Podcasting
Advertisers
Enterprise
Pricing
Resources
Discover Discover

The Small Business Cyber Security Guy | Cybersecurity for SMB & Startups

Reverse Benchmarking: Learn from the Biggest Cyber Faceplants

2025-12-01

What if the best way to protect your business isn't copying what the successful companies do, but avoiding what the failures did wrong? Welcome to reverse benchmarking, the cybersecurity equivalent of learning from other people's face-plants so you don't repeat them. In this episode, Noel and Mauven flip traditional benchmarking on its head. Instead of asking "what are the best companies doing?", they explore the far more revealing question: "what did the disasters get catastrophically wrong?" From the Target breach via an HVAC vendor to ransomware attacks on UK holiday parks, the hosts dissect spectacular cybersecurity failures to extract practical lessons for small businesses. You'll discover why copying enterprise best practices often backfires for SMBs, how compliance creates...

In this episode, Noel and Mauven flip traditional benchmarking on its head. Instead of asking "what are the best companies doing?", they explore the far more revealing question: "what did the disasters get catastrophically wrong?" From the Target breach via an HVAC vendor to ransomware attacks on UK holiday parks, the hosts dissect spectacular cybersecurity failures to extract practical lessons for small businesses.

You'll discover why copying enterprise best practices often backfires for SMBs, how compliance creates dangerous false security, and practical ways to build your own "disaster library" of lessons learned. Plus, the hosts reveal why some of the worst cybersecurity advice comes from studying successful companies rather than failed ones.

This isn't just negativity packaged as strategy. It's a systematic approach to identifying your business's genuine vulnerabilities by examining where others fell through the cracks. Because in cybersecurity, knowing what not to do is often more valuable than copying what others claim works.

Why This Episode Matters

One in three small businesses were hit by cyberattacks last year. The average cost? A quarter of a million pounds, with some reaching seven million. But here's the crushing statistic: 60% of small businesses close within six months of a cyber incident.

Traditional benchmarking tells you to copy what big enterprises do. Reverse benchmarking shows you what kills businesses like yours, so you can avoid becoming the cautionary tale in someone else's podcast.

Key Takeaways

1. Traditional Benchmarking Often Fails SMBs

Copying FTSE 100 security on a shoestring budget is a losing game
Enterprise solutions don't scale down effectively
By the time you copy last year's "best practice," threats have evolved
Context matters more than copying

2. Compliance ≠ Security

Being compliant doesn't mean you're secure
Compliance is like passing your driving test - it proves you know the rules, not that you'll never crash
Checkbox culture creates dangerous complacency
Attackers don't check your certifications before striking

3. The Statistics Are Sobering

One third of SMBs hit by cyberattacks annually
Average breach cost: £250,000
Some breaches: £7 million
60% of small businesses close within six months post-attack
NCSC estimates 50% of UK SMBs will experience a breach each year

4. Real-World Disasters Teach Practical Lessons

Target breach: Lost $162 million because HVAC vendor credentials weren't properly segmented
Colonial Pipeline: Shutdown of major US fuel infrastructure from weak VPN password
UK holiday park ransomware: Peak season attack forced cash-only operations
Common thread: Basic security fundamentals ignored

5. Third-Party Risks Are Existential

61% of breaches involve third-party access
Small vendors create backdoors into larger networks
Your security is only as strong as your weakest supplier
Segment vendor access ruthlessly

6. Practical Implementation Steps

Build your own "disaster library" of relevant failures
Hold quarterly "what went wrong" review sessions
Map your business to failed case studies
Ask "could this happen to us?" for every breach you read about
Create no-blame culture for reporting near-misses

Detailed Show Notes Introduction (00:00 - 01:24)

Noel poses a simple question: in the pub, what do people talk about? Their wins, mostly. This episode does the opposite by examining failures instead of successes. The hosts introduce "reverse benchmarking" as the Darwin Awards of cybersecurity, learning from others' digital disasters rather than bragging about fancy firewalls.

Key Quote: "Learn from other people's face-plants so we don't repeat them."

What Is Reverse Benchmarking? (01:24 - 03:46)

Traditional benchmarking means copying what successful companies do. Reverse benchmarking flips this around: study the worst failures in your industry and make certain you don't repeat them.

