This month we ran an extra #InfosecLunchHour. At our October session, one of our regular attendees asked for time to talk about BT’s rescue of TalkTalk, and a lot has happened since. On 5 October 2026 BT agreed a deal worth around £400 million to buy TalkTalk’s consumer and wholesale businesses out of administration. The Government has issued a Public Interest Intervention Notice, and the Competition and Markets Authority and Ofcom are both watching the deal closely.
The room included a digital forensics specialist, a cyber security journalist, a standards auditor, a website designer and people working in content protection, third party risk management and cyber sales and marketing. As always, everything was under Chatham House Rules. The timing felt fitting too. One attendee pointed out we were meeting almost 11 years to the day since the 2015 TalkTalk breach.
Setting The Scene: Why This Deal Matters
The attendee who proposed the topic set out the concern clearly. TalkTalk held contracts well beyond home broadband. Since the telecoms market opened up, the company picked up defence contracts and critical infrastructure work supporting hospitals, GP surgeries and local police forces. The Government’s own statement on the deal says critical connections span health, emergency services, defence, education, transport, banking and government.
So how did an organisation with years of financial trouble and a poor security record keep those contracts? It would have been audited against security standards, let alone financial ones. Risks were almost certainly reported internally. Nobody raised a red flag loud enough to stop it limping on until administration and a rescue in the national interest.
That led to the question at the centre of the session. What value do our cyber security standards and certifications hold when this happens?
What Is a Certificate Worth?
The answer from the room was uncomfortable. A certification such as ISO 27001 confirms certain boxes have been ticked. How they were ticked is a different matter. As one attendee put it, two organisations hold the same certificate and work in completely different ways. One is stronger in one area, the other stronger elsewhere, and both fail in different places. Both are still certified.
Our standards auditor agreed and added the missing piece. Without buy in from the CEO, the senior leadership team and the shareholders, a certificate is not worth the paper it is written on. There are core standards every organisation should meet. Meeting them on paper while the culture ignores them helps nobody.
Our forensics specialist has used the 2015 TalkTalk breach in presentations for a decade, because the lesson never goes out of date. What happens after a breach is mainly a management problem, not an IT problem.
The People Behind the Headlines
We spent time on the human cost, which rarely makes the news. Around 900 people work in the parts of TalkTalk BT is buying. Reports say they will all transfer to BT, but several of us felt those staff have lived with insecurity for years, and will continue to until BT has reviewed the estate and decided what it keeps.
Think about the frontline teams in contact centres and complaints, handling escalations day after day for a company with a long record of poor complaint handling, mis-selling and rolling customers onto new contracts without warning. One attendee had heard from a customer whose direct debit jumped from £24 to £74, with nobody to call to get the money back.
Supporting people through difficult times at work was part of why I started #InfosecLunchHour in the first place. Employee wellbeing belongs in this conversation as much as contracts and certificates.
Politics, Bailouts and Accountability
One attendee argued there is a political game at play. Letting a large ISP fail after the financial crisis would have looked bad for the economy and for international markets. He compared it to the bank bailouts, where institutions were propped up and walked away with their brands intact. TalkTalk followed the same pattern.
Accountability came up too. The chief executive at the time of the 2015 breach went on to lead NHS Test and Trace. The same attendee contrasted this with his own work as an expert witness, where he signs a statement under oath declaring any conflicts of interest before he gives evidence. The group felt senior public appointments deserve the same scrutiny.
Another point stuck with me. People working in defence need to make the country secure and make it feel secure. When a supplier has proved unreliable over time, someone needs to ask questions of the people who awarded and managed those contracts.
Our journalist attendee raised a practical question for anyone who was a TalkTalk customer. Does your contract simply transfer to BT? Does that create a conflict with your own policies on digital sovereignty or supplier choice? He pointed to the Cyber Security and Resilience Bill, which could give government powers to restrict the use of technology deemed a threat to national security. His advice was to build supplier ownership changes into your risk posture. He used the example of Sophos buying Secureworks. If you chose a supplier for good reasons, check whether those reasons still hold after an acquisition.
Who Pays for a Breach?
One attendee asked the unpopular question. Beyond the data being disclosed, what harm did most people suffer from the 2015 breach? His point was not to dismiss the victims. He argued it is unfair to blame people for not caring enough when the ICO is low on enforcement, breaches happen constantly and most personal data is effectively public already. There is a deeper cultural problem, and blaming individuals for not complaining loudly enough ignores it.
Others pushed back with evidence of real harm. After the breach, rogue call centres phoned victims one by one, telling them a class action was coming and charging around 100 dollars to register. Thousands of people were scammed, and the calls carried on for 6 or 7 years. Criminals often sit on stolen data for years before using it. That long tail of harm rarely gets reported, by the media or by regulators.
There was a fair defence of the regulators too. Their resources are limited, and one attendee felt Ofcom is among the more active enforcers. For context, the ICO fined TalkTalk £400,000 in 2016 over the 2015 breach.
The Media Gap
One attendee described getting cyber security stories into the media as less an uphill battle and more like climbing a cliff in the rain. I agree. When stories do land, they tend to be the largest breaches, and the blame falls squarely on the victim organisation. There is little thought about the systemic issues behind the attack, or about the lack of education for organisations and individuals.
