It’s that time again! Global cybersecurity PR agency Eskenzi PR has opened nominations for its tenth annual Security Serious Unsung Heroes Awards. The awards celebrate the UK’s most extraordinary cybersecurity professionals who work to make the industry not only more secure, but also more diverse, healthier and better informed about current events. Key sponsors include CultureAI, OneAdvanced and The Zensory. The awards are also supported by Computer Weekly, Information Security Buzz and IT Security Guru. 

The awards celebrate the cybersecurity professionals who go above and beyond to make a difference, often behind the scenes. They recognise educators who are fostering the next generation of cyber talent, those who are fighting cybercrime head-on, and mentors who are guiding others in the field. The awards also acknowledge those who are making cybersecurity a more inclusive space (Diversity Champion) and those who prioritise the wellbeing of their peers (Cybersecurity Wellbeing Advocate).

For 2026, three new categories have been introduced:  

• Cyber Scribe: This category celebrates the cybersecurity industry’s best and most insightful cyber blogs and newsletters, including those published on Medium, Substack or LinkedIn.

• Voice of Security: This category celebrates the industry’s best podcasts and vodcasts.   

• Channel Champion: This category celebrates the unsung heroes of the channel, from distributors and resellers to vendors with a strong channel presence.

Entries are now open, which includes filling in a short form detailing why the person deserves the award. Nominations will remain open until 5pm on the 16th of September 2026, before closing for review by an esteemed (soon-to-be-announced) panel of judges. 

Nominees, nominators, and their guests are then invited to a celebratory evening in London in October, to coincide with Cybersecurity Awareness Month. Thanks to its sponsors, the Security Serious Unsung Heroes Awards are free to enter and to attend.

Sam Soares, CRO at CultureAI, said:  “CultureAI is proud to support the tenth Security Serious Unsung Heroes Awards, celebrating the cybersecurity professionals who protect their organisations without fanfare, even as the threat, technology and governance landscapes shift. As AI adoption outpaces governance, these teams are absorbing an entirely new category of risk alongside everything they already carry. Recognising that work is long overdue, and we’re pleased to play a part in it.” 

“As we celebrate the 10th year of the Security Serious Unsung Heroes Awards, I’m incredibly proud of what these awards have come to represent. Over the past decade, we’ve had the privilege of recognising hundreds of remarkable people whose dedication, kindness and expertise have helped make our industry stronger, safer and more inclusive,” said Yvonne Eskenzi, Co-Founder and Director at Eskenzi PR. “I encourage everyone across the cybersecurity community to take a moment to nominate a colleague, mentor, teammate or friend who deserves to be recognised. Their contribution matters, and together we can make sure their achievements are celebrated as part of this very special milestone year.” 

  Categories this year include:

• Cyber Correspondent (for cyber journalists, broadcasters and writers)
• Godparent of Security
• Data Guardian
• CISO Supremo
• Security Avengers – Best Team
• Best Educator
• Best Ethical Hacker/Pentester
• Rising Star
• Security Mentor
• Best Security Awareness Campaign
• Diversity Champion
• Cybersecurity Wellbeing Advocate
• Cyber Scribe (for blogs/newsletters)
• Voice of Security (for podcasts/vodcasts) 
• Channel Champion

You can make nominations or find out more information here.

To see previous winners, click here.

The post 10th Annual Security Serious Unsung Heroes Awards Open for Nominations appeared first on IT Security Guru.

An experimental AI agent powered by OpenAI models has successfully compromised part of Hugging Face’s infrastructure during a controlled cybersecurity evaluation, offering a glimpse into the evolving offensive capabilities of advanced AI systems.

The incident, first disclosed by Hugging Face last week, has now been confirmed by OpenAI to have involved a combination of its models, including GPT-5.6 Sol and a more capable pre-release model with cyber safety restrictions temporarily relaxed for testing. According to both companies, the AI agent was evaluated as part of an internal benchmark designed to measure the cyber capabilities of frontier AI models.

OpenAI said the breach was quickly detected and contained, with no impact on customers or production systems. However, the company acknowledged that incidents involving increasingly autonomous AI agents are likely to become more common as models become more capable. This has raised alarm among cyber professionals. 

