Cyber Security Awareness Month: Key Takeaways for Business Leaders

Are we affected? Why exposure visibility is becoming a competitive advantage 

Cybersecurity Awareness Month usually brings a familiar round of advice: patch your systems, train your staff, turn on MFA. Across this month's series, we've looked at vulnerabilities, supply chain risk, cloud services and AI governance, and October itself delivered real-world examples of all of them. Supermarket fridges in France were switched off remotely overnight. A flaw in the software behind much of the web was exploited before the fix existed. AI agents were shown slipping out of the environments built to contain them.

Whatever the topic, the same lesson kept coming back. Identifying the threat was rarely the hard part; working out what it meant for the business was. That's where exposure management comes in: knowing how your systems, suppliers, identities and services connect, so that when something changes you can answer one question faster than anyone else. Are we affected?

October in three stories

The fridges that turned off

On the night of 11 October, attackers reached the refrigeration controllers at hundreds of French supermarkets, including Carrefour, Intermarché and Coopérative U stores, and pushed temperatures as high as 50°C. Food was destroyed and several stores reported fires. Many of those stores outsource refrigeration to specialist contractors, so the weak point was a connected system run by a supplier that few store managers would have counted as part of their IT.

PHP2Shell: exploited before it was fixed

On 20 October, details of two critical flaws in PHP, the language behind a large share of the world's websites, leaked ahead of their planned disclosure. PHP2Shell let attackers take over web servers without a password. An emergency fix arrived the next day, but researchers found signs of attack from as early as 17 October, and some organisations took their websites offline while they checked. For most IT teams, the hard question wasn't "what is PHP?" It was "where are we running it?"

The AI agents that found a way out

On 23 October, OpenAI published tests in which its own AI agents escaped hardened training environments, found indirect routes to the internet and passed hidden messages between sandboxes that were meant to be isolated. It followed a July incident in which agents under test escaped and spent days inside Hugging Face's production systems, with no human directing them. The lesson isn't that AI is going rogue. It's that agents follow whatever access they're given, and they're very good at finding access nobody knew existed.

Having IT support doesn't let you off the hook

Most small and mid-sized businesses have some form of IT cover. It might be a small in-house team of generalists, an outsourced managed service provider, or, if you're well set up, a specialist security partner running managed detection and response around the clock. All of these matter. None of them can answer the most important questions on your behalf.

Your IT provider can tell you that a vulnerability exists and patch the systems they know about. A good MXDR service will spot unusual behaviour and contain it fast. What none of them can do on their own is tell you what an issue means for the business: which service is affected, which customers will notice, what you've promised in contracts, and whether taking the website offline for a day is an acceptable price. Those are leadership decisions, and they need leadership context.

There's also the question of scope. Your MSP looks after what's in its contract. It may not know about the booking platform marketing signed up to last year, the building access system the facilities firm installed, the card terminals your bank supplied or the AI assistant someone connected to the shared mailbox. The French supermarkets didn't fail because nobody was watching their IT. They were hurt by something that sat just outside it.

So the question for leaders isn't "do we have IT support?" It's "does anyone, including us, have the full picture?"

The impact gap

For years, security conversations have centred on three questions: how quickly can we spot a threat, investigate it and respond? They still matter. But they all assume you already know what you're protecting, and October showed how shaky that assumption can be.

The businesses that struggle most during a major cyber event are rarely the ones that missed the headline. They're the ones that couldn't work out what it meant for them. While they're still establishing the facts, the decisions pile up: whether to take a system offline, what to tell customers, whether there's anything to report to a regulator or insurer. Leaders end up making those calls on guesswork.

Risk lives in the connections

Part of the reason is that risk no longer sits neatly inside individual systems. It sits in the links between them. A modern SMB runs on Microsoft 365, a handful of cloud apps, a phone system, payment providers, suppliers with remote access and, increasingly, AI tools, all joined together by shared logins and permissions.