The Problem with Traditional Benchmarking:

Big enterprises have massive IT teams and unlimited budgets
Trying to copy enterprise security on SMB resources is futile
Benchmarking looks backwards - by the time you implement, hackers have moved on
If everyone in your industry has the same gap, benchmarking won't reveal it

Why It Matters Now:

One third of SMBs were hit by cyberattacks in the past year
Average cost: £250,000, with some reaching £7 million
60% of small businesses close within six months of a cyberattack
Most small business owners still think they're too small to be targeted

UK Context: The National Cyber Security Centre (NCSC) estimates around half of UK SMBs will experience a breach each year. Coin flip odds. If you're sitting in a board meeting saying "hackers won't bother with us," you might as well hang a sign reading "free Wi-Fi, no password."

The Compliance Trap (03:46 - 06:15)

Many businesses believe being compliant means they're secure. This is cybersecurity's biggest misconception.

Compliance vs Security:

Compliance is like passing your driving test - it means you know the rules, not that you'll never crash
Or that you're a good driver
Microsoft's security GM: "Some SMBs believe being compliant means they're safe. It doesn't."
Hackers don't check whether you've got ISO certification before attacking

The Checkbox Culture:

"We did our annual password change. Job done."
Hackers respond: "Challenge accepted."
Following checklists creates false sense of security
Real security requires ongoing vigilance, not annual tick-boxes

The Hidden Risk: If everyone in your industry has the same security gap but meets the same compliance standards, benchmarking against them won't reveal your shared vulnerability. You're all vulnerable together, congratulating each other on your certifications.

Case Study 1: The Target Breach (06:15 - 09:42)

One of retail history's most infamous breaches demonstrates how third-party access becomes a catastrophic liability.

What Happened:

December 2013: Hackers stole 40 million credit card numbers and 70 million customer records
Entry point: HVAC contractor with network access
Attackers used vendor credentials to access Target's corporate network
Then moved laterally to payment systems

The Aftermath:

Direct losses: $162 million
CEO resigned
CIO resigned
Board chairman resigned
Countless hours dealing with breach response, forensics, legal battles

The Lesson: Your security is only as strong as your weakest supplier. That HVAC company, plumber, or IT consultant with network access? They're potential backdoors. Target's enterprise-grade security was bypassed through a small contractor's weak credentials.

For Small Businesses:

61% of breaches involve third-party access
Small businesses often provide services to larger enterprises
Your compromise becomes their breach
Vendor management isn't optional

Practical Actions:

Segment vendor access ruthlessly
No contractor needs access to your entire network
Use separate credentials for third parties
Monitor vendor access continuously
Regular vendor security audits

Case Study 2: Colonial Pipeline (09:42 - 12:28)

In May 2021, a single compromised password shut down a major fuel pipeline supplying 45% of the US East Coast's fuel.

What Happened:

Ransomware attack forced shutdown of 5,500-mile pipeline
Entry point: Weak VPN password
No multi-factor authentication (MFA) on VPN access
Company paid $4.4 million ransom (partially recovered later)

The Impact:

Fuel shortages across southeastern United States
Panic buying, price spikes
Emergency government declarations
Week-long shutdown of critical infrastructure

The Lesson: Credentials are your front door. If you're not protecting them properly, you've left the door unlocked with a welcome mat out for attackers.

For Small Businesses: The Colonial Pipeline didn't fail because of sophisticated zero-day exploits or nation-state malware. They failed because they didn't have MFA enabled on remote access.

Your Action Items:

Enable MFA everywhere, particularly VPN access
Enforce strong password policies
Monitor for credential compromise
Phishing-resistant MFA (hardware tokens or biometrics) for privileged access
Regular access reviews

The Cost-Benefit Reality:

Hardware security keys: £40-70 per user
Potential breach cost: £250,000 average
MFA prevents 99.9% of automated credential attacks
The mathematics are straightforward

Case Study 3: UK Holiday Park Ransomware (12:28 - 15:15)

Closer to home, a UK holiday park discovered that timing matters when ransomware strikes.

What Happened:

Ransomware attack during peak summer season
All booking systems encrypted
Payment processing down
Guest check-ins disrupted

The Business Impact:

Had to operate cash-only during busiest period
Couldn't process new bookings
Lost revenue during most profitable weeks
Guest experience severely compromised
Reputation damage

The Lesson: Attackers choose timing deliberately. They struck during peak season when the business would be most desperate to restore operations quickly and most likely to pay the ransom.

For Small Businesses: Seasonal businesses are particularly vulnerable during peak periods. That's precisely when attackers strike, knowing you can't afford downtime.

Your Defence Strategy:

Offline, air-gapped backups tested regularly
Incident response plan practiced before peak season
Alternative payment processing methods ready
Staff trained on ransomware procedures
Crisis communication templates prepared

The Backup Reality: Having backups isn't enough. You need to test restoration procedures. The middle of a ransomware attack is not the time to discover your backups don't work or take three weeks to restore.

