Today’s #InfosecLunchHour didn’t go to plan. Minutes before we started, I was pulled into urgent work calls. I joined long enough to say hello and apologise, then had to hand the session over and leave. The lunch hour carried on without me and having read through the transcript, I’m glad they did. The conversation was honest, a little ranty in places and full of practical sense.

A Very Special Thank You to Group Member James Bore

James Bore stepped in as host with about 5 minutes’ notice. He opened the room, let people in from the lobby, picked a topic and kept the discussion moving for the full hour. He did all of this with good humour and no preparation time.

James, thank you. You turned a session I thought I’d have to cancel into one of the best discussions we’ve had this year. I owe you more than a coffee.

Setting the Scene

There was no shortage of topics. The attacks on supermarket refrigeration systems in France last month were still in the news. The NCSC had published its latest report the day before. Pylons and blood banks were also on the list.

The group noticed these stories all pointed to the same question. Why are we still getting the fundamentals wrong, when we’ve known how to fix them for decades?

How Does a Fridge Become a Heater?

One attendee, less technical than most in the room, asked how a fridge freezer gets hacked on such a large scale. The answer was simpler than you’d expect.

Say you run 500 fridges across your business. Managing them all from one control room saves money and energy, so you put them online. If nobody changes the default password, an attacker logs in, finds the defrost mode, switches it on and leaves it running. Your fridge is now a heater.

Physical security doesn’t work like this. If you forget to secure a fence, someone has to travel to your site and target you. Once a device sits on the internet, distance stops protecting you. Anyone, anywhere, can find it.

The group also pushed back on blaming the people who set these systems up. Security professionals see these risks as obvious because we work with them every day. A mechanic thinks the same about checking your oil. Most people outside our field were never taught, and teaching them was largely our job.

Everybody, Somebody, Anybody and Nobody

Someone shared the old poem about Everybody, Somebody, Anybody and Nobody, where a job everybody assumed somebody would do ends up done by nobody. It summed up the session.

Responsibility gets lost at every stage of the supply chain:

• Vendors ship products with weak defaults. One attendee once found in car Wi-Fi routers, sold to emergency services, leaking live GPS data without any login. The buyers assumed the vendor had secured them.
• Problems go deeper than software. Chips arrive with debug modes left switched on.
• Installers are refrigeration, CCTV or lift engineers, not cyber security specialists. Nobody defines who secures the setup or who checks it afterwards.
• Maintenance contracts change hands. A small store might buy fridges 10 years ago, then hire a new firm who only fixes the motors and never thinks about connectivity.
• When one vendor stopped supporting a product, it told customers to turn off the Wi-Fi. Many of the people managing those contracts never got the message, or never knew the Wi-Fi was on.

The Capability Gap

A figure of roughly 80,000 cyber security professionals in the UK came up in the session. Set against millions of UK businesses, most organisations will never employ one. Please verify this figure from a primary source before quoting it.

One attendee works in security education for a large insurer with its own threat intelligence team. Until her role was created 2 years ago, cyber security had no visible face inside the company. Staff didn’t know who ran it.

If a large insurer struggles with visibility, a 2 store franchise has no chance without outside help. The group agreed we don’t do enough to get security information to people who sit outside our industry.

Nationally Significant, Publicly Invisible

The NCSC report prompted a sharp question. If an incident is nationally significant, why don’t we know what most of them were?

The group agreed many of these incidents are reported to the authorities but not disclosed publicly. There might be good reasons for this in some cases. The cost is other organisations stay unaware of threats heading their way.

Know Your Information Before You Buy the Tools

A retired information assurance consultant brought the discussion back to first principles. Before any technology, you need a register of all your information, wherever it lives.

Every piece of information needs 1 named owner. Two owners leads to disaster. The owner decides who creates, changes, deletes or sees the data. When staff download data to their own machines to work on, you lose control of it unless you know it has happened.

Cloud services add layers you don’t see. Your provider rents space in a data centre. The data centre outsources physical security and cleaning. Your system runs in a virtual environment alongside others. Your internet link sits outside everyone’s control unless you encrypt it. A true risk analysis has to map what you control, what you’ve outsourced with policy and what nobody controls.

The same attendee warned about decisions made on golf courses, where a senior leader hears about a product from a friend and buys it without asking the people who understand the risk.

