Security policy and user awareness

Put ROCs before SOCs, Qualys tells public sector

Putting risk operations before security operations may help government agencies and other public sector bodies better manage the myriad threats they face, and make better decisions for the security of all Continue Reading

By

• Alex Scroxton, Security Editor

NCSC sets out how to build cyber safe cultures

The UK’s National Cyber Security Centre has published guidance for security teams and leaders on how to foster accessible and appropriate cyber security cultures in their organisations Continue Reading

By

• Alex Scroxton, Security Editor

Fortifying the future: The pivotal role of CISOs in AI operations

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Aditya K Sood, Aryaka

Infosecurity 2025: SMEs feel on their own in the face of cyber attacks

Project findings to be presented at Infosecurity Europe 2025 highlight vulnerability of SMEs to cyber attack Continue Reading

By

• Brian McKenna, Enterprise Applications Editor

Preparing for AI: The CISO’s role in security, ethics and compliance

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Elliott Wilkes, ACDS

SailPoint charts course for AI-driven identity security

SailPoint is driving the use of agentic AI in identity security with its Harbor Pilot offering while preparing to help enterprises govern and secure AI agents Continue Reading

By

• Aaron Tan, Informa TechTarget

US cyber agency CISA faces stiff budget cuts

CISA is one of several US agencies facing drastic budget cuts under the Trump administration Continue Reading

By

• Alex Scroxton, Security Editor

The hidden security risks of open source AI

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Brian Fox, Sonatype

Cyber and digital get over £1bn to enhance UK’s national security

The government has set out plans to spend over a billion pounds on digital and cyber warfare capabilities to enhance the UK’s ability to defend itself and fight offensive wars Continue Reading

By

• Alex Scroxton, Security Editor

AI security: Balancing innovation with protection

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Javvad Malik, KnowBe4

Dutch businesses lag behind in cyber resilience as threats escalate

While non-IT business professionals in the middle of their careers face the most disruption from AI, professionals in the IT services sector and their employers must prepare for change Continue Reading

By

• Kim Loohuis

How cyber security professionals are leveraging AWS tools

It’s now essential for IT security teams to have oversight of cloud computing, and AWS offers a plethora of tools to make managing it easier. Find out how cyber pros are using them in the wild Continue Reading

By

• Nicholas Fearn

Cloud migration demands contractual safeguards and clear strategy

Cyber security experts urge organisations to define clear objectives, understand shared security models and implement strong data governance when migrating workloads to the cloud Continue Reading

By

• Aaron Tan, Informa TechTarget

Signalgate is a signal to revisit security onboarding and training

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Mike Gillespie and Ellie Hurst, Advent IM

Zero-trust is redefining cyber security in 2025

The future of zero-trust is about embedding resilience into every facet of an organisation. To achieve this, SRM leaders must reimagine their strategies to address emerging challenges and prioritise key areas. Continue Reading

By

• Dale Koeppen, Gartner

RSAC rewind: Agentic AI, governance gaps and insider threats

AI was naturally a major theme of this year's RSAC conference, but we maybe failed to anticipate how it is coming to dominate every conversation. Continue Reading

By

• James Robinson, Netskope

AI and compliance: Staying on the right side of law and regulation

Without careful planning, AI projects risk blundering into a legal and regulatory minefield. We look at the risks from hallucinations, basic errors and coming regulation Continue Reading

By

• Stephen Pritchard

US makes fresh indictments over DanaBot, Qakbot malwares

US charges the operators of two malwares, DanaBot and Qakbot, whose actions led to millions of dollars worth of cyber theft and fraud Continue Reading

By

• Alex Scroxton, Security Editor

Armed forces charity steps in to address cyber mental health crisis

CIISec and military charity PTSD Resolution hope to address a gathering mental health crisis among frontline cyber professionals Continue Reading

By

• Alex Scroxton, Security Editor

Building resilient cyber threat intelligence communities

Cyber threat intelligence is no longer a luxury: intelligence sharing communities must mature, and there are many common lessons to learn. Continue Reading

