Underdog Security Practical cyber defence for the smaller guys

Underdog Security

Practical cyber defence for the smaller guys

Latest Articles

The Bin Bag Doesn't Shred: A Thirty-Minute Clear-Out Audit for Small UK Offices
Physical Security

The Bin Bag Doesn't Shred: A Thirty-Minute Clear-Out Audit for Small UK Offices

Most small teams think about firewalls and phishing, then tip a decade of office clutter into a wheelie bin without a second glance. This is a practical thirty-minute audit for paper, old kit, branded tat and unwanted post — plus the wipe-or-destroy basics and a simple leave-the-building checklist that works when nobody owns facilities.
The Subscription Ended. The Access Didn't: A SaaS Exit Check for Small Teams
Access Management

The Subscription Ended. The Access Didn't: A SaaS Exit Check for Small Teams

Cancelling a SaaS tool is a billing event, not a security event. This 30-minute exit check helps small UK teams export what matters, revoke integrations, close admin routes and keep a record that stands up to UK GDPR accountability.
Your Vacancy Just Named Your Firewall: A Twenty-Minute Job Ad Scrub
Free Tools

Your Vacancy Just Named Your Firewall: A Twenty-Minute Job Ad Scrub

Recruitment ads are written for candidates, but they're published to the open web and read by people who will never apply. Here's a twenty-minute routine — browser and a spreadsheet, nothing else — for finding the free reconnaissance in your own job posts and rewriting it without making the role impossible to fill.
Your Away Message Is a Free Org Chart — Here's the Fifteen-Minute Fix
Email Security

Your Away Message Is a Free Org Chart — Here's the Fifteen-Minute Fix

Auto-replies, voicemail greetings and shared calendars are supposed to help colleagues, not strangers. But a rushed away message can hand an attacker your travel dates, your cover contact and a named person to impersonate. Here's a quick audit and a set of templates that keep the handover useful without doing reconnaissance for fraudsters.
The Grant Form Wants Proof, Not Poetry: Building a Charity Cyber Pack in 45 Minutes
Certification

The Grant Form Wants Proof, Not Poetry: Building a Charity Cyber Pack in 45 Minutes

UK funders have started asking small charities for evidence of basic cyber governance, not a certificate on the wall. Here is a one-page pack you can assemble in 45 minutes — owner, assets, backups, incident route, training — with wording that does not oversell.
The Little Padlock Has No Owner: A Twenty-Minute Sweep of Your Shared Password Vault
Access Management

The Little Padlock Has No Owner: A Twenty-Minute Sweep of Your Shared Password Vault

Most small UK teams have a password vault called something like ‘Team Stuff’. It works right up until you need to know who can get into it, who owns each entry, and what happens when the person who set it up leaves. Here is a timed sweep to turn it from a dusty shared drawer into something with actual owners.
Someone Is Pushing Buttons on Your Phone: A Twenty-Minute MFA Fatigue Rehearsal
Access Management

Someone Is Pushing Buttons on Your Phone: A Twenty-Minute MFA Fatigue Rehearsal

Repeated sign-in prompts are a quiet way to wear a small team down until someone taps Approve. Here is a short rehearsal, the settings worth switching on in Microsoft 365 and Google Workspace, and a helpdesk script that checks the login without making anyone feel stupid.
Copilot Doesn't Ask Twice: The Permission Sweep to Run Before You Switch It On
Access Management

Copilot Doesn't Ask Twice: The Permission Sweep to Run Before You Switch It On

An AI assistant doesn't grant anyone new access — it just makes every old permission instantly searchable. Before you switch Copilot or Gemini on for the team, spend an afternoon finding the folders that should never have been open in the first place, and write a prompt policy that fits on one side of A4.
One Bar of Signal: The Thirty-Minute SIM-Swap Rehearsal for Small UK Teams
Access Management

One Bar of Signal: The Thirty-Minute SIM-Swap Rehearsal for Small UK Teams

Your mobile number is probably doing more security work than anyone in the office realises: password resets, bank codes, payroll logins and that helpful 'text me a code' button. This is a calm, practical tabletop exercise for small UK teams who need to know what to do in the first hour if that number is taken over.
The Inbox Everyone Can Open and Nobody Can Explain
Access Management

