SecurityHQ has announced the appointment of Aaron Hambleton as senior vice president of product and services, as the cybersecurity provider looks to strengthen innovation across its business.

This is the latest step in SecurityHQ's push to transition operations away from reactive monitoring and into measurable, intelligence-led performance improvement.

Hambleton first joined SecurityHQ in 2020 but will now step into an entirely new position to lead product and service innovation across the firm's portfolio – including the continued development of the SHQ Response platform.

An industry veteran, he brings more than 12 years of cybersecurity experience spanning frontline operations, advisory services, regional leadership, and threat intelligence.

In an announcement, SecurityHQ CEO Feras Tappuni said Hambleton offers a practical understanding of what security teams require of their partners – such as clearer context, faster decisions, and services that improve over time.

"Aaron is a sharp strategist who understands what customers need from a security partner and how global threat activity should inform the services built around them," he commented. "He brings the operational experience, threat intelligence perspective, and judgment needed to connect internal signals with external risk, helping customers make faster decisions and achieve more holistic security outcomes."

Since first joining SecurityHQ, Hambleton has transitioned from operational security leadership roles into positions with direct responsibility for regional strategy, customer delivery, and global advisory services.

The firm said his time spent leading teams across service delivery, customer success, operational performance, and growth in the Middle East and Africa has given him deep insight into evolving customer needs.

On the partnerships front, Hambleton is also credited with developing technology alliances that expand visibility and control through enterprise-grade platforms, while also strengthening SecurityHQ's portfolio with new modular offerings.

According to the vendor, his leadership across global threat intelligence, offensive security, exposure management, and platform innovation was a key factor in the company's recognition by IDC as a leading MDR provider in the Middle East for two years running.

In his new role, Hambleton will now focus on product and service innovation across SecurityHQ's range of MDR, threat intelligence, exposure management, and security operations offerings.

"Most security teams already have enough noise. What they need is a clearer way to understand which risks matter, what action to take, and how each decision improves their security over time," he explained.

"My focus is on building services that connect intelligence, exposure, and response so that customers can close the gap between detection and action, while improving their security with every decision."

Hackers posing as IT experts are showing up in person at law firms, the FBI has warned.

In the past, the Silent Ransom Group (SRG), also known as Luna Moth, Chatty Spider, and UNC3753, sent phishing emails purportedly charging small 'subscription fees'. To cancel the fake subscription, the victim was instructed to call the threat actor, who then emailed the victim a link to download remote access software.

Now, though, the group is using phone calls and phishing emails to pose as IT support, gaining access to the victims' computers and exfiltrating data.

And while this is often done through legitimate remote access tools, the group has also been sending individuals in person to the victim company's location to gain physical access to machines.

"This is a pretty natural evolution of extortion operations. We spent years building detections around malware and exploits, and now attackers are shifting toward social engineering, trusted tooling, and physical access," commented Gabrielle Hempel, security operations strategist at Exabeam.

"Physical security fell by the wayside when organizations began to move their data to the cloud, but if your security model assumes that the threat actor is always on the other side of the internet, you have a problem."

The group's first step is to either directly call or send phishing emails urging employees to call 'IT support'. While on the phone, the SRG actor directs the employee to grant access to a remote desktop session.

If that attempt fails, though, SRG sends a threat actor to the victim's location to gain access and insert a storage device into the victim's computer. The hacker tells the victim they need to image the device or create a backup file to address potential impacts from the phishing email.

Once they've got access to the victim's device, they minimally escalate privileges and quickly pivot to data exfiltration without encryption, using Windows Secure Copy ( WinSCP) or a hidden or renamed version of 'Rclone'.

"SRG actors use the exfiltrated victim data to extort the victim by sending a ransom email threatening to sell or post the data online," the FBI said. "SRG actors also call employees or clients of a victim company to pressure the victim to begin ransom negotiations."

While SRG has hit companies in a number of sectors, including the insurance, finance, and healthcare industries, it's consistently been targeting US-based law firms since spring 2023.

"The group is leaning into trust by posing as IT support, walking employees through remote access, then moving quickly to steal data before anyone realizes something is wrong," warned Nick Tausek, lead security automation architect at Swimlane.

"That makes this especially dangerous for law firms. These environments hold sensitive client records, privileged communications, financial details, and case information. If that data is stolen, the damage does not stop at the victim organization. Clients can be pressured, legal strategies can be exposed, and employees can become targets for follow-up scams."

The UK is building a national cyber defence shield powered by AI, the first to be publicly announced in the world.

That's according to a speech from GCHQ head Anne Keast-Butler, who said AI was an "unstoppable force with great opportunity" that comes with risks.

The system she described remained a plan that the security agency hoped to have up and running within the next five years, according to reports, and would use AI agents to spot threats against critical national infrastructure, including airlines and telecoms.

"In the past few months, GCHQ has developed the blueprint for a new national cyber defence capability will hardwire cutting-edge agentic AI into machine-speed cyber defence," Keast-Butler said.

"And as we draw on decades of expertise in machine learning to reimagine cyber security, we're also embedding frontier AI deeper into our operations – responsibly and ethically – to enhance algorithms, translate foreign languages, and find needles in haystacks faster than ever before," she added.

Few other details about the plans were revealed.

Last year, major British companies suffered serious outages after a series of cyber incidents, including one against Jaguar Land Rover that was deemed the "single most financially damaging cyber event to ever hit the UK" and another that cost retailer M&S nearly £400m.

Hackers have increasingly turned to AI for their attacks, with AI now deemed a "standard part of the attacker toolkit", according to one industry expert, while CrowdStrike said the technology was accelerating the expansion of enterprise attack surfaces at an alarming speed.

Future tech threats

She said AI efforts were necessary for the UK and its allies to stay ahead, and there was a narrowing window to keep the lead, in particular when it comes to technology and war.

"Tech companies are releasing AI-driven innovations at a remarkable pace, with untold consequences, as algorithms are weaponised often just below the threshold of traditional warfare," said Keast-Butler. "And China is now a tech superpower with sophisticated cyber, intelligence, and military capabilities."

She added: "One thing is clear: technology and data are no longer just tools; they are transformational forces."

Alongside AI, she pointed to quantum computing, calling for companies to be ready for the security implications, notably the ability to crack existing encryption techniques.

"So we must protect our most critical systems from future quantum attacks," Keast-Butler said. "This will take time – and that's why we're calling on businesses to act now to meet the timelines set out by NCSC."

The National Cyber Security Centre last year laid out a ten-year timeline for the transition to quantum-resistant encryption methods, known as post-quantum cryptography – but 90% of companies aren't prepared, according to one survey.

And she noted the rise of space technologies, noting that ten thousand new objects had been launched into space in the three years since she took over as GCHQ director.

Teamwork to counter threats

The UK and its allies, be it Europe, Five Eyes or NATO, need to work together to counter the danger of China or Russia taking the lead in any of these technologies – and both are investing heavily.

She admitted that raised issues for digital sovereignty, an increasingly hot topic amid geopolitical concerns presented by the dominance of Big Tech firms from the US and Chinese success in AI and hardware.

"Some strive to stay safe by keeping data within their borders, shutting out foreign IT," she said. "But that doesn't work."

The EU has started to tender for sovereign cloud services for EU institutions, and France is making its own software to replace US-made productivity solutions, for example. But Keast-Butler argued for a different route, saying sovereignty need not mean "made in the UK" but control over supply chains, data, and dependencies.

"It's about backing great British science and innovation, established tech companies, and academic excellence – whilst not limiting our ability to harness the best of the world's technology," she said.

GitHub has confirmed that around 3,800 internal repositories have been breached, after a developer unwittingly installed a malicious VS Code extension.

The Microsoft-owned code repository and DevOps platform said the breach was detected on Monday, but that the activity involved exfiltration of GitHub-internal repositories only.

"We have no evidence of impact to customer information stored outside of GitHub's internal repositories, such as our customers' own enterprises, organizations, and repositories," said the firm's chief information security officer, Alexis Wales.

"Some of GitHub's internal repositories contain information from customers, for example, excerpts of support interactions. If any impact is discovered, we will notify customers via established incident response and notification channels."

GitHub said it started rotating critical secrets as soon as it discovered the breach, with the highest-impact credentials prioritized first. It is now analyzing logs, validating secret rotation, and monitoring its infrastructure for any follow-on activity, it said, promising a fuller report once it's finished its investigation.

GitHub hasn't explicitly named the attacker, but made reference to a claim by the TeamPCP hacker group that it had accessed around 3,800 repositories, saying that the number was consistent with its investigation so far.

TeamPCP, which first appeared late last year, is the group linked to the Mini Shai-Hulud worm, and carries out supply chain attacks by stealing CI/CD credentials and using them to publish infected versions of further packages.

The group has reportedly not asked for a ransom for the GitHub data, but is offering the stolen data for sale for $50,000, saying that if it doesn't receive an offer, it will leak it for free.

"This is another reminder that developers are now permanent targets in software supply chain attacks. TeamPCP has shown how a motivated attacker can move through the tools developers trust every day – open source packages, extensions, accounts, and credentials – rather than trying to break in through the front door," said Ilkka Turunen, Field CTO at Sonatype.

"Combined with the acceleration we're already seeing from AI-assisted vulnerability discovery, the window between compromise and exploitation is collapsing. The old assumption was that defenders would have time to identify, prioritize, and respond. That margin is disappearing."

The news came just a day after the Nx Console VS Code extension, which has 2.2 million installs, was briefly backdoored, with the malicious version collecting credentials silently when a developer opened a workspace. The issue was handled swiftly, with the extension pulled within 18 minutes on the VS Code Marketplace and 36 minutes on Open VSX.

"The community's ability to catch and remove malicious packages is real. For extensions with millions of installs, it's also insufficient," commented Shaun Brown technical product marketer at Aikido Security.

"Caught in 18 minutes and prevented exposure are not the same thing. Minimum package and extension ages are the best way to protect your devices from similar attacks today."

Small and medium-sized businesses (SMBs) across the UK are struggling to get cybersecurity strategy plans up and running, according to new research.

Analysis from Kaspersky shows more than two-thirds (67%) of SMBs lack "fully actionable" cybersecurity strategies. This means that while many have developed theoretical plans for how to tackle growing security threats, real-world implementation is falling flat.

These shortcomings are leaving a concerning number of businesses at higher risk of attacks amidst an escalating cyber threat landscape, the company warned.

"Cybersecurity can't remain a theoretical exercise," commented Oscar Suela, Kaspersky general manager, Iberia, UK & Ireland. "The findings show that while many SMBs have well-intentioned strategies, these often stay on paper."

So what's hempering cybersecurity strategy plans? A key factor here lies in a chronic disconnect between executives and IT leaders on the importance of cybersecurity, the study noted.

Nearly one-quarter (22%) of IT leaders said C-suite executives do not fully understand the strategic importance of cybersecurity, which is "slowing progress towards effective, organization-wide protection".

While strategies are falling flat, SMBs are turning to outside expertise to shore up defenses, the study noted. More than one-third (38%) of small businesses are now engaging with external cybersecurity partners.

These partners are helping bridge gaps, enabling IT leaders to build long-term sustainable security strategies.

SMBs are increasingly looking for partners that provide continuous awareness training for staff, particularly in defending against threats such as phishing, while other key focus areas include those with incident response capabilities.

Getting plans off the ground

Despite an increased focus on managed services, IT leaders are still pushing to develop their own internal strategies, the study noted. But for many that's easier said than done.

As a starting point, Kaspersky said that IT leaders should focus primarily on implementing "practical, measurable" security practices that can be easily integrated within daily operations.

Simply put, the study found that starting small and building thereafter is the best approach to building a robust long-term strategy. Investment in cyber awareness training and education for staff is also critical, Kaspersky noted.

Finally, emphasizing the importance of cybersecurity to leadership is among the most crucial aspects of any strategy during its embryonic stages. Suela said that creating alignment between IT and leaders is vital.

MORE FROM ITPRO

• Some of the most popular open weight AI models show ‘profound susceptibility’ to jailbreak techniques

AI is helping to speed up code deployment, but security isn't keeping up.

That's one of the key findings from a report by security firm Black Duck, with 81% of 1,000 security professionals surveyed saying application security testing is now slowing down development and delivery.

The report comes as AI is starting to have an impact on coding and development, with 84% of developers surveyed by Stack Overflow over the summer saying they've used the technology in the last year or plan to imminently, even though trust in the end product remains an issue. Indeed, a survey of security leaders last year found that the vast majority – some 92% of those polled – were concerned that AI-generated code could cause a security incident in their organization.

The Black Duck research found nearly 60% of those polled are deploying code every day – if not more frequently – but security is getting in the way of that AI-accelerated speed.

That's because 46% of those asked still rely on manual processes with security, with 81% of professionals saying that application security slows down the development process – and that can lead to security debt, with security problems left piling up unaddressed.

The report noted that companies have successfully built "high-velocity development pipelines," thanks to AI as well as other coding tools, but automation of security lags behind.

"This automation gap means many businesses are simply unaware of their vulnerabilities, with 61.64% of

organizations testing less than 60% of their own applications," the report noted. "The result is that you're accumulating a massive security debt with every single release."

AI vs workflows

Because of that, developers said that improving development workflow integration is a top priority for 27% of those polled.

"The findings paint a clear picture: the old ways of doing application security aren't working, and speed without integrated security creates risk for companies," said Jason Schmitt, CEO of Black Duck. "To navigate this new world, development teams must shift from a reactive, tool-centric model to a proactive, platform-based strategy that integrates security directly into developer workflows to achieve true scale application security."

The challenges are exacerbated by 71% of respondents saying that security alerts are noise, with too many false positives and duplicate findings from multiple tools eating into any benefits, known as tool sprawl.

Risk vs reward for AI coding

More generally, two-thirds of respondents said AI helps them write more secure code, but 57% agreed it can also introduce new risks.

"This report nails the core dilemma facing modern DevSecOps: the tradeoff between velocity and visibility," said Mayur Upadhyaya, CEO at APIContext. "We're seeing a shift away from adding more tools toward simplifying and integrating the ones teams already have."

Upadhyaya added: "As AI becomes both a productivity multiplier and an attack vector, governance must evolve, but so must observability. If you can't baseline normal behavior and detect deviation in real time, you're playing catch-up. And in AI-native pipelines, catch-up is too late."

Of course, security debt is a problem even without AI. A report by Veracode earlier this year showed remediation times for security flaws had grown by 47% over the last five years, from an average 171 days to fix a vulnerability in 2020 to 252 days in 2025.

Deepfake attacks are on the rise and causing big financial losses, but organizations are largely unprepared.

In its second annual AI Deepfake Threat Report, enterprise comms security provider Ironscales found that 85% of cybersecurity and IT leaders at mid-range and large enterprises have experienced at least one deepfake attack in the last year, 10% more than the year before. Four-in-ten experienced three or more attacks.

And of these, 55% incurred monetary losses, which averaged $280,000; although 61% lost $100,000 or more, nearly 20% lost at least $500,000, and more than 5% lost more than $1 million.

The two most common threats are static images and email-based attacks, at 59% each. However, other attack vectors are catching up quickly, with audio or voice manipulations rising from 25% to 52%; videos from 33% to 45%, and both live video manipulation and live voice-only calls increasing from 30% to 41%.

However, budgets aren't keeping pace with the threat.

"In light of the above findings, it should come as little surprise that deepfake defense is rapidly becoming a top priority for security teams. However, we are seeing a significant lag in actual investment," the researchers warned.

"While both current and anticipated investment in deepfake defense is increasing, the gap between concern and action reflects market dynamics: deepfake defense solutions are relatively new to the market, and many organizations are waiting for more mature, proven technologies before committing budget, even as losses mount."

Organizations are offering deepfake training, the report found – but it's not always terribly helpful. While 88% have provided training in the last year, up from 68% the year before, only 8% saw first-try simulation pass rates of 80% or above, and the first-try deepfake-simulation pass rate average was just 44%.

However, despite the fact that 94% of respondents expressed at least some level of concern about the threat deepfakes currently pose to their organizations, and over 63% said they were very concerned, an overwhelming 99% claim to be confident in their defences.

"This disconnect might be dismissible as just a matter of question design if organizations were otherwise performing well in defending against these threats. On the contrary, though, as we've seen throughout this report, organizations are not faring well thus far in the fight against deepfakes," the researchers said.

"So, what's behind this seeming preparedness paradox? Some possible explanations include professionals' wishful thinking about their organizations investing more and improving their defensive capabilities, an underestimation of more widespread prevalence, or plain old wishful thinking."