Oliver Simonnet, Lead Cybersecurity Researcher at CultureAI, said: “It’s not just the sophistication of the attack, but what it says about where we are with AI capability, as this wasn’t just a model executing a predefined exploit chain. It seemingly identified obstacles, discovered new attack paths, pivoted through multiple environments, and remained relentlessly focused on achieving its objective, even after leaving its sandbox.”

The evaluation was intended to help researchers better understand how advanced AI systems behave in realistic cybersecurity scenarios and to improve future safeguards. OpenAI said it has now restored the affected safety protections on the models used during the testing.

Kieran B, Head of Technical Services at Bridewell, noted: “OpenAI deserves credit for being transparent about what happened, disclosing the vulnerability responsibly and working with the affected parties to remediate the issue. That openness will help the wider industry learn from the incident. However, it also serves as a reminder that this was a controlled research scenario. If an attacker sought to exploit weaknesses in enterprise deployments using the new advanced AI models, the consequences could be far more significant.” 

The incident is likely to fuel ongoing discussions around AI security, agentic AI and the need for robust governance as organisations increasingly deploy autonomous AI systems. It also highlights the importance of rigorous testing and responsible disclosure as AI models gain the ability to perform increasingly sophisticated cyber tasks, even within tightly controlled research environments.

Cyber experts have weighed in on the incident. Sai Molige, Senior Manager of Threat Hunting at Forescout, said: “The required security posture is not ‘trust the model unless it misbehaves.’ It is to assume that a capable agent will discover every reachable path that advances its objective and to ensure that no such path grants unintended authority.”

Kevin Kirkwood, CISO at Exabeam, said: “The practical fix is to treat every dataset, model, plugin, and AI-processing job as untrusted code. Run it in a disposable sandbox with no standing cloud credentials, no direct access to production systems, and tightly restricted network egress. The goal is not to assume every malicious payload will be caught. The goal is to make sure a compromised worker has nowhere useful to go.”

“Next, remove the blast radius. Use short-lived workload identities, strict network segmentation, and separate trust zones for processing, production, internal datasets, and secrets. A worker handling user-supplied content should never inherit broad cluster access or reusable credentials. If one node is compromised, the incident should end at that node instead of becoming a tour of the company’s infrastructure.”

“Finally, build detection and response for machine-speed abuse. Monitor for rapid credential discovery, unusual service-account activity, cross-cluster access, abnormal API sequences, and large internal data pulls. Pair that with automated token revocation and fast worker rebuilds. ” Kevin continued. 

Roey Eliyahu, CEO and Co-Founder of Salt Security, said: “Every AI agent needs to be treated like a new identity with its own privileges, its own behavioral baseline, and continuous oversight. The question security teams should be asking right now is simple: do you have visibility into what your agents are calling, what systems they are reaching, and whether that behavior is what you sanctioned? Because if an agent starts making API calls it was never supposed to make, to systems it was never supposed to reach, you need to know before the breach happens, not after.”

Oliver Simonnet from CultureAI concluded: “This incident really highlights the challenges of building AI systems that are powerful enough to strengthen cyber defence whilst also ensuring they remain contained during development and testing. Being able to securely evaluate these systems is just as important as securing the systems they’re designed to protect.”

The post OpenAI-Hugging Face Incident: What We Know appeared first on IT Security Guru.

The 25th July 2026 marks one year since the Online Safety Act’s landmark child safety duties came into force, making it a natural moment to assess what’s changed, what’s worked and what challenges remain. Although the Act itself received Royal Assent in October 2023, its requirements were introduced in phases, with 25th July 2025 being the date many of the most visible obligations on platforms took effect.

The child safety duties require platforms likely to be accessed by children to introduce stronger protections, including effective age assurance, child risk assessments and measures to reduce exposure to harmful content. 

One year on, has the Online Safety Act fundamentally changed the internet for UK users, or has it simply shifted the challenges elsewhere? We spoke to cybersecurity experts for a short series of reports to find out more.  

Today, we’re examining the unintended consequences of the Act… 

Professor George Loukas, Head of Centre for Sustainable Cyber Security, University of Greenwich, said: “Ofcom has moved from consultation to enforcement. Naturally, the larger adult sector platforms have been the most visible early targets, and there have been lots of discussions on whether that led to a shift to more VPN usage as well as to non-compliant adult websites. These were all predictable though.”

