meet Mark Weait

04:24 Will it actually happen? Where the bill stands

07:17 What the bill proposes

10:39 Who’s directly in scope, and who feels it anyway

13:37 Why “we’re not critical” isn’t the whole story

16:54 What your customers may soon ask you to prove

20:49 What insurers will expect to see

24:35 Three questions leaders should ask today

28:21 Why resilience beats a tick-box

30:50 The one conversation to have this quarter

31:59 Closing thoughts

Your IT provider might be doing an excellent job. But does that include actively watching for threats, investigating suspicious activity, and taking action if something goes wrong?

In this episode, Lynn is joined by Nikoo Fullerton to unpack a distinction that catches a lot of businesses out: everyday IT management and specialist cyber security monitoring are not the same thing, even when they sound like they should be.

Nikoo explains what a typical IT contract reasonably covers, why a genuinely good MSP can still fall short of providing round-the-clock threat monitoring, and why that gap usually comes down to an untested assumption rather than poor performance. The conversation also strips away the acronym soup around SOC, MSSP, MDR and MXDR, focusing on what buyers should actually be asking about outcomes, scope and authority to act.

Nikoo walks through how to decide between managing security internally, outsourcing it, or blending both, why cyber security strategy can never be fully handed off to a third party, and the signs that a business is either under protected or quietly paying twice for overlapping cover.

Because the goal isn’t more tools or more providers. It’s knowing exactly who’s watching, who’s investigating, and who’s authorised to act, agreed before anything goes wrong.

If this episode leaves you with more questions than answers, join Babble’s upcoming Managed Cyber Security webinar, where we’ll unpack what to buy, how to buy it, and the questions worth asking before you do.

Register for the webinar: How to Buy Managed Cyber Security

Key takeaways:

• Why a good IT provider isn’t automatically your security team
• What a SOC actually is (hint: not a room full of analysts)
• How to cut through SOC, MSSP, MDR and MXDR by focusing on outcomes
• How to choose between internal, outsourced and hybrid models
• Why cyber security strategy can’t be fully outsourced
• The exclusions and costs that catch businesses out

Chapters:

00:00 Doing it well isn’t the same as watching for threats

00:50 Welcome to HIDDEN

01:43 Meet Nikoo Fullerton

03:07 Who’s actually responsible?

04:17 What your IT provider can reasonably cover

05:24 Where IT ends and security begins

06:28 How escalation actually works

07:17 Doing a good job doesn’t mean doing it all

08:34 What a security operations centre actually is

09:42 Cutting through the acronyms

11:02 Internal, outsourced or hybrid

12:37 Why you can’t outsource accountability

13:41 Why playbooks matter

15:24 Signs you’re under protected or overpaying

17:01 Know what you’ve got before you shop around

18:17 MSP, SOC, MSSP, MDR and MXDR explained

22:02 What 24/7 actually means

23:46 The costs that catch people out

25:56 The one thing that needs a named owner

27:22 Closing thoughts

Your security software just flagged something suspicious. It’s 2am, your team’s asleep, and the office is closed. So what happens next?

In this episode, Lynn sits down with Steve Hennessy to unpack what an alert actually means, and why it’s only ever the beginning of the story. Because detecting a threat isn’t the same as understanding it, containing it, or knowing who’s responsible for dealing with it once the noise starts.

Steve walks through why not every alert carries the same weight, what genuinely happens in the hours between a 2am alert and a 9am login, and why expecting a small internal IT team to catch everything around the clock often isn’t realistic. He also breaks down what triage, investigation and containment mean in practice, and who should have the authority to isolate an account or device when the business itself can’t be reached.

The conversation moves beyond the alert itself and into the harder questions: what a genuine 24/7 monitoring service should include, why the cost of proper cover is often more accessible than people assume, and why there’s no single right answer for every business.

Because the real risk usually isn’t the alert. It’s not knowing who’s watching, what they’ll do, and when.

If this episode leaves you with more questions than answers, join Babble’s upcoming Managed Cyber Security webinar, where we’ll unpack what to buy, how to buy it, and the questions worth asking before you do.

