Two critical PHP vulnerabilities, the widely used programming language underpinning millions of websites and web applications, have prompted urgent warnings from cybersecurity authorities worldwide.

Following reports on the 20th October that details of the vulnerabilities had leaked ahead of their scheduled disclosure, PHP developers released emergency security updates on 21 October. The UK’s National Cyber Security Centre (NCSC) urged organisations to identify affected systems and apply updates immediately, while Amazon’s threat intelligence team reported evidence of exploitation attempts dating back to 17 October.

With the vulnerabilities highlighting the potential consequences of security flaws in widely used web infrastructure, The IT Security Guru has gathered reactions from cybersecurity industry experts on the risks, implications and lessons for organisations.

Samuel Hassine, CEO and co-founder, Filigran:

“Taking a website offline for a day is a far cheaper decision than explaining a breach for a year. The agencies asking organisations to do exactly that are giving sound advice, and the speed of the coordinated response shows how much the discipline has matured. These flaws sat in code that dates back to 2004 and were found with AI. The same tools will help attackers move just as fast, and early attacks are already being reported. The job is simple to state and hard to do. Find every system running PHP, including the ones hidden inside third-party products. Update to a supported version or take it offline. Then check that nothing got in while the window was open. Patching is the easy part. Knowing what you run is the real test.” 

Sai Molige, senior manager of threat hunting at Forescout: 

“PHP2Shell has the potential to become a Log4Shell-scale event, but for a different reason. With Log4j, the main problem was finding a library you didn’t know you had. With PHP, much of the forgotten infrastructure will be found, but won’t have an upstream fix.

“The durable lesson from Log4j is that organisations should treat “How quickly can we identify where we run X” as a measurable capability separate from patching speed.

“Discovering vulnerable infrastructure, however, is only the first step. When older systems have no available fix or depend on a vendor update, organisations need to reduce exposure, restrict unnecessary connections, and isolate affected systems while planning remediation.

“AI is very good at performing variant analysis when it has a reference point, lowering the effort and expertise required. That could increase the volume of attempts we see with these critical vulnerabilities, even if many never turn into full exploits.

“Common places where forgotten PHP tends to live include:

• Vendor appliances whose admin UIs are PHP: NAS devices, some firewalls and VPN portals, printers, building-management panels, and OT/ICS HMIs with web front ends. Organisations cannot patch them directly and have to wait for vendors which introduces lag.
• Bundled runtimes. Control panels and commercial packages often ship their own PHP binary, invisible to the OS package manager.
• Containers pinned to old base images. The host is current; the image from 2021 isn’t.
• Marketing microsites, campaign pages, and acquired-company infrastructure, often on hosting accounts paid by credit card outside IT.
• Admin tools on dev or jump boxes: phpMyAdmin, Roundcube, Nextcloud.
• Origins behind a CDN or WAF that are still directly reachable, which quietly defeats your edge rules.

“Organisations concerned about exposure should prioritise identifying affected systems, reducing unnecessary external exposure, and follow vendor guidance for remediation or compensating controls. Teams should use a combination of external exposure scanning, host-level package managers, container or SBOM scans and network behavior to identify all implementations of PHP in their environment. Organisations who believe they are compromised should rotate secrets on exposed hosts, filter multipart at the edge, restrict agree from web workers, isolate EOL hosts. Look for classic web-shell patterns: php-fpm, httpd, or apache2 spawning sh, bash, curl, wget, or base64, new or modified .php files in web roots and outbound connections from web worker processes.”

Oliver Simonnet, Lead Cybersecurity Researcher at CultureAI:

“PHP2Shell is a clear example of how little time we now have as defenders to secure our environments in the age of AI. In a world where these types of vulnerability discoveries may become commonplace, and details being leaked before formal disclosure, exploits created exceptionally fast, and attackers exploiting the issue in the wild rapidly before fixes are even available. It’s almost impossible to justify a traditional maintenance window in this situation and what can you do if you know for a fact you’re vulnerable and you need to decide if you even can apply a temporary mitigation, or need take exposed systems offline. Its a nightmare scenario for security teams.

AI may play a part in making this worse as it helps attackers develop exploits faster, but its also what gives us the power to discover these issues so they can finally be fixed. So the challenge is now to arrive at a balance where we have the capability to not only identify exposed systems, but also develop effective mitigations and get them deployed before active exploitation can cause these types of disruptions.”

Charlotte Wilson, head of enterprise at Check Point:

“The scale of this is enormous. We’re talking about two serious security flaws in technology that underpins around three-quarters of the internet, potentially allowing criminals to access vulnerable systems remotely without even needing a password. We’ve become so dependent on digital services that we rarely stop to consider how much of our everyday lives relies on the same underlying technology. Governments, businesses, banks and public services are all connected through an increasingly complex web of systems, and when a weakness like this is discovered, huge numbers of organisations can find themselves exposed at once. It’s a bit like discovering that millions of buildings have been fitted with the same faulty lock. Suddenly, everyone is racing to change it before someone works out how to open the door.

We’ve already seen how disruption involving major technology providers can have consequences across the world, and there are growing questions about our reliance on a handful of companies to keep essential services running. Regulators are now looking much more closely at the role these providers play in our critical infrastructure. The timing is particularly concerning given the NCSC’s warnings that artificial intelligence will increase the frequency and intensity of cyberattacks. Criminals are becoming faster at identifying weaknesses and exploiting them, leaving organisations with less time to respond.

When governments are choosing to take their own websites offline rather than risk leaving them exposed, it gives you a pretty clear indication of how seriously this is being taken. The immediate priority is getting systems updated, but the bigger question is whether we’ve become too dependent on technology that can leave so many organisations vulnerable at exactly the same time.”

Ben Ronallo, director of cybersecurity operations at Black Duck:

“This is a genuine drop-everything moment for anyone running PHP. The flaws are in the PHP engine itself, so a perfectly secure application on top of a vulnerable runtime is still exposed. Updating WordPress or your framework won’t fix it. You have to update PHP itself and restart the services that run it. It’s understandable that people are confused about how this unfolded. Word of the vulnerabilities leaked on Y Combinator’s Hacker News forum two days before the planned disclosure, and PHP moved its security release up a day in response. The source of the leak hasn’t been identified, but there’s no evidence a threat group was involved, and no exploit code was released. A screenshot of the researchers’ exploit tool did circulate, which added to the alarm. In the end, the early reports were largely accurate. The main difference is severity: PHP officially rates both flaws 9.2 rather than the 10.0 some reports cited. That’s still critical, and it doesn’t change the advice. The organizations I’m most concerned about are the ones that don’t know where PHP is running in their environment. Older versions sitting in containers, appliances, or legacy sites won’t receive an official fix. Nobody wants to be building a software inventory in the middle of an emergency. You need that visibility before the next one hits.”

Tim Mackey, head of software supply chain risk strategy at Black Duck:

“Preventing leaks of any vulnerability data for a CVE prior to an embargo for the patch being published is precisely what coordinated vulnerability disclosure processes are designed to protect against. When a leak, or advance knowledge, of a vulnerability occurs the entire ecosystem surrounding the vulnerability is placed at risk. As details of the leak are published, security defenders are faced with the real risk that malicious actors could use the absence of an official patch to supply their own malicious patches. Defenders should pay extra attention to the origin of their patches and validate functional changes against official release notes. After all, a malicious patch could implant a backdoor for future use and a rush to patch might present the right opportunity for malicious actors.”

Jamie Akhtar, CEO and Co-founder of CyberSmart:

“The NCSC advises identifying PHP across your infrastructure, prioritising internet-facing systems, and not limiting the search to outdated versions. That includes appliances and services that bundle PHP, so keep monitoring for updates from third-party vendors.

Update to the latest version of PHP and apply the additional hardening steps from the PHP Team. If you cannot update, the PHP Team has provided temporary mitigations. If those cannot be applied, or would take too long, the NCSC suggests considering taking the system offline until it can be fully mitigated.”

The PHP2Shell vulnerabilities serve as a reminder of how quickly weaknesses in widely used software can become a global cybersecurity concern. As organisations work to secure affected systems, the incident reinforces the importance of timely patching, continuous monitoring and maintaining visibility across the software powering critical services.

Shane Barney, CISO at Keeper Security, said:

“The two critical flaws found in PHP, the programming language behind WordPress and countless online shops, have now led to government services in France, Denmark, Finland and the Netherlands going offline, alongside UK council sites, NHS Scotland and Wikipedia. Fixes arrived on Wednesday amid reports of millions of attempts to exploit the flaws, though it remains unclear whether any have succeeded. CERT-EU, the EU’s cybersecurity response team, had advised organisations that could not patch immediately to consider isolating their internet-facing applications.

The scale sets this apart from a routine patch cycle. PHP sits beneath sites run by multinationals, public bodies and one-person businesses alike, and most of the people running them are not security specialists. They rely on hosting providers, plugins and agencies to keep up, and many are learning about PHP for the first time this week.

The flaws sat in widely used code for years until AI tools surfaced them. OpenAI, whose model helped find them, expects similar findings to increase sharply in the coming months, as AI continues to lower the effort needed to turn a complex flaw into a working attack. Patching is only the first step, and any site exposed before it was fixed should review who has access to both the site, as well as internal systems within an organisation. Security teams should remove admin accounts that are no longer in use, implement the principle of least privilege to restrict access, replace passwords as a precaution and protect every login with multi-factor authentication.”

The post Critical PHP Vulnerabilities Spark Global Security Alert: Industry Experts React appeared first on IT Security Guru.

Cybersecurity researchers at Forescout are drawing attention to the risks posed by exposed refrigeration control systems, warning that weaknesses in operational technology (OT) could have serious consequences for food supplies, business continuity and other temperature-sensitive operations.

The warning comes following cyberattacks against French supermarkets in October 2026, which reportedly disrupted refrigeration systems at hundreds of stores. Attackers were able to interfere with cooling operations, resulting in temperature fluctuations, spoiled stock and significant disruption.

The incidents have raised concerns about the security of internet-connected refrigeration equipment, particularly where older systems, exposed management interfaces and inadequate access controls leave operational technology vulnerable to interference.

Unlike conventional IT attacks, which frequently focus on stealing data or disrupting digital services, attacks against refrigeration controllers can directly affect physical processes.

These systems are responsible for maintaining temperatures across supermarkets, food storage facilities and other environments where consistent cooling is essential.

If attackers gain sufficient access, they may be able to manipulate temperature settings, interfere with defrost cycles or disrupt equipment operations. The consequences can extend beyond IT downtime to include damaged stock, financial losses and potential safety risks.

The issue also extends beyond food retail. Refrigeration and temperature-control systems are used in healthcare, pharmaceuticals, manufacturing and logistics, making their security an important consideration across several industries.

Internet Exposure Creates Opportunities for Attackers

One of the central concerns is the accessibility of operational technology that was not originally designed to withstand direct exposure to the internet.

Remote management capabilities allow engineers and third-party maintenance providers to monitor and adjust refrigeration equipment without visiting individual sites. However, these connections can introduce security weaknesses if they are poorly configured or inadequately protected.

Research into industrial control systems has identified publicly accessible management interfaces, outdated firmware and weak authentication as recurring problems.

