Alpha it Solutions

04/09/2026

Three in four UK businesses told the government they have a firewall. About one in three has a separate Wi-Fi network for visitors.

That gap is the whole story. In most small offices the firewall is the box the broadband company posted you, somebody plugged it in on move-in day, and nobody has logged into it since.

Today's guide covers what Cyber Essentials actually asks of that box, the support end date the law now makes the manufacturer publish, and five checks you can do this week without spending anything.

One of them usually takes twenty minutes and finds a door left open for an engineer who left in 2022.

https://www.alphaitsolutions.uk/blog/small-business-firewall-router-security/

Also on Telegram: t.me/AlphaITSolutionsUK

03/09/2026

Nobody raises a purchase order to paste a supplier's remittance advice into a chatbot and ask what it actually says. They just do it, because it's quicker than reading it properly.

The government's own survey says 21% of UK businesses have adopted AI tools. That number counts the tools a business decided to buy. It doesn't count the free ChatGPT tab somebody in accounts has had open since March.

Today's guide is about the difference. What actually happens to the text (NCSC is clearer on this than most vendors), why the free account and the business account have opposite defaults on training, and the one page worth writing before somebody pastes the wrong thing.

https://www.alphaitsolutions.uk/blog/ai-tools-at-work-small-business/

Also on Telegram: t.me/AlphaITSolutionsUK

02/09/2026

How many phishing emails did your staff report last month?

If the answer is none, that's not a quiet month. It usually means there's no easy way to report one, so people delete the message and get on with their day, and nobody finds out the same email went to eleven other staff.

Phishing was the most common attack on UK businesses again last year: 88% of the businesses that had any breach at all had a phishing one. The most common reason firms gave for it being disruptive wasn't stolen money. It was staff time spent checking whether things were real.

Today's guide is about what to do instead of buying another training video. NCSC's own guidance has a section headed "the problems with phishing simulations", and it's worth reading before anyone in your business gets told off for clicking one.

https://www.alphaitsolutions.uk/blog/phishing-training-small-business/

Also on Telegram: t.me/AlphaITSolutionsUK

NCSC has a section headed the problems with phishing simulations. Why click rate is the wrong number, what to count instead, and where staff training sits.

31/08/2026

Who in your business can install software on their own laptop?

If the answer is everybody, that's normal and it isn't really anybody's fault. The first account created on a new Windows PC is an administrator, and whoever signed the company up for Microsoft 365 was made a Global Administrator of the whole tenant on the spot. Nobody decided any of it.

It matters because software runs with the rights of whoever is signed in. A bad attachment opened on a standard account can rummage through that person's own files. Opened on an admin account, it can install a service, switch off protection and reach the other machines.

Today's guide is about the fix, which is smaller than people expect. Two accounts for the same person rather than two people. It also covers the local administrator password that's usually identical on every machine in the office, and what Microsoft gives away free to sort that out.

https://www.alphaitsolutions.uk/blog/admin-rights-small-business/

Also on Telegram: t.me/AlphaITSolutionsUK

Why the account you read email with should not be the one that can change everything, how many Microsoft 365 Global Admins to keep, and what Cyber Essentials asks.

27/08/2026

Every business has the cupboard. Four laptops nobody has switched on since the Windows 10 deadline, a desktop labelled "reception, do not move", and a bare hard drive somebody pulled out of a server in 2019.

That isn't dead kit. It's live personal data sitting in your building, and you're still the one answerable for it.

Deleting the files doesn't remove them. Formatting doesn't either. And on a modern SSD, overwriting the drive doesn't reliably work the way the old advice says it does, because the controller decides where your write actually lands.

We've written up what does work, how to check a disposal firm is what it claims to be, and the second rulebook nobody reads: who legally has to pay to recycle business IT, and why a skip isn't one of your options.

https://www.alphaitsolutions.uk/blog/disposing-of-old-business-computers/

Also on Telegram: t.me/AlphaITSolutionsUK

Deleting files doesn't remove them, and a certificate of destruction proves little on its own. How to wipe old business computers, and what the law wants.