The last fortnight shows how relentless this is. ASOS has been notifying customers about a breach. TFG London, owner of Hobbs, Whistles and Phase Eight, disclosed a cyber incident on 11 October and said there was no reason to believe payment information was at risk. We also discussed reports that landed this week of French supermarkets losing stock after attackers got in through legacy refrigeration and HVAC systems. Add Marks and Spencer, the Co-op and Harrods earlier in the year, and the list keeps growing.
Commentators keep calling these attacks a wake up call for UK businesses. The room’s view was blunt.
They won’t be.
I raised something I keep thinking about. Someone close to me, who helped build the business that gave me my start in cyber, has stepped back from the industry. When I asked why, the answer was simple. They were tired of having the same conversations about the same breaches and the same vulnerabilities, year after year. If our long standing professionals reach that point and leave the industry, we lose a lot of good people.
Small Businesses Still Think They Are Too Small
A few weeks ago I got talking about cyber with the lady who washes and grooms my dog Poppy. Her first response was that she is a sole trader and nobody would bother with her. Then I asked how she takes bookings. I book Poppy in through her website. If that site disappeared, she would lose her diary and her customers could not book. She had never thought of it that way. She is exactly the kind of person I want to reach, and too often the message falls on deaf ears.
Our forensics specialist shared a case that made the point painfully. A landscaping company working with a major developer lost a quarter of a million pounds to an invoice scam. Once the insurance paid out, they stopped returning calls about the training they had asked for. They would not spend £1,000 to avoid losing another £250,000. Another attendee shared how a family member’s small business lost a lot of money after a customer stole data.
Even when small businesses want to act, where do they go? There are so many bodies, schemes and organisations that I would be confused if I did not work in this field. The group felt the answer sits with the bodies small firms already trust. Chambers of Commerce, the Federation of Small Businesses and trade bodies should offer clear guidance on what to do, without selling a product. One attendee cited the Law Society of Scotland, which issues guidance like this to its members. I would like to see something sent out by Companies House when someone registers a new business.
One attendee laid much of the blame for this on our own industry, and I agree with that assessment. By his estimate, 75 to 80 percent of the cyber security industry is vendors selling products, and most of the rest are consultants selling advice. No matter how well meaning the people inside those vendors are, the model comes down to sales. A business with a dozen staff is told it needs per device licences, a SOC and dedicated security staff. No wonder they feel lost.
When AI Gives People the Answer They Want
The final part of the session turned to AI. Our forensics specialist described a new client who sent his lawyers a brief written with ChatGPT. He had not even removed the placeholders. The brief told the lawyer and the expert witness what to do and pushed for a no case to answer submission. The client went in expecting to walk away. He now faces the real possibility of prison.
He has also been asked to train staff at a Citizens Advice service, because they keep receiving enquiries prepared with AI tools. People arrive with the answer they want and ask advisers to confirm it. These stories will never make the headlines, but they cause harm to people who have real problems and need real advice. He was clear he uses AI in his own forensic work. The difference lies in how you use it and whether you understand its limits.
I have seen a rise in people using AI to prepare benefit claims, so they look perfect on paper. I have also seen it in recruitment. In a recent round of interviews I conducted, one candidate paused for a long time after each question, then delivered slick, polished answers while their eyes flicked as if reading from another screen. I want to add a caveat here. As an autistic person I find eye contact difficult and sometimes painful, so eye movement alone proves nothing. Taken together, though, the signs were clear.
Others in the room went further. Some tools now listen to the interviewer, generate answers and display them just under the camera, so the candidate appears to look straight ahead. One attendee had seen someone in a chartership assessment wearing glasses with the answers visible in the lenses. Chartership questions are deep by design and ask for specific situations, so it was obvious the person did not understand what they were saying. These tools are advertised openly on social media. People are not inventing these tactics alone. They are being sold to them.
Ideas To Take Forward
- Push for clear, vendor neutral guidance for small businesses through Chambers of Commerce, the Federation of Small Businesses, trade bodies and Companies House at the point of registration.
- Use #InfosecLunchHour to champion awareness for small businesses and sole traders, starting with the people we deal with every day.
- Ask how controls work in practice, not only whether a certificate exists. Leadership buy in matters more than the badge.
- Add supplier ownership changes, including acquisitions and administrations, to your risk register and review your contracts when they happen.
- Encourage the media to cover the systemic causes of breaches and the harm victims face years later.
- If you interview or assess candidates, design questions that test real experience, and don’t rely on eye contact as a sign of honesty.
A Topic for Another Day
Right at the end, we touched on the honorary doctorates being advertised on LinkedIn, often for a few hundred euros and a short interview. One attendee has a list of dozens. That deserves a session of its own.
Closing Reflections
The BT rescue of TalkTalk is more than a business story. It shows what happens when certificates replace culture, when regulators lack resources and when politics keeps a struggling supplier running. Small businesses and frontline staff carry much of the cost. Meanwhile AI is creating new problems in places most of us never look, from legal advice to job interviews.
If you hold a security certification, ask yourself one question this week. Would your board and your frontline staff describe your security culture in the same way your auditor does?
Join the Next #InfosecLunchHour
The next #InfosecLunchHour takes place on Wednesday 4 November 2026 at 12.30pm GMT. If you would like to join a group of cyber and infosec professionals for some relaxed chat over lunch, please contact me via lisa@unitysolutions.org.uk to be added to the calendar invite.
#InfosecLunchHour is a free, open, community networking event hosted by Lisa Ventura MBE FCIIS. All discussions take place under Chatham House Rules: participants may use information shared in the meeting but may not attribute it to named individuals or organisations.
