entrustIT Insights | Cyber Security

Security updates and your suppliers: the questions to ask

In short: any supplier whose systems touch your business can expose you if they fall behind on security updates. That includes suppliers who look after your technology, like your website host or IT provider, and those who hold your data or connect to your network, like a payroll provider or a software vendor with remote access. Ask each one who updates what, how quickly and how they'll tell you about alerts. A good answer gives a timescale, never longer than the 14 days Cyber Essentials allows for critical updates, and much faster when a flaw is being actively exploited.

What is technical security debt?

In short: Technical security debt is the security risk a business builds up when IT fixes, upgrades and clean-ups get put off. Unpatched software, unsupported kit, old accounts and quick workarounds all add to it. Like financial debt, it gathers interest: the longer it's left, the more it costs to fix and the easier it is for attackers to exploit.

AI is finding security flaws faster: do you know what you run?

AI tools helped find the critical PHP vulnerabilities, and the NCSC says AI is making it easier to find and exploit software flaws at scale. For UK businesses, that points to one thing: less time to react to security updates. The best preparation is a clear picture of what you run and who looks after it, before the next alert lands.

Critical PHP vulnerability (PHP2Shell): what UK businesses need to do now

Last updated: 2 November 2026 Latest update, 2 November: PHP2Shell is now being used to attack firewalls, not just websites. Palo Alto Networks has confirmed attacks on PAN-OS firewalls whose management page is open to the internet, and has released fixes. In some attacks it was combined with a Linux flaw called Fragnesia to take full control of the device. If you run Palo Alto firewalls, patch PAN-OS now and make sure the management interface isn't reachable from the internet.

What is social engineering, and what stops it working on your staff?

Social engineering is when an attacker persuades a member of staff to hand over access or money by exploiting trust, fear or urgency, instead of breaking into a system. Phishing, spear phishing and AI voice cloning are all forms of it.

What is Cyber Essentials Plus, and do you need to upgrade from Cyber Essentials?

Cyber Essentials Plus covers the same five controls as Cyber Essentials. The difference is that an independent assessor tests your live systems to verify the controls actually work. This gives stronger assurance to clients, insurers and partners.

What is Cyber Essentials, and does your business need it?

Cyber Essentials is a UK government-backed certification that shows your business has the basic controls in place to defend against the most common cyber attacks.

What is a passkey, and should your business ditch passwords?

A passkey is a passwordless login that replaces your password with your device's fingerprint, face or PIN, making sign-in both simpler and far harder to hack. Instead of typing something you can forget, reuse or have stolen, you prove who you are with the device already in your hand. For businesses tired of password resets and phishing scares, that's a genuinely different way of working, and it's arriving faster than most people realise.

Cyber security isn't something you buy. It's something you run.

Most businesses are asking the wrong question about their cyber security.

EDR vs XDR vs MDR: what they actually do?

Good security isn't just about the tools you own. It's about whether anyone is actually watching them. Once you accept that, the next question is what to do about it, and that's where it gets confusing, because the answer arrives wrapped in acronyms. EDR. XDR. MDR. Three letters that sound almost identical and seem to promise the same thing.

Security updates and your suppliers: the questions to ask

In short: any supplier whose systems touch your business can expose you if they fall behind on..

What is technical security debt?

In short: Technical security debt is the security risk a business builds up when IT fixes, upgrades..

AI is finding security flaws faster: do you know what you run?

AI tools helped find the critical PHP vulnerabilities, and the NCSC says AI is making it easier to..

Critical PHP vulnerability (PHP2Shell): what UK businesses need to do now

Last updated: 2 November 2026 Latest update, 2 November: PHP2Shell is now being used to attack..

What is social engineering, and what stops it working on your staff?

Social engineering is when an attacker persuades a member of staff to hand over access or money by..

What is Cyber Essentials Plus, and do you need to upgrade from Cyber Essentials?

Cyber Essentials Plus covers the same five controls as Cyber Essentials. The difference is that an..

What is Cyber Essentials, and does your business need it?

Cyber Essentials is a UK government-backed certification that shows your business has the basic..

What is a passkey, and should your business ditch passwords?

A passkey is a passwordless login that replaces your password with your device's fingerprint, face..

Cyber security isn't something you buy. It's something you run.

Most businesses are asking the wrong question about their cyber security.

EDR vs XDR vs MDR: what they actually do?

Good security isn't just about the tools you own. It's about whether anyone is actually watching..

Security updates and your suppliers: the questions to ask

What is technical security debt?

AI is finding security flaws faster: do you know what you run?

Critical PHP vulnerability (PHP2Shell): what UK businesses need to do now

What is social engineering, and what stops it working on your staff?

What is Cyber Essentials Plus, and do you need to upgrade from Cyber Essentials?

What is Cyber Essentials, and does your business need it?

What is a passkey, and should your business ditch passwords?

Cyber security isn't something you buy. It's something you run.

EDR vs XDR vs MDR: what they actually do?

Recent Posts

Posts by tag

Security updates and your suppliers: the questions to ask

What is technical security debt?

AI is finding security flaws faster: do you know what you run?

Critical PHP vulnerability (PHP2Shell): what UK businesses need to do now

What is social engineering, and what stops it working on your staff?

What is Cyber Essentials Plus, and do you need to upgrade from Cyber Essentials?

What is Cyber Essentials, and does your business need it?

What is a passkey, and should your business ditch passwords?

Cyber security isn't something you buy. It's something you run.

EDR vs XDR vs MDR: what they actually do?

Subscribe here!

Recent Posts

Posts by tag