Why Reverse Benchmarking Works Better (15:15 - 17:45)

Traditional approaches focus on aspirational goals. Reverse benchmarking focuses on avoiding catastrophic failures.

The Psychological Advantage:

Failures provide concrete examples of what not to do
Success stories often omit the messy details
Disasters reveal the actual attack patterns you'll face
Real consequences make lessons stick

The Practical Advantage:

You learn what actually breaks in the real world
Not theoretical best practices that might work
Understand attack chains step by step
See how small gaps become massive breaches

The Cost Advantage:

Avoiding one disaster pays for years of modest security investment
You don't need enterprise budgets to avoid enterprise mistakes
Focus resources on genuine vulnerabilities
Not on impressive-sounding but irrelevant controls

The Timeliness Advantage:

Recent failures reflect current threat landscape
More relevant than last year's "best practices"
See how threats evolve in real-time
Adapt defences to actual attack methods

Building Your Disaster Library (17:45 - 19:29)

Practical implementation of reverse benchmarking for your business.

Step 1: Collect Relevant Failures

Focus on breaches in similar-sized businesses
Same industry or adjacent sectors
Similar technology stack
Geographic relevance (UK regulations, threat actors)

Step 2: Quarterly Review Sessions

"What went wrong" meetings with your team
Review recent breaches systematically
Ask: "Could this happen to us?"
Identify similar vulnerabilities in your environment

Step 3: Map to Your Environment

For each breach, trace the attack path
Identify which elements exist in your business
Where are your equivalent vulnerabilities?
What would the impact be if it happened to you?

Step 4: Prioritise Actions

Not every lesson requires immediate implementation
Focus on high-probability, high-impact scenarios first
Quick wins vs long-term projects
Balance cost against realistic risk

Step 5: Create Your "Anti-Playbook"

Document what you'll never do based on failure analysis
Share with team so everyone knows the "forbidden" approaches
Update as new disasters emerge
Make it living document, not static policy

Resources to Monitor:

NCSC Weekly Threat Reports
Information Commissioner's Office (ICO) breach reports
Industry-specific security bulletins
UK Cyber Security News
Global breach databases with UK filter

Creating a No-Blame Culture (19:29 - 20:45)

If people hide mistakes, you lose the chance to fix vulnerabilities before an actual breach occurs.

The Aviation Model: Airlines improve safety by fostering no-blame culture for near-misses. They want to hear about every close call so they can fix systemic issues before disaster strikes.

Applying This to Cybersecurity: If Janet in accounting falls for a phishing test, berating her is counterproductive. Instead, make it a learning opportunity for everyone. Next time, she might be the one to spot a real phishing attempt and save your business.

Practical Implementation:

"Lessons learned" sessions, not "who screwed up" meetings
Focus on systems and processes, not individuals
Reward reporting of near-misses
Share failures anonymously when needed
Celebrate catches of suspicious activity

The Payoff: Fear doesn't work. Education does. When people feel safe reporting potential issues, you catch problems early before they become breaches.

Summary and Call to Action (20:45 - 21:37)

Sometimes the best way to secure your business is by studying the worst failures out there and doing the opposite.

Key Principles:

Traditional benchmarking can lead you astray for SMBs
Reverse benchmarking provides genuine security advantage
Study disasters: Target, Colonial Pipeline, holiday park ransomware
Build it into regular practice, not one-off exercise

Your Mindset Shift: Think of yourself as Sherlock Holmes of cyber failures. Every incident is a case study that makes your business smarter. In cybersecurity, boring is good. If nothing's happening, it means your defences are working.

Immediate Actions:

Start your disaster library this week
Schedule your first quarterly review session
Map one recent breach to your business environment
Implement one lesson learned from this episode
Share this approach with your team

Resources Mentioned Statistics and Studies

National Cyber Security Centre (NCSC): UK SMB breach probability estimates
Microsoft Security: Compliance vs security research
Industry reports: 61% of breaches involve third-party access
Bernard Ma: Quote on benchmarking limitations

Case Studies Referenced

Target Corporation data breach (2013): HVAC vendor compromise, 40 million cards stolen, $162 million loss
Colonial Pipeline ransomware (2021): VPN password compromise, $4.4 million ransom, critical infrastructure shutdown
UK holiday park ransomware: Peak season attack, cash-only operations

UK Regulatory and Advisory Bodies