Insights

Answers, not alarms.

Research, detection engineering notes and plain-English explanations for the questions UK boards, IT managers and security leads actually ask. One substantial piece a week; a short threat brief in between.

Get the fortnightly briefing

Guide15 September 2026

What is a managed SOC, and what does SOC as a service cost in the UK?

A managed SOC is a security operations centre you subscribe to rather than build. Here is what you are actually buying, what it costs in the UK compared with building your own, how the market prices it, and how to choose a provider you will not regret a year later.

Peter Bassill13 min read · 14 reads

Insights18 September 2026

The phishing page that let Microsoft do the reconnaissance

I spent a few minutes yesterday poking at a phishing page that behaved exactly like the real Microsoft 365 sign-in, because it was the real Microsoft 365 sign-in, relayed through the attacker's server. What made it worth writing about was not the theft of credentials but the quiet way it used Microsoft's own sign-in endpoints to work out, before a password was ever typed, whether it had caught a real account at the right company.

Peter Bassill13 min read · 7 reads

Insights18 September 2026

Your supplier was breached. What did you do before it happened?

A London property manager has told its customers that bank details, passwords and lockbox codes may have been taken through a cloud reporting tool. The tool was the supplier's; the decision about what it could read was not. Here is how to review your supply chain, write it down, and be able to show your working when the inevitable happens.

Peter Bassill18 min read · 6 reads

Insights15 September 2026

Iranian state spyware ‘CHOSEN BRICK’: what it does and what to do

The NCSC, FBI and AIVD have exposed Iranian spyware — CHOSEN BRICK — used to surveil dissidents, activists and journalists. What the campaign does, who is really at risk, and the practical steps that protect the people targeted and the organisations around them.

Peter Bassill11 min read · 68 reads

Threat briefing4 September 2026

Trade bodies and membership organisations threat intelligence report — 29 August – 4 September 2026

Trade bodies and membership organisations face a phishing-first threat picture: 30% of UK charities reported a breach or attack in the past year, and the newly listed Starlette vulnerability reaches the FastAPI back-ends behind many membership portals.

Peter Bassill8 min read · 3 reads

Threat briefing4 September 2026

Defence and government contractors threat intelligence report — 29 August – 4 September 2026

State-linked reconnaissance leads the defence and R&D picture — Volt Typhoon probing contractor login portals and APT41 active across 15+ industries — alongside KEV additions for JFrog Artifactory and BerriAI LiteLLM that bear directly on build chains and AI workflows.

Peter Bassill8 min read · 2 reads

Threat briefing4 September 2026

Healthcare threat intelligence report — 29 August – 4 September 2026

Healthcare's week is defined by Boston Scientific's global network outage, the McKesson disclosure of roughly 284 million patient-related records exfiltrated via third-party applications, and Medusa ransomware passing 500 victims.

Peter Bassill8 min read · 3 reads

Threat briefing4 September 2026

Retail threat intelligence report — 29 August – 4 September 2026

Retail remains in a social-engineering-driven era: the Scattered Spider help-desk doctrine, long-running Magecart skimming against major-card payment flows, and the SonicWall SMA1000 zero-day chain dominate the week.

Peter Bassill8 min read · 3 reads

Threat briefing4 September 2026

Legal services threat intelligence report — 29 August – 4 September 2026

Legal-sector risk continues to be driven by rising SRA-reportable breach numbers, the dominance of phishing and completion-payment fraud, and two actively exploited SonicWall SMA1000 zero-days that matter to firms using SMA appliances for remote access.

Peter Bassill9 min read · 2 reads

Threat briefing4 September 2026

Maritime and logistics threat intelligence report — 29 August – 4 September 2026

The maritime and logistics picture is shaped by the follow-on impact of the North Carolina Ports cyberattack, sustained APT interest in shipping and port operators, and a 103% year-on-year rise in recorded maritime cyber incidents.

Peter Bassill8 min read · 0 reads

Threat briefing4 September 2026

Financial services threat intelligence report — 29 August – 4 September 2026

The week's financial-services picture is dominated by the actively exploited SonicWall SMA1000 zero-day chain, continued Cl0p leak-site pressure from the PTC PLM campaign, and FS-ISAC's warning on adversarial use of AI to accelerate vulnerability discovery.

Peter Bassill9 min read · 7 reads

Threat briefing17 July 2026

Threat intelligence briefing — first half of July 2026

It consolidates the seven vertical-specific products (TI-2026-0717-001 through -007) into a single distribution-ready deliverable.

Peter Bassill29 min read · 5 reads

219 articles · page 1 of 19