Your business is using more software than you think.
AI tools, SaaS subscriptions, browser plugins, and apps adopted by individual team members all add up — and most businesses don’t have full visibility of what’s in use, who has access, or what data those tools can see.
For many SMEs, that’s not a future risk — it’s a current one.
GDPR exposure – Tools processing personal data without a Data Processing Agreement in place.
Licence waste – Unused or duplicate subscriptions that no one has reviewed.
Shadow IT – Tools adopted without IT visibility — carrying unknown security risks.
Audit Failures – Unable to demonstrate control of your software estate to customers or insurers.
We map everything your business is currently using — including tools IT didn’t know about. You get a clear picture within days.
We right-size licences, put Data Protection Agreements (DPAs) in place where needed, and establish a lightweight approval process for new tools going forward.
Quarterly reviews keep your software estate current. New tools go through a fast, structured intake — so you move quickly and stay protected.
This isn’t an enterprise compliance programme. It’s a practical service designed for SMEs that want to use the best available tools — without the risk that comes from adopting them without governance.
EMH acts as your IT partner, not a gatekeeper. Our role is to give you the information you need to make good decisions quickly — and to keep the paperwork off your desk.
UNSANCTIONED / END-OF-LIFE SOFTWARE
A staff member at VoIP provider 3CX downloaded X_Trader, an old financial trading application that its own maker had decommissioned three years earlier and no longer supported or patched. The trojanised installer backdoored that employee’s PC, letting attackers move laterally through 3CX’s network for months undetected and ultimately plant malware inside 3CX’s own official desktop app. That app was then pushed out via routine auto-update to roughly 600,000 business customers and 12 million users worldwide. Investigators called it the first confirmed case of one supply chain attack triggering another.
UNMANAGED LEGACY SOFTWARE
An attacker used a free penetration-testing tool to scan Carphone Warehouse’s infrastructure and found an internet-facing WordPress installation from 2009 that had gone unpatched for six years. Over 3 million customers’ and 1,000 employees’ personal data was compromised. The ICO’s message was blunt: if a free scanning tool can find an unmanaged system, so should the organisation’s own security team.
Source: BankInfoSecurity, ICO commentary
MISSED PATCH, MONTHS OLD
One of the largest breaches on record was traced to a single unpatched Apache Struts vulnerability. Equifax failed to apply an available patch for months, then took weeks to disclose the breach once discovered. The financial and reputational fallout ran into hundreds of millions of dollars and years of litigation.
UNMANAGED PERSONAL SOFTWARE
An Okta employee signed into a personal Google account on the Chrome browser of a company-managed laptop. A sensitive service account’s username and password had synced into that personal account, giving attackers a route into Okta’s customer support system — and from there into downstream customers including BeyondTrust and 1Password. No malware was needed; unmanaged personal software on a business device was the whole attack path.
Source: Computer Weekly, November 2023
UNPATCHED THIRD-PARTY SOFTWARE
A previously unknown SQL injection vulnerability in the MOVEit file transfer tool was mass-exploited by the Cl0p ransomware group before a patch was available. UK payroll provider Zellis used MOVEit to exchange files with its clients, so when its instance was compromised, the personal data of employees at British Airways, the BBC, Boots, and Aer Lingus was exposed, including national insurance numbers, dates of birth, and home addresses. None of these employers used MOVEit directly, and none had a contract with it — the exposure came entirely through a supplier’s supplier. Every affected organisation reported the breach to the ICO. Globally, the vulnerability affected over 2,700 organisations and around 93 million people.
Source: The Register, July 2023
The pattern: every one of these incidents traces back to software or access that fell outside routine governance — a missing patch, an unmanaged account, or a personal tool touching business data. EMH’s SaaS and AI governance service is built to close exactly these gaps before they become headlines.
A fixed price audit gives you a clear picture of your current exposure and an actionable recommendations report – with no commitment to ongoing services.
Book a free 30-minute Call with one of our team members. We’ll listen to what you’re trying to achieve, give you honest advice on your opinions, and help you figure out the right next step – no pressure, no sales pitch.