Threat briefing
Financial services threat intelligence report — 4–8 May 2026
During the reporting period the financial-services threat picture continued to be dominated by ransomware and pure data-extortion crews…
Peter Bassill16 min read · 5 reads
Insights
Answers, not alarms.
Research, detection engineering notes and plain-English explanations for the questions UK boards, IT managers and security leads actually ask. One substantial piece a week; a short threat brief in between.
Get the fortnightly briefing
TopicsAdversary-in-the-middle 1Agentic AI 1AI in security 2AI security 1AI SOC 1Alert fatigue 1Banking 14Biometrics 1Board and governance 3Board governance 1Case study 4CISO 1Citrix NetScaler 1Cloud security 5Compliance 5Consulting 1Cross-sector 3CSRF 1Cyber Essentials 1Cyber skills 1Data breach 2Data protection 1DDoS 2Defence 14
Threat briefing
Defence and government contractors threat intelligence report — 4–8 May 2026
The R&D and military / government-contractor threat picture for the reporting period continues to be dominated by sustained state-sponsored activity.
Peter Bassill16 min read · 6 reads
Threat briefing
Trade bodies and membership organisations threat intelligence report — 27 April – 3 May 2026
The trade-body and membership-organisation threat picture for the reporting period is dominated by phishing and ransomware against organisations holding member-PII at scale, augmented by Russian state-aligned hacktivist activity targeting representative bodies for political signalling.
Peter Bassill14 min read · 3 reads
Threat briefing
Retail threat intelligence report — 27 April – 3 May 2026
The retail vertical continues to operate in the wake of the Marks & Spencer / Co-op / Harrods cyber-attack wave of spring 2025, which has been classed as a Category 2 cyber-event with combined cost estimates of £270m–£440m.
Peter Bassill14 min read · 2 reads
Threat briefing
Maritime and logistics threat intelligence report — 27 April – 3 May 2026
The maritime and logistics threat picture for the reporting period is dominated by the continuing year-on-year escalation in incident volume — CYTUR figures for 2025 reflected a 103% rise in maritime cyber incidents…
Peter Bassill13 min read · 3 reads
Threat briefing
Legal services threat intelligence report — 27 April – 3 May 2026
The legal-services threat picture for the reporting period continues to reflect a sharp upward trajectory in attacks on UK law firms — the Law Gazette reports a 77 per cent year-on-year rise in successful attacks (538 to 954)…
Peter Bassill14 min read · 3 reads
Threat briefing
Healthcare threat intelligence report — 27 April – 3 May 2026
The healthcare threat picture for the reporting period continues to escalate. Health-ISAC reporting flags a 55% surge in cyber incidents in 2025 with continued escalation expected in 2026.
Peter Bassill14 min read · 4 reads
Threat briefing
Financial services threat intelligence report — 27 April – 3 May 2026
During the reporting period the financial services threat picture continued to be dominated by ransomware and data-extortion crews, augmented by sustained credential-harvesting against retail and SME banking customers.
Peter Bassill14 min read · 8 reads
Threat briefing
Defence and government contractors threat intelligence report — 27 April – 3 May 2026
The R&D and military-government-contractor threat picture for the reporting period is dominated by sustained state-sponsored activity.
Peter Bassill16 min read · 6 reads
Insights
The FCC Foreign Router Ban: Supply Chain Risk, State-Sponsored Threat Actors, and What UK Enterprise Security Teams Must Do Now
The FCC's ban on foreign-made routers has direct implications for UK and EU enterprise security posture. We examine the threat model, regulatory context, and strategic response.
UK Cyber Defence Editorial Team7 min read · 3 reads
Insights
What Should a Board Expect from a Modern SOC Provider?
Cyber security has moved from the server room to the boardroom. Regulators, insurers, and shareholders now expect boards to demonstrate active oversight of cyber risk — and for most organisations, that means understanding what their Security Operations Centre provider is actually delivering. This article sets out the ten areas every board should scrutinise when evaluating a modern SOC provider, from detection engineering and threat intelligence to transparent reporting, compliance alignment, and measurable outcomes.
Peter Bassill16 min read · 7 reads
Insights
LockBit 5.0: New Version Targets Windows, Linux, and ESXi Systems
An in-depth analysis of LockBit 5.0, the:w! latest evolution of the prolific ransomware family, now targeting Windows, Linux, and VMware ESXi environments with enhanced evasion, cross-platform payloads, and refined extortion tactics.
Peter Bassill13 min read · 24 reads
226 articles · page 9 of 19