Register for the webinar: How to Buy Managed Cyber Security

Key takeaways:

• Why an alert is a warning sign, not a resolution
• Why not every alert requires the same response
• What can happen in the hours before a 2am alert gets noticed
• Whether a small internal IT team can realistically provide round-the-clock cover
• What triage, investigation and containment actually involve
• Why 24/7 monitoring means very little without a clear plan behind it

Chapters:

00:00 Alerts are not the all clear

00:20 Welcome to HIDDEN

01:20 The 2am scenario

02:06 What an alert actually tells you

04:37 Ownership comes up again

05:28 Where does the alert actually go?

06:23 Breaking down MDR and MXDR

07:21 Six hours in the dark

09:04 Alert fatigue is real

12:33 What investigation needs to establish

15:51 What containment actually looks like

17:38 Who has the authority to act?

19:55 The run book as an incident response plan

22:07 What 24/7 monitoring should include

23:50 Does round-the-clock cover cost a fortune?

26:51 Build it in-house or bring in support?

29:06 Does every business need the same cover?

31:51 The one question to ask your MSP

33:54 Closing thoughts

You’re already paying for antivirus, Microsoft Defender, or an IT provider to keep your laptops and phones secure. So why do gaps still slip through?

In this episode, Lynn sits down with Nisha Sondhi to unpack a pattern that shows up again and again in Babble’s HIDDEN assessments: businesses that have the right tools in place, but can’t always say how they’re configured, who’s checking them, or whether they cover every device accessing company data.

Because having security software installed isn’t the same as being protected.

Nisha explains what “fully managed” should actually mean in practice, why bring-your-own-device (BYOD) policies often have more grey area than businesses realise, and how personal privacy and business security can coexist without one compromising the other. The conversation also covers what happens when the person responsible for a security platform leaves the business, and why it’s usually ownership, not the technology, that quietly falls apart.

This isn’t about pointing fingers or selling another tool. It’s about understanding what you already have, who’s accountable for it, and what evidence proves it’s actually working.

Because before you consider buying anything else, it’s worth knowing whether your existing protection is doing its job.

If this episode raises more questions than it answers, join Babble’s upcoming Managed Cyber Security webinar, where we’ll unpack what to buy, how to buy it, and the questions worth asking before you do.

Register for the webinar: How to Buy Managed Cyber Security

Key takeaways:

• Why installed security software doesn’t automatically mean protection
• What “fully managed” should really include
• The BYOD grey area many businesses overlook
• How personal privacy and business security can coexist
• Why ownership, not technology, is usually what fails
• Why MFA and zero trust remain non-negotiable basics

Chapters:

00:00 Why installed doesn’t mean protected

00:27 Welcome to HIDDEN

01:44 What “protected” actually means

04:02 The BYOD blind spot

05:37 Who really owns your security

07:04 Getting more from Microsoft Defender

08:01 Where privacy ends and security begins

10:44 Policy vs. device management

12:58 When the person managing your tools leaves

14:15 Installed isn’t the same as managed

15:13 MFA, zero trust and the human check

17:17 Closing thoughts

Why do some businesses seem to get more value from technology than others?

It’s a question that goes beyond budgets, sectors, or the latest AI tools, and it’s exactly what Babble set out to answer through the Technology Performance Index (TPI): an independent study of 1,000 UK SMB leaders.

In this episode, Lynn is joined by Mark O'Dell and Jeremy Langley to unpack the findings, revealing three distinct groups of technology adoption: Tech Vanguards, Emerging Adopters, and Tech Bystanders.

The conversation explores what separates these groups, why some organisations consistently turn technology into a driver of growth, while others find themselves stuck firefighting, and how businesses build confidence through structure, governance, and a clear focus on outcomes.

You'll also hear why treating technology as a business investment (not simply an IT cost) changes the way organisations make decisions, prioritise projects, and measure success.

Perhaps most importantly, this episode challenges the idea that successful technology adoption is about buying the right tools.

