Cybersecurity assumptions that can put your business at risk
There are plenty of assumptions organisations can make about their cybersecurity – that compliance means they’re secure, that having more security tools means they’re better protected, or that a cyber insurance policy means they’re covered.
In this Cyber Reality Check video, Rob Smith, COO at CloudClevr, and Simon du Plessis, IT Practice Director at CloudClevr, unpack some of those assumptions and explore what cybersecurity looks like in practice.
They discuss why compliance and security need to be treated as distinct responsibilities, how overwhelming volumes of alerts can leave IT teams struggling to identify genuine threats, and why cybersecurity needs to be considered beyond the IT team because of its wider impact on the business.
The conversation also explores the growing challenge of Shadow AI. Rather than banning AI, organisations need to understand how people use it, what data they share, and what controls and guardrails are needed.
They also look at the importance of testing incident response plans, the changing expectations around cyber insurance, and how security testing has evolved from annual compliance exercises towards a continuous assessment.
Across all of these areas, one message comes through clearly – don’t rely on assumptions. Test what you have, understand where the gaps are and make sure you have evidence that your controls are doing what you expect them to do.
Key takeaways
Compliance is not the same as security
Compliance provides a baseline of controls and checks, while security is focused on monitoring threats in real time and addressing them before they harm the business. The two should work closely together, but they have distinct responsibilities.
More alerts don’t necessarily mean better protection
Security platforms can generate huge volumes of information. The challenge is making sure someone is actually looking at the alerts that matter and can distinguish genuine threats from the noise.
AI needs to be managed, not simply banned
The conversation highlights how employees are already using AI to improve efficiency across different parts of the organisation. The focus therefore needs to be on understanding which tools are being used, what data they have access to, and putting appropriate controls and guardrails in place.
Cybersecurity extends beyond the IT team
While IT has an important role in managing security, cyber risk has implications for the wider business. The board has responsibility for areas such as risk, resources and regulatory requirements, while employees also play an important role in maintaining security through awareness and everyday behaviour.
Incident response needs to be tested
Having a plan isn’t enough if people don’t know what to do when an incident happens. Simulating scenarios can expose practical gaps, including how people will communicate if systems such as email and Teams are unavailable.
Cyber insurance is increasingly evidence-based
Cyber insurance requirements have moved beyond simply confirming that controls exist. Insurers are increasingly asking organisations to provide evidence that controls such as MFA, device updates and other security measures are actually in place.
Security testing needs to keep pace with change
The discussion highlights how penetration testing has evolved from an annual compliance exercise towards more continuous vulnerability assessment and, in some cases, red teaming. As technology and threats change, security needs to be an ongoing process rather than something reviewed once a year.
Replace assumptions with evidence
Whether you’re looking at compliance, AI usage, incident response, cyber insurance or your security tools, the recurring question is simple: how do you know it works? Testing and evidence give you a clearer picture of where your organisation is actually protected and where assumptions may be hiding gaps.
How confident are you in your cybersecurity?
The video raises an important question: how much of your cybersecurity do you know works and how much are you simply assuming does?
Put your own assumptions to the test with our 5-minute cybersecurity maturity quiz. You’ll get a personalised report highlighting where you can be confident, where there may be gaps, and the steps you can take to strengthen your security posture.