To effectively fight the threat, said Ironscales, organizations should focus on three critical areas: training that addresses the full spectrum of deepfake sophistication; detection technologies that match the pace of AI advancement; and incident response processes that account for the unique challenges of synthetic media.

The UK's Metropolitan Police have arrested two teenagers for the recent data breach of the Kido chain of children's nurseries.

The two men, both aged 17, were arrested yesterday in Bishop's Stortford, Hertfordshire, as part of a raid on a number of properties. They were taken into custody, where they are being questioned on suspicion of computer misuse and blackmail.

"Since these attacks took place, specialist Met investigators have been working at pace to identify those responsible," said Will Lyne, the Met's head of economic and cybercrime.

"These arrests are a significant step forward in our investigation, but our work continues, alongside our partners, to ensure those responsible are brought to justice."

The attack on the Kido pre-school chain saw the theft of data on around 8,000 children. It appeared to have been carried out through the breach of Kido's billing, staffing, and reporting software system, supplied by Famly.

It was widely condemned when the previously unknown hackers, who called themselves Radiant, published the profiles of 10 children and threatened to publish more if their ransom demands weren't met.

The data included the children's names, dates of birth, and birthplaces, along with the personal details of parents, grandparents, and guardians, including their addresses and phone numbers.

The hackers were even reported to have contacted the parents of some affected children directly to extort them.

However, the attackers later removed all the stolen data and pictures from their darknet site and said they'd deleted all the data they'd stolen.

"We understand reports of this nature can cause considerable concern, especially to those parents and carers who may be worried about the impact of such an incident on them and their families," said Lyne.

"We want to reassure the community and anyone affected that this matter continues to be taken extremely seriously."

At the time, Palo Alto researchers noted that Radiant appeared to be a brand new group, and unaffiliated with any nation-state actors or other established cybercrime syndicates.

Targeting small children and publishing such a broad range of personal data was also something of a first. And when asked by BBC News whether they felt bad about extorting a nursery using the children's data, the criminals said they 'weren't asking for an enormous amount' and that they 'deserve some compensation for our pentest'.

While this was the first attack of its kind, Palo Alto Networks warns that there may be more, with many educational establishments using similar billing, staffing, and reporting software without understanding the security implications.

Palo Alto advises schools and nurseries that use such platforms to immediately review the security controls they currently have in use. They should rotate passwords, particularly across key operational and administrative accounts, and adopt multi-factor authentication where available.

Middlesbrough Council has announced a sizable investment into a 12-month cybersecurity service worth approximately £25,000, in recognition of the growing risk to UK public sector organizations.

The move has come amid an year-long overhaul of the council's cybersecurity strategy, including greater staff training and data center disaster recovery tests.

In a report [PDF] published 25 September, the council acknowledged the work it currently does to ensure its third-party suppliers safeguard data in order to secure its supply chain, in addition to its own cybersecurity measures.

It noted that in November 2024 the council suffered two DDoS attacks that took down its website, with another successful attack happening in early December.

Responding to these attacks, the council implemented a mitigation solution at the end of 2024 and has suffered no further DDoS incidents since.

In the spring, it put in place a three-year cybersecurity training strategy and completed the Get Cyber Assessment Framework (CAF), a government program councils can use to identify third-party dependencies, organizational vulnerabilities, and analysis of critical teams.

Completion of the program secured Middlesbrough Council a £15,000 grant.

During 2025 its teams also carried out a disaster recovery plan for its data centers and commissioned the shared service firm Veritau to audit its server admin and security.

"A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited," Vertiau concluded.

"Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance."

UK public sector under attack

To highlight the cyber threat UK organizations now face, the report's authors cited the UK government's latest Cyber security breaches survey, which found that 43% of companies and 30% of charities within the UK had reported experiencing a cyber attack in the 12 months leading up to the survey.

Among larger organizations, this number was higher, with 67% of medium and 74% of large businesses reporting cyberattacks.

A large number of public sector leaders are concerned about cyberattacks, and a report by Blackberry released in 2024 found UK public sector organizations are vulnerable to supply chain attacks.

In recent years UK councils have publicly struggled with cyber incidents. At the start of 2024 Canterbury City Council, Thanet District Council, and Dover District Council were hit with cyberattacks that caused severe disruption to services, and in March Leicester City Council was also hit with a highly disruptive attack.

Later the same year, council services across Greater Manchester were disrupted after the housing services firm Locata was attacked by hackers. Councils across Manchester, Salford, and Bolton were forced to suspend housing websites in response.

Attacks have continued well into 2025. In February, Hammersmith and Fulham Council revealed that it faces 20,000 attempted cyber attacks per day, mainly in the form of phishing.

And in June, hackers stole historic data, including the personal information of poll station workers and ballot counters at Oxford City Council, though the organization's automated security systems were able to limit the scope of the attack.

The EU is being battered by cyberattacks, with government and critical infrastructure the top targets, cybersecurity agency ENISA has warned.

The latest ENISA Threat Landscape report found that state-aligned threat groups have been intensifying their operations towards EU organizations. It's seen such groups carrying out cyberespionage against the public administration sector, while feeding EU audiences with misinformation.

At the top of the target list is public administration, at 38%, mostly hacktivism and state-nexus intrusion to conduct cyberespionage campaigns against diplomatic and governmental bodies.

Next is the transport sector, at 7.5%, followed by digital infrastructure and services at 5%, finance at 4.5% and manufacturing at 3%.

Hacktivism accounted for almost 80% of the total number of incidents, mainly through low-impact DDoS campaigns targeting EU member states organizations' websites. Only 2% of hacktivism incidents resulted in service disruption.

Phishing – including vishing, malspam, and malvertising – is the main method for initial intrusion, accounting for about 60% of cases.

"The recent ENISA report makes it clear that phishing is still the leading entry point for attackers. What's interesting is how the technique is being reshaped by AI," said Mick Leach, field CISO at Abnormal AI.

"As shown in the report, attackers don't need to innovate while they continue to see success with tried-and-true techniques. Instead, they can make these methods more impactful with generative models that allow the creation of highly convincing and context-aware campaigns."

Vulnerability exploitation was the next most common vector.

"Vulnerability exploitation, which accounts for 21.3% of all attacks according to ENISA, is continually seen as a problem for businesses," said Sylvain Cortes, VP strategy, Hackuity.

"The challenge is that organisations often have difficulty with visibility and prioritization; they need both a centralised view to identify vulnerabilities and then the context around these to know where to prioritise remediation efforts. There's an inherent imbalance in the time it can take for organisations to patch critical vulnerabilities and the speed with which attackers can exploit them."

DDoS hacktivism

DDoS attacks were the most common type of incident, accounting for 77%, with most carried out by hacktivists rather than cyber criminals. But, said the researchers, there has been a notable convergence between threat groups. State-aligned actors are showing hacktivist characteristics, while the two groups are using increasingly similar tools.

The report highlighted the abuse of critical dependency points, for example in the digital supply chain. And AI, meanwhile, is being used both as an optimization tool for malicious activities and also as a new point of exposure. LLMs are enhancing phishing and automating social engineering activities.

"The growing role of AI has become an undeniable key trend of the rapidly evolving threat landscape, the researchers said.

And, they warned, "While the focus of threat activities involving AI was the use of consumer-grade AI tools to enhance their existing operations, the emergent malicious AI systems is raising concerns about their capabilities in the future due to the widespread use of AI models."

MORE FROM ITPRO

• What is a DDoS attack
• AI phishing

Businesses still fall short when it comes to embedding resilience in their operations, according to a Gartner expert, due to low collaboration across teams and a lack of business focus.

Arthur Sivanathan, senior director analyst at Gartner, led a talk on organizational resilience at the Gartner Security & Risk Management Summit, held in London at the end of September.

In his talk, Sivanathan advocated for far more focus on business processes via business impact assessments (BIAs), for a more holistic approach to securing critical business functions.

"Gone are the days when we did business impact assessments purely for business continuity and disaster recovery, it doesn't work anymore," he said.

In today's digitally-connected world, he said, BIAs must be carried out at the business function layer, so that CISOs and CIOs can demonstrate to the business teams the areas that need the most urgent attention and investment.

"The business impact assessment is the heart of cyber resilience," Sivanathan said in conversation with ITPro after the talk.

Sivanathan showed an example of a BIA diagram assessing the procurement management processes of a finance unit.

This BIA could be used to scrutinize the effect of disruption to processes such as inventory management, purchasing, distribution, and supplier payments and how each is tied to dependencies like IT infrastructure, workforce decisions, and third-party vendors.

Without this level of cross-department detail and agency, cybersecurity professionals won't be able to adequately embed resilience throughout the organization, he added.

"Traditionally, people focus more on detection, response and recovery but I think there's a bigger play here because if you look at third-party risk, that's in governance," Sivanathan told ITPro.

"Identification is crucial. Have you got full visibility over not just your hardware assets, your software assets, your critical third parties, your data?"

Cross-party collaboration is key to this, he said, with security teams and neighbouring capabilities such as crisis management, business continuity, disaster recovery, IT, and the business needing to work together on establishing BIAs.

'Resilience' can be hard to define

Measuring cyber resilience is a recurring issue for cybersecurity leaders, Sivanathan explained, because it can't be measured across just one metric.

"I think there are a lot of vendors out there who try and come up with that metric, and it doesn't really work, because they're looking at one pillar in isolation... so that's something we're looking to establish."

In his talk, Sivanathan cited a number of definitions for cyber resilience, including NIST SP 800-172, the Global Cyber Security Capacity Centre at the University of Oxford, and the International Organization for Standardization.

Sivanathan said that the multitude of definitions can be confusing for leaders, but urged attendees to look beyond them to the scope of their role.

"The key statement is the ability to limit the impacts and adapt quickly to resume business operations in the rise of cyber regulations."

He acknowledged the rising pressure on leaders to adhere to the Digital Operational Resilience Act (DORA) and Network and Information Systems 2 (NIS2) Directive.

The majority of audience members at the talk raised their hands when asked to identify if they're currently dealing with this legislation in their day-to-day work.

In the past 18 months, he said, there's been a big shift away from enquiries about the implications of DORA, with around 80% of the 15-20 enquiries he takes per week now focused on NIS2.

Many organizations are struggling to comply with NIS2. But in the pursuit to meet legislative requirements, Sivanathan warned against coming to see resilience as a mere "tick box exercise".

He pointed to NIST CSF 2.0 as a fundamental framework for resilience, citing Ireland and Belgium as regions leaning on this legislation to put accountability at the very top level of decision-making.

In contrast, Sivanathan showed data from Gartner's August 2025 Cybersecurity Controls Assessment, which found large gaps between the average importance CISOs place on functions such as response and recovery and the average maturity of their organizations in these areas.

The importance of practical exercises

To improve maturity and business buy-in, Sivanathan advocated for more foundational steps such as running tabletop exercises, to test cyber resilience strategies against real life incidents.

Sivanathan said 46% of organizations test less than 20% of their business continuity plans using tabletop exercises each year, while more mature organizations are running these tests at every level including at the top with executives.

This is essential in cases such as deciding whether your organization will agree to ransomware payments in the event of a severe ransomware attack, Sivanathan added:

"The number of organizations I speak to that say, when I first ask about this, 'oh no, we'd never pay ransoms, it's company corporate policy, we would never pay the ransom.

"However, when I started to dig or to ask pointed questions, there was suddenly an aha moment of 'no, I think we need to go and check' because if all of your data's gone, your infrastructure's gone, what are you going to do? You can't sustain it as an organization; maybe there is a thing where you have to pay a ransom."

Sivanathan added that tabletop exercises should be run at multiple levels, including wider stakeholders, business teams, and technical teams, for maximum effectiveness.

But he cautioned that every organization will need to take a slightly different approach, particularly when it comes to using tabletop exercises to clue in executives, as they aren't the individuals who directly manage a crisis.

"You definitely need legal and compliance in some of those activities, especially around messaging, because the first message that goes out after an incident can mitigate the reputational damage. If that's not worded correctly, it can have serious implications."

Looking ahead to 2026, Sivanathan said organizations would continue to struggle with NIS2 as it embeds in various regions, with UK businesses also closely tracking the passage of the Cyber Security and Resilience Bill in parliament.

MORE FROM ITPRO

• Cyber Security and Resilience Bill in parliament
• What is cybersecurity

A newly-discovered threat group linked to China is targeting governments, the military, and other critical bodies across Africa, the Middle East, and Asia for espionage.

Palo Alto Networks said the group, which it has dubbed Phantom Taurus, belongs in the top tier of global threats.

"This is largely due to their targeting of both high-level geopolitical intelligence and entities (embassies, foreign ministries, diplomats) and critical telecommunications infrastructure, making them very much a dual threat," the researchers warned.

Phantom Taurus has been operating for two years, using a distinctive set of tactics, techniques, and procedures (TTPs) that allow it to conduct highly covert operations.

Alongside more common tools, such as China Chopper, the Potato suite, and Impacket, the group uses customized tools, including the Specter malware family and Ntospy. It's also been able to maintain long-term access to critical targets through a custom-built malware suite called NET-STAR.

Since 2023, Phantom Taurus has focused on stealing sensitive and specific emails of interest from email servers – but has more recently shifted to the direct targeting of databases using a script named mssq.bat.

This connects to an SQL Server database with a given server name, a user ID named sa (system administrator), and a password that the attackers previously obtained. It then reads the SQL query provided in the command-line arguments by the group's operators, allowing dynamic searching for tables and specific keywords.

Finally, it executes the provided query and returns the results that match the user's search, exports the results to a CSV file, and closes the database connection.

Perhaps most significantly, the group is using a new and undocumented malware suite, NET-STAR, designed to target Internet Information Services (IIS) web servers.

"The NET-STAR malware suite demonstrates Phantom Taurus' advanced evasion techniques and a deep understanding of .NET architecture, representing a significant threat to internet-facing servers," the researchers said.

The suite consists of three distinct web-based backdoors, each carrying out a specific role in the attack chain, while maintaining persistence within the target's IIS environment.

IIServerCore is a fileless modular backdoor that supports in-memory execution of command-line arguments, arbitrary commands and payloads; AssemblyExecuter V1 loads and executes additional .NET payloads in memory; and AssemblyExecuter V2 is an enhanced version of AssemblyExecuter V1 that's also equipped with Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) bypass capabilities.

Palo Alto Networks has published indicators of compromise here, and has upgraded its Advanced WildFire machine-learning models and Cortex XDR to give better protection. It said it has also shared its findings with fellow Cyber Threat Alliance (CTA) members, and is recommending that they do the same.

MORE FROM ITPRO

• Harrods hit by cyber attack
• Ashai production halted by cyber attack

Japanese brewing giant Asahi is the latest company hit by hackers to suffer operational disruption.

Asahi said yesterday it had suffered a cyberattack that had led to a "system failure" limited to its Japanese orders and shipments. The company holds 40% market share in Japan, but also owns international brands including Peroni and Grolsch, as well as Fullers in the UK.

No personal information or customer data had been leaked, Asahi said in a statement on its website, but order and shipment operations at Japanese divisions had been suspended, as well as call centre operations including customer service.

Production stopped at as many as 30 plants, and more than a day on has not been able to say when production might resume, a spokesperson told Reuters. Beer supply for Asahi's European or UK companies has not been impacted, Asahi added.

"We are actively investigating the cause and working to restore operations; however, there is currently no estimated timeline for recovery," the Asahi statement added.

Customers should keep an eye on their data regardless of Asahi's initial report said Kevin Marriott, senior manager of cyber at Immersive.

"In their statement, Asahi said 'there has been no confirmed leakage," Marriott said in a statement sent to ITPRO. "As is often the case in these situations, stances on what has and hasn't been compromised can change, so this may not be a definitive position, and data might have been stolen. People should therefore keep an eye on updates as the situation evolves."

Further details of the incident and the nature of the attack have yet to be released.

Big brands become targets

The Asahi hack is the latest in a series of high-profile attacks on major brands. Earlier this year, a spate of ransomware attacks against retailers saw M&S' online orders knocked offline for several weeks, with some services taking months to recover. Co-op and Harrods were also targeted, with total costs topping £440 million.

Earlier this month, Jaguar Land Rover was hit by a cyberattack that forced it to shut down production systems. This week, with production still not back up and running, the government confirmed plans to bail out the company with a £1.5bn loan guarantee, highlighting the significant impact and potential costs of such cyber attacks.

"Cybercriminals are increasingly targeting the operations of global brands, with Asahi the latest victim," Marriott added. "Manufacturing networks are complex ecosystems, spanning legacy infrastructure, external suppliers, diverse technologies, and competing priorities around safety and availability. A breach in one area can quickly ripple through supply chains and disrupt operations."

