The Rybec Group

13/10/2026

I’ve worked directly with cyber crime offenders. Now I’d like to help local businesses avoid becoming their victims.

Hi everyone, Chris here from The Rybec Group

Before moving into cyber security, I was a police constable, and part of my work involved dealing directly with people who had committed cyber crime.

That experience gave me a different perspective on how cyber crime works and why people and businesses can find themselves caught out.

And one thing I’ve learned is that cyber security doesn’t always have to be complicated.

Sometimes it’s about recognising a suspicious email, questioning an unexpected request or simply knowing what to do when something doesn’t feel right.

That’s why I’d like to personally invite local business owners to a FREE cyber security workshop I’m delivering in Hull on Thursday 5 November.

I’m not planning to spend the morning bombarding you with technical jargon or trying to frighten you with horror stories.

Instead, we’ll have a practical conversation about:

* How cyber criminals target small businesses.
* The tricks they use to deceive people.
* Warning signs that are easy to miss.
* Simple steps you can take to better protect your business.
* What to do if you think something isn’t right.

I’ll be drawing on my experience in policing and cyber security, and there’ll be plenty of opportunities to ask questions.

And please don’t worry if you’re not particularly technical. You don’t need to be!

Whether you run a business on your own, employ a few people or manage a growing team, I’d like you to come away with some useful knowledge and practical ideas you can put into action.

Here are the details:

FREE Cyber Security for Business Workshop

Thursday 5 November 2026
9.00am – 12.00pm
Bespoke Centre, Hull

Hosted by Hull City Council’s HCC Managed Workspace Centres.

I’d genuinely love to see some local business owners there.

If cyber security is something you’ve been meaning to get your head around, this is a chance to come along, ask questions and get some straightforward advice.

No jargon. No scare stories. No sales pitch.

Just practical cyber security advice from someone who’s worked on both the policing and business sides of the subject.

And if you know someone running a business in Hull or the surrounding area who might find this useful, please feel free to share this invitation with them.

Hope to see you there!

Chris

The Rybec Group

13/10/2026

“Everyone completed the annual cyber security training.”

Good.

Now ask the more useful question:

What happens when somebody receives a suspicious message tomorrow morning?

Training should help staff deal with the things they actually see:

Invoices.
Delivery notifications.
Password resets.
Changes to payment details.
Messages claiming to be from senior staff.
And spotting something suspicious is only half of the process.

Staff also need an easy way to report it and somebody needs to monitor and act on those reports.

A training register can show who attended.

A working security control needs to function when something actually happens.

12/10/2026

October is Cyber Security Awareness Month. Today's tip:

Protect your business email.

If someone gets into your business email, they could use it to reset the passwords on your other accounts.

That makes its sign-in worth ten minutes of your time this week.

Open your email account's security settings and set up a passkey if it's offered. A passkey lets you sign in using your device, for example with your fingerprint, face or PIN.

Then ask whoever manages your email to enable passkeys for staff accounts too. Either way, any password left on an account should be strong and unique, with multi-factor authentication (MFA) switched on.

The NCSC recommends passkeys wherever they're available because they are resistant to phishing.

Check with your IT provider if you're not sure what your email supports.

08/10/2026

Not every SME that asks us about pe*******on testing actually needs a pe*******on test.

That is why we start with the scope.

What are you trying to test?

Has a customer specified a requirement?

Which systems matter?

What evidence needs to come back at the end?

We help define what the testing needs to achieve, bring in a trusted specialist partner where a pe*******on test is appropriate, and help you work through the findings afterwards.

And if a vulnerability scan is enough for what you are trying to achieve, we will say so.

Buying the more expensive test simply because it sounds more thorough is an easy way to waste security budget.

If you want to talk through the scope before anything is booked, email

[email protected].

07/10/2026

As part of Cyber Security Awareness Month, here’s one simple rule that can help protect your business from payment fraud.

New bank details? Call a number you already have.

A regular supplier emails to say their bank details have changed. They ask you to update them before the next payment run.

Before you change anything, call the supplier on a number you already have, such as one from an old invoice or your contacts. Don't use the number in the email. Make this the rule for every bank-details change, however urgent the request sounds.

Emails can be faked, and real email accounts can be taken over. A call to a number you already trust is a separate check, which makes this kind of fraud much harder. Share this with the person who handles your payments.

06/10/2026

A vulnerability scan and a pe*******on test are not interchangeable.

A vulnerability scan uses automated checks to identify potential weaknesses and known issues.

A pe*******on test involves skilled testers actively trying to breach agreed parts of a system using attacker-like techniques.

Both have a place.

But if a contract or customer requirement says “pe*******on test”, do not assume that sending them a vulnerability scan report will satisfy it.

Before buying anything, ask:

What evidence do you expect to receive at the end?

The answer will usually tell you what type of testing you actually need.

And it can stop you paying for the wrong job.

02/10/2026

October is Cyber Security Awareness Month.

For us, this month is an opportunity to focus on something that matters all year round, helping businesses build better cyber security habits.

Cyber security does not have to mean complicated technology, endless jargon or scare stories.

For many SMEs, a strong starting point is getting the fundamentals right:

* protecting accounts and access
* keeping devices and software updated
* backing up important information
* helping employees recognise suspicious activity
* understanding what to do if something goes wrong

Throughout October, we’ll be sharing practical cyber security guidance designed to help SMEs understand the risks and take sensible, achievable steps to reduce them.

No fear-based messaging.
No unnecessary jargon.
Just practical cyber security advice for real businesses.

People aware. Businesses safer.

01/10/2026

The certificate is the outcome.

The management system is the work.

If a customer or tender has asked for ISO 27001, the job is to build an Information Security Management System that actually operates inside the business.

That means establishing the system, putting the required processes into practice, maintaining evidence and carrying out internal audit.

We help organisations with that implementation and ongoing management work.
For UKAS-accredited certification, the independent certification body carries out the certification process and issues the certificate, not us.

Rybec is currently listed on the ISOQAR Associate Network, and we also work with other appropriate certification bodies where required.

If ISO 27001 has appeared in a customer requirement and you are trying to work out what is actually involved, email [email protected].

www.rybec.co.uk

We’ll talk you through it.

29/09/2026

Your ISO 27001 Information Security Management System (ISMS) should describe the business you run now, not the one you ran last year.

Think about what has changed recently.

A new supplier portal.

A different file-sharing platform.

A cloud service somebody introduced to solve a problem.

A new application that is now holding company or customer information.

If those changes never reach the asset inventory, risk assessment or relevant ISMS processes, the documentation gradually stops matching reality.

This does not necessarily mean rebuilding the ISMS.

It means building a simple habit into the business:

When a new system holds, processes or transmits important information, make sure somebody names it, owns it and considers the risk.

A useful check for your next review:

What was the last new system your business introduced and does your ISMS know about it?

www.rybec.co.uk

25/09/2026

Good morning!

We’ve updated the Rybec website with more useful information for businesses.

www.rybec.co.uk

Have you ever been asked for IASME Cyber Essentials, Cyber Essentials Plus or UKAS accredited ISO 27001 and thought.

“What actually is that?”

We’ve added some straightforward guidance to help explain what these terms mean, why businesses may be asked about them, and where to start.

No unnecessary jargon. Just practical information to help make things a little clearer.

Please feel free to have a look around the new website and see what you think.

And a big thank you to it'seeze websites Hull for helping us with the update and getting everything looking the way it should.

Cyber Essentials, ISO 27001 and supply chain compliance for growing UK businesses. Expert guidance from former cybercrime specialists. Book a free chat.