Roughly half of UK small businesses report a breach or attack each year. Most responses treat this as a training problem or a firewall problem. A third factor sits underneath both: your data lives in six suppliers' systems, so you depend on six security practices, and every copy between them is another door. This article shows the arithmetic, and states which properties change it.
Connect with us about a secure estate · · Replies within 24 hours
The Department for Science, Innovation and Technology publishes the Cyber Security Breaches Survey each year. It reports the share of UK organisations that identified a breach or attack, and the figure has stayed close to half for businesses across recent editions.
The survey also reports low uptake of basic controls among smaller organisations. Many hold no incident response plan, and many do not know which of their suppliers hold their data.
Two problems therefore run together. Attacks are common, and the ability to answer questions after one is uncommon.
Count the systems that hold your customer data. A booking tool, an accounts package, a customer relationship system, a payroll provider, a marketing platform and a document store. Six suppliers is a normal position for a small organisation.
Three consequences follow, and each one is arithmetic rather than opinion.
UK data protection law requires you to report a notifiable personal data breach to the ICO within 72 hours. The ICO sets out the duties in its UK GDPR guidance.
The report needs four facts. Which data was affected. How many people. What you have done. What risk the people now face.
| Fact needed | Six suppliers | One estate |
|---|---|---|
| Which records were read? | Ask six suppliers, and wait. | Query your own event log. |
| How many people? | Add six answers, and hope for no overlap. | Count once. |
| Who read them? | Six log formats, if logs exist. | One named actor per event. |
| Could the log be altered? | Usually yes. | No, the chain would break. |
The fourth row decides what the other three are worth. A log an administrator can update records what somebody chose to leave in it.
Five, and each one is a design decision made before your data exists.
The National Cyber Security Centre's Cyber Essentials scheme covers the controls that sit above these properties, and the ICO's guidance on encryption treats it as a core security measure.
A framework asks whether you have a control, and it does not ask how many places must hold it.
Consider access control. A framework asks whether access is limited to what a role needs. Six suppliers means six answers, six audits and six chances of a wrong answer. Your certificate then describes six separate positions.
Frameworks are worth holding. They measure practice, and architecture decides how much practice is needed.
We build your system on engage.re, and the five properties above are properties of the platform.
Sense Future built engage.re, and it has run in production since December 2025.
A common objection follows. One estate means one supplier, so you depend on us instead of six.
Three properties answer it, and each one is checkable before you sign.
We set out the seven pre-signature tests in vendor lock-in, what can you prove before you sign.
A council runs forty systems from twenty suppliers. A breach in one supplier starts a three-week exercise to establish which residents were affected, and the 72-hour clock runs from the moment the council becomes aware.
A small business runs six systems. The exercise takes three days instead of three weeks, and it exceeds the same deadline. The arithmetic scales, and the deadline does not.
The care home software and retail software pages set out the sector detail. Our guides to the Data Security and Protection Toolkit and provable erasure cover the duties that follow an incident.
Roughly half of UK businesses identify a breach or attack in a year, on the Cyber Security Breaches Survey published by the Department for Science, Innovation and Technology. The same survey reports low uptake of basic controls among smaller organisations, and many hold no incident response plan.
Because your exposure is the weakest of their security practices, and you control none of them. Six suppliers means six sets of credentials, and every integration between them creates a copy with its own retention period and its own access list. The copies are the part nobody can count.
A notifiable personal data breach must reach the ICO within 72 hours. The report needs four facts: which data was affected, how many people, what you have done, and what risk those people now face. Answering across six suppliers usually takes longer than the deadline allows.
Anti-falsification. A log whose rows an administrator can update records what somebody chose to leave in it. A log that carries a hash of the previous entry in each new entry makes any alteration detectable, and that property is what gives an incident report weight.
Partly. A controls framework asks whether you have a control, and not how many places must hold it. Six suppliers means six answers, six audits and six chances of a wrong answer. Frameworks measure practice, and architecture decides how much practice is needed.
We build your system on engage.re. Your records live in one estate with one gate deciding every domain crossing, each record is encrypted separately under keys you hold, every access is an event in a signed chain, and each record carries its own retention class and legal hold.
Connect with us about a secure estate · · Replies within 24 hours