Resources
Insights.
Thinking, briefings and lessons learned from the people who've stood on the front line.
Building a threat assessment that actually drives decisions
Most threat assessments end up as background documents. The useful ones change where money is spent — and where it isn't.
Why most business continuity plans fail under pressure
The plan is rarely the problem. The problem is the gap between the document and the organisation's ability to operate it.
Supply chain resilience: five lessons from a disruptive 2025
From Red Sea disruption to concentrated cloud outages, last year was an unusually clean test of how resilient your suppliers really are. The results were not flattering.
Mental Health First Aid: the quiet layer in your incident response
The first 72 hours after a serious incident are a welfare problem as much as an operational one. Most response plans don't reflect that.
Hostile reconnaissance: what to train your frontline to spot
Attackers almost always look first. The single highest-leverage investment in protective security is often the one that costs the least.
The anatomy of a crisis response team that actually performs
Most crisis teams fail in the first ninety minutes — not because the plan is wrong, but because the team has never been built to operate as one.
Operational resilience: what 'beyond March 2025' actually looks like
The FCA's transitional period has closed. The interesting question now isn't whether you're compliant — it's whether the framework you built is doing any real work.
Tabletop or live simulation? Choosing the right crisis exercise format
Tabletops, functional drills and full-scale simulations each pressure-test different muscles. Picking the wrong one wastes the rarest resource your leadership team has — time.
Martyn's Law: what the Terrorism (Protection of Premises) Act actually asks of you
A plain-English breakdown of the new statutory duties, the Standard and Enhanced tiers, and where most organisations are underestimating the work.