Founder and Head of Threat Disruption

Peter Bassill

Peter founded Hedgehog Security in 2009 — the penetration testing consultancy that became UK Cyber Defence — and leads the company from The Officers' Mess at Duxford.

Before that he was Global CISO for a FTSE 100 gaming company and for Microsoft Europe. He brings decades of SOC operations, incident response, penetration testing and security leadership experience to the work, and still spends time in the SOC and on engagements.

He writes here about running security operations that boards can understand, the practical side of regulation (FCA, DORA, NIS2, Cyber Essentials) and what actually happens during incidents.

Website LinkedIn

190 articles by Peter Bassill

Insights12 October 2026

Britain's exposed controllers: a UK exposure report after the French fridge attack

After Sunday's cyberattack on French supermarket refrigeration, we turned the same question on the UK. Over 800 internet-exposed refrigeration and building-management controllers answer directly to the open internet here, across Danfoss, Carel, Copeland and other vendors, and that figure is a floor rather than a ceiling. Here is what we found, why France was hit and not Britain, and what to do this week.

Peter Bassill9 min read · 133 reads

Insights12 October 2026

Cyberattack defrosts the fridges at hundreds of French supermarkets

Overnight on 11–12 October 2026, attackers reached into the refrigeration controllers of several hundred French supermarkets and switched the fridges and freezers into a defrost cycle that never ended. Intermarché, Coopérative U, Carrefour and Leclerc lost their chilled and frozen stock, the Paris prosecutor has opened an investigation, and the equipment at the centre of it is sitting on the open internet in the UK too.

Peter Bassill11 min read · 179 reads

Insights29 September 2026

Citrix NetScaler again: two exploited zero-days, and why patching is only half the job

Two critical flaws in Citrix NetScaler ADC and Gateway are being exploited in the wild, both scored 9.5, both reachable by an unauthenticated attacker on the internet-facing side of the box. CISA has given federal agencies until 30 September. Here is what the flaws are, why the honest instruction from several national authorities is to take the appliance offline, and why installing the update does not, on its own, get an intruder out.

Peter Bassill10 min read · 36 reads

Insights27 September 2026

One click, one new administrator: the Elementor CSRF flaw explained

A flaw in Elementor 4.3.0 and 4.3.1 lets anyone who can get a WordPress administrator to click a link create themselves an administrator account. No JavaScript, no form, no exploit kit: a plain link. Around two million sites were exposed. Here is how it works, why it is worse than it sounds, what to do this morning, and the Wazuh rules our SOC is using to see it.

Peter Bassill10 min read · 16 reads

Guide15 September 2026

What is a managed SOC, and what does SOC as a service cost in the UK?

A managed SOC is a security operations centre you subscribe to rather than build. Here is what you are actually buying, what it costs in the UK compared with building your own, how the market prices it, and how to choose a provider you will not regret a year later.

Peter Bassill13 min read · 34 reads

Insights12 October 2026

Seeing what your SOC sees: the new SIEM section in Pulse

Managed security has a quiet flaw: when it works, there is nothing to look at. The latest release of Pulse, our client portal, changes that. You can now watch the activity our Security Operations Centre records across your estate as it happens, see every monitored machine, and open the same page for each one that our analysts use. Here is what has changed, why we built it this way, and how to get the most from it.

Peter Bassill19 min read · 6 reads

Insights5 October 2026

The spies, the schools and the supply chain: a week in UK cyber

In the space of a few days MI5 warned a hundred British academics they may have helped Chinese intelligence, a think tank told Europe its patchwork of rules leaves it exposed to Chinese vendors, and the exam regulator quietly reported that England's schools are recovering from cyber incidents faster than ever. Three very different stories, one thread worth pulling.

Peter Bassill10 min read · 16 reads

Insights30 September 2026

The basic cyber skills every UK business owner should have (a plain-English guide)

The government's own research says 57 per cent of UK businesses now lack confidence in basic cyber skills, up sharply on last year. That is around 808,000 businesses. The good news is that 'basic' really does mean basic: nine ordinary tasks, none of which needs a specialist. Here is what they are and how to do each one.

Peter Bassill13 min read · 5 reads

Insights30 September 2026

500,000 faces, one false alarm: what the rail facial-recognition trial really tells us

British Transport Police scanned more than half a million faces at London stations over six months. The system raised a single alert, and it was wrong. Before this is filed under 'surveillance that failed', it is worth understanding why the numbers came out as they did, because the lesson is not the one either side is shouting, and it applies to any organisation thinking about biometrics.

Peter Bassill10 min read · 5 reads

Insights29 September 2026

Why an AI SOC means company owners can sleep better at night

Attackers now use AI to move at machine speed, and they time their work for Friday evenings and weekends, when most security teams are at their thinnest. Our own data for September shows exactly that pattern. Here is what an AI-assisted SOC actually does about it, what it does not do, and why the plain answer is the reassuring one.