By

• Rob Dartnall, SecAlliance

Security vs. usability: Why rogue corporate comms are still an issue

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Elliott Wilkes, ACDS

When leaders ignore cyber security rules, the whole system weakens

The US ‘Signalgate’ debacle is a case study in how security collapses when leadership treats basic rules as optional Continue Reading

By

• Raihan Islam, defineXTEND

Preparation and appreciation – the human factor in incident response

A typical incident response effort is highly technical, so where do soft skills come in and how do you know how effective your team is? We look at a measurement option and the human consideration in these scenarios Continue Reading

By

• Dan Raywood

What are the best practices for securing AWS tech stacks?

An AWS tech stack can aid business growth and facilitate efficient operations, but misconfigurations have become all too common and stall this progress Continue Reading

By

• Nicholas Fearn

NCSC: Russia’s Fancy Bear targeting logistics, tech organisations

The NCSC and its partner agencies have blown the whistle on an extensive campaign of malicious cyber attacks orchestrated by the Russian state Fancy Bear operation Continue Reading

By

• Alex Scroxton, Security Editor

Podcast: RSA 2025 – AI’s risk surface and the role of the CISO

We review RSA 2025 with Vigitrust CEO Mathieu Gorge who looks at the impacts on compliance of AI’s expanding risk surface, the role of the CISO, and a changed supplier approach Continue Reading

By

• Antony Adshead, Storage Editor

Ransomware attacks dropped by a third last month

Reported ransomware attacks eased off during April following a dramatic spike in the first quarter of 2025 Continue Reading

By

• Alex Scroxton, Security Editor

How to create a remote access policy, with template

Remote work, while beneficial, presents numerous security risks. Help keep your organization's systems safe with a remote access policy. Continue Reading

By

• Paul Kirvan

Chinese cyber spooks lure laid-off US government workers

A Washington DC-based think tank has published evidence that Chinese intelligence services have been running a network of digital ‘front’ companies targeting laid-off government workers as recruits Continue Reading

By

• Alex Scroxton, Security Editor

CW APAC – Trend Watch: API management

Application programming interfaces are subject to the pros and cons of emerging technologies. In this handbook, focused on API management in the Asia-Pacific region, Computer Weekly looks at governance and security, gateway tools, and strategic approaches to creating an automation framework Continue Reading

NHS asks suppliers to sign up to cyber covenant

NHS digital and security leaders call on their suppliers to commit to a cyber security charter as the health service works to improve its resilience in the face of growing threat levels Continue Reading

By

• Alex Scroxton, Security Editor

Is IPSIE the game changer that SaaS security demands?

It started with an announcement in October 2024, and now it seems the vision of secure identity in the enterprise is becoming a reality. We look at the prospects for IPSIE Continue Reading

By

• Dan Raywood

Scattered Spider retail attacks spreading to US, says Google

Google’s threat intel analysts are aware of a number of in-progress cyber attacks against US retailers linked to the same Scattered Spider gang that supposedly attacked M&S and Co-op in the UK Continue Reading

By

• Alex Scroxton, Security Editor

It's time to get to grips with DORA

It's not really a surprise so many organisations missed the EU's DORE compliance deadline, but there's no excuse for delaying, says Azul EMEA VP James Johnston Continue Reading

By

• James Johnston, Azul

New security paradigm needed for IT/OT convergence

Industry leaders and policymakers highlight growing cyber threats from the integration of IT and operational technology systems, calling for collaboration and regulatory frameworks to protect critical systems, among other measures Continue Reading

By

• Aaron Tan, Informa TechTarget

May Patch Tuesday brings five exploited zero-days to fix

Microsoft fixes five exploited, and two publicly disclosed, zero-days in the fifth Patch Tuesday update of 2025 Continue Reading