Instead, it's about starting with the outcome you want to achieve and building the right strategy to get there.

Whether you see your business in the Vanguard, Emerging Adopter, or Bystander category, this conversation offers practical insights to help you move forward with greater confidence, and a clearer understanding of how technology can become a genuine driver of productivity, growth, and resilience.

Key takeaways:

• The three technology mindsets shaping UK SMBs
• What separates Tech Vanguards from everyone else
• Why confidence comes from structure, not bigger budgets
• How firefighting prevents long-term progress
• Why outcomes, not technology, should drive every investment
• How AI and cyber security are widening the gap between businesses

Explore the Technology Performance Index

📊 Take the free Technology Performance Index Assessment
https://info.babble.cloud/tpi-assessment2026?hsCtaAttrib=425604937930

📖 Download the full Technology Performance Index Report
https://145811431.hs-sites-eu1.com/hubfs/TPI/Report/The%20Babble%20Technology%20Performance%20Index%202026.pdf?hsCtaAttrib=425516543165

🔍 Explore more insights and resources
https://www.babble.cloud/tpi

Chapters:

00:00 Welcome: Meet Mark O'Dell and Jeremy Langley 
01:39 What is the Technology Performance Index (TPI)? 
02:34 Why did Babble ask 1,000 business leaders this question? 
03:29 What really separates a Vanguard from a Bystander? 
05:24 Which group does your business belong in? 
06:37 The Bystander: Why are a third of UK businesses falling behind? 
12:04 The Emerging Adopter: What’s stopping them from becoming a Vanguard? 
15:51 The Vanguard: What are they doing differently? 
19:03 Mark's advice for Bystanders, Emerging Adopters and Vanguards 
22:22 How did this research change Babble's thinking? 
24:58 Where will UK businesses be this time next year? 
26:37 Conclusion

For years, cyber security was built around a simple idea: protect the perimeter.

But what happens when your applications live in the cloud, your data is spread across multiple platforms, and AI systems can access information, automate tasks, and make decisions on your behalf?

In this episode, Lynn sits down with Keith Archer to explore how network and cloud security is evolving in the AI era, and why many of the security assumptions organisations have relied on for years no longer hold up.

Because AI isn't just changing how businesses work. It's changing how cyber threats operate too.

From agentic AI and prompt injection to shadow AI and tool hijacking, this conversation unpacks some of the newest risks emerging as organisations race to adopt AI-powered tools and platforms.

Keith explains why traditional security controls often struggle to detect these threats, how attackers are beginning to weaponise AI, and why visibility has become one of the most important capabilities an organisation can have.

The discussion also explores the growing challenge of shadow AI — where employees introduce AI tools without formal oversight — and the business impact of not knowing what systems, data, or applications those tools can access.

Most importantly, this episode isn't about avoiding AI. It's about adopting it responsibly.

Because organisations that balance innovation with governance will be far better positioned than those that either ignore AI altogether or deploy it without understanding the risks.

A HIDDEN Cyber Security Snapshot helps organisations identify gaps across people, identities, data, recovery, devices, networks, cloud environments, and emerging AI usage; creating a clearer picture of where exposure actually exists.

Key takeaways:

• Why traditional security perimeters no longer exist
• What agentic AI means in practical terms
• The risks associated with prompt injection and AI manipulation
• How shadow AI creates visibility and governance challenges
• Why traditional security tools struggle with AI-driven threats
• Where organisations should focus first to improve resilience in the AI era

Chapters:

00:00 Introduction
01:12 Meet Keith Archer
02:59 The evolution from perimeter to cloud
05:20 Understanding agentic AI
07:11 Why traditional security tools are struggling
10:34 Jailbreaking and prompt injection explained
14:58 The rise of indirect prompt injection
16:19 The real business impact of AI threats
18:17 Shadow AI and the visibility challenge
19:58 When AI tools become attack paths
21:31 Where organisations are getting AI wrong
23:27 Immediate actions for security teams
25:49 Why human risk still matters
27:46 Keith’s wake-up call for business leaders
30:05 Conclusion

Your cyber security is only as strong as the devices connecting to your business.

