Tines has been announced as the headline sponsor of CSIDES 2026, a community-focused cyber security event taking place at the Grand Pier in Weston-super-Mare on the 9th October.

Organised by not-for-profit organisation Defend Together CIC, CSIDES aims to make cyber security more accessible to individuals, families, businesses and educators, while inspiring the next generation of cyber professionals.

Tines, an intelligent workflow platform used by security and IT teams, joins a roster of sponsors including 4FOX Security, Consultants Like Us, Punk Security, Darktrace, Utopian Knight, PPRO and IASME.

The event, described by its organisers as the UK’s first not-for-profit cyber security event built by and for a coastal community, will bring together industry experts and local residents for a day of talks, practical workshops and community engagement.

Tackling Cybercrime in Coastal Communities

The event comes amid growing concerns about the impact of cybercrime and fraud on local communities.

According to figures cited by the organisers, 1,728 victims of cybercrime were reported to law enforcement through Report Fraud in the Avon and Somerset region between March 2025 and March 2026, with reported losses exceeding £130,000.

Fraud figures were significantly higher, with 7,803 reports accounting for £57.8 million in losses during the same period.

Against this backdrop, CSIDES aims to equip local residents and small and medium-sized businesses (SMBs) with practical knowledge to protect themselves against online threats, including email scams and cybercriminal activity.

The event will offer accessible, jargon-free advice alongside opportunities for attendees to engage directly with cyber security professionals.

Tines to Deliver Hands-On Automation Workshop

As part of its headline sponsorship, Tines will host an interactive workshop introducing attendees to security automation. The session will guide participants through building their first ‘Tines Story’, demonstrating how automated workflows can help streamline everyday tasks.

Jennifer Cox, Director of Solutions Engineering at Tines, will also deliver the opening welcome address alongside CSIDES co-founders Hazel McPherson and Jess Matthews.

Cox will additionally moderate the event’s Main Stage programme, which will feature speakers including Threat Intelligence Manager Sophia McCall and representatives from the South West Regional Economic and Cyber Crime Unit.

Sessions throughout the day will explore topics ranging from local scams and artificial intelligence to digital wellbeing and bias in security.

Hazel McPherson, Co-Founder of CSIDES, said: “CSIDES exists to open cyber security to everyone, not just those already in the room. We couldn’t do that without the support of organisations like Tines. Tines and our other sponsors are helping us to create a truly inclusive and hands-on event that’s built with the community at its core. We cannot thank them enough.”

Jennifer Cox, Director of Solutions Engineering at Tines, added: “We’re so excited to support CSIDES, an event that not only connects security practitioners but also brings practical security knowledge to the local community. I can’t wait to meet attendees, hear their questions, and help people build their first Tines story at our workshop.”

Making Cyber Security Accessible to Everyone

Beyond its technical sessions, CSIDES seeks to address barriers that can prevent people outside the cyber security industry from accessing reliable advice and support.

Led by local residents, the event is designed to create opportunities for people of all backgrounds to learn about digital safety, connect with experts and explore potential careers in cyber security.

Organisers also hope the community-led approach can provide a model for similar initiatives in coastal communities across the UK.

CSIDES 2026 takes place on Friday, 9 October, at the Grand Pier in Weston-super-Mare. Last minute tickets can be found here.

The post Tines Named Headline Sponsor of CSIDES 2026 in Weston-super-Mare appeared first on IT Security Guru.

It’s that time again! Global cybersecurity PR agency Eskenzi PR has opened nominations for its tenth annual Security Serious Unsung Heroes Awards. The awards celebrate the UK’s most extraordinary cybersecurity professionals who work to make the industry not only more secure, but also more diverse, healthier and better informed about current events. Key sponsors include CultureAI, OneAdvanced and The Zensory. The awards are also supported by Computer Weekly, Information Security Buzz and IT Security Guru. 

The awards celebrate the cybersecurity professionals who go above and beyond to make a difference, often behind the scenes. They recognise educators who are fostering the next generation of cyber talent, those who are fighting cybercrime head-on, and mentors who are guiding others in the field. The awards also acknowledge those who are making cybersecurity a more inclusive space (Diversity Champion) and those who prioritise the wellbeing of their peers (Cybersecurity Wellbeing Advocate).

