The Small Business Cyber Security Guy · 2026-05-27 · 13 min
Key moments - from our scoring
Substance score
47 / 100
Five dimensions, 20 points each
Noel Bradford argues that cybercrime's impact - invoice fraud, ransomware, account takeovers, data breaches - lands on the business bottom line, not the firewall, yet remains chronically underfunded and under-governed at leadership level. British Chambers of Commerce data showing 21% of firms experienced cyber attacks in the past year frames this as a growth barrier, not a technical novelty. The episode dismantles compliance theatre and vendor-speak to show how a phishing email becomes payment fraud, how a compromised account becomes legal exposure, how downtime becomes cash flow crisis. Bradford challenges small business leaders to reframe cybersecurity from Dave's server cupboard issue to a board-level risk register item requiring incident decision-makers, payment control reviews, systems criticality mapping, and resilience budgeting before crisis hits. The message is direct: criminals have professionalized supply chains and support structures; most legitimate businesses haven't. For UK SMBs, this maps to British Chambers of Commerce and UK Cyber Security Breaches Survey guidance; US listeners can apply the same principles through FTC and CISA small business frameworks. The uncomfortable truth is that cyber risk forces uncomfortable governance conversations about who approves money, who accesses data, and whether written process actually exists.
Because cyber incidents directly impact business continuity - stopped trading, delayed payroll, blocked orders, frozen production, leaked customer data, regulator triggers - landing costs across finance, operations, sales, and customer service, not just the IT department. If leadership only sees it as Dave's IT problem, accountability stays unowned until a crisis exposes weak governance.
Add cybersecurity and fraud to the risk register; identify an incident decision-maker before crisis happens; map systems that stop trading if unavailable; review payment change controls with finance; budget for resilience controls (MFA, backup testing, asset inventory, supplier access review) not just tools; and ask who owns each critical decision in the first hour of an incident.
Criminals exploit business process, pressure, urgency, politeness and trust - attacking approval chains, weak passwords, forgotten supplier accounts, shared admin credentials, unwritten processes and unclear ownership. They profit from flat networks, untested backups, and businesses where 'someone else' is assumed to be handling security.
Untested backups mean hope is not a recovery strategy; downtime costs money and trust, potentially missing customer commitments and delaying payroll. Unsupported servers become unpatched backdoors into the entire estate if compromised, and forgotten admin accounts on them can stay active for months as persistent access points.
Cybercrime is now a cost of doing business; budgeting for it only after invoice fraud lands means paying twice - once for prevention (cheap) and once for incident response (expensive). When leaders skip MFA rollout, asset inventory and supplier reviews to fund dashboards and SaaS tools, they're betting the business on hope rather than resilience.
Our reviewer’s read on each dimension, with quotes from the episode.
The episode delivers consistent, well-articulated observations about framing cybersecurity as business risk rather than IT risk, with concrete examples of business impact (payment fraud, regulatory triggers, customer trust). However, it relies heavily on rhetorical force and metaphor rather than novel data or unexpected angles - the core insight (cyber is a business problem, not IT) is sound but not deeply surprising to informed operators. The episode succeeds through clarity and scope of application rather than through introducing genuinely new or counterintuitive claims.
Cybercrime isn't an IT problem, it's a business problem with IT consequences.
If a cyber incident stops you trading, it's business risk. If it delays payroll, it's business risk. If it blocks orders, it's business risk.
The framing of cyber as a business continuity problem is reasonably well-executed but not novel - this shift is well-established in risk management and security leadership circles. The rhetorical style (colorful metaphors, contrarian tone) is distinctive, but the underlying frameworks are conventional. The episode adds little new thinking to how businesses should actually approach cyber risk; it repackages existing wisdom in more accessible language rather than introducing fresh analysis or counterintuitive arguments.
Cybersecurity is not an IT hobby. It's business continuity with a login prompt.
If cyber only appears in your IT budget, your business has misunderstood the threat.
This is a solo monologue by the host, not a guest-driven episode. Noel Bradford presents himself as an operator with perspective on SMB cyber risk, but the episode provides no evidence of his specific operational background, scale of businesses he's run, or credential beyond hosting the show. The absence of a guest with demonstrated track record of managing actual incidents at scale significantly limits the episode's authority on this dimension.
I'm Noel Bradford and today we're talking about cost
This has been a Small Business Cybersecurity Guy production.
