Phishing for Trouble from IO (ISMS.online)

IO (ISMS.online)

Compliance, security, privacy, AI risk. There's a lot of noise out there, and not much of it is useful when you're the one having to do the work. Phishing for Trouble is the business resilience podcast from IO (ISMS.online), the platform thousands of teams use to manage compliance and build resilience day to day. Rebecca Harper and David Holloway talk to the security leaders, specialists and business experts they actually learn from, the kind of guests who give you something to take back to your team on Monday. Honest, practical, sometimes a bit awkward. Always useful.

  1. Oct 19 ·  Bonus

    SPECIAL: Beyond the Headlines - Cyber Resilience, Supply Chains and the Cost of Disruption (Part 2)

    In part two of this Cyber Security Awareness Month special, Rebecca Harper, David Holloway and Kate O'Flaherty explore 2026's resilience lessons, from supply chain disruption and customer trust to the risks emerging in 2027. From major service outages to cyberattacks affecting entire supply chains, 2026 has highlighted just how interconnected business risks have become. When critical services fail or suppliers experience disruption, the consequences can extend far beyond the original incident, affecting customers, operations, reputation and trust. In Part 2 of our Cyber Security Awareness Month special, IO's Rebecca Harper and David Holloway are joined once again by cybersecurity journalist Kate O'Flaherty to examine what the year's biggest incidents reveal about business resilience, third-party dependencies and the growing commercial importance of security and trust. Drawing on incidents involving major technology providers and supply chains, they explore why organisations are struggling to manage third-party risk, how supplier failures can become their customers' problems, and why resilience requires more than incident response and recovery plans. The discussion also examines the case for more connected governance across information security, privacy, AI and compliance, and what business leaders need to understand about their critical dependencies. Looking ahead to 2027, the conversation turns to the emerging risks and developments organisations should be watching, from AI and ransomware to critical infrastructure and geopolitical uncertainty. If you're wondering how to build resilience in a world where so much of your business depends on systems, suppliers and services outside your direct control, this episode explores what organisations can learn from 2026 and how they can better prepare for what comes next. Missed Part 1? Catch up on our discussion of AI, regulation and the reality of governance in 2026. Find out more at IO.

  2. Oct 19 ·  Bonus

    SPECIAL: Beyond the Headlines - AI, Regulation and the Reality of 2026 (Part 1)

    For Cyber Security Awareness Month, Rebecca Harper, David Holloway and Kate O'Flaherty explore how AI, regulation and governance evolved in 2026, separating headline hype from the changes that really mattered 2026 has seen AI adoption accelerate, regulatory requirements evolve and organisations face growing pressure to demonstrate that their governance practices work in reality. But beyond the headlines, which developments have genuinely changed how businesses approach security, privacy, compliance and risk? In Part 1 of a two-part Phishing For Trouble special for Cyber Security Awareness Month, IO's Rebecca Harper and David Holloway are joined by cybersecurity journalist Kate O'Flaherty to explore the developments that mattered most in 2026, separating the hype from the changes creating real challenges for organisations. From Shadow AI and emerging security threats to the practical implications of the EU AI Act, Cyber Resilience Act and evolving UK legislation, the conversation explores why visibility, accountability and effective controls are becoming increasingly important. They also discuss the gap between investing in governance and putting it into practice, and why responding to each new regulation in isolation is no longer sustainable. If you're trying to make sense of what 2026 really means for your organisation's approach to AI, compliance and governance, this episode looks beyond the headlines to the practical lessons businesses should take forward. Continue the conversation in Part 2, where we explore cyber resilience, supply chains and the cost of disruption. Find out more at IO.

  3. Jul 23

    Built to Last: How Compliance Enables Business Resilience

    Looking back at Phishing For Trouble's second season, we've explored the challenges organisations face as technology, regulation and risk evolve, from supply chain vulnerabilities and AI governance to privacy, operational resilience and what regulators are really looking for. In this final episode, IO's Rebecca Harper and David Holloway are joined by Rik Ferguson, Vice President of Security Intelligence at Forescout Technologies and founding Special Advisor to Europol's European Cyber Crime Centre. Drawing on decades of experience, Rik reflects on the biggest lessons from the series and what organisations need to do to build resilience in an increasingly complex landscape. Featuring key moments from guests across the season, Rik shares his perspective on why compliance should be treated as the foundation for growth rather than a tick-box exercise, how organisations can prepare for an AI-driven future, what effective resilience really looks like, and why governance, visibility and culture matter just as much as technology. If you're wondering what separates organisations that simply react from those that are built to last, this episode brings the whole season together.   Find out more at ISMS.online

