No creaking doors. No mysterious footsteps. Just a few things that could keep a business owner or IT leader awake at night.
Halloween and Cybersecurity Awareness Month coinciding gives us an excuse to have a little fun with cybersecurity. But behind these nightmares are recognisable pressures: busy people, growing systems and security tools that each bring another screen to check. In TIEVA’s experience, tool sprawl can leave teams struggling with both the workload and the sheer number of decisions.
These ten scenarios are designed to start a conversation, rather than a list of equally urgent jobs. Which of these cybersecurity nightmares is keeping you up at night?
An overlooked account leaves access available after the business need has ended. The challenge is finding every account when different departments buy their own software.
Start by checking a small sample of recent leavers against your main systems, including applications outside your central sign-in service. Close unnecessary access and revoke active sessions where supported; preserve business records through an agreed handover process. Use what you find to improve the leaver checklist.
The question: does returning a laptop trigger the end of access everywhere, or just in the systems IT knows about?
That is exactly why social engineering attacks can be so difficult to spot; and why asking employees to identify every convincing deception puts too much weight on individual vigilance.
Require bank detail changes to be verified through an independently established contact route, such as a number already held in your supplier records. Apply the same rule to urgent requests from senior colleagues. A telephone number supplied in the suspicious message is no help.
Make it normal for requests like these to involve additional checks. Nobody should have to choose between following the process and pleasing the boss.
An unsupported system needs a decision, even when immediate replacement is unrealistic. Its business value does not remove its security limitations.
Find out who can access it, what it connects to and how much the business depends on it. Restrict unnecessary access, examine isolation options and agree a funded replacement or migration plan. Record who owns the remaining risk while that work happens.
The question: is keeping it running an active decision with risk mitigations, or is it a decision that keeps getting overlooked?
The NCSC’s [ransomware-resistant backup guidance](https://www.ncsc.gov.uk/collection/ransomware-resistant-backups) makes an important point: being backed up, on premises or in the cloud, does not automatically make data resistant to ransomware.
Choose one important service and test recovery safely. Check how backup copies resist deletion or alteration, who can administer them and whether recovery is possible if normal business accounts are unavailable.
Record how long it takes to restore a usable service. A successful backup job is reassuring; a demonstrated recovery tells you much more.
If an account is compromised, unnecessary privileges can give an attacker more room to cause damage.
Review the most accounts with the most privileges first. Remove rights that no longer serve a purpose, separate routine work from administration and use strong authentication. Keep emergency access arrangements protected and tested.
This is also worth asking of suppliers: does an engineer need permanent, broad access, or controlled access for a specific task?
External support is part of running a business. The risk comes from access that outlasts its purpose or extends further than necessary.
Start with suppliers that can reach critical systems or sensitive information. Confirm the access owner, its scope, authentication requirements and review date. Prefer named accounts and time-limited access where practical.
You do not need to begin with a questionnaire for every supplier. Begin with account access that could have the biggest impact if misused.
A stretched team can end up spending more time managing alerts than investigating the ones that matter. Buying another detection tool may add to that problem unless the response process improves too.
Pick one important alert and trace what happens next. Who receives it? What can they do? Who covers absence or out-of-hours incidents? Test the route with an agreed simulation.
The NCSC recommends [aligning monitoring with incident response](https://www.ncsc.gov.uk/collection/10-steps/logging-and-monitoring). An alert is only useful when it leads to action.
Cloud collaboration is useful precisely because sharing is easy. Permissions still need to reflect the information involved and who needs it now.
Review external access to a small selection of sensitive locations, starting with customer, employee or financial information. Remove unnecessary links, use named recipients where appropriate and set expiry dates when suitable.
Give people a clear, convenient way to share safely. A process that makes normal work difficult invites workarounds.
The intention is productivity. The unanswered questions concern where the information goes, who can access it and what the service is allowed to do with it.
Give employees an approved route for useful AI tasks and clear examples of information they should not enter into unapproved services. Check the chosen service’s terms, settings, retention and access arrangements. If an AI tool connects to business systems, review those permissions too.
The NCSC advises [taking care with sensitive information submitted to public AI tools](https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk). Different services and configurations offer different protections; a blanket assumption is not enough.
A short rehearsal can reveal practical problems before an incident does. Bring IT, finance, operations and a senior decision-maker together. Work through a plausible scenario: a compromised email account, a fraudulent payment request or an unavailable order system.
Who makes decisions? How do you contact each other without normal email? Who can authorise external help? Where are the essential contact details?
Keep a securely accessible copy of the plan outside the systems it depends on. Give the gaps you discover an owner and a date to address them.
