Episode 14: The Confidence Trap: What the TPI Data Says About Cyber Readiness in UK SMBs

Confidence is easy when nothing has gone wrong yet. 79% of UK SMB leaders say they’re confident they could identify a cyber attack. Only 28% believe they could recover from one within a week. In this episode, Lynn is joined by Mark O’Dell to unpack fresh cyber security findings from Babble’s Technology Performance Index, a survey of 1,000 UK SMB leaders, and what they reveal about the gap between feeling confident and being ready. Because spotting an attack and recovering from one are very different jobs, and confidence often follows what’s been spent rather than what’s been tested. What you’ll learn in this episode: • Why confidence in spotting an attack doesn’t guarantee the ability to recover • What sits between feeling confident and actually being covered • Why the most tech-advanced businesses can be the most overconfident • How AI is changing both sides of cyber security, from more convincing phishing to smarter defences • Why shadow AI needs real controls, not just guidance • The difference between a tool that raises alerts and a service that acts on them • Why employee education matters more than many businesses expect This episode also explores: • Why just over half (55%) of SMB leaders have effectively adopted cyber security tools • How to start using AI defensively with the platforms you already have • Why assumptions about who looks after security can leave gaps no one owns • What a recovery gap could cost, with just 41% of SMBs adopting business continuity and disaster recovery technology • What good cyber risk governance looks like without a dedicated security team The research points to a familiar pattern: businesses invest, feel reassured, and move on. But cyber security isn’t a one-time purchase. It needs a clear owner, regular testing and the same board-level attention as any other business risk. Mark explains what that looks like in practice, and the one question that gets you started without spending anything: if we were hit tomorrow, what would happen? Further reading: • Explore the Technology Performance Index: babble.cloud/tpi • NCSC guidance on mitigating malware and ransomware attacks: ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks Mentioned in this episode: watch our managed detection and response webinar on demand → Managed Cyber Security: What to Buy, and How to Buy It Other episodes featuring Mark O’Dell: • Episode 1: Why UK businesses are being targeted by cyber attacks • Episode 9: Inside the TPI: Why some businesses make technology work and others don’t Chapters: 00:00 Confidence and readiness are not the same thing 00:30 Welcome to HIDDEN 01:22 Meet Mark O’Dell 03:01 The confidence gap: 79% confident, 28% could recover 06:28 What sits between confidence and coverage 08:45 Why tech vanguards are overconfident 10:25 The AI arms race and phishing 15:37 Using AI defensively, and shadow AI 21:44 Why buying a tool isn’t security 23:40 Tools vs. managed detection and response 25:27 Why education matters most 29:18 The cost of having no recovery plan 30:57 Who’s really watching your security? 34:52 Cyber risk at board level 36:47 The one conversation to have this quarter 39:03 Don’t tick the box and move on 40:05 Closing thoughts #CyberSecurity #TechnologyPerformanceIndex #TPI #SMBs #CyberRisk #AI #TheHIDDENPodcast