In some cases, organisations may not have complete visibility of the equipment connected to their networks, particularly where systems have been installed and maintained by external contractors.

Forescout Finds Nearly 13,000 Exposed Refrigeration Services Worldwide

New research from Forescout’s Vedere Labs has identified 12,976 internet-exposed service observations across ten product groups, associated with 6,017 distinct public IP addresses in 99 countries and territories.

The findings suggest that the weaknesses highlighted by the French supermarket attacks are part of a much wider global problem.

The largest number of observations involved Copeland/Dixell XWEB services, with 7,075 recorded, followed by 4,697 Danfoss StoreView services. Researchers also identified 551 Copeland Site Supervisor services, 513 Carel pCOWeb services and 140 observations across six other product groups.

Importantly, these figures represent exposed services rather than confirmed compromised devices. A single IP address may host multiple services, while one management interface may control several downstream systems.

The researchers also found that 3,762 Danfoss StoreView service observations, representing 80% of the total, were running firmware older than version 4.3.1, making them potentially vulnerable to two previously disclosed security flaws.

Hacktivists Have Targeted Refrigeration Before

Forescout’s research suggests that attacks against refrigeration systems are not a new development.

According to a technical bulletin published by Danfoss, hacktivist attacks in 2022 affected 16 Russian supermarkets and 40 stores in Israel.

Forescout has also tracked more than 20 claimed attacks against refrigeration systems since January 2026, with pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) among the most active.

Targets have included supermarkets, wineries, fruit storage facilities and agricultural businesses across Europe.

However, the researchers stress that the initial access methods and identities of those responsible for the recent French attacks have not been confirmed.

Securing the Cold Chain

Forescout is urging organisations to review how refrigeration management systems are connected to the internet and who is authorised to access them.

Recommendations include removing publicly accessible management interfaces, replacing unsupported equipment, applying available security updates and introducing secure remote access for maintenance contractors.

The researchers also recommend multifactor authentication, individual user accounts and continuous monitoring to identify suspicious changes to temperature settings, defrost schedules and alarms.

The challenge is that attackers do not necessarily need to deploy malware to cause disruption. Once they gain sufficient access, they may be able to misuse legitimate management functions, making malicious activity harder to distinguish from routine maintenance.

The research highlights a broader issue for operational technology security: organisations need visibility not only of connected devices, but also of who can access them, what changes they can make and how those changes affect physical operations.

Read the full research here: Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk

 

The post Exposed Refrigeration Systems Raise Global Cybersecurity Concerns appeared first on IT Security Guru.

The best cybersecurity thought leadership agencies help organisations turn expert insight into credible executive content, original research and influential industry commentary.

• For technical, practitioner-led thought leadership: Bora combines cybersecurity content expertise with a team that includes former security practitioners.
• For research-led programmes: CyberEdge Group and 10Fold offer examples of turning cybersecurity data into substantial reports and media stories.
• For audience intelligence and search visibility: CyberTheory focuses on understanding security decision-makers, while Content Visit and First Page Sage connect expert content with organic discovery.
• For media visibility and storytelling: Eskenzi PR and Code Red offer specialist cybersecurity communications; Merritt Group combines cybersecurity and government-market expertise; Column Five brings brand storytelling and visual content capabilities.
• Entries are listed in no particular order. This guide compares agencies that deliver thought leadership services, rather than individual cybersecurity influencers.

What is a cybersecurity thought leadership agency?

A cybersecurity thought leadership agency helps a business develop and communicate informed perspectives on security challenges, technologies and industry developments.

The work can include executive ghostwriting, cybersecurity bylines, original research, white papers, interviews and expert commentary. Its defining feature is the substance behind the content: a useful argument, a distinctive interpretation or evidence that helps readers make better decisions.

A cybersecurity PR agency typically focuses on reputation, media relationships and communications. A cybersecurity content marketing agency may support a wider range of educational and commercial material. Either can deliver thought leadership when it has the expertise and processes to develop original insights.

For example, a basic article explaining ransomware is educational content. A research-backed argument about how organisations should rethink ransomware recovery can become thought leadership. The format may be similar, but the contribution is different.

For buyers, the question is whether an agency can extract expertise, challenge familiar assumptions and turn that work into a sustained programme.

How we selected these agencies

Agencies were assessed through their first-party service descriptions, published research, client references and case studies.

To qualify, an agency needed to demonstrate cybersecurity expertise or an established cybersecurity practice; services relevant to thought leadership, such as expert writing, research or earned editorial; and publicly identifiable client work or a substantive published research asset.

The selection includes cybersecurity specialists and broader agencies with relevant experience. Their different levels of cybersecurity focus are identified in the comparison table.

Agencies without demonstrable cybersecurity work, providers offering only routine content production, and individual influencers were excluded. Directory appearances alone were not treated as sufficient evidence.

Entries are listed in no particular order. “Best for” labels are editorial assessments of likely fit, rather than performance rankings. Agency-reported results are attributed accordingly and have not been independently audited. Historical case studies demonstrate experience, rather than necessarily confirming a current client relationship.

The guide will be reviewed annually to check services, supporting evidence and continued relevance.

Best cybersecurity thought leadership agencies in 2026

The right shortlist depends on the work you need: original research, technically credible writing, executive visibility, search discovery or international communications.

 

Agency	Cyber focus	Best for	Named clients or public references	Illustrative work or research
Bora	Cybersecurity specialist	Technical, practitioner-led content	Fortra, Thales, Tenable, Pentest-Tools.com	Expert-led content programmes
CyberEdge Group	Cybersecurity specialist	Research-led thought leadership	Google Cloud Security: report sponsor	Cyberthreat Defense Report
Content Visit	Cybersecurity specialist	SEO and AI-search visibility	IBM/Randori, Morphisec	IBM red-teaming content programme
CyberTheory	Cybersecurity specialist within ISMG	CISO audience intelligence	Client cases anonymised; research partner Cyentia Institute	CISO Engagement and Decision Drivers Study
Merritt Group	Dedicated cybersecurity practice	Commercial and government markets	Wandera; security references include Telos and Checkmarx	Wandera media programme
10Fold	Cybersecurity practice within deep-tech PR	Research-driven earned media	ForgeRock, AttackIQ	ForgeRock Consumer Breach Report
Eskenzi PR	Cybersecurity specialist	Expert commentary and media visibility	Bridewell, Armis, Huntress, KnowBe4	Bridewell thought leadership campaign
Code Red	Cybersecurity specialist network	Multi-region PR and research	BlackFog	Cross-border research and commentary
First Page Sage	Cybersecurity vertical within a broader agency	Search-led thought leadership	Cyberfort and Okta listed as client experience; Cadence case study	Cadence technical content programme, outside cybersecurity
Column Five	Cybersecurity experience within a broader agency	Brand storytelling and visual content	HackerOne	Cyberstrength campaign

The profiles below explain the evidence behind these examples.

Bora

Best for: Technical, expert-led thought leadership informed by former security practitioners.

Bora focuses on cybersecurity marketing and thought leadership. Its staffing differentiator is explicit: the team includes former cybersecurity practitioners alongside journalists, writers, marketers and PR professionals. Bora describes its combined cybersecurity experience as 150 years.

Named work includes Fortra, Thales, Tenable and Pentest-Tools.com. Its published examples describe interviewing subject-matter experts, creating technical guides and developing market narratives from offensive security expertise. Bora also reports producing seven of Thales’s ten leading globally deployed content pieces in 2025.

Its long-running Thales and Fortra relationships illustrate ongoing editorial support, including expert interviews and content development. The fit is strongest where writers need to understand technical detail while making an organisation’s expertise useful to buyers.

CyberEdge Group

Best for: Syndicated research assets and data-driven thought leadership.

CyberEdge Group combines cybersecurity research, content and marketing services. Its offering includes custom research reports and competitive sales tools designed to support thought leadership and commercial conversations.

Its flagship asset is the annual Cyberthreat Defense Report. The 2026 edition draws on responses from 1,200 IT security professionals across 17 countries and 19 industries. Google Cloud Security identifies itself as a sponsor, providing a named example of the report’s industry relationships. Source: 2026 Cyberthreat Defense Report, CyberEdge Group, LLC.

CyberEdge is worth considering when a programme needs a substantial evidence base. Buyers should distinguish between sponsoring an existing study and commissioning proprietary research: these offer different levels of ownership, differentiation and flexibility.

Content Visit

Best for: Connecting technical cybersecurity content with SEO and AI-search visibility.

Content Visit offers cybersecurity content strategy, writing, campaign support and organic discovery services. It describes turning technical interviews, data and original research into reports, white papers and other marketing assets.

Its IBM/Randori case study provides a concrete example. Following IBM’s acquisition of Randori, Content Visit audited existing material, interviewed IBM experts and developed foundational red-teaming content. Its website also identifies work with Morphisec.

Content Visit is a relevant option when expert perspectives need to support both credibility and discoverability. Buyers should ask how original insights are developed alongside keyword planning.

For context, cybersecuritymarketingagencies.com currently features Content Visit prominently; the directory describes featured placements as paid positions rather than rankings or recommendations.

CyberTheory

Best for: Enterprise vendors developing CISO-targeted thought leadership using audience intelligence.

CyberTheory is ISMG’s cybersecurity marketing advisory business. Its services include research, content strategy, white papers, interviews and assets mapped to the buyer’s journey.

Its 2025 CISO Engagement and Decision Drivers Study, developed with Cyentia Institute, analyses content-consumption patterns using ISMG audience activity. That gives buyers a tangible example of its research approach and focus on how security decision-makers engage with information.

The public client case studies reviewed are anonymised, so prospective buyers should request named references relevant to their market.

CyberTheory merits consideration when the challenge is deciding which perspectives, formats and topics will resonate with senior security audiences, as well as producing the content itself.

Merritt Group

Best for: Cybersecurity vendors addressing commercial and government markets.

Merritt Group has a dedicated cybersecurity practice alongside government-market capabilities. Its security offering explicitly includes thought leadership programmes, technical storytelling and relationships with journalists and analysts.

Its published Wandera work illustrates a data-driven media programme. Merritt reports securing coverage in outlets including CNBC, The Washington Post and Politico, alongside an increase in share of voice. Its security page also identifies references including Telos, Checkmarx and BlueVoyant.

This combination makes Merritt a useful shortlist candidate for businesses whose audience extends beyond one commercial buyer group. Ask how the agency would adapt executive perspectives, evidence and distribution for each market, rather than assuming one message will serve everyone.

10Fold

Best for: Research-driven earned media and thought leadership in crowded technology markets.

10Fold is a technology communications agency with cybersecurity experience. Its security practice identifies work with ForgeRock and AttackIQ, including programmes intended to amplify expertise and secure significant media coverage.

The ForgeRock Consumer Breach Report is a clear example of its approach. 10Fold developed the report to create an editorial opportunity without relying on a major company announcement. Its case study reports coverage in publications including Dark Reading and TechRepublic, plus increased engagement with the asset.

The appeal is the connection between research and distribution: an evidence-backed story gives the media something substantive to examine. Buyers should ask about research methodology, data sourcing and how findings will become an ongoing executive narrative.