High cost of operational disruption

Indeed, Marriott noted that the operational disruption may have wider impact, despite the incident being limited to Japan so far.

"While the disruption is currently confined to one country, Asahi has a significant market share in Japan of almost 40%," he said. "Therefore, disruption to production will be costly to Asahi and potentially re-sellers."

He added that the recent attacks on the retail sector and Jaguar Land Rover showed the high costs of operational disruption like a halt to production or supply chain.

"True cyber resilience means organisations can anticipate, withstand, and bounce back from attacks without having to halt manufacturing," Marriott added. "This requires improving and demonstrating the cyber capabilities of a business's workforce, ensuring they are prepared for the next cyber crisis."

MORE FROM ITPRO

• Harrods hit by cyber attack
• Kido nursery hackers threaten to release more details

Hackers have published the profiles of children attending the Kido chain of nurseries and are threatening to release more.

A group called Radiant hacked the company's systems and posted the profiles of ten children online on Thursday and another ten on Friday, saying it would release 30 more, along with the personal data of 100 employees.

The data released includes the children's names, dates of birth, birthplaces, and the personal details of parents, grandparents, and guardians, including addresses and phone numbers.

"It's an unfortunate fact that the reason for the public outcry over compromised child data is the very reason it was targeted in the first place: it's considered very sensitive. Because of this, a common assumption is that the data is heavily protected, but that's often not the case," commented Tim Erridge, vice-president of Europe, the Middle East, and Africa at Unit 42 at Palo Alto Networks.

"Sadly, this attack potentially marks a turning point whereby we can no longer assume that children are off limits to attackers ethically. Something that typically would have been true in the past, with many assuming that children's data isn't of value to hackers."

The attack appears to have been carried out through the breach of billing, staffing, and reporting software supplied by software firm Famly.

"This malicious attack represents a truly barbaric new low, with bad actors trying to expose our youngest children's data to make a quick buck," chief executive Anders Laustsen told the BBC.

"We have conducted a thorough investigation of the incident and can confirm that there has been no breach of Famly's security or infrastructure in any way and no other customers have been affected."

The Radiant group

The Radiant group appears to be brand new; the Kido compromise is the only one on its site. According to Palo Alto Networks, there's no information about the group beyond what it has supplied itself. The group doesn't as yet appear to be affiliated with any nation-state actors or other established cybercrime syndicates.

Palo Alto researchers said the incident appears to be a ransomware attack combined with data exfiltration, a tactic commonly known as double extortion. The hackers have even reportedly contacted the parents of some affected children directly to extort them.

"Most places of education use apps for parent convenience but the implementation of these platforms is often not done with security being an inherent consideration, let alone mandatory," said Erridge.

"The education sector is lean, so usually schools and nurseries are themselves responsible for setting up, running, and maintaining apps, but it's rare that they possess the cybersecurity know-how to do so securely. Alternatively, they may rely upon third-party services to help run their IT infrastructure and assume that security is included as part of the deal when it simply is not."

He advised schools and nurseries that use such apps to immediately review the security controls currently in use and rotate passwords, particularly across key operational and administrative accounts, and also to adopt multi-factor authentication where available.

MORE FROM ITPRO

• Cyber skills shortages are pushing firms into dangerous shortcuts
• How to choose the best cybersecurity vendor for your business

UK businesses face a huge hidden cyber risk that’s driving security practitioners mad: employees keeping quiet about cyber attacks.

More than one-third of office workers (39%) said they wouldn’t tell their cybersecurity team if they thought they had been the victim of a cyber attack – and it's not for a lack of security awareness.

A survey of 4,500 workers across EMEA by data security and management firm Cohesity found that British employees are more aware of cyber threats, such as ransomware, than their counterparts in France and Germany.

Almost half (43%) of UK employees know exactly what ransomware is, compared with just 28% of workers in France and 30% in Germany. Four-in-five (79%) said they were confident that they could identify a malicious cyber attack.

“Staying silent if they suspect a malicious cyber attack is quite possibly the worst thing an employee could do, particularly when they claim to know the dangers,” said Olivier Savornin GVP Europe at Cohesity.

"This reluctance to speak up leaves organizations in the dark and vulnerable to serious damage to the business."

So why are employees keeping quiet? According to the survey, 17% wouldn’t want people to think it was their fault, with the same number worried they'd get into trouble. One-in-eight said they were afraid of causing an unnecessary fuss.

This desire to hush things up is so serious that 11% said they would even try to fix the problem themselves, rather than seek official help from the company experts.

Drop the blame game, improve culture

Savornin noted that the research shows a big cultural change is needed to support workers and ultimately improve broader transparency in business.

“We need to create a workplace culture where people feel comfortable raising the alarm and are properly trained on how to recognize a cyber threat and the correct action to take - no matter how small the issue might seem," said Savornin.

Earlier this year, a survey from managed services company IT.ie found that 43% of office workers believed that they were at risk of causing a cybersecurity incident in the next 12 months.

Six-in-ten of these people blamed incomplete or non-existent cybersecurity training, with 31% blaming poor communication from management regarding cyber risks.

This isn't the first time that a reluctance to report incidents has been reported. In October last year, for example, Arctic Wolf's 2024 Human Risk Behavior Snapshot report found that a quarter of workers were too scared to report security problems.

They may have good reason for this fear, however, with a report from security firm Egress last year finding that just over half of employees caught out by phishing attacks were disciplined as a result.

Notably, four-in-ten were fired following an incident, and this only exacerbates long-term issues with reporting.

In some cases, staff have even been told not to disclose a breach. A 2023 survey from Bitdefender showed a cover-up culture had emerged at many enterprises.

The poll of 400 IT and security professionals found that nearly half of cybersecurity practitioners were told to keep data breaches under wraps by senior management figures.

Meanwhile, three-in-ten said they actively avoided disclosing a breach themselves despite specific processes being in place.

MORE FROM ITPRO

• Almost a third of workers are covertly using AI at work
• Employee phishing training is working – but don’t get complacent
• Remote work is still causing security headaches for CISOs

The UK government is putting more cash into the cybersecurity sector as part of a new Cyber Growth Action Plan.

The aim is to boost the UK's £13.2 billion cyber sector with up to £16 million in new funding for startups, scale-ups, and university spinouts.

The project will be led by the University of Bristol and Imperial College London's Centre for Sectoral Economic Performance (CSEP).

It will look at the supply and demand of cyber goods and services, such as protective monitoring and encryption, to establish the opportunities for growth and explore emerging technologies, including AI and quantum.

"Today's investment will help to turn innovative ideas into successful businesses up and down the country, and the new research will support our mission to grow the economy," said chancellor of the Duchy of Lancaster Pat McFadden.

"Recent cyber attacks show just how important it is we foster the development of the sector – delivering the double dividend of high-paying jobs as well as strengthening the country's cybersecurity."

Up to £10 million in additional funding will be invested in the CyberASAP program over the next four years to support the UK's academic cyber sector in turning research into commercial companies.

The program has already supported the creation of 34 spin-out companies, which have raised over £43 million in investment. With the new funding, the aim is to add another 25 spin-outs by 2030 and attract £30 million in additional investment.

"The UK cyber sector is successful and growing, but so too are the challenges, as demonstrated by recent events which have affected businesses and consumers," said Simon Shiu, project leader and professor of cybersecurity at the University of Bristol.

"Based on input from all parts of the cyber sector, this project will make independent recommendations to accelerate growth in cyber, but also to increase cyber-resilience in the other sectors critical to UK security, industry, and prosperity."

Meanwhile, in addition to the government's current cyber accelerator Cyber Runway, up to £6 million will also go to support cyber startups and SMBs, helping them scale, access new markets through trade missions, and boost the UK's wider cyber ecosystem generally.

The government's also pulled in cyber experts from the defence industry, big tech firms, AI labs, and academia to advise it on public sector cybersecurity, with the group set to report later this summer. Execs from BAE Systems, Santander, Amazon Web Services, Microsoft, and Google DeepMind, will take up positions on the Government Cyber Advisory Board.

The work will help support the upcoming cyber resilience bill, which is to be introduced to parliament later this year. It includes proposals to protect the UK's supply chains, critical national services, and IT service providers, with targeted support for hospitals and energy suppliers.

The European Commission is making €145.5 million available to help small and medium-sized enterprises and public bodies to boost their cybersecurity, with specific help for hospitals and healthcare providers.

It's launched two calls for proposals. The first is part of the Digital Europe Programme, with a budget of €55 million, €30 million of which will go to enhance the cybersecurity of hospitals and healthcare providers.

€15 million will go to post-quantum Public Key Infrastructures, meanwhile, with €10 million allocated to enhance the Network Connectivity Center (NCC) Networks.

The plan is to help organizations detect, monitor, and respond to cyber threats, particularly ransomware. The aim is to have identified the key ransomware strains targeting healthcare by the end of this year, and to set up a ransomware recovery subscription service by 2026.

"This will boost the resilience of the European healthcare system, especially in the current geopolitical context, aligning with the EU action plan on cybersecurity in hospitals and healthcare," said the Commission.

The fund will be used for pilot projects including national or regional hospital clusters, healthcare systems, professional associations, and cybersecurity service providers.

These could include, for example, the creation of security operation centers offering real-time monitoring, threat detection, and rapid incident response, as well as the use of cybersecurity tools including Security Information and Event Management (SIEM) platforms, threat intelligence, and automated response capabilities.

The second call, forming part of the Horizon Europe Programme, has a budget of around €90.5 million. It will, said the Commission, support the use and development of generative AI for cybersecurity applications and new advanced tools and processes for operational cybersecurity, along with privacy-enhancing technologies and post-quantum cryptography.

Of this, €40 million will go to generative AI for cybersecurity applications, €23.55 million on new tools and processes for operational cybersecurity, and €11 on privacy enhancing technologies.

Security evaluations of Post-Quantum Cryptography (PQC) primitives will get €4 million, with €6 million for the security of implementations of PQC algorithms and another €6 million for the integration of PQC) algorithms into high-level protocols.

Proposals for the first call can be submitted until 7 October here, with the second here, open until 12 November.

According to the Commission, in 2023 alone, EU countries reported 309 significant cybersecurity incidents targeting the healthcare sector -- more than any other critical sector. And the call for healthcare cybersecurity proposals follows an EU action plan launched earlier this year.

"Digital technologies and health data-driven solutions have opened unparalleled opportunities in healthcare. They enable precision medicine, real-time patient monitoring, and seamless communication between healthcare providers across borders," said Olivér Várhelyi, commissioner for health and animal Welfare.

"But digitalization is only as strong as the trust it inspires and resilient from cyberattacks. Patients must feel confident that their most sensitive information is secure. Healthcare professionals must have faith in the systems they use daily to save lives."

Cyber attacks are costing UK businesses £64 billion a year in ransom payments, staff overtime, lost business, and other associated costs.

Research from cybersecurity firm ESET shows that 53% of UK businesses have fallen victim to at least one attack over the last year, with 43% saying that it's had a long-term impact on business growth.

The top three most common cyber attacks or breaches were phishing attacks, experienced by nearly half, while more than a third were targeted with malware and three-in-ten by attacks - or attempted attacks - against online bank accounts.

This is having a significant effect on the bottom line, the study noted. The most common direct cost was the extra staff time needed to deal with an attack, cited by nearly two-thirds of businesses.

Other direct costs included ransom payments, stolen or lost funds, legal and regulatory costs, disruption to operations, and the cost of bringing in third-party expertise along with higher cyber insurance premiums.

All in all, these direct costs added up to £37.3 billion, or 0.7% of overall business turnover. Notably, the indirect costs were almost as significant, at £26.7 billion or 0.5% of overall business turnover.

The biggest factor here was the need to increase cybersecurity budgets, with two-thirds of businesses identifying this as a major cost, and 28% deeming it extremely significant.

Other indirect costs included loss of clients, the cost of redirecting resources to incident response, and a loss of competitive advantage due to the theft of corporate intellectual property.

"The rising costs of cyber attacks – both direct and indirect – prove that no business can afford to overlook cybersecurity," said Jake Moore, global cybersecurity advisor at ESET.

"With growing public scrutiny on data protection and cybersecurity preparedness, businesses that fail to take proactive measures risk financial losses and long-term damage to trust and credibility."

Cyber attacks have huge long-term implications

ESET also specifically highlighted the long-term effects of cyber attacks. More than four-in-ten businesses reported restricted business growth and a similar number needed additional funding, the study found.

In some cases, the consequences were more severe, with 14% saying they'd been forced to downsize, 15% that they'd entered administration, and 16% that they'd undergone a merger or acquisition.

Small businesses suffered particularly from impacted growth rates, which affected 45%. Meanwhile, large enterprises were more likely to require additional financing to recover from an attack, a problem for 46%.

But despite 43% of businesses expecting an attack in the next 12 months, nearly half said they manage cybersecurity fully in-house, without external expertise, and 15% report having no cybersecurity budget at all.

Impact on UK regions differs greatly

On a regional basis, Southern England is facing the highest financial burden - £20.2 billion in direct costs and £15.5 billion in indirect costs - probably because of a concentration of high-value industries such as finance and technology, the study noted.

Meanwhile, the Midlands gets off the lightest financially, with £4.6 billion in direct costs and £2.6 billion per year.

"With over 50% of UK businesses experiencing a cyber attack in the past three years, it’s clear that no organization is immune. Businesses must shift from a reactive to a proactive cybersecurity strategy to stay ahead of evolving threats," said Matt Knell, UK MD of ESET.

"At ESET, we’ve found that organizations forced to make a reactive investment can spend more than 10 times as much as they would have spent on proactive measures when recovering from an attack."

MORE FROM ITPRO

• Rising data breach costs show no signs of slowing down, says IBM
• Regulatory fines could be the tip of the iceberg for enterprises as data breach lawsuits expected to surge
• UK councils are paying out a fortune in data breach claims

More than four-in-ten UK businesses were hit by a cyber attack last year, marking a decrease on the year prior – but security experts have warned enterprises to still remain vigilant.

The government's latest Cybersecurity Data Breaches Survey revealed that 43% of businesses were affected, with a total of 612,000 cyber attacks or breaches recorded across the year. That's noticeably fewer than in the previous year, when the figure was 50%.

There were 61,000 attacks against charities, affecting three-in-ten, down from 32% in the previous year.

But the fall wasn't spread evenly across the board. While micro and small businesses fell victim to fewer phishing attacks, the figures for medium and large businesses were pretty much the same as in 2024.

Small businesses in particular showed the most improvement in several cyber hygiene practices, with nearly half using cybersecurity risk assessments, up from 41% in 2024.

More than six-in-ten revealed they now have cyber insurance, up from 49% in 2024, and the proportion with a formal cybersecurity policy rose slightly. Meanwhile, 53% now have a business continuity plan, up from 44% in 2024.

High-income charities, though, got worse. Only three-quarters now carry out activities to identify cybersecurity risks, down from 86% in 2024.

Similarly, just one-in-five said they review immediate supplier risks, down from 36% in 2024, and the proportion having a formal cybersecurity strategy in place fell from 47% to 39%.

Cybersecurity is improving, but don’t get complacent

Jonathan Gill, CEO of Panaseer, said that while the survey showed positive signs, complacency could cause bigger problems down the line.

"Most breaches don’t happen because organizations ignored security, but because they believed they were secure when, in reality, they weren’t,” he said.

"They assume they’re covered, but blind spots in visibility mean critical assets go unpatched, misconfigurations slip through the cracks, and security gaps persist without anyone realizing it," Gill added.

The most common type of breach involved phishing attacks, which affected 85% of businesses and 86% of charities.

Matt Cooke, cybersecurity strategist for EMEA at Proofpoint, said this was unsurprising given the continued success of phishing attacks by cyber criminals globally.

"Email has been the number one threat vector for many years now – why? Because it continues to work."

The effects of these breaches included a near-doubling in temporary loss of access to files or networks - 7%, up from 4% in 2024 - while charities reported an increase in loss of access to third-party services at 5%, up from 1% in 2024.

The resulting costs were significant, the survey found, standing at around £1,600 for businesses and £3,240 for charities on average.

Both businesses and charities appear to be pretty poor at dealing with supply chain risks, the survey warned. Only 14% of businesses said they reviewed the risks posed by their immediate suppliers, and only 7% looked at their wider supply chain.

These figures were even worse for charities, at 9% and 4% respectively.

Board-level cybersecurity focus is dwindling

A concerning trend highlighted in the survey centered around board-level responsibility for cybersecurity, which has steadily declined among businesses since 2021.

