Building security resilience before we need it
Freebridge Community Housing was Highly Commended in the Cyber Security category of the Housing Technology Awards 2026.
Cyber-security rarely becomes urgent at a convenient moment. For mid-sized housing providers like us, the real test isn’t just whether we can respond when something goes wrong, but whether we’ve done enough before that moment arrives. In housing, that responsibility feels especially personal; behind every system, login, repair request, payment process and resident record is a person relying on us to keep our services safe, available and trusted.
This has shaped how we think about cyber-security. We are a forward-thinking housing provider with around 250 colleagues and a modest technology team of 11 people. That means our approach must be practical, proportionate and focused.
Why proactive cyber-security matters now
The direction of travel is clear. The UK’s Cyber Security and Resilience Bill is reinforcing the importance of stronger digital defences for the services people rely on every day. For housing providers, this isn’t simply a compliance issue; it’s about making sure our systems, suppliers, people and data are resilient enough to withstand increasingly sophisticated attacks and recover quickly when something goes wrong.
From technical controls to organisational resilience
- Identity and access – phishing-resistant, privileged-access hardening and continuous identity governance.
- Threat management – continuous threat exposure management for proactive risk reduction.
- Data protection – data-centric security controls.
- Culture – behavioural change programmes supported by AI-driven awareness tools.
Balancing automation with human judgement
One of the biggest lessons for us has been that while speed matters, judgement matters more. Automation now underpins much of our detection and response capability, helping to reduce our response time from hours to minutes. However, human oversight remains essential. The aim isn’t to replace people with automation but to give skilled people better information, faster.
The challenge for midsize housing providers
Cyber-security has moved beyond being a technical safeguard. It’s now a key part of business strategy, organisational trust and service resilience. The challenge for mid-sized housing providers organisation is how to use best-practice technology in cost-efficient ways while still building a modern security strategy that is credible, measurable and sustainable.
That challenge is becoming sharper as AI-powered attacks become faster, more convincing and more automated. Traditional controls still matter but they’re no longer enough on their own. Housing providers need to move from a mindset of simply preventing incidents to one of reducing exposure, detecting earlier, responding faster and recovering with less disruption.
For me, this is where the conversation becomes very practical. Security and trust should be seen as business enablers, not blockers. Boards and executive teams are increasingly expected to understand cyber risk, ask better questions and provide clear accountability. At the same time, supply chains, cloud platforms and connected services mean resilience must extend beyond the boundary of the organisation itself.
By embedding resilience into the foundations, housing leaders can protect their corporate reputation, maintain confidence and support sustainable digital transformation.
Our proactive programme last year comprised:
- Delivery of CloudGuard AI SOC
- Delivery of Microsoft Sentinel SIEM and Defender using E5 capability including Purview.
- Development of our existing Mimecast email security platform, DLP, archiving and awareness risk management to include browser isolation, misaddressed email protection and Exchange sync and recover.
Why we chose this approach
Our move towards Microsoft 365 E5 over the past three years was very deliberate. It gave us a unified foundation for threat protection, identity governance, compliance and data protection. Rather than adding disconnected tools, our aim was to build an integrated ecosystem that could scale with us, reduce duplication and give our team better visibility across our technology estate.
Business & technology results
Combining CloudGuard AI SOC capability with Microsoft E5, Sentinel, Defender, Purview and Mimecast has helped us to create a more joined-up defence. The practical benefit is a stronger ability to detect, investigate and respond to threats, while continuing to improve our mean time to detect (MTTD) and mean time to respond (MTTR).
Innovation & next steps
The wider opportunity is to use cyber-security as an enabler for safer digital transformation. In housing, this means protecting people, data, services and, increasingly, connected assets, including:
- Human-centric protection (Mimecast & E5) – while E5 provides native security, tools such as Mimecast add an innovative layer focused on human risk management, including AI to detect personalised phishing scams (in particular those targeting housing officers with access to tenants’ sensitive personal and financial data).
- Proactive defence –Microsoft Sentinel’s AI-driven user and entity behaviour analytics allows housing providers to move from reactive to ‘offensive’ security.
- Functionality – Sentinel can automatically hunt for anomalies across an entire digital estate.
- Securing the ‘smart home’ and IoT – as more housing providers deploy IoT sensors for damp, mould and energy monitoring, they create new entry points for cyber-attacks. This integrated strategy provides options for the network segmentation and monitoring necessary to protect these critical systems.
Measuring progress
- Reduce our MTTR by 50 per cent – leverage Sentinel and CloudGuard’s SOAR (e.g. auto-suspending accounts flagged as identity risks), aiming for response times measured in minutes rather than hours.
- Realise operational software cost-savings of 10 per cent– consolidate disparate and overlapping legacy security tools into the E5 suite.
- 100 per cent visibility of critical IoT/smart-building assets – onboard smart-building sensors to detect anomalies which could indicate tampering or unauthorised access, supporting compliance with Awaab’s Law.
We’re already seeing some early benefits from combining AI-assisted SOC capability with human-led decision-making. Our first focus has been on reducing our response times, improving visibility and using operational intelligence to target areas of higher risk.
The value we are aiming for:
- Establish a ‘golden thread’ of security governance – use Microsoft Purview for the classification and auditing of sensitive data, ensuring a transparent and defensible chain of information.
- Strengthen cyber literacy – provide future security posture reports to our board, translating technical risks into business terms.
- Enhance human risk resilience – shift from basic compliance training to ‘informed’ awareness and provide targeted coaching to the top five per cent of higher-risk users.
The lesson
It’s not that cyber resilience requires the largest team or the biggest budget. It requires clear priorities, joined-up tools, engaged leadership and a culture where security is understood as part of everyone’s role. In housing, that matters because cyber-security is about protecting the trust residents place in us and ensuring essential services continue when they’re needed most.
Adam Whittle is the head of ICT at Freebridge Community Housing. The housing provider was Highly Commended in the Cyber Security category at the Housing Technology Awards 2026.