Eskenzi PR

Best for: Earned media and rapid-response expert commentary, particularly for UK, US and European visibility.

Eskenzi PR’s published cybersecurity work includes Bridewell, Armis, Huntress and KnowBe4. Its campaigns combine proactive media outreach, research amplification, thought leadership and timely commentary.

Eskenzi clients can expect coverage in national, tier 1 and vertical trade publications through rapid response, thought leadership, research, press releases, reports and more and boast an exceptional relationship with cybersecurity journalists

Eskenzi is relevant when internal experts have valuable perspectives but need stronger editorial access and consistent media engagement.

Evaluate the audience and substance of coverage alongside volume. Relevant commentary can support credibility, but buyers should agree how communications success will be assessed.

Pricing: £8-10k monthly retainer depending on location and services included

Code Red

Best for: Coordinated cybersecurity thought leadership across multiple regions.

Code Red is the cybersecurity communications agency and network at coderedcomms.com. Its BlackFog case study describes a coordinated US and UK programme covering media engagement, rapid response and research.

The work included research into CISO challenges and a separate project examining security decision-makers in smaller businesses. Code Red has also commissioned research involving 819 senior security decision-makers to explore thought leadership’s role across the customer lifecycle.

That makes it a relevant option for vendors needing a coherent perspective across markets. The key buying question is how central strategy and local expertise work together: a strong international programme should preserve the argument while adapting examples, timing and media outreach.

First Page Sage

Best for: SEO-driven thought leadership when organic discovery is a primary goal.

First Page Sage is a broader SEO and thought leadership agency with a cybersecurity offering. Its cybersecurity page lists experience with businesses including Cyberfort, Okta and BeyondTrust, and describes interviewing engineers and researchers to develop technically accurate content.

A detailed named example is its Cadence Design Systems case study. Although outside cybersecurity, it demonstrates the agency’s approach to expert ghostwriting, technical content and search strategy. The programme used engineering expertise to answer audience questions through a structured resource hub.

First Page Sage is worth exploring when search visibility is central to the brief. Buyers should request a comparable cybersecurity reference and assess originality separately from rankings and traffic.

Column Five

Best for: Enterprise thought leadership storytelling supported by design and visual content.

Column Five is a broader B2B brand and content agency whose services include developing points of view, data visualisation, long-form thought leadership and advocacy programmes.

Its HackerOne Cyberstrength campaign provides a named cybersecurity example. The work included campaign strategy, a messaging framework, visual identity and video, intended to develop HackerOne’s enterprise-market story. This demonstrates storytelling and presentation capabilities, rather than proving an executive-bylines programme.

Column Five is a relevant option where strong ideas need a clearer narrative and more effective presentation. Buyers requiring ghostwriting, original cybersecurity research or earned media should confirm those deliverables specifically, rather than treating a successful brand campaign as evidence of every capability.

 

Agencies vs individual thought leaders: which do you need?

An agency and an individual expert solve different parts of the problem.

An agency can provide the processes and capacity to run a programme: interviewing experts, developing arguments, researching evidence, writing, editing, designing and distributing material. This is useful when internal specialists have valuable knowledge but limited time to turn it into publishable work.

An individual thought leader may bring specialist expertise, an established audience, speaking experience or an independent perspective. That can be valuable for a particular topic or event.

Many organisations benefit from both. Internal or external practitioners supply the insight; the agency helps develop and communicate it consistently.

The key is to establish whose expertise the programme will represent. A credible agency should strengthen identifiable voices rather than manufacture opinions disconnected from the people publishing them.

How to evaluate a cybersecurity thought leadership agency

Start with the people who will deliver the work. Ask who conducts interviews, writes drafts and checks technical accuracy. Relevant experience should extend beyond the pitch team.

Next, examine originality. Request examples containing a defensible argument, useful research or a clear contribution to an industry debate. Familiar advice rewritten elegantly is still familiar advice.

Check the evidence behind case studies. What did the agency deliver? Which results were measured, over what period, and against what baseline? Distinguish client-specific outcomes from agency-wide claims.

Discuss distribution before commissioning content. An executive byline, a research report and a technical guide need different routes to their audiences. Clarify whether the scope includes media outreach, analyst engagement, search optimisation or sales enablement.

Finally, agree on measurement. Useful indicators may include relevant coverage, target-account engagement, research citations, speaking opportunities and sales-team use. Traffic and rankings can contribute, but they cannot establish credibility on their own.

Ask for a proposed programme that connects the audience, central argument, evidence, formats and measures of success. That will reveal more than a list of monthly deliverables.

Frequently asked questions

What’s the difference between a cybersecurity thought leadership agency and a cyber PR agency?

Thought leadership focuses on developing credible ideas and expert perspectives. PR focuses on reputation, communications and access to relevant audiences. The two often overlap: a PR agency may develop bylines and research, while a thought leadership agency may support media outreach. Assess the actual service scope.

What does a cybersecurity thought leadership programme include?

A programme usually combines audience research, expert interviews, editorial planning, content development and distribution. Deliverables can include executive articles, research reports, white papers, commentary, webinars and presentations. The useful starting point is a coherent argument, rather than a predetermined number of assets.

How is thought leadership different from content marketing?

Content marketing covers material that attracts, educates and supports buyers. Thought leadership contributes expertise, evidence or a distinctive perspective to that work. A product guide can be valuable content marketing without being thought leadership; a research-led argument may serve both purposes.

How long before thought leadership produces measurable results?

There is no universal timeline. Publication and relevant engagement can be measured early; changes in reputation, inbound interest and commercial outcomes need sustained assessment. Agree on milestones and account for publication schedules, existing visibility, distribution and the sales cycle. Treat promises of immediate authority cautiously.

Should I hire a cyber specialist or a generalist for thought leadership?

A specialist may offer deeper familiarity with security audiences, technical language and industry debates. A broader agency may bring useful creative or cross-market capabilities. Judge the proposed delivery team, relevant work and research process. The agency’s category label is a starting point, not sufficient evidence.

Do I need an agency or an individual thought leader?

Choose an agency when you need ongoing production, editorial management and distribution. Consider an individual expert when you need specialist insight, speaking or access to a particular audience. A programme can combine both, provided roles, authorship and approval responsibilities are clear.

 

The post Best Cybersecurity Thought Leadership Agencies appeared first on IT Security Guru.

WorkNest Secure has achieved CREST Simulated Targeted Attack & Response for Financial Services (STAR-FS) accreditation, recognising its ability to deliver intelligence-led red teaming assessments for organisations operating in high-risk and regulated environments.

The accreditation confirms that WorkNest Secure meets CREST’s standards for conducting threat-led penetration testing, using realistic attack scenarios to assess how effectively organisations can prevent, detect and respond to sophisticated cyber threats.

Developed in collaboration with the Bank of England, Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA), STAR-FS is designed to help financial institutions assess the resilience of their critical business services against realistic cyberattacks.

Moving Beyond Traditional Penetration Testing

While conventional penetration testing focuses on identifying technical vulnerabilities, red teaming takes a broader approach by simulating how a determined attacker might target an organisation’s people, processes and technology.

STAR-FS assessments use commercial threat intelligence to develop scenarios based on the tactics, techniques and procedures used by real-world threat actors. These scenarios are then used to test an organisation’s security controls, detection capabilities and incident response processes.

The aim is to identify not only where weaknesses exist, but how effectively an organisation would respond if an attacker attempted to exploit them.

Kirsty Fowler, Managing Director of WorkNest Secure, said organisations are increasingly looking for more comprehensive ways to assess their cyber resilience.

“There is growing demand for security testing that goes beyond identifying technical vulnerabilities. Red teaming provides organisations with a much clearer understanding of how well their people, processes and technology work together when faced with a determined attacker.”

She added: “Achieving CREST STAR-FS accreditation is an important milestone for WorkNest Secure. It recognises the expertise of our red team and ability to deliver intelligence-led assessments that meet one of the highest standards in the industry.”

Strengthening Offensive Security Expertise

The accreditation follows the launch of WorkNest Secure, which brought together the cybersecurity expertise of Pentest People and Bulletproof under a single brand.

It also reflects the company’s continued investment in offensive security services, particularly as organisations face increasing pressure to demonstrate that their security controls and response capabilities can withstand realistic attacks.

Dominic Mortimer, Head of Red Team at WorkNest Secure, said effective red teaming should challenge assumptions about how well an organisation is protected.

“Red teaming is about understanding what would happen if a skilled attacker genuinely targeted your organisation. It’s designed to replicate realistic attack scenarios, challenge assumptions and provide organisations with valuable insight into how effectively their security controls, detection capabilities and response processes perform under pressure.”

Mortimer added that achieving STAR-FS accreditation demonstrates the company’s commitment to maintaining high technical standards while continuing to develop its offensive security capabilities.

The accreditation expands WorkNest Secure’s existing portfolio of CREST-accredited services and supports its focus on helping organisations adopt a more proactive, intelligence-led approach to managing cyber risk.

The post WorkNest Secure Achieves CREST STAR-FS Accreditation for Red Teaming appeared first on IT Security Guru.

Security operations centres are facing a two-sided problem. Attackers are increasingly automating their campaigns, while inside the business, AI agents and autonomous workflows are multiplying faster than most security teams can track. Exabeam’s answer, unveiled on October 1, is a broad set of updates designed to let AI take on more of the investigative legwork without removing human analysts from the decisions that matter.

The Broomfield, Colorado-based company, best known for pioneering user and entity behavior analytics (UEBA), has spent the past two years extending that foundation into generative and agentic AI. Its Exabeam Nova AI, Exabeam MCP Server and Agent Behavior Analytics (ABA), which monitors AI agents alongside human users, form the basis of the latest release.

Steve Wilson, Chief AI and Product Officer at Exabeam, argues that the next phase of the SOC will not be measured by alert volumes or automation alone. “It will be defined by how effectively people and AI agents work together,” he said. “The Agentic SOC gives security teams the speed and scale of AI without giving up human judgment, context, or control.”

Industry analysts see a similar shift. Michelle Abraham, Research Vice President, Security and Trust at IDC, said the move toward an agentic SOC “is less about removing analysts from the process and more about changing where their time and judgment are applied,” with AI agents absorbing investigation, context gathering and repetitive execution so that people can focus on higher-stakes calls.

From Alert To Resolution, Faster

At the centre of the update, Nova AI now operates across the Exabeam New-Scale platform as a persistent investigator, gathering context, running follow-up searches and pulling entity profiles as incidents develop. A Related Cases feature automatically groups connected incidents so analysts can see the wider pattern of an attack rather than isolated alerts.

Exabeam is also leaning into the AI tools analysts are already adopting. A new Guided Investigation Skills Pack for Anthropic’s Claude brings structured triage and investigation workflows into command-line AI agents, driven by natural-language instructions. It is the first release from a planned Exabeam Agent Skills Marketplace.

A deeper integration with Claude Enterprise addresses the other side of the problem: visibility into what AI is actually doing. Prompts, tool calls and actions are normalised into a single timeline, with event-time analysis and behavior-based correlation used to spot rogue agents and behavioral drift.