By

• Alex Scroxton, Security Editor

Australian data breaches hit record high in 2024

More than 1,100 data breaches were reported in Australia last year, a 25% jump from 2023, prompting calls for stronger security measures across businesses and government agencies Continue Reading

By

• Aaron Tan, Informa TechTarget

Government will miss cyber resiliency targets, MPs warn

A Public Accounts Committee report on government cyber resilience finds that the Cabinet Office has been working hard to improve, but is likely to miss targets and needs a fundamentally different approach Continue Reading

By

• Alex Scroxton, Security Editor

Preparing for post-quantum computing will be more difficult than the millennium bug

The job of getting the UK ready for post-quantum computing will be at least as difficult as the Y2K problem, says National Cyber Security Centre CTO Ollie Whitehouse Continue Reading

By

• Bill Goodwin, Computer Weekly

US tells CNI orgs to stop connecting OT kit to the web

US authorities have released guidance for owners of critical national infrastructure in the face of an undisclosed number of cyber incidents Continue Reading

By

• Alex Scroxton, Security Editor

UK government websites to replace passwords with secure passkeys

Government websites are to replace difficult-to-remember passwords with highly secure passkeys that will protect against phishing and cyber attackers Continue Reading

By

• Bill Goodwin, Computer Weekly

Europe leads shift from cyber security ‘headcount gap’ to skills-based hiring

Research from Sans Institute reveals European organisations are leading a global shift in hiring priorities, driven by regional regulatory frameworks Continue Reading

By

• Kim Loohuis

Oxford Uni adds cyber resilience module to MBA programme

Oxford University’s Saïd Business School is working with cyber response specialist Sygnia to help future business leaders get on top of security Continue Reading

By

• Alex Scroxton, Security Editor

Unspoken risk: Human factors undermine trusted platforms

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Aditya K Sood, Aryaka

Beyond the hook: How phishing is evolving in the world of AI

Phishing attacks are evolving. Gone are the days of clumsy, error-ridden emails that were easy to spot – today’s campaigns harness advanced techniques to bypass even the latest defences. A new approach is needed Continue Reading

By

• Isla Sibanda

Signalgate: Learnings for CISOs securing enterprise data

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what CISOs can learn from this potentially fatal error Continue Reading

By

• Todd Thiemann, Principal Analyst

Co-op shuts off IT systems to contain cyber attack

A developing cyber incident at Co-op has forced the retailer to pull the plug on some of its IT systems as it works to contain the attack Continue Reading

By

• Alex Scroxton, Security Editor

M&S systems remain offline days after cyber incident

M&S is still unable to provide contactless payment or click-and-collect services amid a cyber attack that it says has forced it to move a number of processes offline to safeguard its customers, staff and business Continue Reading

By

• Alex Scroxton, Security Editor

Challenges persist as UK’s Cyber Security and Resilience Bill moves forward

Elements of the Cyber Security and Resilience Bill are welcome but questions remain about how best to act in the face of persistent challenges like geopolitical chaos, threats to critical infrastructure, and technological advances Continue Reading

By

• James Morris, CSBR

Rethink authentication to remove the burden on users

The rise of AI powered threats and non-human identities will push an already strained identity security model over the edge Continue Reading

By

• Patrick Wardrop, IBM

Financially motivated cyber crime remains biggest threat source

Mandiant’s latest annual threat report reveals data on how financially motivated cyber criminals, such as ransomware gangs, dominate the cyber security landscape Continue Reading

By

• Alex Scroxton, Security Editor

Amid uncertainty, Armis becomes newest CVE numbering authority

Amid an uncertain future for vulnerability research, exposure management company Armis has been given the authority to assign CVE IDs to newly discovered vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

Cyber ‘agony aunts’ launch guidebook for women in security

Cyber ‘agony aunts’ Amelia Hewitt and Rebecca Taylor are launching a book aimed at empowering women in their cyber security careers Continue Reading

