Would You Know? And Should You Need To?
Something rather interesting happened on the internet last week.
Two serious vulnerabilities were discovered deep inside PHP, the technology that sits behind a huge number of websites and applications. You may have been aware of this, but may not fully understand the impact on your business.
The problem was serious enough for the UK’s National Cyber Security Centre to tell organisations to identify where they were using PHP and update affected systems immediately.
This situation interests me because I was wondering: would you have immediately known if your business would be affected? And perhaps the deeper question is: who should you learn about this type of thing from?
Something you didn’t know you had
A little background. As with many automated workflow solutions, PHP isn’t something most business owners knowingly go out and buy.
It sits behind websites, applications and other technology we use every day. In fact, some commercial products contain PHP without the businesses using them necessarily knowing it’s there.
I think this creates an interesting situation. You can have a website that’s working perfectly well, your systems are running and your customers are happily using them. Nothing appears to be wrong.
Then somebody discovers a vulnerability buried deep inside the technology and suddenly something you didn’t know you had becomes rather important.
AI enters the story
There’s another part to this particular incident which I was intrigued by.
The roots of one of these problems had been spotted previously, but its full significance wasn’t understood. It was actually AI-assisted security research which played a significant part in helping researchers expose just how serious this could be.
AI tools were also used to help validate reports as the security teams worked through the problem. Importantly, I was pleased to see that people remained responsible for the decisions and the fixes.
I find that really interesting, as we’re becoming used to AI helping us write emails, analyse information and automate processes. But here it was helping highly skilled people look deeper into technology and uncover something that had been extraordinarily difficult to find.
That’s great news for security. Of course, there’s another side to that. If the good guys can use AI to find vulnerabilities more quickly, we should probably assume the bad guys are interested too.
So, who’s watching your business?
For me, that’s where this becomes a business conversation rather than a PHP conversation.
You shouldn’t need to understand PHP, nor should you have to spend your Wednesday afternoon reading security bulletins to work out whether something buried inside your website needs urgent attention.
But somebody needs to.
And that person needs to understand more than the latest security alert. They need to understand how your business success is supported by all the different technology you rely upon.
That means being able to look at something like this and quickly put it into context. Does it affect us? Where might the risk sit? Who else needs to be involved? Do we need to act now, or is everything already where it needs to be?
I believe not every security story requires panic. What you need as a business owner is clarity.
Imagine the difference
I think there’s real value in imagining what that relationship could feel like from your side.
You hear about a major technology vulnerability, but rather than wondering whether you should be doing something, you know somebody is already considering what it means for your business.
If action is needed, we can identify it quickly. If your website developer or another technology partner needs to be involved, we can bring the right people into the conversation. And if everything is fine, you get that reassurance too.
For me, that’s a much more interesting relationship with your IT team.
It’s less about having somebody to call when something goes wrong and more about having people close enough to your business to understand how everything fits together, what’s changing around you and where something new might create a risk – or an opportunity.
As AI develops, I suspect we’ll discover more things that have been sitting quietly inside technology for years. Some will be vulnerabilities, while others may help us improve how businesses operate, protect customers or make better use of the technology we already have.
We won’t be able to predict everything that’s coming. But imagine having the right people around you who want your business to succeed as much as you do. People who understand your aspirations, keep asking how your technology and operations can support them, and are ready to respond when something changes.
For me, that’s what a close relationship with your technology partner should feel like.
So perhaps there’s a useful question to ask this week:
“If something like this affected our business tomorrow, who would know?”
And if the answer isn’t immediately obvious, that might be an interesting conversation to have.
If you’d like me to join that conversation, I’d enjoy it.
Simply call 01473 350444 and ask for Colin or email enquiries@heronit.co.uk.
Share this…
