SOC status:Duty analyst on shift
Insights
Research, detection engineering notes and plain-English explanations for the questions UK boards, IT managers and security leads actually ask. One substantial piece a week; a short threat brief in between.
Get the fortnightly briefing
The legal-services vertical continues to be shaped by the NCSC Cyber Threat Report on the UK legal sector and by the accelerated cadence of intrusions against mid-market and boutique firms.
The healthcare vertical continues to be shaped by the Synnovis retrospective (7 London hospitals, June 2024, Qilin, still generating disruption two years on) and by the sustained 10x surge in IPS events across UK hospitals reported by SonicWall for Jan-May 2026 (264k events).
The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets.
The R&D and defence-contractor vertical continues to be shaped by the sustained China-nexus dominance of intrusions against the defence industrial base identified by Google Cloud / Mandiant in the 2026 update, and by continued Russian and North Korean activity in the same space.
It consolidates the seven vertical-specific products (TI-2026-0717-001 through -007) into a single distribution-ready deliverable.
The trade bodies and membership organisations vertical is characterised by the combination of high personal-data density (member records, event registrations, directory data) and typically low cyber-maturity relative to commercial peers of similar size.
The retail vertical remains defined operationally by the DragonForce / Scattered Spider methodology - voice-phishing IT service desks to reset MFA, help-desk social engineering, aggressive cloud-tenant pivot, and DragonForce ransomware detonation.
The maritime and logistics vertical is in an actively-adverse threat environment this period. The Adriatic Port Authority intrusion, attributed to Anubis with a \$10m ransom demand and confirmed exfiltration of safety plans, employee records and internal communications, is the anchor event.
The legal vertical remains a high-value target for both organised criminal extortion crews and, in the top firms, state-linked espionage actors seeking privileged client material.
The healthcare vertical is in a sustained reconnaissance phase from the perspective of the attackers. SonicWall's mid-year data - 264,000 IPS events across UK hospital networks Jan-May 2026 versus 27,000 across the whole of 2025, a 10x surge - is the anchor statistic for the reporting period.
The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets.
The R&D and DIB vertical continues to sit at the highest strategic threat level of any of the covered verticals, with the dominant threat being long-dwell espionage from China-nexus and DPRK-nexus actors.
216 articles · page 2 of 18