Just over one-third (38%) of businesses had a board member with responsibility for cybersecurity in 2021 - this has since dropped to 27%.

Cooke noted that this is a “worrying development” and further highlights a degree of complacency among organizations of all sizes.

"Cybersecurity can’t be treated as an after-thought by anyone in an organization - particularly those at board level, who control the purse strings and business priorities."

The findings are expected to inform the upcoming Cyber Security and Resilience Bill, which is set to introduce sweeping changes to shore up national cybersecurity capabilities and impose stricter requirements on businesses.

Etay Maor, chief security strategist at Cato Networks, said the growing threats posed by cyber criminals, and the increased use of AI tools by sophisticated threat groups, poses questions for lawmakers.

"The bill should incorporate measures to address the growing threat of AI-powered attacks, ensuring businesses and consumers are adequately protected from increasingly sophisticated cyber criminals,” he said.

"A holistic approach, encompassing proactive threat prevention, robust incident response, and mandatory reporting of AI-driven attacks, is crucial to effectively mitigate the evolving cyber landscape," Maor added.

MORE FROM ITPRO

• The role of cyber security in the UK’s tech renaissance
• The UK cybersecurity sector is worth over £13 billion, but experts say there’s huge untapped potential if it can overcome these hurdles
• UK underestimates threat from hostile states, says new NCSC head

Nearly a third of public sector IT professionals are seriously concerned about the security dangers of AI, especially the risks around data privacy and compliance.

While AI adoption is gaining momentum, with predictive analytics and issue detection seen as the top benefits, there are lingering concerns, according to a SolarWinds survey.

Nearly a quarter of respondents said they were leveraging AI to automate tasks related to IT operations and enhance IT observability, with many more planning to adopt it soon.

However, almost three-in-ten said they were extremely or very concerned about the potential risks associated with adopting AI, such as data privacy and compliance.

This, researchers warned, is making full-scale implementation a slow process, leaving the public sector lagging behind.

"It is only by providing the right tools, with full visibility, that we ensure the security and resilience of our nation’s critical services," said Richard Giblin, SolarWinds' head of UK public sector and defence.

Broader security issues plague the public sector

In addition to AI-related security risks, public sector workers also flagged a number of key concerns looking ahead.

Budgets were the biggest hurdle to improving cybersecurity, according to SolarWinds, cited by a quarter of those who took part.

One-in-five complained of the complexity of the internal environment, 11% of a lack of technical solutions, and one-in-ten of competing priorities.

For most organizations, digital transformation was a work in progress, with only 6% reporting that they'd fully completed their digital transformation journey.

Four-in-ten said their efforts were well underway, or beginning implementation in some areas with limited progress (40%).

Privacy and security concerns, as well as the complexity of integrating new systems, were key barriers, they said, while the most pressing current security challenges included vulnerabilities in monitoring systems and the critical need to safeguard sensitive information from cyber threats.

The survey found that the top-ranked security threat was careless or untrained insiders, cited by 56% of respondents - compared with 55% who rated the general cyber criminal community as more dangerous. Similarly, just over half were most concerned about foreign governments.

This, SolarWinds said, emphasized the need for stronger security awareness training, enhanced tools, and better access control mechanisms.

"It’s clear that UK public sector organisations are shifting operations and workloads to the cloud and embracing hybrid IT environments now more than ever," Giblin said.

"But this evolution, along with increased AI adoption, brings added complexity in maintaining data security and regulatory compliance, all while navigating increasingly tight budgets."

The UK public sector experiences frequent cyber attacks, including the October 2023 ransomware attack on the British Library and a supply chain attack hit the Ministry of Defence last year.

A report from Verizon late last year found that insider threats accounted for three-in-ten breaches in the public sector.

Additionally, nearly seven-in-ten were caused by a non-malicious human action, such as a worker falling victim to a social engineering attack or making an error.

MORE FROM ITPRO

• 'Archaic' legacy tech is crippling public sector productivity
• Public sector AI adoption could save workers millions of hours in admin each week
• UK government signs up Anthropic to drive public sector efficiency

Hammersmith and Fulham Council has reportedly revealed it faces around 20,000 attempted cyber attacks every day.

According to reports from The Standard, most of the attacks consist of phishing attempts, and the council said it has applied anti-phishing measures and tightened up firewalls to deal with the threat.

Local authorities have become a popular target for cyber criminals in recent years, thanks to the large amount of valuable personal data they hold, often-outdated IT systems, and comparatively poor cybersecurity budgets.

According to the Information Commissioner’s Office (ICO), cyber attacks on local authority systems jumped by a quarter between 2022 and 2023 while personal data breaches reported by local government organizations surged by 58% in the same period.

Adam Boynton, senior security strategy manager EMEIA at Jamf, said the figures highlight the broad array of threats faced by local authorities across the country.

"The number of cyber attacks Hammersmith and Fulham Council is facing represents a wider issue, as security threats across all local councils have significantly increased over the last few years," he said.

"Councils hold vast amounts of personal data, making them prime targets for cyber crime. This data can be exploited for fraud, sold on the dark web, or used in future attacks."

Last year, information commissioner John Edwards urged local authorities to take cybersecurity more seriously and recognize the effect that breaches can have on people's lives.

"We trust local government with some of the most sensitive personal information imaginable, yet they remain one of the leading sources of data breaches," he said.

"This is not just an admin error – it is about people. When data is mishandled, it can have serious and long-lasting consequences, particularly for people in vulnerable situations. We need local government to do better."

UK councils face a barrage of cyber threats

During 2024, numerous councils faced cyber attacks, including a supply chain attack that affected the housing websites for Manchester, Salford, and Bolton councils.

Similarly, this time last year three Kent councils suffered an incident which severely disrupted services while an attack on Leicester City Council in March knocked IT systems and phone lines offline.

A large part of the problem is local authorities' creaking IT systems, Boynton said.

"Local council networks are particularly vulnerable due to their continued reliance on outdated IT systems and end-of-life software that are not equipped to handle modern cyber threats," he said.

"These systems are frequently patched together over many years, introducing complexities in maintenance and security upgrades."

Jamf recommends implementing multiple defensive layers and enforcing more robust cyber hygiene practices, such as multi-factor authentication, secure passwords or password management software, and user awareness of security risks.

"Strong hygiene practices are an effective way to improve cyber resilience without stretching limited budgets," said Boynton.

MORE FROM ITPRO

• Why public sector security debt is a serious problem
• NAO warns UK government doesn't know how vulnerable IT systems are
• How to protect the public sector from cyber attacks

IT leaders across a range of industries are ramping up AI adoption plans in the year ahead, but traditional focus areas such as cybersecurity, cloud, and privacy still remain critical.

That’s according to ITPro’s 2025 Future Focus report, a piece of in-house research fielding responses from IT executives and business leaders. Conducted as an online survey, we collected responses from 736 C-suite executives, directors, IT leaders, IT decision makers, and decision makers.

The study shows that, while IT leaders are optimistic about the future and the possibilities of emerging technologies, there is also a sense of realism about the many potential hurdles facing them.

AI is top of mind for many, with over three-quarters (78%) saying it will be one of their top three focuses in 2025. This is compared to 41% making the same claim about 2024.

Three-quarters of respondents said AI understanding or readiness would become more important this year, while the study also pointed to a heightened level of investment. Nearly a quarter (24%) intended to spend between 21% and 31% of their IT budget on AI this year.

Other industry research reflects this bullish approach to investment, with analysis from EY in mid-2024 revealing that the number of companies investing $10 million or more is set to nearly double this year.

Notably, IT leaders are having difficulties with AI adoption and deployment. One respondent told ITPro that their business had experienced difficulty integrating AI into daily workflows while another said they lack the in-house technical expertise to maximize the benefits of the technology.

AI skilling has been a persistent issue for a while now, with more than one-in-ten (81%) of IT managers warning of an urgent AI skills gap according to a Red Hat survey last year.

Businesses have a disconnect on cybersecurity

Across every region we surveyed, a combined 74% of respondents said that cybersecurity investment would be more important in 2025 than it had been in 2024, with 27% highlighting its importance.

There is a disconnect, however, as most businesses are not planning to invest in cybersecurity in line with this perceived importance.

Almost half (40%) of respondents in the US, Canada, and EMEA only expect to spend 20% or less of their overall budget on cybersecurity this year. While businesses are contending with rising levels of cyber attacks, this has not translated into bigger budgets for security departments.

Cybersecurity departments are increasingly contending with budget cuts, with research from ISC2 finding that growth in the global cybersecurity workforce had slowed for the first time in six years on the back of budget constraints.

Also testament to shrinking budgets is the cybersecurity skills shortage, with 96% of small and medium-sized businesses (SMBs) reporting a lack of cyber skills, according to a report from Sophos.

Cloud and data are key areas of focus

Just under two-thirds (64%) of respondents said cloud migration was a greater focus in 2025 than it had been in 2024. Over half (52%) said cloud will be one of their top three areas of investment for this year.

As organizations focus on the cloud as a core part of their overall IT strategy, access to data and the ability to manage it also becomes more important. More than half (56%) of those surveyed put analytics as one of their top three areas of focus or investment for the coming year.

“I see the biggest tech opportunity in 2025 as leveraging cloud and edge computing to enhance data processing and analytics, driving efficiency and growth,” one respondent said.

Cloud investment has been on an upward trend over recent months, with analysis from IDC predicting global cloud spending to reach $1.6 trillion by 2028 at a five-year compound annual growth rate of 19.5%.

MORE FROM ITPRO

• The trends we’re watching in 2025
• Channel predictions 2025: an interesting year lies ahead
• Five AI trends to watch in 2025

American insurance firm Globe Life has warned that another 855,000 people were potentially impacted by a cyber attack last summer — not the original 5,000 initially reported.

Last summer, Globe Life spotted that cyber criminals had accessed customer data, reportedly via an online portal.

The insurance company — one of the biggest and oldest in the US — filed a report with the SEC on the attack, saying that details had been accessed on 5,000 individuals, but promised to update that figure after an internal investigation.

In October, Globe Life revealed that cyber criminals had contacted the insurer attempting to extort money in exchange for not leaking data.

Now, Globe Life has revealed further details of the attack, saying the initial 5,000 confirmed victims were traced to a set of specific databases maintained by third parties, or as the company put it: "a small number of independent agency owners."

The details taken were from customers of Globe Life subsidiary American Income Life Company. Those databases also included details on the additional 850,000 people, and while there's no evidence their information was leaked, the company is writing to potential victims as a precaution.

"Out of an abundance of caution, the company has also initiated the process to provide voluntary notifications to, and credit monitoring services for, approximately 850,000 additional individuals whose information was also stored in the relevant databases, even though the company has not been able to confirm if the threat actor acquired these additional individuals’ data," the company said in an SEC filing.

Globe Life insists no ransom was paid

Globe Life added that it didn't pay the ransom, and stressed the extortion attempt didn't use ransomware or impact business operations at the time.

According to the most recent filing, the data accessed includes names, email addresses, phone numbers, and addresses, as well as insurance policy information, health data, social security numbers, and date of birth, but no financial information.

Thomas Richards, principal consultant at security firm Black Duck, said the incident will still be a cause for serious concern among customers.

“The uncertainty regarding the number of individuals affected and data accessed in this breach should be concerning, especially since this is a pretty substantial breach with almost one million policyholders affected,” he said.

"Without having this information, the affected individuals may not have clarity on the best ways to protect themselves and their personal information.

“Although it is fortunate that no financial information was accessed, financial information is often the easiest to change in this kind of scenario," Richards noted.

"However, one cannot change their health-related data, date of birth, or social security number so it’s imperative that the affected individuals are notified as soon as possible to begin taking the necessary steps to protect themselves and their data."

Globe Life was one of several high-profile insurers hit by cyber criminals last year, with a spate of attacks targeting organizations operating in the industry.

The Change Healthcare cyber attack, for example, impacted around 190 million US citizens, with parent company UnitedHealth having recently revised its numbers following an investigation.

Elsewhere, a data breach at Landmark Admin saw 800,000 users exposed. A filing with the Attorney General of Maine revealed the breach exposed a broad range of personal data, including full names and addresses, social security numbers, tax ID numbers, and drivers’ license numbers.

Major Indian tech firm Tata Technologies has confirmed it suffered a ransomware attack that forced it to take a number of its IT systems offline.

A subsidiary of major automobile manufacturer Tata Motors, Tata Technologies provides engineering and digital services to a range of manufacturers in the automotive, aerospace, and industrial machinery industries.

In an official statement provided to the Indian Stock Exchange on 31 January 2025, the company said the attack affected “a few of our IT assets”, forcing it to temporarily suspend some of its services as a precautionary measure.

The statement added that these services have now been restored, and Tata Technologies’ client delivery services were unaffected and remained fully functional throughout.

“Further detailed investigation is underway in consultation with experts to assess the root cause and to take remedial action as necessary. We remain committed to the highest standards of security and data protection and are taking all necessary steps to mitigate any potential risks”, the statement concluded.

Further details including the identity of the threat actors responsible – or the means by which they achieved access to some of Tata Technologies’ IT assets and corporate network – were not included in the filing.

Ransomware attacks targeting India spiked 55% in 2024

Ransomware attacks targeting India-based companies appear to be on the rise, according to data collected by CyberPeace.

Research from the security firm identified 98 ransomware incidents impacting various sectors in India, which represents a 55% increase compared to the 63 attacks recorded in 2023.

“This surge highlights a concerning trend, as ransomware groups continue to target India's critical sectors due to its growing digital infrastructure and economic prominence,” CyberPeace warned.

Trend Micro’s 2024 Midyear Cybersecurity Threat Report found India ranked tenth overall and sixth in Asia for ransomware threats, accounting for 5% of all ransomware incidents in Asia and just under 3% globally.

In one case, Comtel, a data center operator hosting critical infrastructure for a number of brokerage firms in India, was hit with a ransomware attack in December 2024 that resulted in a temporary suspension of the affected stock brokers by two of India's leading exchanges.

The finance sector accounted for 10% of the incidents recorded in 2024, CyberPeace found, but the industrial sector was by far the most frequently targeted industry in India, accounting of 75% of total incidents.

The Tata conglomerate has been the victim of previous ransomware activity in recent years. In October 2022, the Hive ransomware group claimed responsibility for an attack on Tata Power, locking down its IT systems and exfiltrating sensitive information.

A sample of the stolen information posted to the group’s leaksite included contracts with suppliers and employees, ‘master’ files on several employees, and details of senior executives’ remuneration packages.

Hackers are using an uncensored chatbot dubbed GhostGPT to help write malware, highlighting how AI can be twisted to "illegal activities".

That's according to Abnormal Security, which laid out details of GhostGPT in a blog post, saying the chatbot lacks the guardrails of standard AI tools such as ChatGPT, making it a helpful tool for cyber criminals.

It's not the first hackbot-as-a-service, however. WormGPT arrived in 2023 offering a similar chatbot subscription service for writing phishing emails and business email compromise attacks.

That, Abnormal Security noted, was followed by WolfGPT and EscapeGPT, suggesting GhostGPT is a sign malicious actors see value in AI helping them commit cyber crime.

The security company explained that GhostGPT was specifically designed for cyber crime purposes and that enterprises should be wary of its potential looking ahead.

"It likely uses a wrapper to connect to a jailbroken version of ChatGPT or an open source large language model (LLM), effectively removing any ethical safeguards," the blogpost explained.

"By eliminating the ethical and safety restrictions typically built into AI models, GhostGPT can provide direct, unfiltered answers to sensitive or harmful queries that would be blocked or flagged by traditional AI systems."

What can GhostGPT do?

Abnormal shared a screenshot of an advertisement for the GhostGPT service that claimed the chatbot was fast and easy-to-use, offered uncensored responses, and had a strict no-logs policy, saying "protecting our users' privacy is our top priority."

Abnormal noted that GhostGPT was marketed for coding, malware creation, and exploit development, but could also be used to write material for business email compromise (BEC) scams. The advertisement noted its various features make GhostGPT "a valuable tool for cybersecurity and various other applications."

"While its promotional materials mention "cybersecurity" as a possible use, this claim is hard to believe, given its availability on cyber crime forums and its focus on BEC scams," the Abnormal post added.

"Such disclaimers seem like a weak attempt to dodge legal accountability — nothing new in the cybercrime world."

Indeed, Abnormal's researchers asked GhostGPT to write a phishing email; it outputted a template that could be used to trick victims.

