Insights

Answers, not alarms.

Research, detection engineering notes and plain-English explanations for the questions UK boards, IT managers and security leads actually ask. One substantial piece a week; a short threat brief in between.

Get the fortnightly briefing

Threat briefing17 July 2026

Financial services threat intelligence report — 11–17 July 2026

The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets.

Peter Bassill21 min read · 5 reads

Threat briefing17 July 2026

Defence and government contractors threat intelligence report — 11–17 July 2026

The R&D and defence-contractor vertical continues to be shaped by the sustained China-nexus dominance of intrusions against the defence industrial base identified by Google Cloud / Mandiant in the 2026 update, and by continued Russian and North Korean activity in the same space.

Peter Bassill22 min read · 6 reads

Threat briefing17 July 2026

Cross-sector threat intelligence briefing — 11–17 July 2026

It consolidates the seven vertical-specific products (TI-2026-0717-001 through -007) into a single distribution-ready deliverable.

Peter Bassill30 min read · 5 reads

Threat briefing10 July 2026

Trade bodies and membership organisations threat intelligence report — 4–10 July 2026

The trade bodies and membership organisations vertical is characterised by the combination of high personal-data density (member records, event registrations, directory data) and typically low cyber-maturity relative to commercial peers of similar size.

Peter Bassill19 min read · 5 reads

Threat briefing10 July 2026

Retail threat intelligence report — 4–10 July 2026

The retail vertical remains defined operationally by the DragonForce / Scattered Spider methodology - voice-phishing IT service desks to reset MFA, help-desk social engineering, aggressive cloud-tenant pivot, and DragonForce ransomware detonation.

Peter Bassill20 min read · 7 reads

Threat briefing10 July 2026

Maritime and logistics threat intelligence report — 4–10 July 2026

The maritime and logistics vertical is in an actively-adverse threat environment this period. The Adriatic Port Authority intrusion, attributed to Anubis with a \$10m ransom demand and confirmed exfiltration of safety plans, employee records and internal communications, is the anchor event.

Peter Bassill21 min read · 3 reads

Threat briefing10 July 2026

Legal services threat intelligence report — 4–10 July 2026

The legal vertical remains a high-value target for both organised criminal extortion crews and, in the top firms, state-linked espionage actors seeking privileged client material.

Peter Bassill20 min read · 3 reads

Threat briefing10 July 2026

Healthcare threat intelligence report — 4–10 July 2026

The healthcare vertical is in a sustained reconnaissance phase from the perspective of the attackers. SonicWall's mid-year data - 264,000 IPS events across UK hospital networks Jan-May 2026 versus 27,000 across the whole of 2025, a 10x surge - is the anchor statistic for the reporting period.

Peter Bassill20 min read · 2 reads

Threat briefing10 July 2026

Financial services threat intelligence report — 4–10 July 2026

The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets.

Peter Bassill20 min read · 5 reads

Threat briefing10 July 2026

Defence and government contractors threat intelligence report — 4–10 July 2026

The R&D and DIB vertical continues to sit at the highest strategic threat level of any of the covered verticals, with the dominant threat being long-dwell espionage from China-nexus and DPRK-nexus actors.

Peter Bassill20 min read · 4 reads

Threat briefing6 July 2026

Threat intelligence briefing — second half of June 2026

Coverage this period is dominated by the CISA KEV addition of the SharePoint deserialisation defect (CVE-2026-45659) on 01 Jul with a three-day federal remediation deadline; the continued tail of CitrixBleed 3 session-token abuse against NetScaler estates…

Peter Bassill19 min read · 3 reads

Threat briefing3 July 2026

Trade bodies and membership organisations threat intelligence report — 27 June – 3 July 2026

Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659, sustained credential-stuffing volumes against member portals, and the continuing baseline of BEC / invoice-redirect fraud against trade-body finance functions.

Peter Bassill17 min read · 5 reads

226 articles · page 3 of 19