Peter Bassill12 min read · 8 reads

Insights27 September 2026

The supplier you stopped using still has your data

Revolut's customers have had their details taken twice in a month, and on neither occasion was Revolut hacked. The second time, the data walked out of a brokerage Revolut had finished migrating away from over a year ago. Supply chain risk does not end when the contract does, and this is what to do about it.

Peter Bassill13 min read · 17 reads

Insights18 September 2026

The phishing page that let Microsoft do the reconnaissance

I spent a few minutes yesterday poking at a phishing page that behaved exactly like the real Microsoft 365 sign-in, because it was the real Microsoft 365 sign-in, relayed through the attacker's server. What made it worth writing about was not the theft of credentials but the quiet way it used Microsoft's own sign-in endpoints to work out, before a password was ever typed, whether it had caught a real account at the right company.

Peter Bassill13 min read · 13 reads

Insights18 September 2026

Your supplier was breached. What did you do before it happened?

A London property manager has told its customers that bank details, passwords and lockbox codes may have been taken through a cloud reporting tool. The tool was the supplier's; the decision about what it could read was not. Here is how to review your supply chain, write it down, and be able to show your working when the inevitable happens.

Peter Bassill18 min read · 25 reads

Insights15 September 2026

Iranian state spyware ‘CHOSEN BRICK’: what it does and what to do

The NCSC, FBI and AIVD have exposed Iranian spyware — CHOSEN BRICK — used to surveil dissidents, activists and journalists. What the campaign does, who is really at risk, and the practical steps that protect the people targeted and the organisations around them.

Peter Bassill11 min read · 98 reads

Threat briefing4 September 2026

Trade bodies and membership organisations threat intelligence report — 29 August – 4 September 2026

Trade bodies and membership organisations face a phishing-first threat picture: 30% of UK charities reported a breach or attack in the past year, and the newly listed Starlette vulnerability reaches the FastAPI back-ends behind many membership portals.

Peter Bassill8 min read · 9 reads

Threat briefing4 September 2026

Defence and government contractors threat intelligence report — 29 August – 4 September 2026

State-linked reconnaissance leads the defence and R&D picture — Volt Typhoon probing contractor login portals and APT41 active across 15+ industries — alongside KEV additions for JFrog Artifactory and BerriAI LiteLLM that bear directly on build chains and AI workflows.

Peter Bassill8 min read · 12 reads

Threat briefing4 September 2026

Healthcare threat intelligence report — 29 August – 4 September 2026

Healthcare's week is defined by Boston Scientific's global network outage, the McKesson disclosure of roughly 284 million patient-related records exfiltrated via third-party applications, and Medusa ransomware passing 500 victims.

Peter Bassill8 min read · 26 reads

Threat briefing4 September 2026

Retail threat intelligence report — 29 August – 4 September 2026

Retail remains in a social-engineering-driven era: the Scattered Spider help-desk doctrine, long-running Magecart skimming against major-card payment flows, and the SonicWall SMA1000 zero-day chain dominate the week.

Peter Bassill8 min read · 11 reads

Threat briefing4 September 2026

Legal services threat intelligence report — 29 August – 4 September 2026

Legal-sector risk continues to be driven by rising SRA-reportable breach numbers, the dominance of phishing and completion-payment fraud, and two actively exploited SonicWall SMA1000 zero-days that matter to firms using SMA appliances for remote access.

Peter Bassill9 min read · 5 reads

Threat briefing4 September 2026

Maritime and logistics threat intelligence report — 29 August – 4 September 2026

The maritime and logistics picture is shaped by the follow-on impact of the North Carolina Ports cyberattack, sustained APT interest in shipping and port operators, and a 103% year-on-year rise in recorded maritime cyber incidents.

Peter Bassill8 min read · 19 reads

Threat briefing4 September 2026

Financial services threat intelligence report — 29 August – 4 September 2026

The week's financial-services picture is dominated by the actively exploited SonicWall SMA1000 zero-day chain, continued Cl0p leak-site pressure from the PTC PLM campaign, and FS-ISAC's warning on adversarial use of AI to accelerate vulnerability discovery.

Peter Bassill9 min read · 55 reads

Threat briefing17 July 2026

Threat intelligence briefing — first half of July 2026

It consolidates the seven vertical-specific products (TI-2026-0717-001 through -007) into a single distribution-ready deliverable.

Peter Bassill29 min read · 12 reads

Threat briefing17 July 2026

Trade bodies and membership organisations threat intelligence report — 11–17 July 2026

The trade body and membership organisation vertical continues to be shaped by three structural characteristics that shape the threat picture: (i) the sector holds sensitive membership registers, financial information (dues, event bookings…

Peter Bassill21 min read · 3 reads

Threat briefing17 July 2026

Retail threat intelligence report — 11–17 July 2026

The retail vertical continues to be shaped by the M&S / Co-op / Harrods retrospective — reclassified by UK observers as a "Category 2 cyber hurricane" with total combined costs assessed at £270m–£440m — and by the continued arrests connected to the DragonForce / Scattered Spider cluster.

Peter Bassill21 min read · 9 reads