Easy access for all hackers

GhostGPT is accessible as a Telegram bot, making it easy for attackers to make use of without having technical skills or taking the time to set up their own systems, Abnormal noted.

"Because it’s available as a Telegram bot, there is no need to jailbreak ChatGPT or set up an open source model," the blog post noted. " Users can pay a fee, gain immediate access, and focus directly on executing their attacks."

A report in DarkReading noted that prices for GhostGPT were relatively cheap, too: $50 for a week, $150 for a month, and $300 for three months.

Fresh challenge for security

By lowering the barrier of entry to would-be hackers, such chatbots make it easier for cyber criminals without extensive skills to attack anyone — potentially sparking a real challenge for personal and organizational security.

Chatbots also make it faster and easier to launch cyber crime campaigns by enabling threat actors to create more effective malware, realistic-looking phishing emails, and so on.

"With its ability to deliver insights without limitations, GhostGPT serves as a powerful tool for those seeking to exploit AI for malicious purposes," Abnormal said.

Because cyber criminals are shifting to AI, so too must security professionals, says Abnormal, as tools like GhostGPT will make it easier to slip phishing emails and malware past traditional filters.

Application development infrastructure is full of significant security risks, with research by Legit Security finding high or critical risks in the developer environments of every company it examined.

The security company's report into the state of application risk found flaws in applications but also the "software factories" that make them. The report is based on data from its own platform, looking at a range of organizations from large to small, across various industries.

Legit said application security is no longer simply about spotting flaws in source code, noting that the attack surface for applications has grown and diversified.

"With software development that is faster, more automated, more dynamic, and highly reliant on third parties, new opportunities to introduce risk abound."

According to the report, 89% of companies have pipeline misconfiguration issues and 46% are using AI models in source code in a risky way. Notably, security teams are actually unaware where AI is in use, making the booming technology an emerging threat for application security.

"Our research uncovered great risks everywhere throughout the development process," said Liav Caspi, Legit CTO and co-founder.

"These results highlight that teams are overlooking risks in their development environments and CI/CD pipelines, and are inviting the next supply chain attack by neglecting critical security hygiene."

Leaking secrets

The report found that all organizations on its platform had three or more application risks, but only two-thirds had public repositories with two or more risks. Those included exposed information that should have been secret, like cloud keys, GitHub personal access tokens, and even personal information such as credit card numbers.

Such data was often found in source code that could be accessed by any user with access to a repository, such as an external supplier or anyone if it was made public.

But a third of that information was actually outside source code and found in documentation and collaboration tools like Confluence or in ticketing systems.

Legit advised companies not to hard-code "secrets" into source code by using a password manager or environment variable.

"To prevent exposed secrets, focus first on SaaS services keys (e.g., AWS access keys), since if code is leaked, credentials to SaaS services are immediately usable if they are valid, whereas internal credentials require attackers to also have network connectivity," the report added.

Another challenge is giving too much access: the report found 85% of development teams are over-permissioned, while 23% of repositories across organisations have external suppliers or collaborators with admin privileges in places they shouldn't.

The wrong tools

The study also found that most companies use inefficient application security scanning, with 78% using duplicate software composition analysis scanners that would produce the exact same results, and 39% having duplicate static application security testing scanners.

Legit pinned this on developers working in different parts of the business using free versions of scanners, noting that would be exacerbated by mergers and acquisitions.

"To make an analogy, it’s as if they are preparing delicious, innovative dishes, in a kitchen with rusty, dirty, malfunctioning equipment," Caspi added.

"Most security teams today don’t have the visibility or the context they need to identify risk outside of source code or to effectively triage AppSec findings."

The number of cyber attacks worldwide rose by 44% last year, fueled by evolving nation-state attacks and the increasing prevalence of generative AI.

In its annual report, Check Point Software said nation-states are changing their strategy, shifting from acute attacks to chronic campaigns aimed at eroding trust and destabilizing systems.

AI-powered disinformation and influence campaigns targeted a third of global elections between September 2023 and February 2024, researchers said.

The Russian-linked APT group CopyCop, for example, targeted the June 2024 US primary elections with fabricated news segments featuring deepfake portrayals of political figures, and the Islamic Revolutionary Guard Corps (IRGC) using 'hack-and-leak' tactics during the presidential elections.

"Cybersecurity in 2025 is not only about protecting networks; it’s about safeguarding trust in our systems and institutions," said Maya Horowitz, Check Point's VP of research.

"The State of Global Cyber Security 2025 highlights the rapid evolution of threats and reinforces the need for resilience in the face of persistent and complex adversaries."

The evolution of ransomware

Ransomware is also evolving, according to the report, with data exfiltration and extortion overtaking encryption-based attacks as the primary ransomware tactic, simplifying operations and maximizing payouts.

The little-known ransomware group Dark Angels, for example, reportedly extracted a $75 million payment from one Fortune 50 company in 2024.

Healthcare became the second most targeted industry for ransomware, with a 47% increase in attacks year-over-year, highlighting a move away from any 'ethical' approach from ransomware groups.

Meanwhile, compromised routers, VPNs, and other edge devices served as key entry points for attackers last year, with more than 200,000 devices controlled by advanced botnets like Raptor Train, operated by state-sponsored actors.

The report highlights the rising tide of infostealers, with stolen data traded on platforms like Telegram or underground criminal marketplaces such as the Russian Market.

"Following the decline of the big botnets, infostealers have become a significant and wide-scale threat. They offer cyber criminals efficient ways to steal credentials and session tokens, contributing to financial fraud and identity theft and acting as an entry point to corporate networks," said Check Point threat intelligence group manager Sergey Shykevich.

"As companies increasingly adopt remote work and bring-your-own-device policies, it is essential that they implement protective strategies."

AI attacks gain traction

A key talking point in the Check Point annual report centered around AI-powered financial crime. The security firm recorded a sharp increase in this regard across 2024 alongside supply chain attacks on open source projects.

Researchers warned that organizations will face increasing pressure this year thanks to new cyber security regulations, including the EU IoT Regulations, SEC Cyber Security Rules, the Digital Operational Resilience Act (DORA) and the NIS2 Directive.

CISOs, Check Point recommended, should strengthen BYOD Security, implementing strict policies and deploying endpoint protection.

They should also invest in threat intelligence and enhance patch management to address known vulnerabilities proactively and limit exposure to widespread exploits.

Edge devices should be secured, with robust security measures for routers, VPNs, and IoT devices; and they should focus on resilience, preparing for persistent threats with comprehensive incident response plans and continuous monitoring.

More than four-in-ten UK financial services firms look set to miss the deadline for compliance with the new Digital Operational Resilience Act (DORA) tomorrow.

Companies failing to comply with the regulations could face fines of up to 2% of worldwide daily turnover for as long as six months.

However, while nearly nine-in-ten UK CISOs and senior security decision makers believe that DORA will be beneficial, 43% said they won’t be compliant for at least three months.

"The regulatory landscape in the EU is heavily congested with several overlapping standards and laws now in effect," said Richard Lindsay, principal advisory consultant at Orange Cyberdefense, which commissioned the research.

"There is a lot to navigate, and we’re increasingly seeing businesses taking a more reactive approach to compliance requirements once the threat of reprisals becomes tangible."

"However, remaining non-compliant could have severe ramifications, with fines of up to 2% of global annual turnover and the potential of fines of over €1m for individual senior leadership."

The challenges in implementation varied from organization to organization, but included a lack of prioritization, the short timeline involved, a lack of skills, and a lack of visibility over supply chain or third-party partners, each cited by around a quarter of respondents.

To deal with these issues, virtually all said they planned to call on external support.

Budgetary constraints weren't highlighted as an issue, with 84% of respondents saying they had allocated funds ahead of the deadline. Around three-quarters have reallocated funding from other business areas, and around half have pulled in staff members from other projects.

In the longer term, though, two-thirds of CISOs and senior security decision makers believe that DORA will significantly increase cybersecurity costs.

The new regulations include more than 500 individual requirements, with businesses expected to implement essential protection, detection, containment, recovery, and repair measures.

Rules contained in the legislation place a strong emphasis on ICT risk management, incident reporting, operational resilience testing, and oversight of ICT third-party risks.

PwC has estimated that more than 22,200 financial bodies and IT service providers fall under the scope of the act. However, the EU is expected to take a targeted approach to any breaches, focusing on larger players and significant breaches.

CISOs have reported the scope of their role has widened to encompass business concerns that extend beyond cybersecurity, but believe their compensation doesn't reflect this.

The 2025 State of the CISO report from IANS Research includes testimony from roughly 800 CISOs on the growing importance of the role, and the simultaneous growth in the role’s complexity and scope of responsibilities.

The report found that in addition to their traditional remit of InfoSec and digital risk, CISOs are increasingly being asked to look after other business domains such as digital strategy.

For example, 90% of CISOs said they had ownership of what might be considered their traditional domains including the organization’s security operations, architecture, and governance, as well as digital risk and compliance.

The majority (between 50 and 90%) also identified other elements of business risk, such as disaster recovery, business risk, and third-part risk management, as well as broader security concerns such as product security as falling under their remit too.

However, IANS noted a series of ‘emerging domains’ that 1-25% of CISOs reported were being added to their workload, including AI, M&A security, change management, IT due diligence, digital transformation, and innovation.

The report found the broader scope associated with the CISO role has not been reflected in their compensation, with just 3% of CISOs attributing salary raises to taking on further responsibilities.

IANS found that only when switching employers were CISOs more likely to see their additional workload reflected in their pay packet.

For example, 7% of CISOs said their growth in compensation was driven by a change in employers, a move which is often accompanied by taking on a larger role with more responsibilities, and this group received an average increase of 31%.

The vast majority of CISOs (70%), however, indicated any raises they received were annual merit-based increases, which on average were 6%.

CISOs taking ownership of IT unlikely to see meaningful pay rises

IANS identified three distinct segments among respondents in terms of their C-level access and boardroom influence, using the labels ‘strategic, functional, and tactical’.

Strategic CISOs, which accounted for 28% of the group are described as those who report directly to the CEO or at least have a high-ranking position in the C-suite hierarchy, and thus have significant influence across the organization.

This group also enjoys frequent interaction with the board, with quarterly meetings as the minimum, which IANS said promotes “mutual understanding and aligning on strategic priorities between the CISO and top leadership”.

The next group, which made up 50% of respondents, is referred to as the functional CISO. According to IANS’s taxonomy, functional CISOs excel in one of these areas but do not enjoy both C-suite access and boardroom engagement.

The final 22% of respondents were described as tactical CISOs, who have waning executive-level access to a lower organizational rank and only sporadic boardroom engagements.

Comparing the compensation for these three groups, IANS found strategic CISOs were the best remunerated, with an annual cash compensation of around $545,000, compared to $385,000 for functional CISOs and $291,000 for their tactical counterparts.

IANS noted that CISOs who oversee an organization's security as well as all of its IT functions, referred to as ‘dual CISOs’, are a surefire way to ensure increased compensation.

The study found that dual CISOs at large organizations earn an average total compensation (including equity) of $1 million, whereas those who only take on partial IT oversight are closer to the average of traditional CISOs who manage none of the IT functions ($653,000).

“This would seem to indicate taking on all of IT is highly rewarded, but being given some IT functions opportunistically—perhaps due to the departure of another IT executive or unclear lines of ownership between infosec and IT—is not a reliable path to higher compensation,”the report noted.

The UK government is considering banning public organizations from paying ransomware demands as it seeks to strike a "significant blow” to cyber criminal operating models.

The consultation follows a series of serious ransomware incidents at NHS bodies, the British Library, Royal Mail and more, that have caused severe real world disruption and cost millions in recovery costs.

Consultation documents from government officials noted that ransomware is considered the "greatest of all serious and organized cyber crime threats, the largest cybersecurity threat, and is treated as a risk to the UK's national security."

To fight back, the Home Office is running a consultation centered around three proposals.

These include mandatory requirements to report ransomware incidents and a ransomware payment prevention scheme that would require notification of intention to pay and offer support to help victims avoid paying.

The government already prohibits ransomware payments by its own departments, and the third option would seek to extend that across all public bodies — including the NHS — and organizations deemed critical national infrastructure (CNI) and perhaps even their suppliers.

One consideration, the consultation report notes, is coming up with the right measures to encourage compliance with the ban — in other words, how to punish any public or CNI organisation that pays ransomware criminals.

The consultation is considering making non-compliance a criminal offence or making use of civil penalties, such as fines or banning leadership from being a member of a board.

However, the consultation document notes: "The Home Office welcomes views on other measures that could be used to encourage compliance with the ban."

Fighting back against ransomware

The aim of the legislation is to deter future ransomware attacks by cutting down the amount of money threat groups earn as well as to make it easier for authorities to disrupt and investigate attacks, the government said.

"Reducing the spread of ransomware attacks, and undermining the criminals’ business model, requires an entirely new approach, and one that will help the UK to lead the world in fighting back against the increasing risks posed by this crime to our society and economy,” the report states.

Because of that, tackling the threat of ransomware requires a coordinated approach.

"With an estimated $1bn flowing to ransomware criminals globally in 2023, it is vital we act to protect national security," said security minister Dan Jarvis.

"These proposals help us meet the scale of the ransomware threat, hitting these criminal networks in their wallets and cutting off the key financial pipeline they rely upon to operate."

The consultation runs until April.

Does paying ransoms work?

Paying ransoms to threat actors can be a dangerous option for organizations that have fallen prey to a cyber attack. Despite paying, research shows many victims find they cannot recover all stolen data, and in some instances threat actors have still leaked sensitive information.

The National Cyber Security Centre (NCSC) has previously said it does not believe such ransoms should be paid, but doing so is not illegal unless the victim is aware that the money is funding terrorism.

"This consultation marks a vital step in our efforts to protect the UK from the crippling effects of ransomware attacks and the associated economic and societal costs," said Richard Horne, CEO of the NCSC.

The consultation is only targeted at public organisations or those organisations deemed to have critical national infrastructure, but previous research has suggested as many as a third of private companies have paid out to ransomware groups.

Cybersecurity and data protection specialist Acronis has announced the appointment of Gerald Beuchelt as its new chief information security officer (CISO).

An experienced industry leader, Beuchelt arrives with more than a decade of cybersecurity leadership experience, most recently serving as CISO at Sprinklr and previously holding the same role at LogMeIn.

Beuchelt’s career has also seen him serve as treasurer and director on the board of the Boston Chapter of Infragard, the FBI public-private partnership program, and the National Cyber Security Alliance.

Other roles include chief security officer at Salesforce-acquired Demandware, and principal information security engineer at The MITRE Corporation.

In his new role as Acronis’ CISO, Beuchelt will spearhead the firm’s global information security strategy to ensure the protection of its information, systems, and technologies. He will also work to drive its goal of securing clients’ data, applications, and systems, the company said in an announcement.

“We are proud to welcome Gerald to Acronis as our new CISO,” said Ezequiel Steiner, Acronis CEO. “His extensive experience and forward-thinking approach to cybersecurity will play a vital role in advancing our mission to protect all data, applications, and systems for organizations worldwide.

“As CISO, he will drive initiatives that ensure our customers and partners benefit from Acronis’ natively integrated solutions, which eliminate complexity and provide unmatched simplicity and performance.”

As a part of the firm’s senior security leadership team, Beuchelt will lead Acronis’ global team of IT, security, and compliance experts, as well as oversee corporate IT infrastructure such as help desk operations, server, and network management.

The cybersecurity provider said Beuchelt will also support the expansion of new research, reports, and threat intelligence from the Acronis Threat Research Unit (TRU).

Commenting on his appointment, Beuchelt praised the breadth of Acronis’ product capabilities, as well as its global impact and strategic direction.

“I’m particularly inspired by the company’s dedication to making security solutions scalable and accessible for service providers, enterprises, SMBs, and individual users alike,” he said.

“My focus will be on maintaining and continuously improving our security posture to address the increasingly complex threat landscape.

“As part of Acronis TRU, we will implement research-driven guidance that will shape Acronis’ capabilities to protect against modern threats while raising awareness of how our solutions empower businesses to succeed. I look forward to collaborating with the talented team at Acronis to expand our influence in the cybersecurity community.”

2024 was the worst ever for commercial cyber attacks in the UK, new research suggests, with remote IoT devices attracting the most attacks.

During 2024, UK firms each experienced an average of more than 753,341 malicious attempts to breach their online and IT systems, according to analysis by specialist business ISP Beaming.

That was 4% higher than in 2023 - itself a record year - making last year the worst ever for attempted cyber attacks, with businesses encountering a new online threat every 42 seconds.