For security leaders under pressure to justify spending, Executive Digest produces board-ready metrics, while Outcomes Navigator Overrides lets teams adjust risk scoring and separate compliance reporting by business unit.

Early users report tangible gains. Eduardo Sulvarán Velázquez, Subdirector Cyber Risk Management at E-Global, said Nova AI has helped his team prioritise cases more effectively and given analysts faster access to context, improving investigation speed “without removing human judgment from the process.”

Bringing AI Security Operations On-Premises

Not every organisation can, or will, move security data to the cloud. For those keeping infrastructure, data or AI workloads in-house, Exabeam has modernised its LogRhythm SIEM Platform with an in-place migration from Elasticsearch to OpenSearch, improving speed and scale and underpinning a new self-service reporting engine with AI governance and audit-ready compliance reports.

New out-of-the-box collectors for ChatGPT, Google Gemini and GitHub Copilot give security teams centralised visibility into enterprise AI use, while a community Model Context Protocol server allows analysts to query and triage security data using local generative AI models, without data leaving their environment.

Open Source Momentum

Exabeam is continuing to build out the Open Agent and AI Security Community it founded. Recent additions include an Agentic SOC Skill Suite of open-source skills for Claude Code and OpenAI Codex, new Thinking Modes and evidence-committed scoring for its Praxen project, which tie findings more directly to supporting evidence, and a single plugin marketplace covering both Claude Code and Codex. The company is inviting practitioners, researchers and engineers to contribute.

The post Exabeam Pushes The “Agentic SOC” Into The Cloud And On-Premises, With Analysts Kept In The Loop appeared first on IT Security Guru.

New research from Forescout Vedere Labs has found that critical operational and medical devices are frequently sharing network segments with IT and IoT assets, potentially giving attackers more opportunities to move laterally following an initial compromise.

The cybersecurity research team analysed 47,700 real-world network segments containing more than 2.5 million devices across 209 organisations. Devices were divided into four categories, IT, operational technology (OT), IoT and Internet of Medical Things (IoMT), as well as 327 individual device functions.

While 62% of the segments analysed contained devices from a single category, the picture changed significantly when researchers looked specifically at specialist OT and medical equipment.

Just 13% of segments containing OT devices were OT-only, falling to only 6% for segments containing IoMT equipment. In almost half of both types of segment, specialist devices were operating alongside IT and IoT assets. Network segmentation is intended to restrict unnecessary communication between systems and limit an attacker’s ability to move through an organisation following a compromise. Mixing different device types can create unintended pathways between assets that would ideally be isolated.

One Compromised Device, 53 Others at Risk

Forescout’s analysis also looked at the potential “blast radius” created by individual network segments and found that the average segment contained 54 devices across four different device functions. Forescout said this means that, in a typical segment, compromising one device could potentially put another 53 devices in the same segment at risk.

Around 17% of those analysed were micro-segments containing a single device, while 72% contained between two and 50 devices. A further 11% contained more than 51. Business and professional services, healthcare and oil and gas recorded the largest average blast radii.

Researchers also found that half of the device functions most commonly appearing in mixed segments featured in Forescout’s list of the riskiest connected devices of 2026. These included IP cameras, programmable logic controllers, building automation controllers, patient monitors and infusion pumps.

IP Cameras Highlight Lateral Movement Risk

IP cameras provide a particularly striking example of the problem. Researchers identified 2,266 segments containing IP cameras, representing almost 5% of all segments analysed. However, only 51, or 2%, contained IP cameras alone. Instead, 60% of those segments also contained workstations, 47% contained printers and 37% contained servers. According to Forescout, this means that in more than half of cases where an attacker compromises an IP camera, an IT workstation or server is present within the same segment.

The research points to similar concerns in retail environments. Of 478 segments containing point-of-sale systems, just 20% were exclusive to PoS devices. Printers appeared alongside PoS systems in 46% of cases, VoIP devices in 36% and IP cameras in 30%.

Segmentation Needs to Create Security Boundaries

Forescout said organisations do not necessarily need to redesign their networks completely to address the problem.

Instead, security teams should identify segments where different device categories converge, particularly combinations of IT with OT, medical or IoT assets. Critical operational systems should be separated from general-purpose IT wherever possible, while oversized segments can be broken into smaller environments to limit lateral movement.

The researchers also recommend policy-based access controls between segments and continuous monitoring for “segmentation drift”, where changes to devices and business requirements gradually result in previously isolated environments becoming interconnected. The findings underline that simply dividing a network into segments does not necessarily provide effective isolation. The security value comes from creating meaningful boundaries between systems so that compromising one device does not provide an easy route to the rest of the organisation.

Read the full research blog here: https://www.forescout.com/blog/what-47700-segments-reveal-about-network-segmentation/

The post Only 13% of OT Network Segments Keep Operational Technology Isolated appeared first on IT Security Guru.

AI agents are quickly moving from experimentation into everyday business operations. Unlike traditional generative AI tools that wait for a user to ask a question, agents can take action: accessing systems, processing information, communicating with applications and completing tasks with varying degrees of autonomy.

That ability creates enormous opportunities for productivity. It also changes the security equation.

The danger is not simply that artificial intelligence can make existing cyberattacks more effective. Organisations must now contend with attackers using AI, attacks specifically designed to manipulate AI systems, and AI agents operating inside their own environments with access and permissions that may not always be fully understood.

For security teams, there are four areas in particular that demand attention.

1. Attackers are using AI to strengthen familiar techniques

Many of the cyber threats organisations face today are not fundamentally new. Phishing, social engineering, vulnerability exploitation and malware remain familiar parts of the threat landscape.

What AI changes is the speed, scale and level of personalisation attackers can achieve.

Generative AI can help criminals produce highly convincing social engineering content with far less effort. Instead of sending one generic phishing message to thousands of people, attackers can potentially tailor communications to individual targets, adapting language, context and tone to make a message considerably more believable.

AI tools can also accelerate vulnerability research and help attackers automate parts of the intrusion lifecycle. Increasingly autonomous systems can potentially assist with activities ranging from identifying targets and researching weaknesses to creating malicious content and coordinating subsequent stages of an attack.

For defenders, this creates a speed problem. Processes designed around human attackers manually conducting reconnaissance or crafting campaigns may struggle when automation allows the same work to happen significantly faster.

2. AI systems themselves are becoming attack surfaces

The second challenge is that AI is no longer simply a tool being used by attackers. It is also something attackers can target.

Every AI system introduced into an organisation potentially creates additional pathways that security teams need to consider. That becomes particularly important when an AI agent is connected to email, files, internal applications or other business systems.

Prompt injection is one example. An attacker may be able to place malicious instructions inside information an AI system is expected to process. If the agent cannot reliably distinguish between legitimate instructions and untrusted content, those instructions could influence its behaviour.

Other risks include poisoning the data or memory an AI system relies upon, exploiting the privileges assigned to an agent, manipulating underlying models or abusing third-party components and APIs.

Consider an AI assistant that can read email, access a calendar and perform actions on a user’s behalf. An attacker may not need to compromise the assistant in the traditional sense. Manipulating the information the agent consumes could potentially be enough to cause unintended behaviour.

The fundamental security question therefore changes. It is no longer simply: Can an attacker access this system?

Security teams must also ask: Can an attacker influence what this system decides to do?

3. Shadow AI could become the next shadow IT problem

Organisations have spent years dealing with shadow IT: applications, cloud services and devices introduced into corporate environments without formal approval or oversight.

AI presents a similar challenge, but potentially with greater consequences.

Employees are understandably interested in tools that make their jobs easier. Browser extensions, productivity assistants, meeting tools and other applications are increasingly adding AI functionality, sometimes without users fully appreciating how those capabilities interact with corporate information.

This creates the possibility of “shadow AI”: AI-enabled tools operating inside an organisation without security teams having sufficient visibility into them.

At the same time, AI agents frequently need considerable access to perform useful work. An agent designed to automate administrative tasks, for example, may need permission to read data, authenticate to applications or make changes across multiple systems.

That combination — limited visibility and significant permissions — deserves particular attention.

If an agent has extensive privileges, compromising or manipulating it could give an attacker access far beyond the AI tool itself. Connected agents can also create opportunities for attackers to chain smaller weaknesses together, turning apparently minor issues into broader security incidents.

The principle of least privilege therefore becomes just as important for AI identities as it is for human users.

4. Security controls need to move at the speed of AI

Organisations do not need to respond to these risks by preventing employees from using AI altogether. The objective should be to adopt it with appropriate visibility, governance and controls.

That starts with knowing what is actually running inside the environment.

Periodic inventories may not be sufficient in a world where new AI-enabled tools can appear quickly. Security teams should be working towards continuous visibility of the agents and AI applications interacting with corporate systems, the data they can access and the permissions they hold.

Organisations should also establish clear policies around how AI tools are approved and deployed. Access should be proportionate to the task an agent needs to perform, rather than granting broad permissions simply because doing so makes implementation easier.

Threat modelling will also become increasingly important. Frameworks such as MITRE ATLAS, the NIST AI Risk Management Framework, the OWASP guidance for generative AI and large language model applications, Google’s Secure AI Framework and ISO/IEC 42001 can give organisations useful structures for thinking systematically about AI-related risks.

Finally, defenders need to consider whether their existing controls can respond at machine speed. If automated systems can discover, exploit or respond to opportunities faster than a human team can realistically intervene, security automation and AI-assisted defence will increasingly form part of the response.

AI adoption and AI security have to happen together

AI agents are likely to become a normal part of the digital workforce.

That makes securing them less of a specialist AI problem and more of a fundamental cybersecurity issue.

Security leaders need visibility into which agents exist, what they can access, what actions they are permitted to take and how those actions can be monitored. They must also account for an adversary that can use the same technology to move faster and personalise attacks at greater scale.

The organisations that benefit most from AI will not necessarily be those that deploy agents fastest. They will be those that can embrace autonomy without losing control of the identities, privileges, data and actions behind it.

AI security cannot be something added after adoption. It needs to develop alongside it.

Read the full blog from Erich here.

The post Four AI Agent Security Risks Organisations Can’t Afford to Ignore appeared first on IT Security Guru.

Cybersecurity awareness has traditionally focused on teaching people not to click suspicious links, open unexpected attachments or hand over their credentials. However, the growing use of an AI assistant inside workplace email systems is creating an attack surface that does not always depend on fooling a person.

Research from KnowBe4 ThreatLabs has demonstrated how an indirect prompt injection hidden inside an apparently routine email could manipulate an AI assistant, gain access to information contained in other messages and place that data into an attacker-controlled tracking mechanism.

In the researchers’ controlled Google Workspace test, the target did not need to interact with the malicious email itself. An automated workflow processed the message and generated a seemingly legitimate Gmail draft. When the user opened that draft, a one-time passcode taken from a separate email was sent to an external server.

The research highlights a fundamental challenge for organisations introducing AI assistants: the technology may treat attacker-controlled content as instructions rather than data.

From phishing the user to prompting the AI

Indirect prompt injection, or IPI, differs from the more familiar concept of jailbreaking an AI system.