Uptick in VPN Usage 

For many, the enforcement date signalled a natural (if not predictable) shift towards VPN usage to get around age verification tests. The evidence backs up this hypothesis: Proton VPN’s 2025 end of year report revealed that one of the biggest spikes in VPN sign-ups globally was seen in the UK from the 25th July. 

Konstantin Levinzon, co-founder of Planet VPN, noted that the real issue is people seeking out ‘free’ or not reputable VPNs, posing a significant security risk: “The biggest unintended consequence has been pushing people towards less secure tools, not more careful online behaviour. Age verification requirements have driven a significant increase in VPN adoption, but many users don’t seek out reputable providers – they simply download the first free VPN they find. Those services are often the ones leaking DNS requests, harvesting telemetry or relying on weak security practices, creating a worse privacy outcome than the legislation was designed to prevent.”

Sanjeev Malhotra, chief information security officer at TSG, emphasised the security risk: “People engaging with unvetted VPNs are potentially opening themselves up to serious risks, including malware infections, phishing attempts and personal data harvesting. At the end of the day, it’s still going through a server somewhere, and most people don’t stop to think about who’s operating it, where that data is going or what safeguards are actually in place. In some cases, people may be trading one privacy concern for another without realising it.”

A Lack of Measurable Outcomes? 

But is the ban on children accessing adult sites actually working? Some experts argue that there’s no hard evidence to back it up.

Elle Todd, Partner and Co-chair of the Entertainment & Media Industry Group at Reed Smith LLP, said:  “Ofcom’s recent age assurance report found that the proportion of children encountering harmful content online has not substantially improved despite widespread implementation efforts. The uncomfortable truth is that, based on this report, significant investment in compliance and technologies has not yet translated into measurable improvements in safety outcomes.”

Brian Higgins, Security Specialist at Comparitech, noted that, despite some non-compliance fines being handed out, there are still notable enforcement gaps: “Stats from Ofcom summarising their activities during the first twelve months of the Online Safety Act include the launch of 30 investigations, and fines for statutory violations in the region of £4 million GBP. Unfortunately they have also identified ‘enforcement gaps’ where AI and algorithmic content are concerned.”

“This item, in particular, could be a precursor to more widespread enforcement action in the future but a brief investigation into the facts reveals that their twelve-month fine collection figure only stands at £55,000. Couple that with their fairly embarrassing skirmish with the American platform 4chan, where their interjurisdictional service of a £520,000 financial penalty notice was rather infamous met with a picture of a hamster and a heavy dose of internet ridicule and it becomes rather obvious that they aren’t performing particularly well.”

Examining Data Storage and Verification System Security

Boris Cipot, principal security engineer, Black Duck, argues that we should be looking beyond whether checks are working and to whether the software behind the systems doing those checks is actually secure: “For many organisations, the focus has been on whether age checks are working. But an equally important question is whether the software behind those systems is secure and properly maintained. If a vulnerability, misconfiguration or compromised third-party component allows age checks to be bypassed, then this is not just a cybersecurity problem anymore but can quickly become a regulatory one as well.”

Sarah Bone, Co-Founder of YEO Messaging, notes the growing number of specialist identity providers: “The biggest unintended consequence has been a shift in where trust actually sits. Before the Online Safety Act, platforms largely carried the responsibility for verifying users themselves. Now we’ve got a growing ecosystem of specialist identity providers, each holding highly sensitive personal information. That’s strengthened online safety, but it’s also concentrated trust into fewer organisations, which makes them increasingly attractive targets for attackers.”

So what should age verification providers be doing?

Martin Wegrostek, Cyber Security Portfolio Manager at cybersecurity specialist OryxAlign, said: “Businesses should work on the assumption that breaches are a matter of when, not if. The question is whether providers have built their services with security and privacy by design. That means collecting the minimum amount of information needed to verify age, encrypting data both in transit and at rest, enforcing strong access controls, continuously monitoring for suspicious activity and having a well-rehearsed incident response plan. Organisations relying on third-party age-assurance services should also carry out regular security assessments and review the resilience of their supply chain, rather than assuming a compliant provider is automatically a secure one.”