Before 2024, the average number of attacks in a single quarter had only exceeded 2,000 in Q4 2023.

"The rise of automated cyber attacks means the internet has never been more dangerous, and we expect it will become even more so as hackers use AI," said Beaming managing director Sonia Blizzard.

"The good news is that we are not seeing record numbers of companies crippled by hackers because businesses have got better at protecting themselves."

The most frequent targets last year were remotely-controlled IoT devices, with more than 161 daily attacks targeting applications such as building control systems, security cameras, networked printers, remote monitoring, and industrial automation systems.

Web applications, remote desktop software, and company databases were also frequently targeted, with businesses typically attracting more than 20 individual attacks daily for each of these systems in 2024.

Beaming identified more than a million IP addresses being used to launch cyber attacks on UK businesses - and traced more than a quarter of those to locations in China.

It also found significant and increasing volumes of cyber attacks that appeared to come from areas inside India - 87,144 attacking IP addresses - and the US, where there were 81,112.

The big rise in attacks on IoT devices may be explained in part by the activities of Flax Typhoon, a Chinese state-sponsored cyber group that has been active since at least 2021.

Last September, the FBI successfully took down a botnet created by the group that consisted of more than 200,000 devices around the world, including small-office/home-office routers, internet protocol cameras, digital video recorders, and network-attached storage (NAS) devices.

IoT security has been a recurring talking point in the cybersecurity industry in recent years, with a survey from Viakoo last year finding that half of IT leaders thought IoT was the weakest point of their security apparatus.

Similarly, last summer Verizon Business found that while virtually all critical infrastructure organizations had some degree of IoT device adoption, almost half had experienced a major impact due to a compromised IoT device.

"A lack of industry-wide security standards for IoT devices and their communication protocols increases security risks, as does having many devices installed in remote locations where they may be vulnerable to physical tampering," said the firm.

Cyber experts have warned UK telecommunications firms and the wider industry must be ready for a barrage of cyber attacks as the Salt Typhoon hacker group claims yet more victims in the US.

Three further companies based in the US, Charter Communications, Consolidate Communications, and Windstream, have been added to the list of telecoms organizations compromised by the Chinese state-affiliated threat actor, according to the Wall Street Journal.

In December 2024, US security officials revealed Salt Typhoon was able to record private conversations of ‘senior political figures’ after compromising major telecom firms including Verizon, AT&T, and Lumen Technologies.

At the end of the month, Verizon and AT&T announced they had successfully removed the hackers from their IT environment, insisting that their networks were secure.

Elsewhere globally, cybersecurity experts have been watching the incident unfold with bated breath, with practitioners accelerating preparations for a looming onslaught of attacks.

Speaking to ITPro, Jamie Akhtar, CEO and co-founder of CyberSmart, warned that despite Salt Typhoon’s recent focus on entities in the US, the UK and other allies should be on high alert.

“Although Salt Typhoon has focused almost exclusively on US telcos thus far, their UK counterparts should be wary. The UK has long been a key ally of the US and, as a result, it’s impossible to rule out that state-sanctioned threats like Salt Typhoon could also be turned on British firms,” he said.

Akhtar added that there are previous notable examples of Chinese state-affiliated threat actors targeting UK infrastructure in the past, such as the APT31-led attacks in 2021.

Rob Pocock, technology director at Red Helix, cautioned that firms based outside the US should not be complacent and assume such attacks will exclusively focus on US-based companies.

The US’ global allies are a particularly appealing target for state-affiliated threat groups, he warned.

“It is highly misguided to assume advanced persistent threat actors like Salt Typhoon are only interested in the US. These threat groups are just as likely to target other nations, particularly US allies,” he warned.

“All critical infrastructure organizations should continue to expect to be targeted and take proactive steps to strengthen their own security – and that of their supply chains. Supply chains are often seen as the weakest link, but organizations can significantly reduce risks by ensuring their suppliers implement robust security measures.”

UK telcos are in the firing line for Salt Typhoon and others

Pocock added that UK telecoms firms represent a prime target for threat actors at present, especially amidst the country’s ongoing 5G SA roll-out.

However, regulations governing the integrity of telecoms firms such as the Telecommunications Security Act (TSA) may help ensure the country’s communications infrastructure is better protected.

“Telcos are right in the firing line when it comes to APT groups because of their critical role in the digital world. In the UK, the ongoing roll out of 5G SA may present different or new threat vectors for these groups to try and target,” he explained.

“Fortunately, telcos in the UK are already well-positioned to address these threats, thanks to their commitments to compliance with the Telecommunications Security Act (TSA) - a regulation designed with these challenges in mind.”

He argued that, instead of introducing entirely new security protocols, the TSA “reflects best practices already enabled within the industry” and compliance would simply help reinforce these existing procedures.

This, Pocock argued, should stand UK-based telcos in good stead in the face of increasingly sophisticated external cyber threats.

“By focusing on optimized toolsets and avoiding over-complication, telcos continue to maintain a high level of security, ensuring their systems are well-protected against evolving threats.”

During a press briefing on 27 December, Anne Neuberger, President Biden’s deputy national security advisor for cyber and emerging technology, said her UK counterparts argued these regulations would have meant the attack was detected and contained far more quickly.

“[T]heir comment to me was, ‘We would have found it faster, we would have contained it faster, it wouldn’t have spread as widely and have had the impact and been as undiscovered for as long had those regulations been in place.’

“And that’s a powerful message,” she recalled.

The UK government plans to spend £1.9 million on cyber resilience projects across the country, the Department for Science, Innovation and Technology (DSIT) has revealed.

With planned investment in more than 30 projects, the money will help improve the UK’s cyber resilience for both businesses and consumers, and boost national cyber skills.

Some projects set to receive funding include ‘CyberSecurityAId: Empowering Small Businesses with Cyber Security Skills,’ ‘Cybersecurity Angel Investor Network,’ and ‘First Steps to a Cyber Security Career - North West.’

The funding boost comes amid growing concerns over cybersecurity skills shortages across the country. Almost half of UK firms report a deficit in this regard, according to the DSIT, and these projects will help fill current gaps and meet growing demand.

Under the scheme, people across the country will be able to pursue new, high-level career opportunities as a result, DSIT added.

“By upskilling small businesses and individuals, investing in workforce development, and encouraging neurodiverse talent, government and industry partners are fostering robust and diverse cyber communities for the future,” said Jonathan Ellison, director for national resilience and future technology at the National Cyber Security Centre (NCSC).

“This is vital for protecting our digital economy, creating new opportunities for secure innovation, and helping make the UK the safest place to live and work online,” Ellison added.

The UK’s minister for cybersecurity, Feryal Clark, also commented, saying strong defenses are needed for the country’s growing digital economy, which is worth billions of pounds.

“Attempts to disrupt the technologies and services we rely on daily continue to grow, so we’re leaving no stone un-turned to make sure our communities have the skills to rise to the challenge,” Feryal said.

Cyber investment is a good start, but does it go far enough?

While the move has been welcomed by industry stakeholders, some experts have questioned the scope of the initiative.

Socura CEO Andy Kays said a key concern is the “size of investment relative to the scale of its ambition”, suggesting that the volume of projects set to be awarded funding could dilute the overall investment.

“30 new projects slated for 2025 and beyond across multiple regions means that this money will be thinly spread across the UK,” Kays said.

“The concern is that this money won’t go far enough to have the level of impact needed. It is, however, a good start,” he added.

Kays said it was “only right” that the UK invest more money to develop its regional cyber skills in places like Wales, the North East of England, and Northern Ireland.

Jake Moore, global cybersecurity advisor at ESET, welcomed the investment scheme, adding that the initiative will help strengthen the country’s overall cyber resilience and futureproof communities.

“Upskilling workforces is crucial for safeguarding our digital economy, unlocking opportunities to secure innovation, and ensuring the UK remains protected from constant attacks,” Moore said.

“However, this isn’t the first time we have seen a shake-up in the UK’s skills shortage so it is vital that the initiative will continue to be funded and pushed to the next level where more roles are filled,” he added.

Machine identities such as access tokens and service accounts are being tipped as the next big target for cyber attacks.

According to Venafi's latest research report, The Impact of Machine Identities on the State of Cloud Native Security in 2024, 86% of organizations have had a security incident related to their cloud native environment within the last year.

As a result, more than half have had to delay an application launch or slow down production time, while 45% suffered outages or disruption to their application service. Three-in-ten said the incident meant that attackers could gain unauthorized access to data, networks, and systems.

Similarly, nearly nine-in-ten security leaders said they believe that machine identities – specifically access tokens and their connected service accounts – are the next big target for attackers.

More than half said they'd experienced a security incident related to machine identities using service accounts in the last year.

"A massive wave of cyberattacks has now hit cloud native infrastructure, impacting most modern application environments," said Kevin Bocek, chief innovation officer at Venafi.

"To make matters worse, cybercriminals are deploying AI in various ways to gain unauthorized access and exploiting machine identities using service accounts on a growing scale. The volume, variety and velocity of machine identities are becoming an attacker’s dream."

While access tokens used with service accounts topped the risk list with 56% of respondents, almost as many experienced incidents related to other machine identities, such as certificates.

Venafi attributed this to the growing complexity of cloud native environments, which makes it harder to manage and secure the machine identities that underpin access and authentication.

Three-quarters of security leaders agreed that humans are the weakest link in machine identity security, while 83% of teams say that failing to secure machine identities at the workload level renders all other security obsolete. =

Nearly seven-in-ten described delivering secure access between their cloud native and data center environments as a 'nightmare to manage', while 89% said they're experiencing challenges around managing and securing secrets at scale.

Notably, 83% said having multiple service accounts creates a lot of added complexity. Despite this, nine-in-ten agreed they make it easier to ensure policies are uniformly defined and enforced across cloud native environments.

"Attackers are increasingly zoning in on machine identities in cloud native technologies," said Bocek. "Security teams must prioritize machine identity security to the same degree as human identities."

AI poisoning a key concern

Elsewhere in Venafi’s report, more than three-quarters of respondents highlighted AI poisoning as a leading new software supply chain risk.

AI poisoning refers to techniques whereby AI data inputs and outputs are manipulated for malicious purposes.

"There is huge potential for AI to transform our world positively, but it needs to be protected," said Bocek.

"Whether it’s an attacker sneaking in and corrupting or even stealing a model, a cybercriminal impersonating an AI to gain unauthorized access, or some new form of attack we have not even thought of, security teams need to be on the front foot.

"This is why a kill switch for AI – based on the unique identity of individual models being trained, deployed and run – is more critical than ever."

Three-quarters are also worried about model theft and 73% concerned about the use of AI-led social engineering, while 72% are worried about provenance in the AI supply chain.

Despite this, six-in-ten said senior management has taken its focus off supply chain security in the last year.

Insufficient security on individual developer accounts maintaining some of the most popular packages poses a significant threat to the open source community and beyond, according to a report from the Linux Foundation.

The Linux Foundation Census is the third report of its kind looking into the widespread use of free and open source software (FOSS), aggregating data from over 12 million observations of FOSS libraries used in production applications at over 10,000 companies.

The report argued that FOSS has become a critical part of the modern economy, citing estimates that 96% of codebases include FOSS, and as a result the security of the developers maintaining these projects needs to be reassessed.

A significant proportion of the top 500 packages identified in the investigation are hosted under individual developer accounts, according to the Linux Foundation.

The foundation warned that the implications of this fact may not be fully appreciated in the software community.

“The consequences of such heavy reliance upon individual developer accounts must not be discounted. For legal, bureaucratic, and security reasons, individual developers accounts have fewer protections associated with them than organizational accounts in a majority of cases.”

For example, the report noted many individual accounts fail to even have the most basic security protections, like multifactor authentication (MFA), leaving them vulnerable to attack.

In addition, the granularity of permissioning and other publishing controls often found on organizational accounts are lacking on most accounts.

developer accounts are significantly easier to make. Further, a related issue could occur if the individual developer went on a long hiatus, or was hit by the proverbial bus, preventing updates to the code from occurring,” the report added.

Compromised developer accounts pose “significant” threat

The threat posed by lax security is not hypothetical, however, with the report warning that developer account takeovers are increasing in frequency, both on platforms such as GitHub as well as in repositories including PyPI.

One popular method used to infiltrate accounts detailed in the report is backdooring, where hackers insert malicious code into popular packages that give them an easy entry point once the package is installed on systems.

The report cited an example in 2019 an account of a Ruby developer was compromised and used to insert backdoors in eleven packages.

The Linux Foundation noted that while account takeovers remain a significant risk to software security, there are other less obvious issues concerning individual developers maintaining packages that are widely depended upon.

For example, developers that decide to remove or ‘delete’ their projects can cause serious disruption, such as in the case of the ‘left-pad’ package, which left the internet ‘broken’ for several hours after being removed in 2015.

The disgruntled developer responsible for the package removed their code in protest, which broke hundreds of downstream packages that depended on the “seemingly minor piece of code”.

The report also referred to the more recent case of XZ Utils, which it described as an even more serious problem, where a developer intentionally subeverts the software they maintain

In February 2024, a malicious backdoor was introduced into the popular data compression library, used across a number of major Linux distributions that put potentially millions of systems at risk.

The threat actor responsible for the attack, known as Jia Tan, conducted a years-long social engineering campaign to gain the trust of the utility’s original author Lasse Colin using fake GitHub accounts to flood him with requests and pressure him into making Tan a co-maintainer of the project..

It was only due to the keen eye of a Microsoft developer Andres Freund, who spotted the backdoor and reported it to the Openwall Project’s security mailing list, bringing the issue to the attention of a number of major software vendors and preventing the incident from spiralling out of control.

The report concluded that in the context of both security and general risk management, it is critical that developer accounts are better understood and strongly protected.

Moving towards this goal, the Linux Foundation encouraged the use of MFA tokens and also suggested that some individual accounts hosting critical projects should be transitioned to organizational accounts with added layers of security.

T-Mobile was able to protect sensitive customer information and prevent disruption to its services after detecting malicious attempts to infiltrate its systems, according to its security chief.

Jeff Simon, chief security officer at T-Mobile, published an update on a string of recent cyber attacks targeting wireless companies, believed to be orchestrated by the Salt Typhoon group.

The update states that the attacks originated from the network one of T-Mobile’s wireline providers it was connected to, but Simon said connectivity to the provider’s network, which may still be compromised, was quickly severed.

Simon noted that unlike other providers, and despite media reporting, T-Mobile’s customer information was not impacted.

“Many reports claim these bad actors have gained access to some providers’ customer information over an extended period of time – phone calls, text messages, and other sensitive information, particularly from government officials. This is not the case at T-Mobile,” he wrote.

“Our defenses protected our sensitive customer information, prevented any disruption of our services, and stopped the attack from advancing. Bad actors had no access to sensitive customer data (including calls, voicemails or texts).”

Speaking to Bloomberg, Simon said T-Mobile’s network engineers discovered the attack after noticing suspicious behavior on some of the company’s network devices.

The behavior wasn’t “inherently malicious” but may have been used to gain a clearer understanding of the company's corporate network, with threat actors probing for potential lateral movement opportunities.

Simon stated that T-Mobile’s layered network design, featuring network segmentation and robust monitoring, partnerships with third-party cyber experts, and its swift response all helped to prevent the attackers from causing further damage.

Salt Typhoon is on a rampage

Although T-Mobile were unable to “definitively identify” the attacker’s identity, the behavior is consistent with previous attacks leveraged by the Salt Typhoon group.

Trend Micro published a report on 25 November detailing previous activity of Salt Typhoon, also known as Earth Estries, Ghost Emperor, or UNC2286).

The report stated the group has primarily targeted critical sectors such as telecommunications and government entities across the US, Asia, Middle East, and South Africa since 2023 and potentially even earlier.

“The group employs advanced attack techniques and multiple backdoors, such as GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, affecting several Southeast Asian telecommunications companies and government entities,” Trend Micro outlined.

“Earth Estries exploits public-facing server vulnerabilities to establish initial access and uses living-off-the-land binaries for lateral movement within networks to deploy malware and conduct long-term espionage.”

According to the report, the group has compromised over 20 organizations in the telecommunications, technology, consulting, chemical, and transportation industries, as well as government agencies.

Reports of Salt Typhoon infiltrating internet service providers (ISPs) in the US came out in September 2024, with the Wall Street Journal confirming in October that major players Verizon Communications, AT&T, and Lumen Technologies were among a list of companies whose networks were breached.

Unnamed sources familiar with the matter told theWSJ that the access may have allowed the group to access information from systems the federal government uses for court-authorized wiretapping, describing the compromise as "potentially catastrophic”.