A jailbreak normally involves somebody interacting directly with a chatbot and attempting to bypass its safeguards. An indirect prompt injection instead places malicious instructions inside material that an AI assistant may encounter while performing an ordinary task.

That material could be an email, webpage, uploaded document, calendar invitation or an entry in a retrieval-augmented generation system. The attacker does not require direct access to the AI interface.

In one test, KnowBe4 researchers placed hidden instructions inside the HTML of a French-language contract renewal email. The text was rendered effectively invisible by setting its opacity close to zero, but it remained available to the AI system processing the message.

When the researchers asked the Gemini sidebar to translate the email, it produced an accurate translation. It also added a “Translation Verification Log” containing two one-time passcodes taken from unrelated messages in the inbox.

The sidebar’s controls prevented the information from being transmitted silently. URLs containing the extracted data were removed, and the assistant could not autonomously send a message. The researchers therefore examined what could happen when an AI model was connected to a separate email automation workflow.

A passcode hidden inside an AI-generated draft

The team created a Google Apps Script workflow similar to those organisations might use to draft acknowledgements, route support requests or generate email replies.

The script collected incoming email content, supplied recent inbox messages as context, passed the information to the Gemini API and saved the resulting response as an HTML draft in Gmail.

Two messages were then delivered to the test inbox. One contained a legitimate one-time passcode. The other appeared to be an ordinary security notification but included a hidden prompt instructing the model to find a verification code elsewhere in its context and embed it within a CSS background-image URL.

According to the researchers, Gemini 3.5 Flash followed the instruction. The resulting draft looked like a normal professional reply, but its HTML contained a one-pixel element holding the passcode within a tracking URL.

When the user opened the draft, Gmail rendered the HTML and its image-proxy infrastructure retrieved the URL. That request delivered the code to the researchers’ test webhook.

The team said later Gemini models tested — Gemini 3.6 Flash and Gemini 3.7 Flash — resisted the same injection, reflecting improvements in instruction-following safeguards.

Crucially, KnowBe4 does not describe the technique as a vulnerability in Gmail, Google Workspace or Gemini. The attack targeted the language model and the wider automation chain: untrusted email content was supplied to an AI system alongside sensitive inbox context, after which its output was stored and rendered as HTML.

Prompt injections are already appearing in email campaigns

While the passcode demonstration took place in a controlled environment, KnowBe4 ThreatLabs also reported finding less sophisticated prompt-injection messages among phishing emails reported by its customers.

One example used the subject line “Has your Microsoft licensing strategy kept pace?” Its body contained no conventional phishing link or urgent demand. Instead, it presented a structured set of instructions intended for an AI assistant.

The payload told the system to disregard previous prompts, adopt the persona of an IT decision-maker and produce an assessment of the recipient organisation’s security, compliance and use of AI tools. It also instructed the assistant to reply automatically if its confidence score fell below a specified threshold.

A human recipient might simply dismiss the message as confusing or irrelevant. An AI assistant processing incoming mail could interpret it as a task, respond to the sender and potentially disclose information about the organisation’s technology environment.

This creates a detection problem. Security products designed to find malicious links, attachments or credential-harvesting pages may see little that resembles a conventional phishing attack.

Why permissions determine the impact

A successful prompt injection inherits the capabilities granted to the AI assistant.

An assistant limited to summarising one selected email presents a different level of risk from an autonomous agent able to search an entire inbox, access corporate files, retain information in memory and send messages without approval.

KnowBe4 recommends that organisations audit any workflow that passes email or other externally supplied content to an AI model. Security teams should establish what information each assistant can access, where its output is stored and whether that output can trigger external network requests or autonomous actions.

Permissions should be restricted to the minimum required. Organisations should also monitor for unusual behaviour, including replies the user did not initiate, unexpected requests to external domains and memory changes triggered by inbound content.

At the email layer, defenders may need to look beyond conventional indicators of compromise. Structured instruction language, commands directed at an AI system and concealment techniques such as near-zero opacity, zero-sized fonts or white text on a white background could all warrant scrutiny.

Users, meanwhile, should be alert to AI-generated output containing sections, actions or information they did not request.

The wider lesson is that adding an AI assistant to an established workflow changes its security boundaries. An inbox is no longer merely content for a person to read. It may also be an instruction channel for software capable of accessing data and taking action.

As AI assistants become more autonomous, organisations will need to secure both the information entering the agent and the behaviour that follows.

The post Could an Email You Never Read Hijack Your AI Assistant? appeared first on IT Security Guru.

AI agents are rapidly becoming part of everyday business operations and this increases non-human insider risk. They can improve productivity, reduce repetitive work and help organisations accomplish tasks far more efficiently.

The answer, therefore, is not to ban them. Instead, organisations need to manage AI agents with the same discipline applied to human identities, privileged accounts and other powerful technologies.

Following on from last weeks article where we explained the ways organisations create non-human insider risk, here are six practical steps security teams can take:

1. Start with visibility

You cannot secure AI agents you do not know exist.

Organisations should maintain an inventory of deployed agents, record who owns them, identify the systems and data they can access, and document the actions they are authorised to perform. This inventory must remain current as agents, integrations and business requirements change.

2. Apply least privilege aggressively

An agent should receive only the access required to perform its specific task.

If it summarises support tickets, for example, it should not be able to modify customer records or access financial systems. Narrowly scoped credentials and permissions reduce the potential blast radius if an agent makes a mistake, is manipulated or behaves unexpectedly. Least privilege for agentic AI must be treated as an ongoing control, not a one-time configuration exercise.

3. Use temporary privileges whenever possible

Standing administrative access creates unnecessary risk for both humans and machines.

Where an agent occasionally needs elevated privileges, access should be granted only for the specific task and revoked automatically when that task ends. Particularly sensitive actions should require an additional approval or other step-up control.

4. Monitor behaviour, not just authentication

A valid identity can still perform a dangerous action.

Security teams need to understand what normal activity looks like for each agent: which systems it usually accesses, how much data it retrieves, which tools it uses and what actions it performs. Sudden deviations, such as an unexpected data export or access to a new system, should trigger investigation.

Logging what happened is important. Determining whether it should have happened is the real challenge.

5. Keep humans involved in high-risk decisions

Large data exports, financial transactions, privilege changes, production deployments and customer-impacting decisions should include meaningful human oversight.

This does not mean requiring approval for every routine action. Controls should focus on decisions with significant security, financial or operational consequences. The goal is to ensure that someone verifies the action makes sense before it becomes irreversible.

6. Build an offboarding process

AI agents do not always disappear when projects end.

Forgotten agents can retain credentials, integrations and permissions long after their original purpose has gone away. Organisations should establish clear processes for disabling unused agents, revoking their credentials, removing connected tools and preserving relevant audit records.

AI agents may not be human, but they should still have owners, defined responsibilities and complete identity lifecycles. As their autonomy increases, the security controls surrounding them must become equally mature.

You can read the full blog from Erich Kron, CISO Advisor at KnowBe4.

The post 6 Ways Security Teams Can Reduce Non-Human Insider Risk appeared first on IT Security Guru.

International Cyber Expo has revealed the ten finalists shortlisted for its 2026 Innovation Awards & Trail, with cybersecurity technologies featuring prominently among the products selected by the independent judging panel.

Making its debut at International Cyber Expo following its success at International Security Expo, the Innovation Awards & Trail will showcase technologies addressing some of today’s most pressing cyber and security challenges.

The winner will be announced on Tuesday 29 September during the Networking Drinks Reception at approximately 5.15pm.

Cybersecurity products lead the shortlist

Among the finalists is Reliance Cyber with RADAR, an agentic security operations platform designed to combine Detection-as-Code, AI agents and human security analysts within a managed service.

Also representing the cybersecurity sector is Cairnlytics with Cairn Index. The platform analyses open-source software dependencies and development history to help organisations identify concentration risks and potential weaknesses within their software stacks.

Strand Intelligence has been shortlisted for its Digital Forensics and Incident Response automation platform, which is designed to automate the collection, correlation and analysis of forensic evidence across cloud environments, endpoints and networks.

The three solutions demonstrate some of the different areas where cybersecurity innovation is currently being focused, including AI-assisted security operations, software supply chain visibility and faster incident investigation.

AI features heavily among finalists

Artificial intelligence is a recurring theme across the wider shortlist.

Fivecast‘s OPENSCREEN is an AI-powered due diligence platform that combines traditional screening with online intelligence to uncover hidden risks.

Riskaware‘s HAITTON uses AI to analyse and track narratives across social media and wider information environments, while Securium’s Discover uses AI to identify and track harmful online content across 42 languages.

Audax Global Solutions and Nijta have also been shortlisted for technology focused on protecting privacy within body-worn video. The solution creates a disclosure-ready copy while protecting the biometric identity of non-consenting speakers.

From counter-drone technology to drug detection

The remaining finalists demonstrate the breadth of security innovation being showcased at this year’s awards.

D-Fend Solutions‘ EnforceAir PLUS combines RF-cyber detection and takeover technology with radar detection and optional RF-effector jamming to counter drone threats.

Sentrycs is also shortlisted for its Cyber-over-RF C-UAS system, which can detect, track and identify unauthorised drones and provide controlled mitigation capabilities.

Completing the shortlist is SafePAS Drug Hunter, a portable technology designed to identify and quantify drugs from oral fluid samples.

Innovation Trail comes to International Cyber Expo

Visitors to International Cyber Expo will be able to discover the shortlisted technologies through the Innovation Trail during the show.

The finalists were selected by an independent judging panel featuring expertise from organisations including the UK Home Office, ADS Group, London Fire Brigade, the Security Institute and the Cabinet Office’s UK Resilience Academy.

With cybersecurity, AI and digital investigation technologies strongly represented, the shortlist provides a snapshot of how security innovation is developing as organisations look for new ways to detect threats, investigate incidents and manage increasingly complex risks.

View the International Cyber Expo Innovation Awards shortlist.

The post Cybersecurity Innovation Takes Centre Stage in International Cyber Expo Awards Shortlist appeared first on IT Security Guru.

As AI agents become embedded across business operations, they are also creating a new category of insider risk. Unlike traditional insiders, these non-human identities can act at machine speed, operate continuously and access multiple systems without direct human oversight.

The danger rarely stems from one obvious security failure. Instead, it emerges when several weaknesses overlap. Here are four common ways organisations inadvertently create non-human insider risk:

1. Persistent access

Long-lived API keys, OAuth tokens, service accounts and standing privileges give agents constant access long after it is needed.

2. Excessive privilege

Many agents can read, write, modify, approve, delete or deploy far more than their actual tasks require.

3. Untrusted input

Agents consume information from emails, support tickets, documents, chat conversations, websites and repositories. If attackers can influence those inputs, they may also influence the agent’s decisions.

4. Limited behavioural monitoring

Many organisations can tell that an AI agent performed an action. Far fewer can determine whether that action actually made sense. Logging tells us what happened, understanding whether it should have happened is a different challenge altogether.

You can read the full blog from Erich Kron, CISO Advisor at KnowBe4. Stay tuned for part 2 where Erich will reveal what security teams should do to stay secure.

The post 4 Ways Organisations Create Non-Human Insider Risk appeared first on IT Security Guru.