Misconfiguration at Scale

Another attendee, who works in data governance, added the second half of the problem. Classifying data matters, and so does checking how systems are configured.

A large enterprise might run 3,000 to 5,000 SharePoint sites. Configuration gets delegated, people set things up for convenience and nobody reviews them. AI tools now find these gaps quickly, including open SharePoint sites nobody knew existed.

Cyber Essentials and OT

A Cyber Essentials assessor joined for the first time. He expects the scheme to give OT more attention next year. Another view in the room was OT security would likely sit in a separate framework, because OT needs conflict with what Cyber Essentials prescribes. Those discussions are ongoing.

One attendee shared a recent Cyber Essentials Plus experience. Mac and Linux workstations ran the same modern anti-malware product. The Macs passed. The Linux machine failed, because the certification body wanted application allow listing instead. The assessor agreed with the organisation, but the decision stood. To the group, this felt about 15 years out of date.

Basics or Fundamentals?

One attendee objected to the word basics. Calling something basic suggests one small task someone skipped. In reality there are thousands of small tasks, and missing any one of them creates a gap.

The building trade offers a better model. Every brick, every batch of cement and every fixing has to meet a specification. IT doesn’t hold every router, device and connection to the same standard. Some in the room prefer the word fundamentals.

A computer security paper published in 1970 already covered the controls we still struggle to put in place today.

Profit, Paperwork and Pushing Risk Down the Chain

The most passionate contribution of the day came here. OT was built to last 30 to 50 years and run by specialist engineers. Modern business wants products replaced more often, because replacement makes money.

These systems bring water, power and gas to our homes. Regulation and compliance exist because, without them, few organisations would invest in security. Large firms now use legal and assurance paperwork to push risk down to distributors and installers with far smaller budgets and far less ability to absorb a hit.

Another attendee with 30 years on the sales side shared a story of a business spending £30,000 for a seat at a round table, then doing nothing with it, while security teams fight over small budgets. He had also spotted exposed refrigeration systems across Europe and some in the UK weeks before the story reached mainstream news.

Security Protects People From People

The group returned to a simple idea. Security protects people from other people. Technology sits in the middle.

The phrase security enabling business came under fire. Too often it now means moving liability somewhere else so the business can accept more risk for more profit. Security enables business by stopping harm, to staff, to customers and to the public.

Speak the Language of the Bottom Line

Two stories from past audit work landed well.

In the first, a bank manager was told a change would be expensive. He pressed a function key, watched something happen and decided the work must be simple. Nobody had explained the code behind the key. When we hide complexity behind a button, leaders lose sight of the effort involved.

In the second, an IT team relied on 2 people working huge amounts of overtime. If either had left, the business would have been in serious trouble. The IT manager’s budget request had been cut. His request listed what he needed but never said what would happen to the bottom line without it.

The lesson: if a budget line doesn’t show business impact, expect it to be cut. Good commercial people help with this. They know how to frame a request so finance listens. The group also noted companies pay senior sales staff well while underpaying security staff.

AI Will Raise the Stakes

Concerns about AI came from two directions. Managers might buy an impressive AI system and remove the 1 person who understood how things worked. Attackers might feed poisoned data into AI tools to steer them towards false problems and away from real ones.

AI agents also find exposed systems on the internet faster than any human. Every gap left open gets found sooner.

Ideas To Take Forward

• Name an owner for the security of every connected device, from purchase to disposal.
• Change default passwords and turn off remote access you don’t need before a device goes live.
• Ask suppliers and installers in writing who configures security and who checks it afterwards.
• Build an information register with 1 owner for each set of data.
• Review configuration regularly, starting with collaboration platforms such as SharePoint.
• Write every security budget request in terms of business impact.
• Share lessons from incidents, even anonymously, so others are warned.

Closing Reflections

This week, pick 1 connected device in your organisation and find out who owns its security. If nobody knows, you’ve found your first job.

Join the Next #InfosecLunchHour

Our next session takes place on Wednesday 2 December 2026 at 12.30pm GMT on Zoom. I’ll also host a Christmas special on Wednesday 16 December 2026, and I’ll share details nearer the time.

To join, email lisa@unitysolutions.org.uk or message me and I’ll add you to the calendar invite.

#InfosecLunchHour is a free networking session held under the Chatham House Rule and hosted by Lisa Ventura MBE FCIIS.