Amalan

Call Directions Website

Amalan Amalan provides Fractional IT Leadership to SMB and Midmarket European businesses.

07/10/2026

The director has the shiny new laptop. The people doing the work are watching a spinning wheel.

Here's the fix:

List every PC in the business
Anything over five years old is due for replacement
Budget to replace a quarter of them each year, so there's never one massive bill

Try this today: find the oldest PC in your business. How old is it?

More on cutting IT costs without cutting corners: https://www.goodchoiceit.co.uk/stratagic_cost_cutting_for_it/?utm_source=ghl&utm_medium=social&utm_campaign=itbudget-sh01

25/09/2026

Cyber Essentials gives you fourteen days to apply critical security updates. In 2026, Dave believes that is far too long. Where possible, security updates should be applied much sooner, ideally when released.

But there’s a balance to consider. Patch immediately and you can sometimes break systems. Leave a vulnerability unpatched and you increase your exposure to attack. The right approach depends on the risk.

Unsupported software that no longer receives security updates will fail the assessment if it remains in scope. However, Cyber Essentials allows systems to be excluded if they are properly isolated from the rest of the network.

That doesn’t make unsupported systems a good idea. If you’re relying on old systems, the real answer is to upgrade them.

Cyber Essentials: https://www.ncsc.gov.uk/cyberessentials/resources

GoodChoiceIT: https://www.goodchoiceit.co.uk/cyber-security-services/

23/09/2026

Another Cyber Essentials myth: that multifactor authentication is compulsory everywhere.

That’s not quite correct. The latest requirements mandate MFA for web-based applications where it is available, including every account, users and administrators. If an application doesn’t offer MFA, that needs to be declared and the assessor will check it.

Cyber Essentials does not require MFA on every desktop. Microsoft credentials and conditional access can help secure cloud applications.

Passkeys aren’t currently a Cyber Essentials requirement, but Dave strongly recommends deploying them wherever possible. The NCSC recommends using passkeys over passwords when available.

Cyber Essentials: https://www.ncsc.gov.uk/cyberessentials/resources

NCSC passkeys: https://www.ncsc.gov.uk/passkeys

Microsoft Entra: https://learn.microsoft.com/en-us/entra/identity/authentication/

GoodChoiceIT: https://www.goodchoiceit.co.uk/

21/09/2026

If you still have regular password rotation switched on, it may be time to turn it off.

One of the old approaches to password security was forcing staff to change their passwords every month, six months or 90 days. The problem? People often just make a predictable change, such as adding another number to the end. Thistle1, Thistle2, Thistle3.

Instead, Dave recommends using controls that actually prevent weak or compromised passwords from being used. Microsoft Entra password protection uses a global banned password list and can also support a custom list for your organisation.

Cyber Essentials does not mandate regular password changes. Passwords should be changed when there’s a genuine reason, such as when one has been lost or stolen, rather than simply because the calendar says it’s time.

Cyber Essentials requirements: https://www.ncsc.gov.uk/cyberessentials/resources

Microsoft password protection: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad

Visit GoodChoiceIT: https://www.goodchoiceit.co.uk/

17/09/2026

Myth number one in the Cyber Security Myths series: encryption.

There’s a common claim that Cyber Essentials requires you to encrypt the hard drives on your computers. Having read the requirements document, I don’t believe that is the case.

That doesn’t mean you shouldn’t encrypt your devices. If a laptop containing confidential business data is stolen and the drive isn’t encrypted, that data could potentially be accessed, creating a serious data protection issue.

BitLocker or the equivalent is an easy security win for your business. So there are two separate questions: is encryption required by Cyber Essentials, and should you encrypt your business devices? As far as I’m aware, the answer is no to the first and absolutely yes to the second.

Official Cyber Essentials requirements: https://www.ncsc.gov.uk/cyberessentials/resources

GDPR: https://gdpr-info.eu

Visit GoodChoiceIT: https://www.goodchoiceit.co.uk/

28/08/2026

AI projects do not create value just because the technology looks exciting. Many experiments never reach production because the timing, reliability, compliance, or business case is not ready.

Dave’s point is that the person responsible for AI needs to do more than collect ideas. They should document opportunities, understand which use cases are mature enough to move forward, park the ones that are too early, and get the right projects over the line when the time is right.

The goal is simple: turn useful AI opportunities into measurable business value.

AI Advisory:
https://advisory.amalan.co.uk/ai-advisory

AI Evangelist:
https://www.goodchoiceit.co.uk/artificial-intelligence-service/ -evangelist

Two First Steps for AI:
https://www.goodchoiceit.co.uk/artificial-intelligence-service/ -first-steps

27/08/2026

If your IT provider is slow, reactive, and only turns up when something breaks, that can become a bigger problem as your business grows.

Before changing providers, get clear on what you actually need technology to deliver. The goal is not simply faster support. IT should reduce risk, improve reliability, support growth, and help the business get more value from technology. If the current provider cannot deliver that, staying with the status quo can leave you exposed to ransomware, wasted spending, and competitors moving faster.

Outsourced IT Director:
https://advisory.amalan.co.uk/outsourced-it-director

IT Buyer’s Guide:
https://go.goodchoiceit.co.uk/it-buyers-guide-ebook

Contact Dave:
https://www.goodchoiceit.co.uk/contact-us/

27/08/2026

AI spending needs more than enthusiasm. It needs a budget, clear ownership, and a way to measure whether the investment is actually delivering business value.

Dave recommends setting an AI budget, putting someone in charge, and reviewing the results over the next 6 to 12 months. If a tool is expensive but does not improve productivity, reduce costs, or support growth, it may be creating negative value rather than helping the business.

IT also needs to be involved early enough to challenge poor decisions before money is committed and projects become difficult to stop.

AI Advisory:
https://advisory.amalan.co.uk/ai-advisory

AI Evangelist:
https://www.goodchoiceit.co.uk/artificial-intelligence-service/ -evangelist

Two First Steps for AI:
https://www.goodchoiceit.co.uk/artificial-intelligence-service/ -first-steps

26/08/2026

AI is changing how software security needs to be managed.

If your business develops custom software or relies on specialist vendors, vulnerability testing can no longer be something that happens occasionally. Attackers are gaining access to faster tools, so vendors and development teams need to find and fix weaknesses much more quickly.

That also means more frequent changes, more patches, and a greater chance that updates will break something. Businesses should expect more disruption and make sure suppliers are testing their products properly.

Virtual CISO:
https://advisory.amalan.co.uk/virtual-ciso

Cybersecurity Services:
https://www.goodchoiceit.co.uk/cyber-security-services/

Outsourced IT Director:
https://advisory.amalan.co.uk/outsourced-it-director

26/08/2026

AI tools can be useful, but businesses need to control what data and system access they are given.

Do not give an AI tool access to systems it does not need, and avoid uploading confidential business or customer information without understanding how that data is handled. Depending on the platform, account type, and settings, prompts or files may also be used to improve models unless you change the relevant privacy controls.

The safest approach is to set clear rules, limit permissions, and make sure staff know what they can and cannot share with AI.

AI Policy:
https://www.goodchoiceit.co.uk/artificial-intelligence-service/ -policies

AI Advisory:
https://advisory.amalan.co.uk/ai-advisory

Two First Steps for AI:
https://www.goodchoiceit.co.uk/artificial-intelligence-service/ -first-steps

Address

Midtown Hub
Sutton
SM11NU

Telephone

+442080995540

Website

Alerts

Be the first to know and let us send you an email when Amalan posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category