For 2026, three new categories have been introduced:  

• Cyber Scribe: This category celebrates the cybersecurity industry’s best and most insightful cyber blogs and newsletters, including those published on Medium, Substack or LinkedIn.

• Voice of Security: This category celebrates the industry’s best podcasts and vodcasts.   

• Channel Champion: This category celebrates the unsung heroes of the channel, from distributors and resellers to vendors with a strong channel presence.

Entries are now open, which includes filling in a short form detailing why the person deserves the award. Nominations will remain open until 5pm on the 16th of September 2026, before closing for review by an esteemed (soon-to-be-announced) panel of judges. 

Nominees, nominators, and their guests are then invited to a celebratory evening in London in October, to coincide with Cybersecurity Awareness Month. Thanks to its sponsors, the Security Serious Unsung Heroes Awards are free to enter and to attend.

Sam Soares, CRO at CultureAI, said:  “CultureAI is proud to support the tenth Security Serious Unsung Heroes Awards, celebrating the cybersecurity professionals who protect their organisations without fanfare, even as the threat, technology and governance landscapes shift. As AI adoption outpaces governance, these teams are absorbing an entirely new category of risk alongside everything they already carry. Recognising that work is long overdue, and we’re pleased to play a part in it.” 

“As we celebrate the 10th year of the Security Serious Unsung Heroes Awards, I’m incredibly proud of what these awards have come to represent. Over the past decade, we’ve had the privilege of recognising hundreds of remarkable people whose dedication, kindness and expertise have helped make our industry stronger, safer and more inclusive,” said Yvonne Eskenzi, Co-Founder and Director at Eskenzi PR. “I encourage everyone across the cybersecurity community to take a moment to nominate a colleague, mentor, teammate or friend who deserves to be recognised. Their contribution matters, and together we can make sure their achievements are celebrated as part of this very special milestone year.” 

  Categories this year include:

• Cyber Correspondent (for cyber journalists, broadcasters and writers)
• Godparent of Security
• Data Guardian
• CISO Supremo
• Security Avengers – Best Team
• Best Educator
• Best Ethical Hacker/Pentester
• Rising Star
• Security Mentor
• Best Security Awareness Campaign
• Diversity Champion
• Cybersecurity Wellbeing Advocate
• Cyber Scribe (for blogs/newsletters)
• Voice of Security (for podcasts/vodcasts) 
• Channel Champion

You can make nominations or find out more information here.

To see previous winners, click here.

The post 10th Annual Security Serious Unsung Heroes Awards Open for Nominations appeared first on IT Security Guru.

An experimental AI agent powered by OpenAI models has successfully compromised part of Hugging Face’s infrastructure during a controlled cybersecurity evaluation, offering a glimpse into the evolving offensive capabilities of advanced AI systems.

The incident, first disclosed by Hugging Face last week, has now been confirmed by OpenAI to have involved a combination of its models, including GPT-5.6 Sol and a more capable pre-release model with cyber safety restrictions temporarily relaxed for testing. According to both companies, the AI agent was evaluated as part of an internal benchmark designed to measure the cyber capabilities of frontier AI models.

OpenAI said the breach was quickly detected and contained, with no impact on customers or production systems. However, the company acknowledged that incidents involving increasingly autonomous AI agents are likely to become more common as models become more capable. This has raised alarm among cyber professionals. 

Oliver Simonnet, Lead Cybersecurity Researcher at CultureAI, said: “It’s not just the sophistication of the attack, but what it says about where we are with AI capability, as this wasn’t just a model executing a predefined exploit chain. It seemingly identified obstacles, discovered new attack paths, pivoted through multiple environments, and remained relentlessly focused on achieving its objective, even after leaving its sandbox.”

The evaluation was intended to help researchers better understand how advanced AI systems behave in realistic cybersecurity scenarios and to improve future safeguards. OpenAI said it has now restored the affected safety protections on the models used during the testing.

Kieran B, Head of Technical Services at Bridewell, noted: “OpenAI deserves credit for being transparent about what happened, disclosing the vulnerability responsibly and working with the affected parties to remediate the issue. That openness will help the wider industry learn from the incident. However, it also serves as a reminder that this was a controlled research scenario. If an attacker sought to exploit weaknesses in enterprise deployments using the new advanced AI models, the consequences could be far more significant.” 

