A cyber action plan

A question many boards and business owners are asking themselves during Black October is which security standard they should now be working to. Attackers are moving from a newly disclosed flaw to millions of attempts within hours, and firms want to know whether the certificates they hold, or are working towards, prepare them for that.

Any answer has to start with how few UK businesses work to a recognised standard at all. According to the government's Cyber Security Breaches Survey, published in April, 5% of businesses hold Cyber Essentials, the government-backed baseline, while 24% say they have its technical controls in place. Many firms believe they're covered without ever having had that belief tested. Only a quarter have a formal incident response plan, and of the 31% using or considering AI, only about a quarter have any security practices for it. The fieldwork ran from August to December 2025, before the current generation of frontier models and well before Black October.

The standards on offer were also designed for slower attacks. Cyber Essentials is the natural starting point for most UK firms: it's cheap, and insurers and government buyers ask for it. Its patching rule gives firms 14 days to install critical and high-risk updates. PHP2Shell was being exploited before there was anything to install, so a firm that patched on day 13 would have met the standard while being exposed for the whole period that mattered.

The current requirements, version 3.3, also leave out two things this year's attacks have depended on. They describe backing up data as "not a technical requirement". And they never mention API keys, access tokens, service accounts or any other credential that machines use to authenticate to each other; the access control section is about people logging in.

Where Cyber Essentials falls short

Six gaps between the UK's baseline standard and the attacks seen this year.

• Patching in weeks, attacks in hours

  14 days

  Critical updates can wait two weeks. PHP2Shell was being exploited four days before a fix existed, and millions of attempts followed within hours of it.

• Machine credentials

  Not covered

  Nothing on API keys, access tokens or service accounts, credentials that are leaking in record numbers and are rarely replaced.

• Backups

  Not required

  Backing up data is described as "not a technical requirement", so a certified firm may have nothing clean to restore from.

• Detection and response

  Not covered

  All five controls aim to keep attackers out. None requires a firm to watch for an intrusion, plan how to contain it or prove it can recover.

• AI assistants and agents

  Not covered

  Nothing on what AI tools can read, which systems they connect to or what they are allowed to do on a user's behalf.

• Proof that controls work

  Self-assessed

  The basic certificate rests on a questionnaire. Only Cyber Essentials Plus has an assessor test the controls.

Machine credentials are leaking faster than ever. GitGuardian's annual count of secrets exposed on public GitHub, which recorded its largest yearly rise in 2025, found that leaked credentials for AI services rose 81% in 2025, and that 64% of secrets confirmed as valid in 2022 were still valid in January 2026, so most leaked keys are never replaced. Flaws like PHP2Shell can expose the keys held on a server, and patching does nothing about keys that have already been copied.

The other frameworks UK firms turn to cover more ground than Cyber Essentials, but none of them deals with how quickly attacks now move. The table below is our assessment of the main options.

Standard	Effort	Fit with current threats
Cyber Essentials and Cyber Essentials Plus	Low, a few weeks	Low: nothing on machine credentials, detection or recovery; Plus adds testing by an assessor
ISO 27001	High, typically six to twelve months	Moderate: broad risk management, but no response-time targets and little on AI agents
SOC 2 Type 2	High	Moderate: proves controls run over time, but firms set much of the scope
NCSC Cyber Assessment Framework	High	Moderate to good: outcome-based and covers recovery, but heavy for smaller firms

Meanwhile the threat has changed. Verizon's 2026 Data Breach Investigations Report found that exploiting a software flaw has overtaken stolen credentials as the most common way into an organisation for the first time in the report's 19 years, and that the median time to fix a flaw known to be under active exploitation was 43 days. For most firms a breach is likely, and the speed of their response will largely decide what it costs.

Firms that don't yet hold Cyber Essentials should still get it, as a minimum. ISO 27001 takes the best part of a year and won't help with anything that happens this quarter. Firms also need a short set of controls built for the attacks happening now, which is why we've written the AI Cyber Action Plan.