The episode cites two data points (21% of UK firms experienced cyber attacks, 20% reported fraud/scams from British Chambers of Commerce) but uses them only to validate problem importance, not to explore patterns or causation. Concrete examples are mostly hypothetical scenarios (compromised account leads to fraud, phishing becomes payment fraud) rather than named case studies, specific metrics, or detailed incident timelines. References to guidance documents (FTC, CISA, UK Cyber Security Breaches Survey) are mentioned but not explored with specifics. The substance relies on logical argument rather than hard evidence.
British Chambers of Commerce recently warned that crime is becoming a serious barrier to UK growth. Their data said 21% of firms had experienced cyber attacks in the past year. It. It also said 20% had reported fraud or scams.
A phishing email can become a payment fraud issue. A compromised account can become a legal issue. A ransomware attack can become a cash flow issue.
As a monologue, there is no host-guest dynamic or opportunity for follow-up questions, pushback, or exploratory dialogue. The episode is structured as a persuasive speech with rhetorical questions posed to the listener rather than genuine back-and-forth inquiry. While the tone is engaging and the arguments are clearly stated, there is no conversational testing of claims, no challenge to assumptions, and no iterative discovery that would elevate this beyond a one-way broadcast of perspective.
Here's the uncomfortable truth.
Have you considered asking better questions like 'What would stop us trading?'
Computed from the transcript - who did the talking, and the words that came up most.
Noel Bradford opens the episode with a blunt question: what does a cyber attack really cost your business? He takes us out of the server cupboard and into the meeting room, where time lost, money gone, reputations dented and growth stalled are the metrics that actually matter. Through vivid examples - payment fraud that empties a ledger, ransomware that freezes production, a supplier breach that hands customers to a competitor - Noel shows how an email, a weak password or a forgotten server can cascade into an existential business crisis. The narrative follows small businesses facing an uncomfortable truth: cybercrime is no longer an edge-case IT headache, it’s a predictable criminal business model that targets people, process and trust. Noel cites fresh data that brings the story to life - fraud, scams and attacks are climbing - and he paints a picture of criminals with playbooks, support desks and supply chains that mirror legitimate industry behaviour. The result? An urgent call to move cyber from back-office grudge purchase to front-page boardroom agenda.
Transcribed and scored by The B2B Podcast Index.
Cybersecurity Guy. I'm Noel Bradford and today we're talking about cost, not theoretical cyber cost, not vendor maths, not a glossy report with a stock photo of a finance director staring at a laptop like it just insulted the family dog. Real business cost, time lost, money lost, trust lost, growth delayed, customers annoyed, staff pulled into nonsense they didn't cause. That cost because cybercrime isn't an IT problem, it's a business problem with IT consequences.
And if your business still treats it as Dave's little server cupboard issue, your risk management has all the maturity of a wet paper bag. British Chambers of Commerce recently warned that crime is becoming a serious barrier to UK growth. Their data said 21% of firms had experienced cyber attacks in the past year. It.
It also said 20% had reported fraud or scams. That matters, not because it gives us another scary number to throw into a vendor webinar and call thought leadership. It matters because it moves the conversation out of the server cupboard. Cybercrime, fraud, scams, payment manipulation, account takeover, supplier compromise, invoice redirection, ransomware and data theft all land in the same place eventually.
The business, not the firewall, not the help desk ticket, Not the little red alert in a dashboard nobody reads until Tuesday. The business. If a cyber incident stops you trading, it's business risk. If it delays payroll, it's business risk.
If it blocks orders, it's business risk. If it freezes production, it's business risk. If it leaks client data, it's business risk. If it triggers a regulator, it's business risk.
If it makes customers wonder whether you know what you're doing, it's definitely business risk. It's not Dave's little problem in IT, it's your business wearing a bucket on its head in public. And yet, too many small businesses still budget for cyber like it's a grudge purchase. They'll spend money on signage, vans, coffee machines, industry memberships.
Branded polo shirts, 27 SaaS tools that nobody admits buying, another dashboard because apparently the last six dashboards didn't have enough blue in them. But ask for proper backup testing, MFA rollout, asset inventory, vulnerability management, staff training, supplier access review, or incident planning, and suddenly everyone becomes a Victorian accountant guarding the biscuit tin. Cyber is too expensive, they say, right up until the invoice fraud lands. Then it turns out cyber was the cheap bit.
Here's the uncomfortable truth. Cybercrime now sits alongside cash flow, supplier risk, insurance, key person dependency, legal exposure, operational continuity, and customer retention. It belongs on the risk register. It belongs in board conversations.