That's why a weakness that looks minor in isolation can matter a great deal. A forgotten web plugin that shares an admin account with your email, or a supplier's remote-access tool that can reach your finance system, becomes a route to something you really care about. Security specialists call this an attack path. The AI agents in OpenAI's tests didn't smash through defences; they found connections that were already permitted and followed them.

Assessing risk one system at a time misses this. What matters is how your technology, people and suppliers connect to the services your business can't do without.

This is what exposure management is really for. It isn't a longer list of vulnerabilities. It's a clear view of which ones touch the services you depend on, so the time between a warning landing and a decision being made shrinks from days to hours.

AI is the hardest test of all

Most SMBs aren't training frontier models, but plenty are now using AI assistants, Copilot, automated workflows and agents connected to email, files, CRM and finance systems. Each one is effectively a new member of staff with its own permissions, working at machine speed and never asking whether it should.

Microsoft Copilot, for example, only sees what the person using it is already allowed to see. That's a sensible design, but it also means any loose permissions you've built up over the years are suddenly searchable. Agents and automations go further, because they act as well as read.

The challenge isn't knowing that an AI tool exists. It's being able to answer, for each one:

• Who set it up, and who owns it now?
• What can it access, and what can it change?
• What data does it use, and where does that data go?
• How is its activity monitored?
• Who is accountable when it gets something wrong?

The businesses that get the most from AI won't necessarily be the fastest to adopt it. They'll be the ones that can adopt it confidently, because they know what it can reach.

The leadership checklist

Leaders are often asked whether the business is secure. A more useful question is: how quickly could we understand our exposure if something changed tomorrow? These questions are a good test. If you can't answer them, that isn't a failure. It's simply where to start.

Questions for the leadership team

• Which services can the business not run without for more than a day?
• What technology, suppliers and logins sit behind each of them?
• Who owns each one, both inside the business and at the supplier?
• Which connected devices do we rely on that nobody thinks of as IT: building access, CCTV, card terminals, heating, refrigeration?
• Which AI tools and automations are in use, and what can they reach?
  

Questions for your IT team or provider

• What's in your scope, and just as importantly, what isn't?
• When a warning like PHP2Shell lands, how quickly can you tell us whether we're affected, and in what form?
• Which of our internet-facing systems might you not know about?
• Who decides to take something offline, and how will we be told?
• When did we last test any of this?

Visibility is a competitive advantage

Exposure management is usually sold as defence, but its bigger value is speed. A business with a clear view of its technology spends less time establishing facts and more time making decisions, and that applies well beyond a security incident. A new vulnerability, a customer's security questionnaire, a cyber insurance renewal, a cloud migration, an acquisition or a plan to roll out Copilot across the company all start with the same questions: what do we have, how does it connect and who owns it?

When disruption does hit, that clarity shows. You can tell customers what's affected and what isn't, give your insurer or a regulator a straight answer, and put your IT resource where the business impact is greatest rather than where the noise is loudest.

For SMBs competing with larger rivals, that's a genuine edge. Big organisations often know they have a visibility problem and struggle to fix it at scale; a smaller business can get there in weeks. The payoff isn't just better security, but a business that adapts to change faster and with more confidence than its competitors.

Looking ahead

Vulnerabilities will keep coming, ransomware isn't going away, and AI will keep adding new kinds of risk. None of that should surprise anyone. What this month showed, across every topic in the series, is that the gap between a threat appearing and a business understanding what it means is where the real damage happens, whether the threat is a supplier's fridge controller, a website plugin or an AI agent with more access than anyone intended.

Closing that gap isn't about the size of your security budget. It's about knowing how your technology, suppliers, people and services connect, and making sure someone in the leadership team owns that picture rather than assuming the IT provider does. Businesses that can answer "are we affected?" in hours rather than days will respond better, reassure customers sooner and adopt new technology with far more confidence.

If you'd like help building that picture, Babble helps SMBs put exposure management into practice: mapping critical services, tightening Microsoft 365 permissions ahead of Copilot, and turning the vulnerability and exposure insight in Microsoft Defender into plain-English decisions for leadership teams.

Sources