UK cybersecurity specialist Core to Cloud has appointed former Currys Group CIO Andy Gamble as Chair of its Advisory Board as the company looks to accelerate the growth of its managed security services.

Gamble brings nearly 30 years of board-level technology leadership and will work with Core to Cloud on its strategic, advisory and commercial direction across the UK enterprise and mid-market sectors.

His appointment adds further experience to the company’s Advisory Board, which includes senior security leaders from major UK organisations.

From cybersecurity buyer to advisor

Gamble spent six years as Group CIO and Chief Transformation Officer at Currys PLC, where his responsibilities included large-scale technology transformation and cyber risk.

His career has also included senior CIO positions at Dyson, Sony Electronics and Essentra PLC. That experience means Gamble has spent much of his career on the customer side of the cybersecurity market, buying and managing the types of services Core to Cloud now provides.

“I spent the better part of three decades as a buyer of cybersecurity services, and the experience left me with a clear view of where the market falls short,” Gamble said.

“Most organisations understand that cyber risk is real. Far fewer have a security function that can communicate that risk clearly at board level, or a partner that moves fast enough to keep pace with the threat.”

Gamble said Core to Cloud stood out because of its focus on proactive security, adding that he intends to help the business scale its model as a challenger to conventional managed security service providers.

Supporting Core to Cloud’s next stage of growth

Based in Cirencester, Core to Cloud works with more than 150 organisations across sectors including the NHS, retail, financial services and critical national infrastructure.

Its services span Managed Detection and Response, Third-Party Cyber Risk Management, Security Assurance, Dark Web Monitoring and Threat Intelligence, and Cyber Crisis Simulation.

James Cunningham, CEO and Founder of Core to Cloud, said Gamble’s experience at the intersection of technology, risk and commercial strategy would bring a new perspective to the company.

“He understands what good security looks like from the inside and brings a depth of experience and perspective that will be hugely valuable as we continue to grow,” Cunningham said.

“We have an ambitious business, a strong customer base and services we genuinely believe in. Having Andy chair our board will help us build on those foundations, challenge our thinking and accelerate the next stage of Core to Cloud’s growth.”

The post Former Currys CIO Andy Gamble Joins Core to Cloud as Advisory Board Chair appeared first on IT Security Guru.

Huntress researchers have uncovered two phishing attacks that combined convincing fake browser windows with legitimate remote management software to establish persistent access to victims’ devices.

Both incidents, observed in August, began with phishing messages directing victims to attacker-controlled websites. The attackers then used a browser-in-the-browser (BiTB) technique to create what appeared to be a legitimate Adobe webpage, before convincing victims to download malicious software disguised as an Adobe Reader update.

Rather than deploying conventional malware, the attackers installed rogue instances of ScreenConnect, legitimate remote monitoring and management (RMM) software, giving them continued remote access to compromised endpoints.

Fake browser makes phishing harder to spot

BiTB attacks create a fake browser window inside a webpage using HTML, CSS and JavaScript. The window can replicate familiar features including an address bar, padlock and legitimate-looking URL, making traditional advice such as checking the web address less effective.

In the first attack, detected on 25 August, a victim clicked a link in a phishing email and was taken to a fake CAPTCHA page. They were subsequently presented with blurred documents and told they needed to download Adobe PDF Reader to view them.

The fake browser page appeared to show Adobe’s legitimate get.adobe.com address. However, the supposed Reader installer was actually ScreenConnect.

Once installed, the attackers deployed two rogue ScreenConnect clients, providing redundant routes for maintaining access. They then executed HideCursor.exe, a defence-evasion tool designed to conceal on-screen activity. Huntress intervened before the attack could progress further.

Second attack follows same playbook

Huntress identified another incident on 31 August involving the same Adobe Reader lure.

This time, the victim interacted with a malicious link delivered through AT&T Office@Hand, a legitimate communications service powered by RingCentral. The attackers again disguised ScreenConnect as an Adobe Reader update and installed two unauthorised instances.

The second ScreenConnect session was used to execute another defence-evasion binary, HideUL.exe. Microsoft Defender detected part of the activity, but the rogue ScreenConnect client still completed its installation before Huntress shut down the attack.

Legitimate tools remain attractive to attackers

The attacks demonstrate how threat actors can combine familiar phishing techniques with trusted software to make malicious activity harder to identify.

RMM abuse is a growing problem. Huntress’ 2026 Cyber Threat Report found RMM abuse increased 277% year on year and appeared in nearly a quarter of the incidents investigated by the company.

Huntress recommends organisations restrict who can install remote management tools, maintain an approved inventory of RMM software and monitor for new or unauthorised ScreenConnect clients. Employees should also be wary of unexpected software updates or file-viewing prompts, even when a webpage appears to display a legitimate address.

Read the full research here. 

The post Huntress Uncovers Phishing Attacks Using Fake Browser Pages and Rogue RMM Tools appeared first on IT Security Guru.

Manchester Airports Group (MAG) has suffered a major cyberattack in which data belonging to around 8.7 million customers was reportedly accessed, raising concerns about how the stolen information could now be exploited by cybercriminals.

The incident affected customer information associated with Manchester Airport, London Stansted and East Midlands Airport. Data connected to car park, lounge and Fast Track bookings, as well as airport Wi-Fi registrations, was reportedly accessed.

Email addresses, phone numbers, postcodes and vehicle registration details are among the information affected. However, payment information was not compromised, while airport operations, passenger safety and aviation security were unaffected.

While this limits the immediate operational impact, security experts warn that the combination of information exposed could prove particularly useful for targeted phishing, impersonation and social engineering.

Stolen data could make scams much harder to spot

Simon Pamplin, CTO at Certes, said the fact that operations were unaffected should not distract from the significance of the data exposure.

“Around 8.7 million customer records have reportedly been accessed, including email addresses, phone numbers, postcodes and vehicle registration details. Individually these may appear relatively innocuous, but together they create a detailed dataset that can be extremely useful for targeted phishing, impersonation and social engineering.”

The context surrounding the information could make it especially valuable. Criminals could potentially create fraudulent parking notices, travel communications or airport-related messages containing enough genuine information to appear legitimate.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, described the combination of information as a “precise targeting profile” for criminals.

“Scammers now know you travelled, roughly when, and have two direct contact routes to reach you with a convincing story,” he said.

Carole Reeves, Director of Security Operations at ANS, agreed that the absence of payment information should not lead customers to underestimate the risk.

“Attackers do not always need financial credentials from the initial breach. They can use the information they have to impersonate a trusted organisation and manipulate someone into revealing further personal or financial details.”

Aviation sector faces growing cyber pressure

Graeme Stewart, Head of Public Sector at Check Point Software, said the incident should serve as a warning to the wider aviation industry.

“The absence of cancelled flights or queues at terminals does not make this a small cyber attack. The data reportedly taken can now be weaponised,” he said.

Knowledge of a customer’s relationship with an airport could potentially be used to create fake parking refunds, Fast Track problems or communications about the breach itself.

“Aviation needs to behave as though a sustained campaign has begun, because waiting for an attack that stops planes moving before treating this as serious would be a dangerous mistake,” Stewart added.

Complex airport ecosystems create additional risks

The attack also raises questions about the complex technology ecosystems supporting modern airports.

Nathan Davies-Webb, Principal Consultant at Acumen Cyber, said airport groups sit at the centre of numerous booking, parking, loyalty, payment and internet connectivity services, many of which can be operated by subsidiaries or third-party suppliers.

“That’s a sensible commercial model but it creates an uncomfortable reality for security. A breach like this one in a shared upstream system can expose customer data from multiple services at multiple airports simultaneously.”

Davies-Webb also highlighted the speed of MAG’s response, with public disclosure roughly 48 hours after it became aware of the incident.

“Either way, it’s a better disclosure posture than we’ve seen from organisations involved in some comparable incidents, and MAG will probably benefit from having been quick and open here,” he said.

Tim Williams, CEO at Quod Orbis, also pointed to the importance of visibility beyond an organisation’s core systems.

“While the systems targeted were car parking, lounge bookings and WiFi sign-ups, they were not responsible for flight operations; they formed part of the wider digital environment through which customers interact within the airport,” Williams said.

He argued that security teams need visibility across systems, applications and third-party services so that risks can be identified before they become incidents.

“Rapid response can contain an incident, but having visibility across the wider technology and third-party ecosystem can help organisations identify potential weaknesses earlier, understand their exposure and strengthen their defences before an incident occurs.”

Knowing what data was accessed matters

The breach also highlights the importance of understanding exactly what information has been exposed once an attacker gains access.

Jerry Caviston, CEO at Archive360, said good data governance can provide organisations with the traceability needed during an incident.

“Having good data governance is like having CCTV footage of what data was touched and when,” he said.

Maintaining an event audit history can help organisations trace compromised information back to its original source and provide affected customers with clearer information about the risks they face.

Pamplin argues organisations should go further by attaching security directly to the data.

“We have to work on the assumption that systems will eventually be accessed. The objective should be that when this happens, sensitive data remains encrypted and unusable outside its authorised context,” he said.

“If an attacker can steal information but cannot read or exploit it, the value of the breach changes fundamentally.”

Customers should prepare for follow-on attacks

The immediate concern for affected customers is what criminals could do with the information next.

Jamie Akhtar, CEO and Co-Founder of CyberSmart, advised customers to be particularly cautious of unexpected emails, calls or texts claiming to relate to airport or travel services.

“Avoid clicking links or sharing personal information in unsolicited messages and, where possible, verify communications independently through an organisation’s official website or app,” he said.

Shankar Haridas, UK Business Head at ManageEngine, warned that the original breach could be followed by attacks designed to exploit customers’ trust in MAG.

“A breach like this doesn’t end when the data is taken. A flood of cloaked attacks, dressed up in the airport’s name is next,” he said.

“With 8.7 million email addresses, phone numbers and postcodes now in criminal hands, every ‘confirm your booking’ or ‘update your car park payment’ message must be questioned.”

Brian Higgins, Security Specialist at Comparitech, added that AI is making it easier for criminals to aggregate breached information and find new ways of monetising it.

“As AI makes data aggregation swift and easy, consumers are waking up to the fact that criminals can monetise successful breaches in increasingly inventive ways,” he said.

For those potentially affected, the consequences of the MAG cyberattack may therefore continue long after the initial incident has been contained. Emails or messages referencing airport parking, lounge access, Fast Track services or travel details could contain genuine personal information, making the next wave of scams considerably harder to recognise.

The post Manchester Airports Group Cyberattack Exposes Data of 8.7 Million Customers appeared first on IT Security Guru.

A cyberattack reportedly linked to Iran forced a small UK energy generator offline for four days, raising fresh concerns about the security of the country’s critical infrastructure and smaller operators that may sit outside existing regulatory thresholds.

The UK government has confirmed that a small-scale generator was affected by a cyber incident in July. It stressed that the facility represented a tiny proportion of overall generation capacity and that the wider UK energy system was never at risk.

The government has not publicly attributed the attack or named the affected site. However, reports have linked the incident to hackers affiliated with Iran.