  4. Jul 9

    Privacy as Power

    What happens when privacy stops being a legal issue and starts shaping whether your business can grow?  In this episode of Phishing for Trouble, IO’s Rebecca Harper and David Holloway explore why privacy is now a commercial issue, not just a compliance one. They’re joined by Joe Jones, Director of Research and Insights at the IAPP, and Jennifer Appleton, Managing Director at ISO Quality Services, to discuss how organisations are turning privacy into a source of trust, resilience and competitive advantage. Hear why businesses are losing deals, slowing procurement and stalling expansion plans because they can’t clearly explain howdata is being used and why frameworks like GDPR and ISO 27701 are becoming essential foundations for growth. From privacy by design and AI governance to customer trust and cross-border data challenges, this episode explores why the organisations embedding privacy into the way they operate are often the ones moving faster, scaling smarter and building trust that lasts. Find out more at ISMS.online

  5. Jul 2

    What the Regulators Want

    Today, regulators don’t just want compliance, they want accountability and resilience. In this episode of Phishing for Trouble, IO’s Rebecca Harper and David Holloway explore how the shift of expectations isn’t just about speed, it’s about demonstrable, baked-in compliance. Regulators are no longer passive; they’re proactive, prescriptive, and punitive. They’re joined by Paul Vane, the Information Commissioner for the Jersey Office of the Information Commissioner, a man who has worked in privacy and data protection for over two decades and uniquely equipped to clarify how the relationship between company and regulator should work, and why sometimes it doesn’t. Hear what you should be planning for, months or years before a breach, how the mindset for crisis readiness needs to be a continuous process rather than a periodic exercise, and how themember of staff best equipped to cope, should the worst happen, often isn’t from the senior leadership team.   The ultimate ambition is to shift the culture from “responded well” to “being able to see it coming”. It’s no longer enough to simply recover in a crisis, the expectations are now to think about future risks and show some evidence of how you mitigated those dangers ahead of time. Find out more at ISMS.online

  6. Jun 25

    The Cost of Doing Nothing

    What does a cyber incident really cost a business? In this episode of Phishing for Trouble, IO’s Rebecca Harper and David Holloway explore the hidden commercial impact of weak security, poor compliance and delayed investment in resilience. They’re joined by Alan Hughes, Chief Operations Officer at Savenet Solutions, who has worked with organisations before, during and after major cyber incidents witnessing the long-term fallout that often never makes the headlines. Hear why the real damage doesn’t stop with the breach itself, from lost contracts and stalled growth to reputational harm thatcan take years to recover from. The episode explores why smaller businesses are increasingly being targeted, how supply chain requirements are reshapingcustomer expectations and why doing nothing can quickly become the most expensive decision a company makes. From ransomware attacks and failed security questionnaires to business continuity, tested backups and recovery planning, this episode looks at what separates the organisations that recover quickly from the ones left trying to rebuild. Find out more at ISMS.online

  7. Jun 18

    Scaling Securely: What High-Growth Firms Get Right

    What happens when your business grows faster than its foundations can handle? In this episode of Phishing for Trouble, IO’s Rebecca Harper and David Holloway explore why the companies that scale successfully aren’t necessarily the ones that achieve compliance fastest. They’re the ones that build security, privacy and governance into the way they operate from the very beginning. They’re joined by cyber leader Purvi Kay, whose experience spans government, aerospace and FTSE 100 boardrooms and Andy Ellis cybersecurity advisor, former Chief Security Officer at Akamai and author of 1% Leadership. Hear why “security debt” can quietly build as startups race to grow, why compliance should be treated as a product featureand how resilience becomes a competitive advantage as organisations scale. From secure-by-design principles and embedded security teams to risk appetite, customer trust and leadership accountability, this episode explores what high-growth firms get right and why resilience is about far more than passing an audit. Find out more at ISMS.online

  8. Jun 11

    You’re compliant, are you resilient?

    What happens when a cyber attack doesn’t just disrupt your business, but stops it completely? In this episode of Phishing for Trouble, IO’s Rebecca Harper and David Holloway explore why resilience has become a defining business challenge fororganisations of every size. Using the Jaguar Land Rover cyber attack as a case study, alongside insights from cybersecurity expert Pierre Noel and Professor Ciaran Martin, founding CEO of the UK National Cyber Security Centre, they unpack the growing gap between compliance and genuine operational resilience. Hear why businesses are moving from prevention to preparedness, why supply chain resilience matters now more than ever, and why the organisations best placed to survive disruption are the ones building resilience into every part of their operations. Find out more at ISMS.online

See All (24)

Trailer

About

Compliance, security, privacy, AI risk. There's a lot of noise out there, and not much of it is useful when you're the one having to do the work. Phishing for Trouble is the business resilience podcast from IO (ISMS.online), the platform thousands of teams use to manage compliance and build resilience day to day. Rebecca Harper and David Holloway talk to the security leaders, specialists and business experts they actually learn from, the kind of guests who give you something to take back to your team on Monday. Honest, practical, sometimes a bit awkward. Always useful.

Information