The incident is likely to fuel ongoing discussions around AI security, agentic AI and the need for robust governance as organisations increasingly deploy autonomous AI systems. It also highlights the importance of rigorous testing and responsible disclosure as AI models gain the ability to perform increasingly sophisticated cyber tasks, even within tightly controlled research environments.

Cyber experts have weighed in on the incident. Sai Molige, Senior Manager of Threat Hunting at Forescout, said: “The required security posture is not ‘trust the model unless it misbehaves.’ It is to assume that a capable agent will discover every reachable path that advances its objective and to ensure that no such path grants unintended authority.”

Kevin Kirkwood, CISO at Exabeam, said: “The practical fix is to treat every dataset, model, plugin, and AI-processing job as untrusted code. Run it in a disposable sandbox with no standing cloud credentials, no direct access to production systems, and tightly restricted network egress. The goal is not to assume every malicious payload will be caught. The goal is to make sure a compromised worker has nowhere useful to go.”

“Next, remove the blast radius. Use short-lived workload identities, strict network segmentation, and separate trust zones for processing, production, internal datasets, and secrets. A worker handling user-supplied content should never inherit broad cluster access or reusable credentials. If one node is compromised, the incident should end at that node instead of becoming a tour of the company’s infrastructure.”

“Finally, build detection and response for machine-speed abuse. Monitor for rapid credential discovery, unusual service-account activity, cross-cluster access, abnormal API sequences, and large internal data pulls. Pair that with automated token revocation and fast worker rebuilds. ” Kevin continued. 

Roey Eliyahu, CEO and Co-Founder of Salt Security, said: “Every AI agent needs to be treated like a new identity with its own privileges, its own behavioral baseline, and continuous oversight. The question security teams should be asking right now is simple: do you have visibility into what your agents are calling, what systems they are reaching, and whether that behavior is what you sanctioned? Because if an agent starts making API calls it was never supposed to make, to systems it was never supposed to reach, you need to know before the breach happens, not after.”

Oliver Simonnet from CultureAI concluded: “This incident really highlights the challenges of building AI systems that are powerful enough to strengthen cyber defence whilst also ensuring they remain contained during development and testing. Being able to securely evaluate these systems is just as important as securing the systems they’re designed to protect.”

The post OpenAI-Hugging Face Incident: What We Know appeared first on IT Security Guru.

The 25th July 2026 marks one year since the Online Safety Act’s landmark child safety duties came into force, making it a natural moment to assess what’s changed, what’s worked and what challenges remain. Although the Act itself received Royal Assent in October 2023, its requirements were introduced in phases, with 25th July 2025 being the date many of the most visible obligations on platforms took effect.

The child safety duties require platforms likely to be accessed by children to introduce stronger protections, including effective age assurance, child risk assessments and measures to reduce exposure to harmful content. 

One year on, has the Online Safety Act fundamentally changed the internet for UK users, or has it simply shifted the challenges elsewhere? We spoke to cybersecurity experts for a short series of reports to find out more.  

Today, we’re examining the unintended consequences of the Act… 

Professor George Loukas, Head of Centre for Sustainable Cyber Security, University of Greenwich, said: “Ofcom has moved from consultation to enforcement. Naturally, the larger adult sector platforms have been the most visible early targets, and there have been lots of discussions on whether that led to a shift to more VPN usage as well as to non-compliant adult websites. These were all predictable though.”

Uptick in VPN Usage 

For many, the enforcement date signalled a natural (if not predictable) shift towards VPN usage to get around age verification tests. The evidence backs up this hypothesis: Proton VPN’s 2025 end of year report revealed that one of the biggest spikes in VPN sign-ups globally was seen in the UK from the 25th July. 

Konstantin Levinzon, co-founder of Planet VPN, noted that the real issue is people seeking out ‘free’ or not reputable VPNs, posing a significant security risk: “The biggest unintended consequence has been pushing people towards less secure tools, not more careful online behaviour. Age verification requirements have driven a significant increase in VPN adoption, but many users don’t seek out reputable providers – they simply download the first free VPN they find. Those services are often the ones leaking DNS requests, harvesting telemetry or relying on weak security practices, creating a worse privacy outcome than the legislation was designed to prevent.”

