Plain Security Guides
No jargon. No tech background needed. Just the security things everyone should know, answered in plain English by a CREST-registered security team.
Doesn't the Firewall Block All This?
A firewall controls which doors are open. Almost every modern attack arrives through a door you deliberately left open, which is why it passes straight through.
Do Macs Get Viruses?
Yes, and macOS already includes protection you may not know about. Here is what it covers, what it misses, and whether to add anything.
Does Incognito Mode Make Me Anonymous?
It hides your history from the next person using the device. Your employer, your provider and the sites themselves see exactly as much as before.
How Do I Know If a Website Is Fake?
Read the address, not the page. The padlock proves nothing about honesty, and the polish of a site proves even less.
Is It Safe to Plug In a USB Stick?
A drive you did not buy is a device somebody else configured. Here is what can actually go wrong, and what to do with one you have found.
Is My Cloud Storage Actually a Backup?
Syncing is not backing up. If ransomware encrypts a synced folder, the encrypted version syncs too. Here is the difference and what to do.
Is the Café Wifi Safe, and Do I Need a VPN?
The risk is real but different from what you were told. Here is what actually matters on a shared network, and when a VPN genuinely helps.
Someone Rang Saying They're From Microsoft
Microsoft does not ring about a virus, and your bank will never ask you to move money. Hang up and dial the number you already had.
We've Got Nothing Worth Stealing
They are not after your trade secrets. They are after your payroll run, your mailbox and the machines themselves, which every business has.
Our IT Company Handles Security, Don't They?
Keeping systems running and defending them are different jobs. Five questions that tell you which one you are paying for.
Should I Install That Update?
Yes, if it came from the device itself. No, if it appeared in a browser. That single distinction covers almost every case.
Someone's Left. What Do I Need to Switch Off?
Email is the obvious one and the least of it. Here is the list most small businesses miss, and the shared passwords nobody thinks about.
An Email Says They Have My Password and a Video
It is a mass-sent bluff, and the password came from a data breach. Here is why there is no video, and the one thing worth doing.
What Is Ransomware, in Plain English?
Somebody locks your own files and sells you the key. Here is how it gets in, what actually happens, and the three things that decide the outcome.
Is It Safe to Use WhatsApp for Work?
Encryption is not the issue. Where the records live, who can retrieve them, and what happens when somebody leaves is the issue.
Would I Even Know If I'd Been Hacked?
Probably not, and that is by design. Here is what to actually check, and the handful of signals that genuinely mean something.
Do I Have to Tell Anyone We Were Hacked?
Sometimes yes, and the clock is 72 hours. Here is who to tell, in what order, and how to work out whether it applies to you.
I Clicked a Phishing Link. What Happens Now?
Clicking is usually survivable. What you typed next is the part that matters. Here is what to do, in the order that actually helps.
Is My Password Actually Safe?
Length beats symbols, and reuse beats both. Here is what actually decides whether a password holds, and what to do about the ones you have.
Is That Text From Royal Mail or the Tax Office Real?
Almost certainly not real. Here is the tell that works every time, and the free number that takes the scam text off the network.
Two-Factor Authentication Is Unnecessary Hassle
A strong password is one stolen list away from useless. Here is why the extra step matters, and what the NCSC now recommends instead of it.
My Email Has Been Hacked. What Do I Do?
Work in this order: password, second step, then the hidden forwarding rule almost everyone forgets. That last one is how they get back in.
A Supplier Emailed New Bank Details. Is It Real?
The email is genuine, the invoice looks right, and the account is the criminal's. Here is the one check that catches it, in two minutes.
My Business Is Too Small to Be a Target
Attackers rarely pick you by name. Automated scanning sweeps every business on the internet, and 43% of UK businesses saw a breach last year.
Antivirus Is All I Need
Antivirus catches known threats. Most attacks today use phishing, fileless malware, and social engineering that bypass signature-based detection entirely.
What this is, and isn't
Most security advice is written for IT teams. This series is written for everyone else: small-business owners, staff without a security background, and anyone who's ever wondered if a tip they've read online is actually right.
Each guide takes a common misconception (“Is the padlock on a website safe?”, “Do I need antivirus on a Mac?”) and answers it plainly, with the evidence that matters.
For the deeper technical material (Cyber Essentials, penetration testing methodology, sector-specific compliance), head to the main guides library.
Common questions about these guides
- What are Plain Security guides?
- Straight answers to common security questions, written for people without a technical background. Each one takes a question a UK small business actually asks, answers it plainly, and says what to do about it. No jargon, and no assumption that you already know how any of this works.
- Who are these guides for?
- Small business owners and their staff, and anyone who has read contradictory advice online and wants to know which part is true. They assume no prior knowledge and they are written to be read once and acted on.
- What should I read first?
- If you do one thing, read the guide on why a second sign-in step matters, because a stolen password is the most common way UK small businesses get caught. After that, the guide on a supplier emailing new bank details covers the fraud most likely to actually cost you money.
- Are these guides trying to sell me something?
- No. Each one ends by pointing at a free tool where that genuinely helps, and nothing more. If a guide can answer your question without you contacting anybody, it has done its job.
Have a question you'd like answered plainly?
We write these from real questions people ask us. If you've read something confusing or contradictory about security, let us know and we'll put it on the list.
Suggest a topic