By

• Alex Scroxton, Security Editor

Secure Future Initiative reveals Microsoft staff focus

IT security is now a metric in the Microsoft employee appraisal process Continue Reading

By

• Cliff Saran, Managing Editor

Beyond baselines - getting real about security and resilience

In an increasingly contested world, the UK government needs a security certification that goes beyond baseline measures. Continue Reading

By

• Neil Ashdown and Tash Buckley

Tariff turmoil is making supply chain security riskier

Many businesses around the world are taking the decision to alter their supplier mix in the face of tariff uncertainty, but in doing so are creating more cyber risks for themselves, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Collaboration is the best defence against nation-state threats

The rise of DeepSeek has prompted the usual well-documented concerns around AI, but also raised worries about its potential links to the Chinese state. The Security Think Tank considers the steps security leaders can take to counter threats posed by nation state industrial espionage? Continue Reading

By

• Stephen McDermid, Okta

CISA extends Mitre CVE contract at last moment

The US Cybersecurity and Infrastructure Security Agency has ridden to the rescue of the under-threat Mitre CVE Programme, approving a last-minute, 11-month contract extension to preserve the project’s vital security vulnerability work Continue Reading

By

• Alex Scroxton, Security Editor

CVE Foundation pledges continuity after Mitre funding cut

With news that Mitre’s contract to run the world-renowned CVE Programme is abruptly terminating, a breakaway group is setting up a non-profit foundation to try to ensure the project’s continuity Continue Reading

By

• Alex Scroxton, Security Editor

Security leaders grapple with AI-driven threats

Experts warn of AI’s dual role in both empowering and challenging cyber defences, and called for intelligence sharing and the need to strike a balance between AI-driven innovation and existing security practices Continue Reading

By

• Aaron Tan, Informa TechTarget

Mitre warns over lapse in CVE coverage

Mitre, the operator of the world-renowned CVE repository, has warned of significant impacts to global cyber security standards, and increased risk from threat actors, as it emerges its US government contract will lapse imminently Continue Reading

By

• Alex Scroxton, Security Editor

NCSC issues warning over Chinese Moonshine and BadBazaar spyware

Two spyware variants are being used to target the mobile devices of persons of interest to Chinese intelligence, including individuals in the Taiwanese, Tibetan and Uyghur communities Continue Reading

By

• Alex Scroxton, Security Editor

DeepSeek will help evolve the conversation around privacy

The rise of DeepSeek has prompted the usual well-documented concerns around AI, but also raised worries about its potential links to the Chinese state. The Security Think Tank considers the steps security leaders can take to counter threats posed by nation state industrial espionage? Continue Reading

By

• Nick New, Optalysys

It’s time to stop the victim-blaming and insist on safer software

Businesses spend too much time and money protecting themselves against flaws and vulnerabilities in modern software products, when they ought to raise their expectations and insist on better solutions from providers Continue Reading

By

• Mandy Andress, Elastic

UK SMEs losing over £3bn a year to cyber incidents

A lack of access to technology, little to no staff training, and competing priorities are losing UK SMEs up to £3.4bn to cyber incidents every year Continue Reading

By

• Alex Scroxton, Security Editor

NIST calls time on older vulnerabilities amid surging disclosures

The National Institute of Standards and Technology is deferring future updates to thousands of cyber vulnerabilities discovered prior to 2018 amid surging volumes of new submissions Continue Reading

By

• Alex Scroxton, Security Editor

Norway and Nordic financial sector ramps up cyber security

Finans Norge sets up cyber security unit CTSU to support the finance sector in Norway amid increasing threats Continue Reading

By

• Gerard O'Dwyer

Taking a ‘good enough’ approach with cloud security isn't enough

In the wake of the January 2025 'Codefinger' attacks against AWS S3 users, Thales Rob Elliss argues that many organisations are dropping the ball when it comes to their understanding of cloud security best practice Continue Reading