Sanjeev Malhotra, chief information security officer at TSG, emphasised the security risk: “People engaging with unvetted VPNs are potentially opening themselves up to serious risks, including malware infections, phishing attempts and personal data harvesting. At the end of the day, it’s still going through a server somewhere, and most people don’t stop to think about who’s operating it, where that data is going or what safeguards are actually in place. In some cases, people may be trading one privacy concern for another without realising it.”

A Lack of Measurable Outcomes? 

But is the ban on children accessing adult sites actually working? Some experts argue that there’s no hard evidence to back it up.

Elle Todd, Partner and Co-chair of the Entertainment & Media Industry Group at Reed Smith LLP, said:  “Ofcom’s recent age assurance report found that the proportion of children encountering harmful content online has not substantially improved despite widespread implementation efforts. The uncomfortable truth is that, based on this report, significant investment in compliance and technologies has not yet translated into measurable improvements in safety outcomes.”

Brian Higgins, Security Specialist at Comparitech, noted that, despite some non-compliance fines being handed out, there are still notable enforcement gaps: “Stats from Ofcom summarising their activities during the first twelve months of the Online Safety Act include the launch of 30 investigations, and fines for statutory violations in the region of £4 million GBP. Unfortunately they have also identified ‘enforcement gaps’ where AI and algorithmic content are concerned.”

“This item, in particular, could be a precursor to more widespread enforcement action in the future but a brief investigation into the facts reveals that their twelve-month fine collection figure only stands at £55,000. Couple that with their fairly embarrassing skirmish with the American platform 4chan, where their interjurisdictional service of a £520,000 financial penalty notice was rather infamous met with a picture of a hamster and a heavy dose of internet ridicule and it becomes rather obvious that they aren’t performing particularly well.”

Examining Data Storage and Verification System Security

Boris Cipot, principal security engineer, Black Duck, argues that we should be looking beyond whether checks are working and to whether the software behind the systems doing those checks is actually secure: “For many organisations, the focus has been on whether age checks are working. But an equally important question is whether the software behind those systems is secure and properly maintained. If a vulnerability, misconfiguration or compromised third-party component allows age checks to be bypassed, then this is not just a cybersecurity problem anymore but can quickly become a regulatory one as well.”

Sarah Bone, Co-Founder of YEO Messaging, notes the growing number of specialist identity providers: “The biggest unintended consequence has been a shift in where trust actually sits. Before the Online Safety Act, platforms largely carried the responsibility for verifying users themselves. Now we’ve got a growing ecosystem of specialist identity providers, each holding highly sensitive personal information. That’s strengthened online safety, but it’s also concentrated trust into fewer organisations, which makes them increasingly attractive targets for attackers.”

So what should age verification providers be doing?

Martin Wegrostek, Cyber Security Portfolio Manager at cybersecurity specialist OryxAlign, said: “Businesses should work on the assumption that breaches are a matter of when, not if. The question is whether providers have built their services with security and privacy by design. That means collecting the minimum amount of information needed to verify age, encrypting data both in transit and at rest, enforcing strong access controls, continuously monitoring for suspicious activity and having a well-rehearsed incident response plan. Organisations relying on third-party age-assurance services should also carry out regular security assessments and review the resilience of their supply chain, rather than assuming a compliant provider is automatically a secure one.”

On Trust and Risk

The conversation should also focus on human risk, said Tim Ward, CEO and co-founder, Redflags: “Content moderators, trust and safety teams, and customer support staff at in-scope platforms are, for the first time, routinely processing government ID documents, facial scans, and other highly sensitive data belonging to minors as part of their everyday work. That’s a substantial new category of human risk, from simple mishandling to targeted social engineering aimed at staff with access to this data, and it’s had almost no public discussion compared to the technical side of compliance.”

“Organisations that have spent the past year focused on the verification system itself should be asking whether the humans downstream of it have had the same level of scrutiny and support,” Ward noted. 

The post Examining the Unintended Consequences of the Online Safety Act appeared first on IT Security Guru.