T-Mobile appears to have avoided the worst impacts of Salt Typhoon’s campaign, according to Simon, who added that he had recently attended a meeting of leaders at the White House to discuss how the industry can work together to mitigate the threats the group pose and avoid further damage.

Security practitioner salaries have grown by a considerable amount in the last 12 months, but so has the stress associated with the role, according to new research.

A survey of UK cyber professionals between October 2023 and March 2024, conducted by CIISec, found the average wage for a security worker now stands at £87,205.

This is roughly £10,000 higher than the 2023/24 average which was just above £70,000, and almost £25,000 higher than the £62,144 average salary in 2016/17.

When adjusted for inflation the average salary for a cybersecurity professional in the UK has risen 7% in real terms.

But being remunerated this handsomely appears to come at a cost, CIISec found, with 21% of security staff working long hours that are classified as being ‘overworked’.

The report noted that over half (55%) of the respondents said the stress associated with this was keeping them up at night. The fear of suffering a cyber attack was cited by 39% of respondents as hurting their ability to relax at home.

The financial impact an incident could have on their organization was also a considerable factor fuelling stress among 20% of cyber pros, constituting a five year peak.

CIISec’s report noted that mismanaged intrusions can become notorious and haunt those responsible for mitigating the attack. Accordingly, CIISec found that cyber professionals are twice as likely to remember a poorly handled attack than a well-handled one.

What pushes cyber pros to leave their jobs?

Overall, the State of the Profession report found cyber professionals were less positive about staying in their current role than they were last year.

When asked if they see themselves working for the same employer in two years’ time, 20% of respondents said no, compared to just 13% in 2022/23

Although the majority of respondents reporting the stress associated with their role was keeping them awake at night, stress and overwork were no longer listed as one of the top five reasons for leaving their job, CIISec found.

Instead, professionals cited remuneration as the primary reason for leaving their job, despite the fact that this year constitutes a new high for security salaries.

Scope for progression, insufficient training, poor management, and boring work were listed as the four other top factors pushing cyber professionals to look for new roles.

A Blackfrog study of security leaders from the UK and US challenges this finding however, reporting 93% of respondents said stress and job demands were driving the decision to leave their roles.

Blackfrog reported that 45% of security decision makers said they had used drugs or alcohol to manage their heightened stress levels.

When asked what was fueling this anxiety, 42% said they worried about AI-powered attacks, whereas 37% said malware and ransomware attacks caused them the most stress.

Dealing with the flood of alerts and notifications was another factor fuelling burnout among security professionals, the report found, with 63% of respondents saying their team experiences ‘alert fatigue’ that desensitizes them to the urgency of security events.

Virtually every respondent said they are overworked to some degree, with 98% working on average an extra nine hours per week beyond their contract, and 15% stating they worked more than 16 hours over their contracted time.

Security company Qualys has warned of “significant” vulnerabilities it has discovered in the GNU C Library, a key building block of applications in Linux environments.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as their kernel. Qualys explained that the GNU C Library – known as glibc – is an essential component of virtually every Linux-based system, serving as the core interface between applications and the Linux kernel.

“The recent discovery of these vulnerabilities is not just a technical concern but a matter of widespread security implications,” said Saeed Abbasi, product manager in the Threat Research Unit at Qualys.

He said the vulnerabilities identified highlight a critical aspect of software security, that even the most foundational and trusted components are not immune to flaws. “The ramifications of these vulnerabilities extend far beyond individual systems, affecting many applications and potentially millions of users worldwide,” he said.

The first vulnerability identified – CVE-2023-6246 – is described by the security company as a “significant security flaw” in the GNU C Library’s __vsyslog_internal() function, affecting syslog() and vsyslog().

It’s a heap-based buffer overflow vulnerability that was inadvertently introduced in glibc 2.37 (back in August 2022) and subsequently backported to glibc 2.36. Qualys said that it had confirmed Linux distributions including Debian versions 12 and 13, Ubuntu 23.04 and 23.10, and Fedora 37 to 39 were vulnerable.

Qualys said the buffer overflow issue poses a significant threat as it could allow local privilege escalation, enabling an unprivileged user to gain full root access through crafted inputs to applications that employ these logging functions.

“Although the vulnerability requires specific conditions to be exploited (such as an unusually long argv[0] or openlog() ident argument), its impact is significant due to the widespread use of the affected library,” Abbasi said, noting a similar issue was reported in December 1997 in an older Linux libc version.

While looking into the function affected by CVE-2023-6246, the company’s security researchers also spotted two additional “albeit minor” vulnerabilities. These were CVE-2023-6779 which involves an off-by-one heap-based buffer overflow in the function, and CVE-2023-6780, an integer overflow issue in the same function. Qualys noted however that triggering these two minor vulnerabilities appears to be more difficult and exploiting them effectively is likely to be more complex.

Qualys also identified another vulnerability which it described as involving a “subtle yet dangerous flaw” in glibc’s qsort() function. However, the researchers acknowledge that real-world examples of vulnerable programs have not been identified. They said the glibc developers have already addressed this problem in a recent update.

“These flaws highlight the critical need for strict security measures in software development, especially for core libraries widely used across many systems and applications,” Abbasi said.

It’s not the first time Qualys has found vulnerabilities in the GNU C Library: in October 2023 its researchers discovered a buffer overflow vulnerability in GNU C Library’s dynamic loader’s processing of the GLIBC_TUNABLES environment variable. This was a local privilege escalation that grants full root privileges, which it dubbed at the time ‘Looney Tunables’.

A database containing nearly 50 million customer records reportedly stolen from car rental service Europcar has been put up for sale on a hacking forum, but questions have been raised over the data’s authenticity.

If legitimate, the leak would be one of the largest data breaches in recent years, and the nature of the stolen information would have exposed customers to a wide range of attacks.

As pointed out by Reddit’s head of security Matt Johansen on X (formerly Twitter), car rental companies require customers to hand over a lot of personal identifiable information (PII), including passports and driver’s licenses, which are much harder to rotate than exposed passwords. 

Europcar, however, has said the database is fake. It said the records included in a sample of the data do not match those it has on file, with none of the leaked email address records corresponding to those in its own database.

In addition, Europcar speculated that the data may have been synthesized using generative AI, pointing to a series of discrepancies that look like hallucinations.

For example, the data includes non-existent addresses, ZIP codes that don’t match addresses, and both first and last names that do not correspond to those used in email addresses. 

At the time of writing, the authenticity of the data has not been verified, but Huseyin Can Yuceel, security researcher at Picus Security, appeared confident the data was created using generative AI tools.

“The Europcar security incident unfolded like a classic Scooby Doo unmasking. In the space of a couple of hours, the infosec community went from analyzing the impact of one of the biggest data breaches of all time, to exposing an AI powered hoax.”

Can Yuceel argued this incident represents a novel attack vector being exploited by threat actors,  using generative AI to create fake datasets that can be used to deceive and extort businesses. 

“A far cry from initial reports of a data breach involving 50 million customers, this incident should be classified as an attempted social engineering attack. In social engineering attacks, it’s common for adversaries to manipulate their victims into sharing confidential information or executing malware to compromise the target system” he explained.

“In this case, it seems as though attackers tried to create panic and pressure their target into paying ransom for a false claim that they stole sensitive customer data.” 

Questioning the role AI in fabricating data for extortion attempts

This debacle highlights AI’s offensive potential, according to Can Yuceel, who said businesses should take note of the extortion technique and adjust their incident response procedures accordingly.

“Adversaries are quick to adopt new techniques and tools, and the use of AI in cyber-attacks is becoming more commonplace. We, as defenders, should expect more AI-powered cyber-attacks in the near future.”

This interpretation has been challenged by other security experts, however, arguing the role of AI in fabricating the stolen data is not clear and could have been executed using legacy techniques.

Troy Hunt, founder and CEO at data breach site Have I Been Pwned, warned against jumping to the conclusion that AI was integral to this attack, citing his previous work on generating dummy data using software company Red Gate’s SQL data generator technology.

Hunt noted many of the email addresses were not synthesized, but lifted from records exposed in previous data breaches, arguing this confirms AI was definitely not involved in generating the leaked email addresses. 

Regardless of AI’s role in the attack, the recommendations for businesses to protect themselves against falling for fabricated data breaches remains the same: always compare stolen records with internal databases to confirm the veracity of the breach before acting.

As such, Can Yuceel praised Europcar’s response to the incident by cross-checking the stolen data with that in their internal database.

“It appears that Europcar did its due diligence and followed the incident response best practices by confirming whether these claims were true. After analyzing the claim, they found that the data was fake and confirmed there was no breach.”

Most "do not pay" ransomware policies in the UK aren't worth the paper they're written on, according to a new report.

While 94% of UK organizations have a policy not to pay out in the event of a ransomware attack, 97% of those that have fallen victim in the past two years have paid out a ransom.

The research, from data security and management firm Cohesity, polled over 900 IT and security leaders in the UK, US and Australia. It found that three quarters of respondents said their company would be willing to pay over £2.4 million to recover data and restore business processes, with four in ten saying the figure would be more than £4 million. 

"Many organizations said they would pay a ransom to reduce disruption. Paying the ransom almost certainly results in a loss of some of the data," said James Blake, Cohesity's global head of cyber resiliency GTM strategy. 

"Not to mention we’ve seen the UK sanction ransomware operators; the last thing senior management need after dealing with a ransomware attack is the prospect of a huge fine or custodial sentence for breaching sanctions."

More than eight in ten (83%) respondents said they'd fallen victim to a cyber attack in the second half of last year and 95% believe that the threat of cyberattacks to their industry will increase this year, with seven in ten predicting it will increase by more than 50%. 

Respondents are also pessimistic about their ability to deal with incidents, with only a quarter having full confidence in their company’s cyber resilience strategy and its ability to address today’s challenges and threats.

Everyone said they needed more than 24 hours to recover data and restore business processes, with only one in ten saying their company could recover data and restore business processes within three days.

A third (34%) said they would need one to two weeks to recover, and almost a quarter (24%) said they would need more than three weeks to recover data and restore business processes.

"The figures in the survey show huge deficiencies in an organization’s ability to achieve the required recovery times to avoid significant disruption," said Blake.

Respondents were keen to see improvements in executive awareness and responsibility for data security, with only three in ten saying their senior and executive management fully understands the "serious risks and daily challenges of protecting, securing, managing, backing up, and recovering data". 

Four in five said executive management and boards should share the responsibility for their company’s data security strategy, while 64% said their company’s CIO and CISO, in particular, could be better aligned.

In terms of the effects of a successful data breach or cyberattack, the biggest concerns were brand and reputational damage, long-term operational outcomes and projects, a direct hit to revenue, and a loss of stakeholder trust, all cited by around a third. 

"Cyber resilience and data security should be a holistic organizational priority because the use of data and technology occurs in every function by every employee," said Cohesity CEO and president Sanjay Poonen.

"The severe impact of a successful cyberattack or data breach on business continuity, revenue, brand reputation, and trust is enough to keep all business, IT, and Security leaders awake at night."

Burp Suite is a well-established tool kit for ethical hackers, including web developers who want to harden their programs. Originally created as a bare-bones intrusion tool in 2003, it has since become a robust web application security analysis framework, including features such as a proxy, a logger, and a custom intrusion tool. Sadly, the best feature of the original incarnation – burping sounds that the user couldn't turn off – is no longer a thing.

The service now comes in three editions: Community, which is a free version targeting casual users, Professional, for more serious practitioners, and Enterprise, which focuses on larger organizations with collaborative application security and development teams.

We looked at both the Community and Professional editions to get a sense of their functionality and what was different. For many, the Community edition of Burp Suite will be more than adequate. The biggest feature that it lacks is persistence because users cannot save website investigation projects to disk. That makes it less practical than the Pro version for collaboration, or even for longer-term investigations that a researcher might want to come back to. Still, it's useful for poking around your own applications, or other people's with permission.

Burp Suite: Proxy setup 

The proxy is the heart of Burp Suite, sitting between your browser and the website you're analyzing, intercepting traffic, and allowing you to read and change it. You can either use a browser proxy plug-in for Burp Suite to control, or you can use Burp Suite's tightly integrated built-in Chromium-based browser.

The proxy enables you to intercept and change both requests made to the site and responses to those requests. You can filter which domains are intercepted using the Target menu, which shows you everything about the target site including a site map. This is one of many function areas demonstrating just how comprehensive the tool has become, and it sits alongside many other menu-based functions in the program. Here's an empty initial view of the Pro version's Dashboard view, which shows various summaries of Burp Suite activity.

The proxy menu allows you to set rules for what kinds of traffic are intercepted, along with what to do with them. You can also change requests on the fly. An HTTP history section in this section shows you your requests, allowing you to drill down into the request and response bodies. You can make individual notes on these requests and also highlight them in different colors for easy categorization, although remember that only the Pro version allows you to save such details for posterity.

Burp Suite: Requests

You can send requests directly from the HTTP history section to other areas of Burp Suite. One of these is the repeater, which allows you to repeatedly tinker with requests and resend them to assess the results. This is useful if you want to tinker with an input parameter a couple of times to see if an SQL injection attack might work. You can send multiple requests to the repeater, each of which goes into a tab that you can rename. That's handy for identifying and recording interesting finds.

What if you want to run a larger set of requests, perhaps testing user name inputs to test what responses the site sends back? That's where the intruder function comes in. It's an area to mount attacks against websites by specifying parts of a request as placeholders to insert different text. For example, you might want to highlight the someuser part of https://www.anexamplecompany.com/login.php?user=someuser&password=somepassword as a placeholder, replacing it with entries from a word list, and then bombarding the site with results. You can set match strings to look for in the site responses, and you can also use another function, the Comparer, to highlight what changed.

Another trick with the Intruder section is to look for subdomains under your target domain by specifying a placeholder and then running automated requests that replace that field with words from a list. Then you can analyze the results. For example, sorting all the responses to queries in this subdomain list that returned a 200 header revealed a staff subdomain that was shorter in length than the others. This turned out to be a login form, which would warrant further analysis.

Burp Suite: Professional version

Aside from allowing you to save your project to disk, there are some other features in the Pro edition that range from convenient to extremely useful. At the convenient-but-not-crucial end of the spectrum is the inclusion of built-in word lists covering things like user names and domains for Intruder. You could easily find such things online and load them or simply paste them into the relevant area yourself, but pre-baked options make it slightly easier and speed up your job as a practitioner.

The Pro version also comes with some extra tools that make it easier to enumerate sites, or to understand what you've already mapped. These include a Discover Content option that uses common word lists to search a site for hidden directories and other assets, along with subdomains that aren't linked directly from the website. This is a good way to discover development and testing domains not meant to be exposed to the public.

Be warned, though; even with another advantage of the Pro version – threaded operation for faster site hammering – this can take a while. Some tasks such as the subdomain search we mentioned might even be best left running overnight.

You can also use the Analyze Target function in the Pro version to report every parameter used in a mapped site and which URLs they are found at:

At the extremely useful end of the spectrum is the Pro version's scanning and auditing feature. This enables you to point Burp Suite at a website and launch vulnerability scans ranging from a simple passive check to an aggressive bout of intense door-rattling. You can then highlight the issues in the site and drill down into each of them, like so.

The Pro version also lets you produce customizable HTML reports for distribution to your team. That's handy if you're a compliance or security professional who needs to compile a list of things for a developer to address.

Burp Suite: Apps and plugins

There are plenty of other goodies in Burp Suite. For example, it handles WebSockets and also includes some more esoteric goodies like the Sequencer. This analyzes multiple strings to see how random they are, which you can use to see whether, say, session tokens or CSRF tokens are predictable and therefore a security issue.

Burp Suite is a highly functional tool that you can get a lot out of when you understand how to use it properly. It gets even deeper when you delve into the many plugins that the community has developed for this extensive product.

One of the best parts about the whole experience is the set of education resources that Portswigger has created for Burp Suite users. There is an online academy, complete with labs that you can access to solve challenges with Burp Suite. The site tracks how many of these bite-sized exercises you've completed, noting when you've progressed to more advanced levels so that you can tackle tougher tasks. There are also plenty of instructional videos to watch, and even intentionally vulnerable websites to target for practice. This all effectively turns the academy into a beefy ethical hacking course. It's a great way to build a bigger community around an already well-established and respected product.

As with all ethical hacking tools, you can use Burp Suite for good or evil, but we hope you use it for the former. If you're a web developer, it pays to spend time learning this product so that you can spot and seal off a range of vulnerabilities in your application. Making the effort during development could save you some embarrassing incidents in production.