It belongs in management meetings. It belongs in budget planning. It belongs in supplier reviews. It belongs in the grown-up part of the business, where people make decisions before the building is on fire.
For UK SMBs, this isn't about buying cybersecurity because the NCSA said something sensible. It isn't about buying cybersecurity because an MSP waved a scary graph. It isn't What about compliance theatre, where everyone claps because a spreadsheet has been updated and nobody asks whether the business can actually survive an incident. It's about growth protection.
It's about resilience. It's about not letting a scam email, a weak password, a dodgy supplier portal, or a forgotten server become the thing that derails your month, your quarter, or your year. For those listening in the United States, the same lesson lands through FTC and CESA guidance. The labels change.
The message doesn't. Scams against small businesses are not rare edge cases. They're a business model for criminals. Criminals have processes.
They have playbooks. They have supply chains. They have support desks, which is more than some legitimate software vendors can manage without opening a ticket in interpretive dance. And while criminals professionalize, too many businesses still run security like it's an optional extra.
The hot take is simple. If cyber only appears in your IT budget, your business has misunderstood the threat. A phishing email can become a payment fraud issue. A compromised account can become a legal issue.
A ransomware attack can become a cash flow issue. A supplier breach can become a customer retention issue. A stolen laptop can become a data protection issue. A fake Teams message can become a credential theft issue.
A weak remote access setup can become a full estate compromise. See the pattern. The technology is only one layer. The cost lands everywhere.
Finance feels it. Operations feels it. Sales feels it. HR feels it.
Customer service feels it, legal feels it, leadership feels it, usually about four minutes after asking why nobody told them this could happen. Which is a fascinating question from people who treat cyber risk like something IT should quietly handle between printer complaints and password resets. So what should a small business do? Start with language.
Stop asking, are we secure? It's too vague. It's the cyber equivalent of asking, are we healthy? Maybe?
Compared to what? On what day? After how much coffee? Ask better questions.
What would stop us trading? What data would cause real harm if exposed? Which accounts can approve money movement? Which systems must be restored first?
Which suppliers have access to our systems or data? Which staff can change bank details? Which devices are unsupported? Which customer commitments would we miss if email vanished for two days?
Who would make decisions in the first hour of an incident? Who can authorize emergency spend? Who speaks to customers? Who speaks to the insurer?
Who speaks to the regulator if personal data is involved? Those questions are not technical. They're leadership. And yes, your IT provider should help.
They should give evidence. They should explain risk in normal language. They should recommend controls. They should help test recovery.
They should help build resilience, that they shouldn't be the only people thinking, if you own the business, you own the risk. You can outsource tasks, you can outsource monitoring, you can outsource support, you can outsource advice, you cannot outsource accountability. That bit stays stubbornly yours, like tax, or a bad office chair, or the memory of approving a cheap system because the demo looked nice. The business risk view also changes what you buy.
You don't buy MFA because someone says MFA is good, you buy MFA because account compromise can lead to fraud, data loss, downtime and reputational damage. You don't test backups because testing backups is a nice technical discipline. You test backups because downtime costs money and hope is not a recovery strategy. You don't review supplier portals because someone has a spreadsheet fetish.
You review supplier portals because a forgotten account can become a backdoor into your business. You don't train staff because humans are stupid. You train staff because criminals attack business process, pressure, urgency, politeness and trust. And you don't create an incident plan because auditors enjoy binders.
You create one because the first hour of a crisis is a stupid time to discover nobody knows who's allowed to make decisions. Cybersecurity is not an IT hobby. It's business continuity with a login prompt. And once you see it that way, the conversation changes.
The cheapest MSP is no longer automatically attractive. The unsupported server is no longer a charming old warhorse. The shared admin password is no longer practical. The flat network is no longer simple.
The untested backup is no longer reassuring. The supplier with no MFA is no longer just how they've always done it. The staff member asking awkward questions is no longer a nuisance. They may be the person who saves you from an expensive lesson.
This is the part some leaders hate. Cyber risk forces businesses to look at how they actually operate. Who can approve money? Who can access data?
Who can install software? Who can create users? Who can ignore process because they are senior enough to be dangerous? The answer to that last one is often more people than anyone wants written down.
Write it down anyway, because criminals love unwritten process. They love assumptions. They love unclear ownership. They love businesses where everyone thinks someone else has it covered.
