cybersecurity

A product is defective when it lacks the safety a person is entitled to expect. Article 7 turns that into circumstances a court weighs, several written for software: the ability to learn after release, interconnection, cybersecurity requirements, and recalls. This lesson works through the list, the rule that a later improvement is not an admission, and why compliance is not a defence.

The practical middle ground: knowing what data you actually have and reducing it, securing devices and home working without a device management budget, and answering the security questionnaires customers increasingly send to their small suppliers.

Ransomware is the incident that closes small businesses. This lesson covers how it actually unfolds, the decisions that get made badly under pressure, whether to pay, what the first day looks like, and the preparation that turns a business-ending event into a bad week.

Small businesses are told to do everything and can afford almost nothing. This lesson identifies what small organisations are actually attacked with, why that differs from what security marketing describes, and the small set of controls that removes most of the realistic risk.

Real attacks are not a single dramatic moment; they are a patient, multi-stage process. Learn to think like an attacker and follow the chain from reconnaissance to initial access, privilege escalation, lateral movement, and the final objective. Understanding this sequence is the foundation of both breaking in and defending, because every stage is also a chance to stop the attack.

Map how the EU AI Act sorts systems into four risk tiers with matching duties, and how NIS2 sets a horizontal cybersecurity baseline with strict reporting clocks. Learn who each rule binds and how compliance is structured.