That ransomware is expensive to resolve isn’t news to anyone. While most attacks end up costing victims at most tens-of-thousands of dollars, most people are aware of big names like Norsk Hydro or Royal Mail, whose recovery efforts ran to the tens-of-millions of dollars. Even these numbers are small, however, when it comes to the true global cost of this blight.

A 2018 paper presented at RSA conference estimated that around $1.5 trillion was stolen from the global economy every year by cyber criminals. That figure has gotten no better in the intervening years and in July 2023, Cybersecurity Ventures predicted that ransomware attacks will cost victims approximately $265 billion annually by 2031.

According to some in the security industry, the biggest enabler of the explosion in ransomware’s popularity and profitability has been Bitcoin.

“When we brought together the combination of encrypting data and cryptocurrencies for the sake of payment, we created this perfect storm whereby ransomware was able to take off,” says Joe Levy, president and CTO of Sophos, in Weapons and Warriors, the final episode of the cyber security firm’s three-part documentary series, Think you know ransomware?

“[Cryptocurrency] offers a unique opportunity for elicit actors to transfer value across  borders with speed that was not previously possible,” explains Gurvais Grigg, global public sector CTO at blockchain analyst firm Chainalysis.

As laid out in the previous episode, Hunters and Hunted, some of the money taken will be used to fund playboy lifestyles that cyber criminals in Russia are becoming increasingly accustomed to. In other countries, however, the stakes are even higher.

“Look at North Korea. How are they building those missiles – those missiles that are Russian-designed missiles? They’re paying for that in stolen virtual currency and stolen proceeds of cyber crime,” says Tom Kellerman, member of the Cybercrime Investigations Advisory Board for the United States Secret Service.

Beyond the money motivator

While it’s easy to focus on the ransom amount and whether or not it’s paid, there are other elements affected in a ransomware attack that both sides would consider valuable.

“The problem with ransomware is a lot of the effects are not clear right from the beginning,” says Clare Sullivan, a visiting professor at Georgetown University.

“I think it’s wrong just to look at the ransom. The broader picture is the data, the value that has and what stance a nation should be taking to protect [it]. There needs to be a fundamental recognition that the data that we hold is really, really valuable,” she adds. “Focusing just on whether ransoms should or not be paid, it’s missing the crucial element.”

Indeed, it’s not out of the ordinary for cyber attackers to use a ransomware attack as cover for other criminal activity such as the exfiltration of sensitive data.

Tracking down thieves

A ransomware attack is a crime and, provided the victim chooses to involve law enforcement, may attract a police investigation. There’s a level of ‘crime scene’ work that can be done by computer forensics – establishing how the attack unfolded, where the entry point was, what data was affected (even if it wasn’t encrypted), and whether there’s any evidence of the attackers still lurking in the system.

If a ransom has been paid, it may also be possible to track the attackers through their ill-gotten gains, despite cryptocurrencies’ reputation for anonymity.

“They get paid and they receive those crypto and then they begin to move that through a series of wallets in an attempt to obfuscate the trail,” says Grigg. “That’s what makes blockchain analytics so fascinating, because we can literally follow those digital breadcrumbs until they ultimately get it to a place where they hope that it will be safe and they can cash it out.”

As Catalin Cosoi, senior director of investigation and forensics at Bitdefender explains, the main cryptocurrency exchanges are well regulated, established businesses. If law enforcement suspected a cyber criminal used one of these services to cash out their Bitcoin for real money, they could subpoena the records and track down the perpetrator.

Consequently, once they have finished attempting to launder their money, they have to take it to a smaller exchange to cash out ‘off the books’ – but a record of the transaction still remains on the blockchain ledger.

According to Jackie Burns Koven, cyber threat intelligence lead at Chainalysis, the work she does has shown that there is a small number of wallets – and, therefore, a small number of individuals, who are behind most of the attacks.

The importance of defense

While it may be tempting to view this as a victory, the reality is many of these individuals will be outside of the jurisdiction of the place where the victim is based and often there will be no extradition treaty. 

Investing in prevention, therefore, is often better than the hope of any retribution.

“In my experience, prevention – and investment in prevention – is always the best path,” says Grigg. “When you look at solutions of securing your network, that goes a long way to preventing. It’s always easier to prevent a spill than to clean up a spill. 

“Waiting until you’ve become a victim and then trying to clean it up by paying a ransom, that money probably would have been better … spent long before that and maybe you wouldn’t have been a victim at all.”

This includes technology itself, but also skilled cyber security professionals. According to Peter MacKenzie, director of incident response at Sophos, these specialized personnel should be monitoring all machines on an organization’s infrastructure and looking for anomalies. This, he says, will enable them to act prior to the attack being executed, rather than afterwards.

With the tech skills gap still in full swing and a particularly pronounced lack of skilled workers in the cyber security field, finding these skilled professionals may be easier said than done.

Cosoi offers a solution: “If we compare the underground economy and where we have the crime ‘as a service’, probably the same model has to come into cyber security as well. So you need to have cyber security as a service.”

In the words of Erez Leibermann, litigation partner at Debevoise and Plimpton: “Most companies can’t afford the resources that are necessary to fight the sophisticated hackers that are sitting on the other side and yet their data is worth protecting. 

“Working together to pool those resources … through actual cyber security [has] changed the game completely.”

This is the third in a series of three articles based on the Think you know ransomware? documentary series by Sophos. To watch the whole episode Weapons and Warriors and learn more about how businesses can protect themselves from ransomware, click here.

Cyber security is one of the top priorities for any business, but for industries deemed important or critical this becomes an even greater area of focus. Threat actors are upping the ante when it comes to attacks, with new and sophisticated malware and attack chains that exploit any enterprise security weaknesses.

Through the Network and Information Security 2 (NIS2) Directive, the European Union (EU) has sought to respond to these threats and bolster the defenses of organizations against targeted phishing attacks, data breaches, and extortion through ransomware.

It lays out a series of cyber security standards to be met by 17 October 2024 and compels firms to adopt stronger measures against leaks and breaches through the use of systems such as identity management tools.

What is NIS2?

NIS2 is a directive from the European Commission that supplements and modifies existing cyber security laws across the 27-nation bloc.

Formally introduced in January 2023, NIS2 applies to providers of key services across the public and private sectors. The directive seeks to address cybersecurity issues including supply chains, authentication, incident reporting, and understanding of vulnerabilities.

The list of industries NIS2 covers is an expansion of those in the original NIS directive, to include manufacturing, ICT service management, and public electronic communications networks. 

NIS2 applies to all businesses with an annual turnover in excess of €10 million per year and 50 employees or greater, but divides organizations into two categories: ‘important’, and ‘essential’.

Essential entities under NIS2 include energy, financial services, and digital infrastructure, versus those important entities such as firms in the manufacturing, food, and research sectors.

Companies that fail to comply with the directive will face fines beginning at €10 million or 2% of annual total worldwide revenue for those in the essential category to €7 million and 1.4% of annual total worldwide revenue for those classified as important.

Organizations that don’t proactively address their compliance now will face a scramble to get affairs in order by October 2024. Businesses that are yet to take these first steps, or which feel they could do with greater guidance in their continuing efforts could seek advice from a third party. Security providers like Okta can provide the tools and insight to help firms achieve NIS2 compliance by the deadline.

Checklist for NIS2 compliance

Identifying the risks a business faces and assessing the potential damage posed by each of them compared to security measures in place is one of the first and most important steps to NIS2 compliance.

As one of the main threats against critical and important sectors, ransomware was a key consideration when NIS2 legislation was drafted. As such, it’s important that all firms assess their resilience to ransomware in order to achieve NIS2 compliance.

Firms need to carefully assess their response plan for a data breach and other cyber security incidents as another key consideration for NIS2 compliance. 

The text for NIS2 specifically calls for identity and access management (IAM) to be strengthened throughout businesses, making it a key area for firms to look at as part of their journey to compliance and improved security.

Through considered IAM implementation, security teams can set granular permissions for key systems to ensure that personnel can only access what they are meant to, even in the event of a breach. 

Features of IAM such as multi-factor authentication (MFA) can also help to fight security weaknesses common across industries including phishing attacks and poor password hygiene such as using common passwords.

Okta’s adaptive MFA is an example of a multi-layered IAM approach. It works to prove the legitimacy of users at the point of login, using context such as their IP address, the device they are using, and their location. This helps to flag suspicious activity and prevent attacks, without placing a large burden on the end user.

The significance of a proper MFA strategy linked to a comprehensive identity management strategy cannot be overstated. A recent study by Rapid7 found that 39% of ransomware incidents at the start of 2023 resulted from poor management of MFA.

Implementing enhanced authentication protocols can also help deny access to suspicious parties outright, or seek additional verification. IAM systems provide businesses with tools to respond to security incidents in real-time and prevent threat actors from escalating attacks or moving laterally through critical networks in line with NIS2 demands.

NIS2 states that IAM measures such as MFA can be used as part of clear zero-trust policies, under which users are continuously verified to ensure the systems or data they are accessing is within their remit.

Okta data shows that zero-trust strategies can reduce breaches by 50%, and cut the time to respond to attacks based on identity by 90%. 

Another primary concern addressed in NIS2 is software supply chain vulnerabilities. Though always on the radar for security teams, the publicity surrounding the Log4Shell vulnerability has pushed supply chain concerns to the forefront in the C-suite, as well as at the legislative level.

NIS2 compels organizations to commit to regular audits of their third-party software vendors and work to establish clear security standards in all vendor contracts. Zero-trust strategies have another part to play here, as they help to clearly define the access arrangements of software vendors within an organization’s environment.

The directive necessitates that organizations hit by a cyber incident report this to their relevant national information regulatory authority (such as the CNIL in France or Datatilsynet in Norway) within 24 hours of discovering the attack, and provide a technical report within 72 hours. 

When the time comes to provide these incident reports, Okta Workforce Identity Cloud allows admins to build an incident timeline via oversight of all access attempts across their estate. These clear reports can then be distributed to inform entire sectors and add to ongoing collaboration with law enforcement.

By identifying how compliant they are with the various demands of the NIS2 directive, businesses can establish a baseline for their security posture and use this to chart a clear journey to full compliance by October 2024.

In partnership with organizations such as Okta, these strategies can be realized practically to keep businesses not only in line with their obligations but also one step ahead of threat actors.

For more information on how you can get ready for NIS2, click here.

Cyber security provider CrowdStrike has agreed to acquire Israeli application security posture management (ASPM) startup Bionic.

The addition will extend the company’s cloud native application protection platform (CNAPP) with ASPM tools to provide users with comprehensive risk visibility and protection across the cloud estate, including applications and services.

Announcing the move at its Fal.Con 2023 event in Las Vegas, CrowdStrike said the acquisition will make it the first cyber security company to offer complete code-to-runtime cloud security through a single unified platform.

“The cloud is cyber security’s new battleground, yet the industry’s answer to-date has been disjointed point security tools or ‘platforms’ with multiple consoles and agents,” said George Kurtz, CrowdStrike co-founder and CEO. “We are delivering what customers need: Modern protection to address cloud security risk comprehensively, through one unified platform. 

“We pioneered cyber security for the cloud era, and the addition of Bionic further extends our cloud security leadership on our mission of stopping breaches. Bionic shares our passion for customer-focused innovation and will make a great addition to the CrowdStrike team.”

CrowdStrike said it plans to offer Bionic ASPM as an independent offering as well as fully integrated as a capability of Falcon Cloud Security, which forms part of its wider Falcon platform.

Bionic will extend Falcon’s agent-based and agentless protection of cloud infrastructure by providing visibility into application behavior and vulnerability prioritization for both server-based and serverless infrastructure.

CrowdStrike said Bionic’s real-time application visibility will help facilitate the discovery and mapping of application services, databases, microservices, third-parties, APIs, and data flows across cloud service providers, as well as both hybrid and on-premises application deployments. The offering removes the requirement for sensitive source code access, with applications automatically deconstructed while seamlessly integrating with CI/CD pipelines.

Users can also leverage the solution to instantly prioritize application-level vulnerabilities, as well as gain complete visibility into serverless infrastructure such as Azure Functions and AWS Lambda.

Bionic was founded in 2019 and now has a team of around 100 employees based at its offices in Tel Aviv and Palo Alto, all of whom are expected to join CrowdStrike.  Company CEO Idan Ninyo said the firm was founded with the sole aim of providing complete visibility into application risk. 

“We have built a ‘Google Maps for your apps’, delivering a complete picture of application security risk in a truly frictionless way that does not interfere with the development process,” he said. 

“CrowdStrike has taken the mantle as the modern cyber security platform of choice and the company to beat in the cloud security market. Its strength and scale as a market leader and innovator will help us dramatically accelerate the adoption of ASPM by every business and organization on the planet.”

CrowdStrike did not reveal the cost of the acquisition but said the purchase price would be paid predominantly in cash, with a portion delivered in the form of stock. 

The acquisition is expected to close during the company’s fiscal third quarter, subject to customary closing conditions.

There’s a saying in security that criminals only have to get lucky once to count a success. This is as true in cyber security and data protection as it is anywhere else – organizations need to be on alert and ready to defend against a possible attack every minute of every hour of every day. There is, sadly, no respite.

Companies don’t have to face this challenge alone, though; governments, regulatory bodies and the wider security industry are increasingly collaborating to introduce best practice and legislation to help increase everyone’s security posture.

One example of this is the NIS2 Directive, which was created by the European Commission in January 2023 with the aim of boosting cyber security across the European Union. It expands on the existing NIS Directive to include new sectors and entities, improving the resilience and incident response capacities of public and private organizations alike. Members of the 27-nation bloc have until 17 October 2024 to transpose the directive into their own legislation and the UK government has also confirmed it plans to update its NIS regulations as well.

With so much to consider, ITPro, in association with Rubrik, bring you an informative webinar to offer you real-world guidance and insight.

Madeline Bennett, ITPro’s Contributing Editor will be joined by Richard Cassidy, Field CISO at Rubrik to:

• Help businesses understand more about the latest updates around the NIS2 EU Directive including what will – and won’t – be covered by it.
• Learn why we all need to take this new directive more seriously, starting now. 
• Explore how Rubrik's products can help organizations align it's compliance with EMEA regulations such as the NIS 2 Directive.

To hear all this and more, register for the webinar today.

While more exotic forms of attack may make headlines, it turns out good old email is still the most popular vector of attack for malicious actors, according to research from HP Wolf Security, accounting for 79% of threats.

The figure is a single percentage point down from 2022’s figures but highlights issues facing email administrators. Web browser downloads also dropped by 1% to 12%, while other vectors, such as removable media, grew to 9%.

Researchers noted that while attack chains tended to be formulaic, there had been a move to threat actors connecting different components to create something more unique – and harder to detect.

According to researchers “32% of the QakBot infection chains analyzed by HP in Q2 were unique”.

QakBot spam activity surged in Q2 2023, with the malware distributors switching between many different file types to infect PCs. 

Patrick Schläpfer, Senior Malware Analyst at HP Wolf Security, told ITPro that the team had seen continuous and rapid change across various attack vectors. He gave the example of the QakBot campaigns, which showed threat actors changing their initial vector as well as techniques within the infection chain.

He also noted the impact of Microsoft’s disabling of macros by default, which has forced a diversification of attack vectors. “During 2022, we observed attackers attempting various newer techniques such as HTML smuggling, PDF lures, and also OneNote documents – which is particularly interesting as OneNote attacks do not rely on macros,” he said

Schläpfer noted that most attacks were wide-ranging rather than targeted as attackers attempted to gain a foothold in a system. He shared statistics with ITPro collected over the course of Q2 2023 that show over half (51.5%) of malicious email attachments were archives and almost a quarter (24.4%) were documents. PDFs accounted for 4.2% and executables 1.5%.

Attackers are also becoming more creative, according to the research. One recent campaign used multiple programming languages in an effort to avoid detection. The payload was encrypted using Go before switching to C++ in order to interact with the victim’s operating system before running .NET malware.

According to Schläpfer, attackers are becoming more knowledgeable about their target systems, making it easier to exploit gaps or vulnerabilities. He said: “By knowing which doors to push, they can navigate internal systems with ease, using relatively simple techniques in very effective ways – without sounding the alarm”.

With email remaining the top attack vector, the advice for administrators remains the same. Dr Ian Pratt, global head of security for personal systems at HP, commented that while attack chains might vary, the initiation methods tended to remain the same: “It inevitably comes down to the user clicking on something”. 

“Instead of trying to second guess the infection chain, organizations should isolate and contain risky activities such as opening email attachments, clicking on links, and browser downloads.”