Four pressures are landing on organisations at the same time, and one of them has a date on it. This page sets them out plainly, with the numbers behind them and what to do first.
They are landing on organisations at the same time, and most teams are trying to handle them with the same people who keep the lights on. TrusTrak sits where the four overlap.
SQL Server 2016 has already left extended support, and Windows Server 2016 follows on 12 January 2027. Because SQL 2016 will not run on Server 2022 or 2025, the database and the operating system have to move together.
ISO 27001 and SOC 2 are now the price of enterprise and US contracts. DORA reaches ICT suppliers to EU-regulated firms. In the UK, Cyber Essentials mandates MFA on cloud services and gates NHS and government work.
More than half of UK firms now use AI in some form. The thing holding them back is not the technology. It is knowing how to roll it out without handing an agent the keys to production.
AI builders have made brochure sites nearly free. Engineering-led web work, with performance, security, integrations and someone accountable for hosting, has held its value. We only do the second kind.
After that there are no security patches unless you pay for Extended Security Updates. If any part of your estate still runs on Server 2016 or SQL Server 2016, a scoped assessment now is cheaper than an emergency later.
market figures from the uk cyber security breaches survey, ons and beaming / used as context, not as audited data
cyber security breaches survey 2025/26 / beaming / ons / uk figures, used as market context
Every one of these begins with a free 30-minute call and a fixed-scope piece of work. None of them needs you to commit to a programme on day one.
The operating system and the database have to move together, and a sensible wave plan takes weeks to agree before anything is touched. Starting in January leaves no room for the rollback rehearsal that keeps your data safe.
Cyber Essentials Plus in the UK is weeks, not months, for a cloud-based estate. ISO 27001 and SOC 2 take longer, and the evidence is easier to produce when the cloud foundations are built for it.
Secure Foundations combines the assessment, a compliance-ready landing zone and the certification readiness, so the landing zone becomes the evidence base rather than a second project.
An agentic readiness audit is a short, fixed-fee piece of work. It tells you what agents can currently reach, what they should not, and the order to fix it in.
Tell us what you run today and what is pushing you to move. Thirty minutes, no deck, and a straight answer about whether you need us yet.