Someone else is not a control. Someone else is how invoices get paid to the wrong account. Someone else is how backups never get tested. Someone else is how the old user account stays active for six months.
Someone else is how a cyber incident becomes a board-level surprise. And board-level surprises are usually expensive. So here's your hot take. Cybercrime is now a cost of doing business.
Treat it like one before it treats you like lunch. Add cybercrime and fraud to the risk register. Review payment change controls with finance and senior management. Assane an incident decision owner before an incident happens.
Map the systems that stop the business trading if they're unavailable. Budget for resilience, not just tools. Ask what failure would cost. Ask who owns the decision.
Ask what happens in the first hour. Ask whether the business can survive the controls it keeps postponing. Because if cyber only lives in IT, leadership has already failed the first test. The firewall might block traffic.
It won't fix weak governance. It won't approve emergency spend. It won't call customers. It won't explain to the bank why money left the wrong account.
It won't rebuild trust. That's leadership work, and it needs to happen before the incident, not while everyone is sweating into a Teams call and pretending the word ransomware hasn't ruined the week. Cybercrime isn't Dave's problem, it's the business's problem. Dave just gets blamed first.
Reference note, the British Chambers of Commerce has reported crime, cyber attacks, fraud and scams as barriers for UK businesses. The UK Cyber Security Breaches Survey provides wider breach and attack context. US listeners can map the same principles to FTC and CISA small business scam and cyber guidance. Right, before we let you go completely, let's have a quick chat about the boring but necessary legal bits.
Don't worry, I'll make this as painless as possible. First up, and this is important, everything we've said today represents our own personal opinions and experiences. These views are ours alone and don't represent any organisation we work for, any employers, advertisers, sponsors or anyone else who might be connected to the show. When we're giving you advice or sharing our thoughts, that's coming from us as individuals, not speaking on behalf of anyone else.
Everything we've talked about today is for general guidance. It's meant to point you in the right direction, but it absolutely shouldn't be treated as professional advice tailored specifically to your business. Your situation is unique. What works brilliantly for a Birmingham bakery might be completely useless for a Manchester marketing agency.
We do our very best to keep everything accurate and current, but let's be honest here. The cyber security world moves faster than a caffeinated squirrel being chased up a tree by Marvin's Jack Russell. Things can change between when we record and when you're listening so always double check critical technical details with qualified professionals before you go making major changes to your systems if we've mentioned any websites products or services we're giving you information not necessarily giving them our seal of approval we can't be responsible for what happens on their end or if things go sideways when you use them Some things we recommend might involve affiliate partnerships.
We'll always flag those when they come up because transparency matters. Now, if you're dealing with serious cybersecurity incidents, actual data breaches, or gnarly legal compliance issues, please talk to proper professionals, rather than just relying on podcast advice. We're here to educate and help you understand the landscape, not to replace your security consultant, solicitor, or IT team. This has been a Small Business Cybersecurity Guy production.
Copyright 2025. All rights reserved.
Other episodes covering the same guests and topics, from across The B2B Podcast Index.
Aaron McCray: Ferrari Security: Speed With GuardrailsKitecast · on Multi-factor authentication (MFA)88 / 100
Stop 90% of Ransomware Attacks with Basic Cyber HygieneThe Backup Wrap-Up · on Multi-factor authentication (MFA)82 / 100
How to Talk About Cybersecurity to Clients & Prospects with Mark Lamb from HighGround.iothe RocketMSP Podcast · on Multi-factor authentication (MFA)82 / 100
Ep. 5: Food and Agriculture featuring Jonathan Braley, director of the Food and Ag-ISACThe Security Detail · on Multi-factor authentication (MFA)78 / 100
Ep 114: Top 5 Cybersecurity Best Practices with James BierlyLevelUp Cyber · on Multi-factor authentication (MFA)77 / 100
Navigating Cryptocurrency Security: Sim Swaps, Vendor Risks and Assertive MeasuresEncrypted Ambition: Where Ambition Meets Encryption · on Multi-factor authentication (MFA)77 / 100The Open Book Problem 5: Closing it with Practical Defences for Small Businesses75 / 100The Open Book Problem 1: How Your Public Records Become an Attackers' Roadmap90 / 100
The Firewall Fallacy: Fortinet, KEVs and the Cost of Complacency79 / 100Erased from the Web: The Fight Over a Child's Moment58 / 100Birthday Audit: Brutal Lessons for Small Business Cybersecurity64 / 100