25/08/2026

Somebody hands in their notice. Everyone thinks about the handover and the leaving card. Nobody writes down the list of things they can still log into on Monday.

One detail from Microsoft's own documentation that catches most people: blocking a Microsoft 365 account can take up to 24 hours to take effect. If you want someone out now, you reset the password first, then sign them out of all sessions, then block. In that order. An access token already issued is good for about an hour on its own.

The bigger exposure is everything that isn't Microsoft: the VPN, the CRM, the website admin, the domain registrar, the subscription somebody bought on a card. And shared logins, which can't be revoked from one person at all. Changing the password for everyone is the only real revocation there.

https://www.alphaitsolutions.uk/blog/offboarding-revoking-access-when-staff-leave/

Also on Telegram: t.me/AlphaITSolutionsUK

Blocking a Microsoft 365 account can take up to 24 hours to bite. What to switch off on a leaver's last day, in what order, and where the law comes in.

24/08/2026

A spreadsheet sent to the wrong inbox counts as a data breach under UK GDPR. Same as a hacker breaking in. And once you know about it, the clock is already running: 72 hours to tell the ICO, if it's serious enough to need telling.

New on the blog: what actually counts as a reportable breach, when the 72-hour countdown really starts, and what you still have to write down even if you decide not to report.

👉 https://www.alphaitsolutions.uk/blog/data-breach-notification-72-hours/

Also on Telegram: t.me/AlphaITSolutionsUK

UK GDPR gives you 72 hours to tell the ICO about a breach that risks harm to people. What counts, what to record, and what happens if you miss it.

24/08/2026

Quick one if you use agency staff on Temporra, or through any agency at all.

The Agency Workers Regulations have been law since 2011. After 12 calendar weeks in the same role with the same hirer, an agency worker gets the same pay, hours, night work terms and annual leave as if you'd hired them directly. Simple rule. Most businesses still can't say exactly when that clock started for a given worker, though, or whether a break paused it or wiped it out.

Our new guide sets out how the 12 weeks actually count, what pauses the clock, what resets it, and what a hirer needs on file if an agency ever asks.

Also on Telegram: t.me/AlphaITSolutionsUK

👉 https://temporra.app/agency-worker-equal-treatment-12-week-rule.html

Agency workers get equal pay, hours and leave terms after 12 calendar weeks with the same hirer, in the same role. What counts, and what resets the clock.

20/08/2026

Less than half of UK businesses have two-factor authentication switched on. Microsoft's own figure is that it blocks over 99.9% of account attacks. That gap is the biggest single fix most businesses haven't made yet, and it usually costs nothing extra.

New on the blog: what counts as a proper second factor, why an app beats a text message, the "MFA fatigue" trick that got Uber breached in 2022, and the Cyber Essentials rule from April 2026 that now makes this a straight pass or fail.

Also on Telegram: t.me/AlphaITSolutionsUK

Fewer than half of UK firms have two-factor authentication on, though Microsoft says MFA blocks over 99.9% of account attacks. What to enable first, and why.

20/08/2026

A facilities firm running a pool of bank cleaners for sickness cover has never had to think hard about zero-hours contracts. That's changing.

Three new rights are on the way: guaranteed hours worked out from what someone actually did, notice of a shift, and payment if you cancel one late. None of the numbers are locked in yet, the consultation on the low-hours threshold and how far back the reference period looks closes 25 August, five days from now. But the shape of it is clear enough to start planning for.

1.2 million people in the UK work zero-hours right now. If any of yours do, our new guide covers what's confirmed, what's still open, and what's worth logging today rather than waiting for the final rules.

Also on Telegram: t.me/AlphaITSolutionsUK

The Employment Rights Act adds guaranteed hours, shift notice and cancellation pay for zero-hours staff. What changes, when, and what records you need now.