On Trust and Risk

The conversation should also focus on human risk, said Tim Ward, CEO and co-founder, Redflags: “Content moderators, trust and safety teams, and customer support staff at in-scope platforms are, for the first time, routinely processing government ID documents, facial scans, and other highly sensitive data belonging to minors as part of their everyday work. That’s a substantial new category of human risk, from simple mishandling to targeted social engineering aimed at staff with access to this data, and it’s had almost no public discussion compared to the technical side of compliance.”

“Organisations that have spent the past year focused on the verification system itself should be asking whether the humans downstream of it have had the same level of scrutiny and support,” Ward noted. 

The post Examining the Unintended Consequences of the Online Safety Act appeared first on IT Security Guru.

Today (20 July 2026), Andy Burnham became Prime Minister of the UK, succeeding Sir Keir Starmer. While there is not yet a detailed ‘Burnham tech strategy’, pre-transition briefings and reports over recent weeks suggest a strong focus on AI, including plans for a dedicated AI Minister, the scrapping of the hotly debated digital ID programme, and the potential reorganisation of the Department for Science, Innovation and Technology (DSIT), with its responsibilities redistributed across other government departments.

So, what does the cyber community hope Burnham will do in the realm of cybersecurity, AI and tech as Prime Minister? We asked the industry…    

Charlotte Wilson, Head of Enterprise at Check Point said: “Britain’s AI department is at the forefront of the country’s productivity strategy, playing a crucial role in how the technology will be developed and rolled out to drive wider economic growth and defence.”

“Incoming policymakers should take heed; artificial intelligence is the gorilla in the room and will remain so for the foreseeable future. Any suggestion of redeployment or downsizing could send the wrong signal to businesses and cyber criminals about how seriously we take the most transformational technology in living memory,” Wilson continued. 

Dray Agha, Senior Manager of Security Operations at Huntress, added: “Smart infrastructure beats a spending war, and fortunately the UK can’t outspend the US or China on AI models anyway, so the new Prime Minister must focus on where we can win: secure public datasets and targeted sovereign compute.”

“Safely unlocking NHS data while fortifying our energy grid will build real domestic leverage without compromising national security. With guaranteed access to US tech currently on ice, relying solely on Washington is no longer a viable security strategy. The UK must leverage our AI Security Institute to build a ‘middle-power’ tech coalition with NATO and Commonwealth allies, pooling resources to ensure collective cyber resilience.”

Additionally, Muhammad Yahya Patel, vCISO and Cybersecurity Advisor for EMEA at Huntress, noted: “The UK doesn’t need to win the frontier model race; it needs to be a serious, trustworthy place to deploy AI at scale. That’s a more achievable and arguably more valuable position. The ally-pooling argument on sovereign compute and cloud interoperability is sensible from both an economic and security standpoint.”

“The UK’s convening credibility on this particularly through the AI Security Institute is a genuine asset that Burnham should be using. Unlocking health data for AI R&D is genuinely valuable but it’s only responsible if the security and governance infrastructure around that data is built first, not retrofitted after the damage is done. Right now the ambition is ahead of the security maturity.”

Jake Taylor, Head of Government NEMEA at Filigran, said:  “If the new government wants to bring more critical national infrastructure under public ownership, cybersecurity has to become part of that conversation from day one. National resilience isn’t just about protecting individual organisations anymore. It’s about ensuring energy providers, government, suppliers and operators can share intelligence, understand emerging threats and coordinate their response before disruption spreads.”

“The biggest challenge isn’t a lack of security tools. Most critical infrastructure organisations already have those. The challenge is breaking down the silos that still exist between organisations and turning threat intelligence into something that informs operational decisions, rather than simply generating more alerts. As the geopolitical environment becomes increasingly volatile and nation-state activity continues to rise, collaboration will be every bit as important as technology.”

Taylor continued, “the Cyber Security and Resilience Bill is an important step because it moves the conversation towards common standards and greater coordination. If public ownership expands, cybersecurity needs to evolve from a collection of individual security programmes into a genuinely national capability, where intelligence sharing and continuous threat exposure management become fundamental to protecting essential services.” 