Laptops. Phones. Tablets. Personal devices. Corporate devices.

They’ve never been more essential to how we work … and they’ve never been more attractive to attackers.

In this episode, Lynn sits down with Callum Archer to explore why endpoints remain one of the most targeted attack surfaces in modern cyber security, and what organisations can do to improve visibility, detection, and response before a small compromise becomes a much bigger problem.

Because attackers don’t need to break into every device. They just need one.

This conversation unpacks why outdated software, inconsistent device standards, and alert fatigue continue to create opportunities for attackers, particularly in SMB environments where IT teams are often stretched thin.

Callum also explains how endpoint security has evolved beyond traditional antivirus, why behaviour-based attacks are becoming more common, and how modern endpoint detection and response tools help organisations identify and contain threats faster.

Most importantly, this episode explores the importance of speed. Because when a device is compromised, every second matters.

The faster you can detect a threat, contain it, and respond, the less opportunity attackers have to move through your environment and cause damage.

Our HIDDEN Cyber Security Snapshot helps organisations identify hidden gaps across devices, monitoring, policies, and response capabilities; creating a clearer picture of where endpoint risks actually exist.

Key takeaways:

• Why endpoints remain a primary target for attackers
• The risks created by outdated devices and inconsistent standards
• Why traditional antivirus is no longer enough on its own
• How behaviour-based attacks are changing cyber security
• The importance of detection, response, and threat containment
• What good endpoint protection looks like today

Chapters:

00:00 Introduction
01:09 Meet Callum Archer
02:08 Why devices remain a prime target
04:19 The unseen cost of vulnerabilities and alert fatigue
07:25 What happens after a device is compromised
09:00 Why antivirus alone isn't enough
10:51 The rise of malware-free attacks
13:10 How inconsistent device standards create risk
16:25 The non-negotiables of endpoint protection
17:39 Measuring your security maturity
19:47 Callum’s advice on what to do when a device is compromised
20:10 Conclusion

“We have backups.” 

It’s one of the most common phrases in cyber security conversations (and one of the most misunderstood). 

Because having a backup doesn’t automatically mean your business can recover. 

In this episode, Lynn sits down with Steve Hennessy to unpack the critical difference between backup, recovery, business continuity, and resilience, and why testing matters just as much as the backup itself. 

When systems go down, the real question isn’t whether a copy of your data exists. It’s how quickly you can get your business operational again. 

This conversation explores why untested backups create a false sense of security, how ransomware attackers increasingly target backup systems first, and why assumptions around recovery often fall apart during real-world incidents. 

Steve also breaks down the concept of Recovery Time Objectives (RTOs), why downtime impacts every business differently, and how organisations should think about resilience beyond just data storage. 

Most importantly, this episode reframes recovery planning as something proactive, not reactive. Because calm, structured decision-making during a crisis only happens when the planning, testing, and preparation have already happened beforehand. 

From restore testing and disaster recovery planning to identifying single points of failure, this episode is all about understanding what happens after something goes wrong and whether your business is truly prepared for it. 

A Cyber Security Snapshot helps organisations identify hidden gaps across backup strategy, resilience, recovery planning, and operational risk: creating a clearer picture of where vulnerabilities exist. 

Key takeaways: 

• Why backups and recovery are not the same thing  

• The risks of relying on untested backups  

• Why ransomware attackers target backup systems first  

• What Recovery Time Objectives (RTOs) mean  

• How business continuity planning improves resilience  

• Why testing and preparation matter more than assumptions  

Chapters: 

00:00 Introduction 
01:11 Meet Steve Hennessy 
02:15 Why backups alone aren’t enough 
05:33 The importance of restore testing 
08:17 The danger of assuming recovery will work 
10:15 Why attackers target backup systems 
13:17 Understanding Recovery Time Objectives (RTOs) 
14:41 What downtime really costs a business 
10:15 Cyber security and backup systems 
18:07 Backup vs recovery explained 
19:35 Why business continuity planning matters 
22:20 The non-negotiables for resilience 
25:50 Steve’s advice on staying calm during a cyber crisis 
27:02 Conclusion  

Your business data is constantly moving.