The Inbox Everyone Can Open and Nobody Can Explain

A shared info@ mailbox is handy until a supplier email vanishes, the password lives on a sticky note, and nobody can say who read what. Here is a calm 45-minute migration plan for UK small teams moving to named accounts, delegated access, and proper second factors.
Who Did You Let In With a Click? Auditing App Permissions in Microsoft 365 and Google Workspace
Access Management

Who Did You Let In With a Click? Auditing App Permissions in Microsoft 365 and Google Workspace

That helpful scheduling app from lunchtime may still have the keys to your inbox. Here is a practical twenty-minute sweep for finding third-party app consents in Microsoft 365 and Google Workspace, judging which scopes are too generous, and revoking the ones nobody can defend.
The Handset You Forgot Is Still Signed In: Retiring Old Devices Properly
Access Management

The Handset You Forgot Is Still Signed In: Retiring Old Devices Properly

Most small teams treat an old phone like a spare charger: useful one day, forgotten the next. But a retired handset can still hold email, MFA prompts and shared files, often with live sessions attached. This is a 30-minute retirement routine for UK teams with no helpdesk.
The Machine in the Corner That Remembers Everything: A 30-Minute Health Check for Your Office Printer
Physical Security

The Machine in the Corner That Remembers Everything: A 30-Minute Health Check for Your Office Printer

Multifunction printers are networked computers with an admin login, a web console and a hard drive that quietly hoards everyone's paperwork. Most small UK offices set them up once, never touch them again, and hand them back at the end of the lease with the data still inside. Here's a practical half-hour routine to fix that.
Missing Bag, Calm Hands: The Lost-Laptop Routine for Teams With No Helpdesk
Physical Security

Missing Bag, Calm Hands: The Lost-Laptop Routine for Teams With No Helpdesk

A work laptop or phone goes missing on a train, in a taxi or at a conference, and suddenly everyone remembers the device register was last updated in a different financial year. This is a calm, rehearsable lost-device routine for small UK teams: what to freeze, when to wipe, what to keep as evidence, and how to test the whole thing before it matters.
Email Security

The Inbox Rule You Never Wrote: A Twenty-Minute Sweep for Quiet Forwarding

Business email compromise rarely arrives with a bang. It arrives as a tidy little rule that forwards invoices to an address you do not recognise and marks the originals as read. Here is how a small UK team can find those rules, read the tells, and close the door in about twenty minutes.
The Keys Outlive the Contract: Auditing Supplier Access After a Messy Breakup
Access Management

The Keys Outlive the Contract: Auditing Supplier Access After a Messy Breakup

When a small UK organisation changes IT support, web developer or backup provider, the contract ends long before the access does. This is a practical 60-minute exit audit: map every provider login, revoke remote access, recover domain and DNS control, check RMM agents and backup consoles, and get written confirmation that the old provider is out.
Your Desk Is Not the Perimeter: A Room-by-Room Security Walkthrough for Shared UK Offices
Physical Security

Your Desk Is Not the Perimeter: A Room-by-Room Security Walkthrough for Shared UK Offices

Coworking and serviced offices are convenient, but shared Wi-Fi, visitors, cleaners and post rooms quietly widen your attack surface. Use this practical room-by-room review to close the gaps without an enterprise budget.
The Client Questionnaire Is Not a Trap: Answering Security Questions With Evidence, Not Bluff
Certification

The Client Questionnaire Is Not a Trap: Answering Security Questions With Evidence, Not Bluff

Big-client procurement teams are asking sharper security questions in 2026, and small UK teams often answer them by guesswork or copy-paste. This is a calm, repeatable way to answer honestly, back up claims with evidence, and turn the questionnaire into a sales advantage.
Your Domain Is the Front Door: A 30-Minute Hygiene Check for Small UK Teams
Email Security

Your Domain Is the Front Door: A 30-Minute Hygiene Check for Small UK Teams

Most small organisations think of their domain as a web address. It is actually the front door for your email, your invoices and your reputation — and it is usually left unlocked. Here is a practical audit a non-specialist can finish in half an hour.
The Renewal You Should Decline: Five Security Buys Small Teams Quietly Regret
Free Tools

The Renewal You Should Decline: Five Security Buys Small Teams Quietly Regret

Every breach headline comes with a follow-up sales call, and small UK teams end up paying for dashboards nobody opens. Here are five common security purchases worth declining at renewal, with the cheaper or free control that actually moves the needle.

Recommended

non gamstop casinos