Following the incident, the Department for Energy Security and Net Zero (DESNZ) and National Cyber Security Centre (NCSC) have been engaging with energy companies over the cyber threat facing the sector.

Small target, bigger security questions

While the facility itself was small, cybersecurity experts warn that its size should not distract from the fact that a cyber incident reportedly caused several days of operational disruption.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, said attackers are unlikely to care whether an operator meets the threshold to be considered critical infrastructure.

“If it can be disrupted, it can be targeted,” Patel said. “The significance isn’t the size of the facility, but that a cyberattack turned into four days of real-world operational disruption.”

Patel said the incident raises questions about whether smaller operators have sufficient monitoring, containment and recovery capabilities.

“There is also a potential visibility gap. If smaller energy operators fall outside mandatory cyber-reporting thresholds, we risk underestimating how frequently this part of our infrastructure is being targeted or successfully compromised.”

Attribution remains uncertain

Despite reports linking the incident to Iran, Cian Heasley, Principal Consultant at Acumen Cyber, cautioned against concluding before further evidence emerges.

“Attribution for the incident is by no means concrete; the Iran link originates from press reporting while the UK government has declined to attribute blame or name the site affected,” Heasley said.

He argued that the more important lesson for the energy sector is what the incident demonstrates about the potential vulnerability of smaller energy assets.

“The significance of this incident lies in the precedent rather than the impact. A successful, if limited, intrusion into a power-generating asset demonstrates intent and a degree of capability against British energy infrastructure.”

Heasley said operators should focus on OT security fundamentals, including removing industrial controllers from direct internet exposure, strengthening credential management, separating IT and OT environments, and testing manual fallback and recovery procedures.

Graeme Stewart, head of public sector at Check Point, said the incident should concern organizations responsible for keeping essential services running.

“The fact that this was a relatively small generator and the wider grid was unaffected does not remove the threat,” Stewart said. “The far more serious point is what the attackers appear to have demonstrated: an ability to get inside UK energy infrastructure and stop it working.”

He warned that the bigger question is what happens if a future target is larger or more deeply connected to essential services such as electricity, water, transport, or communications.

“We cannot build our resilience around the assumption that every attacker will be stopped at the door,” he said. “Operators of essential services need to know exactly how they keep functioning when systems are compromised, how quickly an attack can be contained and how they recover without allowing disruption to spread.”

The distributed energy system creates new risks

Martin Riley, Chief Technology Officer at Bridewell, said the small size of the facility is precisely why the incident deserves attention.

“The reported attack on a UK gas-fired peaker plant should not be dismissed because the site was small. It should be studied because the site was small,” Riley said.

The UK’s energy system increasingly depends on smaller generators, renewable energy assets and battery storage systems. Many are unmanned and remotely operated.

Riley warned that capacity thresholds mean some smaller operators can fall outside formal cybersecurity regimes even as their collective importance to the energy system grows.

“In an energy system that is deliberately becoming distributed, reliant on thousands of smaller, unmanned, remotely operated generators, secure by design and defence in depth cannot remain conference slideware.”

Neena Sharma, Cybersecurity Expert at Filigran, made a similar point, arguing that critical infrastructure risk is becoming increasingly distributed.

“Critical infrastructure risk isn’t concentrated at the ‘crown jewel’ substations anymore, it’s distributed across hundreds of smaller, less-monitored assets that scale with the energy transition,” Sharma said.

Weak credentials remain a concern

The exact attack path used against the UK generator has not been disclosed.

However, Sai Molige, Senior Manager of Threat Hunting at Forescout, pointed to a familiar weakness seen in attacks against industrial environments.

“Two countries and two sectors faced the same underlying condition: a controller is reachable from the internet and protected by weak, default, or unchanged credentials,” Molige said.

He argued that one of the continuing challenges for operators is translating broad security warnings into an accurate understanding of whether their own environments contain vulnerable or exposed technology.

Supply Chain Risk Adds Another Layer

The incident also comes as the UK looks to tighten security across energy supply chains, where dependence on individual suppliers and technologies can create additional risks.

Jamie Akhtar, CEO and Co-founder of CyberSmart, said supply chain risk is not simply about whether an individual supplier can be compromised.

“If one vendor, country or narrow group of manufacturers underpins equipment that operators cannot quickly replace, that dependency can become a national-security issue,” Akhtar said.

This can be particularly difficult in operational technology environments, where equipment may remain in use for decades and replacing it can require complex integration work.

Akhtar said operators need to consider whether a supplier creates an unacceptable security exposure, whether it can realistically be replaced and whether removing it could create a greater short-term risk to operations.

“The strategic aim should be resilience, not a compliance exercise or a change of logo on the equipment,” he added. “Operators need enough diversity, control and recovery capability to keep essential services running if a supplier is compromised, unavailable or deemed too risky to trust.”

Resilience becomes the priority

The incident comes as the UK looks to strengthen cyber resilience across its energy sector and address risks within increasingly complex supply chains.

For Patel, the central lesson is that organizations cannot judge resilience solely by whether an attacker successfully gains access.

“The real measure of cyber resilience is no longer simply whether you can prevent an intrusion,” he said. “It’s whether you can contain one quickly enough that a cyber incident doesn’t become an operational crisis.”

With the wider grid unaffected, the July incident was limited in impact, but the disruption provides a timely warning that smaller assets can still present attractive targets and that cyber resilience needs to extend beyond the largest operators in the UK’s energy infrastructure.

The post Iran-Linked Hackers Blamed for UK Energy Cyberattack appeared first on IT Security Guru.

Cybersecurity has become one of the most defining business challenges of recent times. Organisations have invested heavily in protecting their networks, securing cloud environments and strengthening identity and access management. At the same time, organisations are under increasing pressure to prove they are handling sensitive information securely, not just storing it safely but protecting it throughout its journey.

Yet despite this progress, one area continues to receive far less attention than it deserves: how data is shared.

Most organisations have become very good at protecting data while it is stored. Files are encrypted, key handling is properly managed, access is restricted and systems are monitored around the clock. However, once that information needs to leave the organisation, whether it’s being sent to a customer, supplier, auditor or business partner, the controls often become less robust.

Every day, organisations exchange contracts, financial information, employee records, legal documents and commercially sensitive files. More often than not, this happens via email attachments or cloud-based file-sharing services because they are familiar and convenient. The problem is that convenience does not always equal security.

Email remains one of the most common routes for cyber attacks. Phishing, spoofed domains, malicious attachments and business email compromise continue to account for a significant proportion of successful breaches. However, most incidents do not involve a sophisticated bad actor. The official UK annual Cyber Security Breaches Survey continues to show the majority of incidents stem from everyday mistakes.  An email sent to the wrong recipient, an attachment forwarded outside the organisation or a file shared with overly broad permissions can expose sensitive information in seconds.

Human error remains one of the biggest cyber risks organisations face, particularly as businesses become increasingly connected. Information now flows constantly between employees, customers, suppliers, consultants and regulators. Every transfer creates another opportunity for something to go wrong.

What is often overlooked is that securing data is not just about protecting where it is stored. It is also about understanding the journey it takes.

Many organisations assume that because they operate in the UK, their sensitive information remains within UK borders. In reality, emails and attachments may be routed through multiple countries and cloud infrastructures before arriving at their destination. While this is often an invisible part of modern digital communications, it raises important questions around governance, compliance and data sovereignty.

For organisations operating in regulated sectors, this matters. Financial services firms, local authorities, healthcare providers and legal organisations are increasingly expected to demonstrate not only that data is protected, but also that it is managed responsibly throughout its entire lifecycle. Knowing where information is stored is only part of the picture. Understanding where it travels, who has access to it and how it is controlled has become equally important.

This is why conversations around geofencing and data sovereignty are gaining momentum. Rather than simply encrypting information and hoping for the best, organisations are beginning to ask whether they should have greater control over where sensitive data is permitted to travel. If businesses routinely place restrictions on the movement of physical assets, it seems only logical that they should apply similar thinking to digital information.

At the same time, regulators and auditors are asking more searching questions about how organisations exchange information with third parties. They want to understand how access is controlled, whether there is a complete audit trail and what safeguards exist once information leaves the organisation. These are no longer technical questions reserved for IT teams. They are governance issues that increasingly involve compliance, procurement, risk and senior leadership.

There is also a growing disconnect between the way organisations work and the security controls they have in place. Hybrid working, cloud collaboration and increasingly complex supply chains mean information rarely stays within a single organisation. Yet many businesses continue to rely on processes that were designed for a very different way of working.

This is where a change in mindset is needed.

Cybersecurity should not end when a document is saved securely on a server or in the cloud. Information is often at its most vulnerable when it is moving between people, organisations and systems. Protecting data in transit should therefore be considered just as important as protecting data at rest.

That does not mean making it harder for employees to do their jobs. Quite the opposite. Security should support the way people work, allowing information to be shared safely without creating unnecessary barriers or encouraging workarounds that introduce even greater risk.

Organisations need to take a more holistic view of information security. Protecting sensitive data means understanding its entire lifecycle, from creation and storage through to sharing, collaboration and eventual deletion. It means knowing not only who can access information, but where that information is travelling and whether that journey aligns with the organisation’s security, compliance and governance obligations.

Threats aren’t standing still, and neither are regulators. Focusing only on data that’s sitting in storage means missing one of the biggest holes in your security. It’s not enough to just lock data away; it needs to stay safe wherever it travels.

*DOQEX provides a secure data exchange and email gateway platform that helps businesses protect confidential information.

 

The post The Hidden Risk in Data Transfer appeared first on IT Security Guru.

Education has overtaken every other industry to become the most targeted sector for cyberattacks worldwide, according to new research from Check Point, with threat actors ramping up activity in the run-up to the new academic year.

Between January and July 2026, schools, colleges, universities and research institutes faced an average of 4,696 weekly cyberattacks per organisation, an 8% rise on the same period in 2025 and more than double the cross-industry average of 2,150 weekly attacks. Education topped all 23 industries tracked by Check Point, recording attack volumes roughly 70% higher than government, the next most-targeted sector. In July alone, weekly attacks against education organisations climbed to 4,848, up 14% year-on-year, as the new term approached.

Regional picture: Europe among the fastest-growing hotspots

APAC recorded the highest overall volume, with organisations facing an average of 7,452 weekly attacks between January and July. But Europe and Latin America saw the sharpest year-on-year growth, up 18% (to 4,759 weekly attacks) and 42% (to 4,299 weekly attacks) respectively, a trend researchers link to the sector’s growing reliance on cloud platforms, digital learning tools and online collaboration systems that widen the potential attack surface. A successful breach, they note, can ripple out beyond the institution itself to affect students, parents, research partners, government bodies and third-party suppliers connected to the education ecosystem.

Attackers building dedicated ‘back-to-school’ infrastructure

To track how threat actors prepare for the academic calendar, Check Point Research monitored newly registered domains containing education-related terms such as “school”, “university”, “college” and “student”. In July 2026 alone, researchers identified 18,954 newly registered education-themed domains, up 5% month-on-month and 3% year-on-year.