Andy Burnham’s long-term plans for the UK’s cyber, AI and technology sectors are still taking shape. The Guru team will be keeping a close eye on developments as his new government begins to set out its agenda.

The post What Does the Cyber Industry Want to See From the New UK Government? appeared first on IT Security Guru.

Last year, CSIDES took place on The Grand Pier in Weston-super-Mare for the first time – a day filled with cyber talks, Cyber’s Got Talent, exceptional swag, its own theme song and – we are told – an extraordinary raffle. 

After the success of the inaugural event last summer, on the 9th October 2026, industry experts will gather in North Somerset once again, courtesy of event sponsors Tines, 4FOX Security, Consultants Like Us, Punk Security, PPRO and IASME.  

The Gurus sat down with the event’s organisers, Hazel McPherson and Jess Matthews (both Most Inspiring Women in Cyber Award winners and esteemed cyber professionals) to discuss all things CSIDES.

You’re back at the beach for the second annual CSIDES event! Can you tell readers who aren’t familiar what CSIDES is and who it’s for? 

CSIDES is the UK’s first cyber security event built by and for a coastal community. It is a one-day event which was designed to equip individuals, businesses, and educators with the tools to protect themselves in a rapidly shifting digital world. 

Why Weston? What makes The Grand Pier so special?  

Weston-super-Mare is a popular seaside resort in Somerset. However, like so many coastal communities in the UK it suffers from historical underinvestment in terms of opportunities in tech and cyber security. 

As a result, talent leaves the town to explore roles in larger cities, such as Bristol, Exeter or further afield. CSIDES was created to show that it is possible to stay and be part of the highly dynamic field of cyber security. Not only that, but local businesses also have access to experts on their doorstep who can provide support.

The Grand Pier is a renowned feature of the town. We could not think of anywhere better to host CSIDES, as an iconic symbol which we felt was the perfect setting for the event. Attendees can immerse themselves among the rides and gaze across the Bristol Chanel whilst taking in serious, cyber security topics in a fun atmosphere! 

What can attendees expect to see at this year’s event? Can you give us any sneaky insider insight?

We have a TV celebrity as a speaker! A workshop on scam callers. The Big Fat Quiz of the Pier. We have 5 rooms of accessible talks and interactive activities. Some of (if not the best) swag in the South West!    

Reflecting on last year’s event, what’s your favourite thing about CSIDES? What did you learn? 

It was exciting for me to see people with no experience in cyber working alongside really experienced senior leaders in cyber in the workshops. Realising that we have created a space where people could talk about cyber in a meaningful way regardless of experience or skills.
 

The local community may not be as knowledgeable about cyber as those who work directly in the industry. Why do events like these matter to them too?

We in the industry are poorer when we only look inwards. There are many in cyber security who see their role as more than a job, it is their mission to protect. To protect our families, communities, businesses and nations. We must be outward-looking as it is shared responsibility, and this is why events like CSIDES matter. We can start at home and locally, empowering people with knowledge so they can walk away from the Pier with steps to better protect themselves. What is more rewarding than that? 

And finally (and just for fun), what’s the best part about the seaside?

Hazel: My favourite thing about the seaside is how it never really changes. As a child, it was all about family holidays, donkey rides, building sandcastles, and paddling in the sea. Those are some of my happiest memories. 

These days, I appreciate it in a different way. I love the sound of the waves, the feel of the sand between my toes, and spending hours looking for unusual pebbles or peering into rock pools in the hope of spotting a tiny crab, a shrimp, or another glimpse of life beneath the surface. 

There is something wonderfully calming and familiar about the good old British seaside. It has a way of slowing life down and reminding me to simply enjoy the moment.

Jess: For me, I was born in Weston-super-Mare and the best part about growing up at the seaside has to be crabbing with my brother. I spent a lot of my childhood looking for limpets on the rocks or using bacon as bait (they prefer it smoked!). There is nothing more satisfying than pulling up the line and seeing a lot of crabs. The bucket was always full and releasing them afterwards was chaotic as they all scurried away in multiple directions. Memories!
 

The post Q&A: Cyber’s Headed Back to the CSIDES appeared first on IT Security Guru.