Shared across Teams. Stored in cloud drives. Downloaded onto devices. Sent externally. Duplicated. Renamed. Forwarded.

And in many SMBs, nobody has full visibility of where it all lives anymore.

In this episode, Lynn sits down with Nisha Sondhi to unpack the growing challenges of data governance, oversharing, and data sprawl. They also discuss why controlling your data has become one of the biggest cyber security challenges facing modern businesses.

Because data doesn’t usually become exposed through one dramatic event.

It happens gradually.

A file gets overshared.
Access permissions are never reviewed.
Sensitive information sits in the wrong place.
A link gets sent externally.

And over time, organisations lose track of what’s sensitive, who has access to it, and what’s happening to it.

This conversation explores why data classification is often missing in SMB environments, how human behaviour quietly increases risk, and why “everyone has access to everything” creates far more problems than it solves.

Nisha also breaks down the growing pressure coming from compliance requirements, insurers, and customers — who increasingly expect organisations to prove they understand where their data lives and how it’s protected.

Most importantly, this episode reframes data governance as something practical, not overwhelming.

Because good data security isn’t about locking everything down.

It’s about balance, visibility, and putting the right controls around the data that matters most.

A Cyber Security Snapshot helps organisations identify hidden gaps across data sharing, access, governance, and user behaviour: creating a clearer picture of where risk actually exists.

Key takeaways:

• Why data sprawl creates hidden security risks
• The dangers of oversharing inside and outside the business
• Why data classification is often missing in SMBs
• How compliance and cyber insurance are reshaping data governance
• What good data governance actually looks like in practice

Chapters:

00:00 Introduction
01:10 Meet Nisha Sondhi
02:10 Why businesses lose track of their data
07:20 Why governance and compliance now matter more
09:05 The problem with unclassified data
12:31 How human behaviour increases data risk
19:20 What to do when sensitive data is exposed
24:04 Conclusion

If someone stole a password in your business today, how much could they actually access?

That’s the question at the centre of this episode.

Lynn sits down with Anton Davies to unpack why identity has become the new perimeter in cyber security, and why attackers are increasingly targeting people, passwords, and access instead of trying to “hack” their way into systems.

Because modern cyber attacks often don’t start with breaking in.

They start with logging in.

This episode explores how compromised identities can quietly open the door to sensitive systems, company data, and internal tools (often without anyone realising until it’s too late). From over-provisioned admin access to forgotten accounts and weak password habits, Anton breaks down the identity gaps that commonly exist inside SMB environments and why they’re so dangerous.

The conversation also unpacks the practical side of identity security, including:

• Why multi-factor authentication (MFA) should be non-negotiable
• How conditional access helps reduce unnecessary risk
• Why “too much access” can become a major problem
• How small housekeeping habits can dramatically improve visibility and control

Most importantly, this episode reframes identity security as something bigger than passwords.

It’s about understanding who has access to what, when they should have it, and what happens if those accounts are compromised.

Because if identity is now the front door to your business, you need to know exactly who can walk through it.

A Cyber Security Snapshot helps organisations identify hidden gaps across identity, access, devices, and governance: creating a clearer picture of where exposure actually exists.

Key takeaways:

• Why identity is now the new perimeter in cyber security
• How credential theft leads to larger breaches
• The risks of excessive admin access and poor housekeeping
• Why MFA and conditional access matter more than ever
• How passphrases can strengthen password security

Chapters:

0:00 Introduction
1:10 Meet Anton Davies
2:05 Identity as the new perimeter
3:11 Credential theft and its implications
6:21 Security gaps in identity management
7:41 Excessive privilege risks
10:44 Penetration testing explained
11:29 Lifecycle control in identity management
13:57 Non-negotiables for SMB identity security
18:37 Governance and ownership of identity
21:49 Anton’s quick win for password security
24:27 Conclusion