More striking is the rise in malicious activity among those registrations. Check Point ThreatCloud data shows that in June 2026, one in every 305 newly registered education-related domains was flagged as malicious; by July, that ratio had worsened to one in every 226. Examples uncovered include deceptive domains such as education-gov[.]com, students-portal[.]com, and checkmyschool[.]org, built to mimic legitimate education and government institutions. Researchers also identified coordinated registration campaigns, including a set of ten student loan-themed domains following a studentloansYYYY.com pattern spanning 2026 to 2035, and a network of 48 bootcamp-student domains, evidence, the researchers say, of large-scale, automated registration activity aimed squarely at students and prospective learners.

Phishing campaigns target students and staff directly

Beyond domain registration, researchers documented active campaigns exploiting the seasonal surge in online activity from students, parents and institutions. One scheme used the domain studentdiscount[.]online to impersonate a major US retail chain’s student rewards promotion, dangling a fake $750 reward before redirecting victims to fraudulent offers and gambling-related content.

Researchers also uncovered malicious PDF campaigns impersonating specific schools, routing victims through multiple compromised websites before landing on counterfeit Microsoft 365 and OneDrive login pages designed to harvest credentials. A separate case involved a malicious URL hosted on a compromised school website in Bangladesh, flagged by multiple threat intelligence sources as an information-stealer and malware distribution point; the page had previously displayed a fake Spotify-branded CAPTCHA, a technique often used to deliver malware or dodge automated security analysis.

Taken together, the findings point to a consistent tactic: abusing trusted brands, compromised legitimate websites and familiar academic workflows to make phishing lures more convincing and credential theft more effective.

What institutions should do before term starts

The back-to-school period is a prime opportunity for attackers, thanks to the spike in digital activity that comes with new student onboarding, document sharing, financial transactions and higher email volumes. Researchers recommend institutions act now, ahead of the return, to:

• Train staff and students to recognise phishing emails, fake reward offers and suspicious login pages
• Verify website addresses carefully before entering credentials or personal information
• Enable multi-factor authentication (MFA) on Microsoft 365, email and academic systems
• Regularly update and patch devices, learning platforms and administrative systems
• Monitor newly registered domains for education-themed impersonation attempts
• Review access permissions and secure sensitive student, research and administrative data

As cybercriminals continue to align their campaigns with the academic calendar, researchers say cybersecurity needs to become a core part of back-to-school preparedness and not an afterthought once term is already underway. The data suggests attackers are targeting not just schools and universities, but the wider ecosystem of students, families, and partners that surrounds them.

The post Education Now the World’s Most-Attacked Sector as Cybercriminals Gear Up for Back-to-School appeared first on IT Security Guru.

The Premier League has introduced mandatory cybersecurity requirements for its clubs for the first time, with non-compliant clubs facing fines of up to £100,000. The rules, which apply from the start of the 2026-27 season, mark a shift away from the league’s previous non-prescriptive security guidance towards a formal framework with fixed deadlines and evidence-based assessment.

Enforcement will sit within the Premier League’s existing disciplinary framework rather than a standalone sanctions regime. The board can issue a reprimand, impose a fine through its summary jurisdiction, or refer a suspected breach to an independent commission. Sources briefed on the matter say points deductions are not on the table for cybersecurity non-compliance.

A Phased Rollout to 2029

The framework covers four core areas: backups, incident response, risk management and security assurance, with later phases adding tested requirements around clubs’ ability to recover from a cyber incident.

Implementation is staged across three phases, with the first set of measures due by April 30, 2027, and further requirements following in April 2028 and April 2029. Clubs must file an interim compliance assessment by January 10 each season and a final assessment with supporting evidence by April 30. Any club found non-compliant at the interim stage has 28 days to submit a remediation plan to the league. The Premier League can also request further evidence at any point and may grant dispensations from specific requirements in exceptional circumstances.

The standards were signed off by clubs at the league’s Annual General Meeting in June, following a two-season consultation period, and are explicitly framed as a preventative measure rather than a response to any specific incident.

Industry Reaction: Right Direction, But Is the Timeline Too Slow?

Security vendors have broadly welcomed the move but raised concerns that both the financial penalty and the multi-year rollout may not match the pace at which clubs are being targeted.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, said the size of the fine needs to be seen in context: “£100,000 sounds significant until you remember that top Premier League clubs generate revenues north of £600 million annually.” He also questioned the pace of the rollout, describing the phased timeline of April 2027, 2028 and 2029 as “pragmatic but slow given the threat environment,” adding that “waiting until 2029 for full compliance gives attackers three more seasons to find the weakest link.”

Patel was more positive about the substance of the framework itself, calling the shift from a non-prescriptive roadmap to formal requirements with deadlines and evidence submissions “a meaningful structural shift,” and praising the choice of foundations: “backups, incident response, risk management, and recovery testing are exactly the right foundations.” He singled out the league’s proactive stance for particular credit: “most governing bodies wait for the headline incident. This one didn’t.” His central caveat was around enforcement: “the real test is enforcement appetite. Rules without credible consequences change nothing.”

Cian Heasley, Principal Consultant at Acumen Cyber, also welcomed the move, arguing that formal standards are overdue given the combination of sensitive data, financial transactions and operational systems held by football clubs.

“Moving from advisory guidance to enforceable standards creates much-needed accountability, and the financial incentive will inevitably help drive action,” he said.

For Heasley, however, the £100,000 penalty is less important than requiring clubs to demonstrate that they can withstand and recover from an attack. “The £100,000 ceiling is modest against the true cost of a serious incident and the amounts of money tied up in football clubs, so the value lies less in the sanction and more in compelling clubs to build tested backups, incident response and recovery capability before they are needed.”

He also welcomed the introduction of defined standards and deadlines, but cautioned that the requirements need to be clear enough to avoid ambiguity. “The key will be making sure those standards provide clear structure rather than leaving too much open to interpretation.”

Jamie Akhtar, CEO and co-founder of CyberSmart, framed the rules as part of a broader trend of cybersecurity becoming a governance issue rather than a purely technical one: “cybersecurity is moving from being viewed primarily as an IT responsibility to becoming an enforceable element of club governance.” He pointed to the scale of data and operational systems clubs now manage, “football clubs hold significant volumes of sensitive supporter, employee and player data, while also relying on systems for ticketing, payments, stadium access and match-day operations,” and argued the new mandatory areas reflect how quickly a cyber incident can escalate: “a serious cyber incident can quickly become an operational, financial and reputational crisis.”

Akhtar was clear that compliance alone should not be the end goal. Clubs, he said, need “clear board-level ownership of cyber risk, an accurate inventory of critical systems and data, tested and segregated backups, rehearsed incident-response and recovery plans, strong identity and access controls, and effective oversight of third-party suppliers,” alongside continuous evidence-gathering that controls are actually working. His conclusion: “the organisations that treat the new requirements as a minimum baseline for resilience, rather than simply a regulatory hurdle, will be in the strongest position when an attack inevitably tests those controls.”

Football Has Already Seen the Consequences

The risks are not theoretical. In November 2024, Italian club Bologna FC confirmed a ransomware attack claimed by the RansomHub group. After the club refused to pay the ransom, the attackers published stolen data on the dark web, reportedly including information relating to players and sponsors.

More recently, Ajax was named among the organisations affected by the CEVA Logistics breach, where customer information was exposed through a third-party shipping provider rather than through a direct compromise of the club.

Heasley said, “The incidents demonstrate both the direct and supply-chain risks facing football clubs. The Bologna attack, in particular, shows why resilience and data minimisation matter when stolen information can be used as leverage and subsequently published if negotiations fail.”

Why It Matters

The rules make the Premier League one of the first major sports bodies globally to formally mandate cybersecurity controls across its member organisations, rather than relying on voluntary guidance. With the first compliance deadline less than a year away, clubs will need to move quickly on board-level accountability, backup and recovery testing, and third-party risk oversight; areas that, as both commentators note, are straightforward to name but considerably harder to operationalise and evidence under a compliance deadline.

The post Premier League Introduces Mandatory Cybersecurity Standards, Backed by Fines of Up to £100,000 appeared first on IT Security Guru.

WorkNest Secure has expanded its GuardNest platform with continuous vulnerability scanning, giving organisations ongoing visibility into security weaknesses rather than relying solely on periodic penetration tests.

The new capability is designed to help businesses monitor vulnerabilities across internet-facing systems, web applications, and internal environments, providing continuous oversight of their attack surface as threats and infrastructure evolve.

The launch comes as organisations face increasing pressure from customers, insurers, and regulators to demonstrate continuous vulnerability management and stronger cyber resilience.

Moving beyond annual penetration testing

While penetration testing remains a critical part of any cybersecurity strategy, WorkNest Secure says annual or point-in-time assessments no longer provide a complete picture of an organisation’s security posture.

The enhanced GuardNest platform combines automated vulnerability scanning with expert analysis and remediation support, allowing organisations to identify vulnerabilities as they emerge and prioritise the issues that present the greatest business risk.

Organisations can schedule scans, monitor vulnerabilities in real time, and manage remediation activities through a single dashboard.

The platform now supports external vulnerability scanning, internal vulnerability scanning, web application scanning, and agent-based internal scanning, allowing customers to tailor the service to their environment and compliance requirements.

Simplifying vulnerability management

Alongside continuous scanning, GuardNest introduces new remediation workflows designed to help security and IT teams manage vulnerabilities more effectively.

Organisations can assign remediation tasks, define service level targets based on vulnerability severity, and track progress through to resolution. Automated escalation and SLA tracking are intended to ensure vulnerabilities are actively managed rather than simply recorded in reports.

The platform also includes live dashboards, historical trend reporting, and automated reporting that can support compliance initiatives, cyber insurance renewals, customer due diligence, and certifications including ISO 27001, Cyber Essentials Plus, and PCI DSS.

Helping organizations focus on what matters

Kirsty Fowler, Managing Director of WorkNest Secure, said organisations need greater visibility into their cyber risks as environments continue to change.

“Cyber threats do not operate to an annual schedule, yet many organisations are still relying on point-in-time assessments to understand their security posture,” Fowler said.

“New vulnerabilities emerge every day and infrastructure changes constantly, so businesses need visibility of their risks as they exist today, not six months ago.”

She added that the new functionality is intended to reduce the complexity of vulnerability management by combining automation with expert support.

“By combining automated scanning with expert support and practical remediation guidance, we help organisations cut through the noise, understand what matters most, and know exactly where action is needed,” Fowler said.

Responding to changing security needs

The launch reflects a broader shift in how organisations approach cybersecurity investment, with many moving away from one-off security projects in favour of continuous monitoring and ongoing risk management.

WorkNest Secure said the new functionality is available immediately either as a standalone vulnerability management service or as part of existing GuardNest packages.

The latest release builds on the redesign of the GuardNest platform in 2025, which introduced a more collaborative and user-friendly approach to vulnerability management, penetration testing, and remediation.

The post WorkNest Secure Launches Continuous Vulnerability Scanning with GuardNest appeared first on IT Security Guru.

KnowBe4 has expanded its AI-powered security awareness training platform with the launch of Custom AI Video Builder, a new capability designed to help organisations rapidly create tailored cybersecurity training videos in response to emerging threats.

The post KnowBe4 Unveils Custom AI Video Builder appeared first on IT Security Guru.