By

• Rob Ellis, Thales

Apple devices are at ‘most risk’ in UK following government ‘backdoor’ order

Home Office refuses to answer questions from Lords over technical capability notice issued against Apple’s iCloud Advanced Data Protection encryption services Continue Reading

By

• Bill Goodwin, Computer Weekly

Countering nation-state cyber espionage: A CISO field guide

The rise of DeepSeek has prompted the usual well-documented concerns around AI, but also raised worries about its potential links to the Chinese state. The Security Think Tank considers the steps security leaders can take to counter threats posed by nation state industrial espionage? Continue Reading

By

• Andrew Hodges, Quorum Cyber

ETSI launches first post-quantum encryption standard

European telco standards body launches its first post-quantum cryptography cyber standard, covering the security of critical data and communications Continue Reading

By

• Alex Scroxton, Security Editor

Will DeepSeek force us to take application security seriously?

The rise of DeepSeek has prompted the usual well-documented concerns around AI, but also raised worries about its potential links to the Chinese state. The Security Think Tank considers the steps security leaders can take to counter threats posed by nation state industrial espionage? Continue Reading

By

• Mike Gillespie and Ellie Hurst

NCSC, DSIT enlist IBM to spearhead cyber diversity agenda

IBM signs on to a partnership deal in support of the popular NCSC CyberFirst Girls scheme designed to foster gender diversity in the cyber security profession Continue Reading

By

• Alex Scroxton, Security Editor

Clop resurgence drives ransomware attacks in February

The exploitation of two new vulnerabilities in a popular file transfer service saw the Clop ransomware gang soar in February, according to NCC Continue Reading

By

• Alex Scroxton, Security Editor

UK under-prepared for catastrophic cyber attack

In this week’s Computer Weekly, MPs have been told the UK is under-prepared to cope with a catastrophic cyber attack – we find out where the problems lie. Our new buyer’s guide assesses the challenges of datacentre capacity planning. And one of the UK’s most successful businessmen, Sir Martin Sorrell, gives his view on the risks and opportunities of AI. Read the issue now. Continue Reading

Seaco charts course for unified security strategy

Shipping container leasing giant consolidates security tools onto a single platform, leveraging AI and extended detection and response to improve security operations Continue Reading

By

• Aaron Tan, Informa TechTarget

How CISOs can counter the threat of nation state espionage

The rise of DeepSeek has prompted the usual well-documented concerns around AI, but also raised worries about its potential links to the Chinese state. The Security Think Tank considers the steps security leaders can take to counter threats posed by nation state industrial espionage? Continue Reading

By

• Elisabeth Mackay, PA Consulting

SuperBlack ransomware may have ties to LockBit

Forescout researchers report on a new ransomware gang that appears to be keeping the legacy of the notorious LockBit crew alive Continue Reading

By

• Alex Scroxton, Security Editor

iPhone, iPad update fixes critical WebKit flaw

iPhone and iPad users are advised to update their devices as Apple addresses an out-of-bounds write issue in the WebKit browser engine that appears to have been exploited in targeted cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

March Patch Tuesday brings 57 fixes, multiple zero-days

The third Patch Tuesday of 2025 brings fixes for 57 flaws and a hefty number of zero-days Continue Reading

By

• Alex Scroxton, Security Editor

Perimeter security appliances source of most ransomware hits

Perimeter security appliances and devices, particularly VPNs, prove to be the most popular entry points into victim networks for financially motivated ransomware gangs, according to reports Continue Reading

By

• Alex Scroxton, Security Editor

Dutch police disrupt half of ransomware operations, finds embedded PHD student

Dutch PhD study reveals the impact of centralised intelligence and strategic interventions in the fight against ransomware Continue Reading

By

• Kim Loohuis

Post Office scandal data leak interim compensation offers made

Some subpostmasters affected by Post Office data breach offered interim compensation payments Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Singapore IT leaders boost AI security defences

Study reveals a surge in perceived importance of artificial intelligence for cyber security in Singapore, but declining investment in traditional measures raises concerns as sophisticated cyber attacks intensify Continue Reading

