A real-world look at today’s threats

The session kicked off with Craig Atkins, who introduced the webinar and shared why our partnership with cybersecurity specialists DigitalXRAID has become so valuable to the businesses we support. He then handed over to Callum Bryant, DigitalXRAID’s Director of Security Testing & Innovation, someone who quite literally spends his days trying to break into organisations (ethically!) so attackers can’t.

Callum brought an energetic, no‑nonsense walkthrough of what his team is seeing: the techniques attackers use, the mistakes companies unknowingly make, and the simple fixes that can make a huge difference.

So how are attackers actually getting in?

Callum broke it down into the four entry points his team encounters again and again, and some of the stats were really eye‑opening:

1. Phishing happens fast
We’ve all heard about phishing, but the speed at which it works is staggering. The median time between someone opening a phishing email and clicking a malicious link is just 21 seconds. It only takes one moment of distraction for an attacker to get in.

2. Stolen passwords are shockingly cheap
Credentials now account for around a quarter of all breaches, and most of the time attackers don’t bother cracking them, they simply buy them. Working login details can cost less than the price of a coffee on the dark web, largely because people reuse the same passwords at work and at home.

3. Unpatched systems are an open door
Every business uses software, and every piece of software has vulnerabilities. While vendors release patches to fix them, attackers actively scan for organisations that haven’t applied those updates yet. Many known vulnerabilities stay unpatched for weeks, giving attackers a huge window of opportunity.

4. Ransomware is still everywhere
Ransomware continues to dominate the threat landscape. Once attackers get inside, they can encrypt data, take systems offline, and demand a ransom, often causing significant disruption long before recovery even begins.

The biggest risk isn’t technology, it’s people

One of Callum’s strongest messages was that this isn’t a deeply technical problem. In fact, most breaches come down to human behaviour: clicking a link, reusing a password, ignoring a software update. As he put it, this topic is relevant to everyone, not just technical teams.

What businesses can do immediately

The good news? You don’t need a huge security budget to dramatically reduce your risk. The webinar highlighted several practical steps any organisation can start with:

• Give employees regular training to help them recognise threats.

• Enforce strong, unique passwords and multi‑factor authentication.

• Patch high‑risk systems quickly and consistently.

• Back up critical data and test recovery processes.

• Use penetration testing to get clear, actionable insights before attackers do.

Ready to see where hackers can break into your systems?

Book a quick call with our team to explore whether penetration testing or vulnerability scanning is right for your business.