The AI Cyber Action Plan

The plan has ten steps. The first five make a breach less likely. The second five assume one will happen anyway, and focus on finding it within the hour, limiting the damage, cutting off the attacker's access and keeping the business running. Recovery gets equal weight because some attacks can't be reliably prevented, including flaws exploited before a patch exists and malicious updates delivered through a trusted supplier. We'll tighten its time limits as attacks speed up.

Prevent	What it means	Start this month
1. Prove who's human	Phishing-resistant sign-in for anyone with real power: admins, finance staff and developers who can publish code	Move those accounts to passkeys or hardware keys, and block older sign-in methods
2. No permanent keys	Every API key, token and service account has a named owner and expires within 90 days at most. Wherever a platform allows it, credentials are issued automatically when needed and expire within hours	Build a register of machine credentials, and move build pipelines and cloud workloads to the short-lived credentials that cloud platforms and secrets managers such as HashiCorp Vault can issue
3. Shield and remove what's exposed	Public apps sit behind a web application firewall, anything that doesn't need to be online is taken offline, and flaws under active exploitation are fixed within 72 hours	Configure servers to accept traffic only through the firewall; run an external scan and remove anything you don't recognise
4. Trust nothing new by default	New software versions wait seven days unless they're security fixes, and every release needs a second person to approve it	Turn on the waiting-period setting in your dependency tools, and pin build components to fixed versions
5. Prove the agent and its session	Once an AI agent has processed external content such as email or web pages, it can no longer send, pay or change systems without approval	List every AI assistant and agent with its connections and permissions, and remove write access from any that read untrusted content

Most organisations won't have considered step five, because the risk it addresses barely existed two years ago. People tend to think of an agent as a fixed thing with a name and a set of permissions. In practice, what an agent does depends on everything that has entered its session: the instructions, documents, emails and web pages it has read along the way. A single hostile email can turn a well-behaved agent into one working for someone else, without its identity or permissions changing at all.

This week's announcements show how much of the problem is still open. Axios reports that banks are struggling to tell whether an agent acting in a customer's account is doing what the customer asked. Anthropic's new Claude Duet asks a person to approve sending, paying, signing and deleting, Walmart is giving shopping agents their own profiles with purchase approvals and spending limits, and 1Password now lets agents sign in without ever seeing the password. Each of these deals with who the agent is, what it holds or which actions need a person. None checks what the agent has read before it acts. Tying an agent's permissions to the contents of its session is technically demanding with today's tools, and it's a problem we're keen to help clients work through.

Recover	What it means	Start this month
6. Know within the hour	Within 60 minutes, you can say whether any given software is running anywhere across servers, laptops and AI tools, and someone is monitoring around the clock	Build one searchable software inventory, and check that monitoring covers identity and cloud as well as devices
7. Contain the damage	Your monitoring provider is authorised in advance to isolate devices, disable accounts and revoke sessions without waiting for sign-off	Sign that authority, test the out-of-hours contact list, and set hard spending caps on AI accounts
8. Rotate and rebuild	Every secret a compromised system could read is replaced within four hours, and affected machines are rebuilt from clean images	Write a one-page rotation guide for each type of credential, using the register from step two
9. Restore the business and its data	Attackers can't alter or delete the backups, which sit behind separate logins, and restored data is checked against a copy known to be clean	Move backups to storage that can't be changed once written, and time a full restore of one critical system
10. Outlast your providers	The business keeps running if a cloud region, identity provider, security vendor or AI provider fails or is compromised	Map which providers each critical service depends on, and set up emergency access that doesn't rely on your main identity provider

Step ten covers a risk most supplier questionnaires miss: the failure of a provider that large parts of the business depend on. The faulty CrowdStrike update of July 2024 crashed about 8.5 million Windows devices, and Black October has shown the hostile version of the same risk, with attacks arriving through trusted software and platforms.

Takeaways: Most UK businesses don't work to any recognised cyber standard, and the most widely used one, Cyber Essentials, was written for attacks that unfold over weeks rather than hours. Firms should still get it as a baseline, but it isn't a plan. The AI Cyber Action Plan sets out ten steps, split evenly between preventing a breach and recovering from one, with time limits measured in hours rather than weeks.