By

• Aaron Tan, Informa TechTarget

How CISOs are tackling cyber security challenges

Security chiefs at the recent Gartner Security and Risk Management Summit in Sydney share insights on navigating board communication, organisational resilience and the importance of understanding business needs Continue Reading

By

• Stephen Withers

Managing security in the AI age

Gartner experts offer guidance on harnessing AI’s power while mitigating its risks, from managing shadow AI to implementing security controls and policies Continue Reading

By

• Stephen Withers

UK cyber security damaged by ‘clumsy Home Office political censorship’

Britain’s National Cyber Security Centre secretly censors computer security guidance and drops references to encryption Continue Reading

By

• Duncan Campbell , 2QQ Ltd, Sussex University

Norway says ‘no way’ to global financial crime

Oslo’s startup ecosystem is fighting back against cyber criminals with tech to wipe out attacks rather than just detect them Continue Reading

By

• Matthew Staff

NHS investigating how API flaw exposed patient data

NHS patient data was left vulnerable by a flaw in an application programming interface used at online healthcare provider Medefer Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Relaunching Neighbourhood Watch for the Internet Age

Neighbourhood Watch became became by far the UK's largest community support movement during Covid - albeit cover is patchy. Across England and Wales it embraces 9% of household but that ranges from ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Aussie businesses ramp up security spending

Australian organisations are set to spend A$6.2bn on security and risk management in 2025, a 14.4% jump from the previous year, driven by the rise of AI and a growing threat landscape Continue Reading

By

• Aaron Tan, Informa TechTarget

Singapore’s HomeTeamNS hit by ransomware attack

The non-profit organisation suffered a ransomware attack that affected some servers containing employee and member data, prompting an investigation and enhanced security measures Continue Reading

By

• Aaron Tan, Informa TechTarget

Ransomware: from REvil to Black Basta, what do we know about Tramp?

This key member of the Black Basta ransomware gang is wanted by the US justice system. He narrowly escaped extradition at the end of June 2024 - with the help of highly-placed contacts in Moscow, according to him Continue Reading

By

• Valéry Rieß-Marchive, Rédacteur en chef

NHS staff lack confidence in health service cyber measures

NHS staff understand their role in protecting the health service from cyber threats and the public backs them in this aim, but legacy tech and a lack of training are hindering efforts, according to BT Continue Reading

By

• Alex Scroxton, Security Editor

Secure software: Third-party suppliers your first-party risk

Outgoing CISA chief Jen Easterly called on buyers to demand better security standards from their software suppliers. The Security Think Tank considers what better means, and what best practice for secure software procurement looks like in 2025 Continue Reading

By

• Ejona Preci, Lindal Group

CVE volumes head towards 50,000 in 2025, analysts claim

Many trends, notably a big shift to open source tools, are behind an expected boom in the number of disclosed vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

CISOs spending more on insider risk

Insider risk management budgets have more than doubled in the past 12 months and look set to grow further still in 2025, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Reflecting on three years of cyber warfare in Ukraine

With the third anniversary of Russia's illegal invasion of Ukraine passing this week, Charl Van Der Walt reflects on how the cyber threat landscape in Europe has changed since 2022 Continue Reading

By

• Charl Van Der Walt, Orange Cyberdefense

Ransomware: on the murky trail of one of the leaders of Black Basta

The internal exchanges within the Black Basta group revealed last week offer a new opportunity to investigate one of its leaders: Tramp. He may have been arrested in Armenia in June 2024, before being released Continue Reading

By

• Valéry Rieß-Marchive, Rédacteur en chef

European Union calls for more cyber data-sharing with Nato

Updates to the EU’s Cyber Blueprint, establishing best practice for multilateral security incident response in Europe, include calls for more collaboration with Nato member states, as the geopolitical environment becomes ever more fractious Continue Reading

By

• Alex Scroxton, Security Editor