Insights

Answers, not alarms.

Research, detection engineering notes and plain-English explanations for the questions UK boards, IT managers and security leads actually ask. One substantial piece a week; a short threat brief in between.

Get the fortnightly briefing

Insights29 September 2026

Citrix NetScaler again: two exploited zero-days, and why patching is only half the job

Two critical flaws in Citrix NetScaler ADC and Gateway are being exploited in the wild, both scored 9.5, both reachable by an unauthenticated attacker on the internet-facing side of the box. CISA has given federal agencies until 30 September. Here is what the flaws are, why the honest instruction from several national authorities is to take the appliance offline, and why installing the update does not, on its own, get an intruder out.

Peter Bassill10 min read · 23 reads

Insights27 September 2026

One click, one new administrator: the Elementor CSRF flaw explained

A flaw in Elementor 4.3.0 and 4.3.1 lets anyone who can get a WordPress administrator to click a link create themselves an administrator account. No JavaScript, no form, no exploit kit: a plain link. Around two million sites were exposed. Here is how it works, why it is worse than it sounds, what to do this morning, and the Wazuh rules our SOC is using to see it.

Peter Bassill10 min read · 13 reads

Guide15 September 2026

What is a managed SOC, and what does SOC as a service cost in the UK?

A managed SOC is a security operations centre you subscribe to rather than build. Here is what you are actually buying, what it costs in the UK compared with building your own, how the market prices it, and how to choose a provider you will not regret a year later.

Peter Bassill13 min read · 27 reads

Insights5 October 2026

The spies, the schools and the supply chain: a week in UK cyber

In the space of a few days MI5 warned a hundred British academics they may have helped Chinese intelligence, a think tank told Europe its patchwork of rules leaves it exposed to Chinese vendors, and the exam regulator quietly reported that England's schools are recovering from cyber incidents faster than ever. Three very different stories, one thread worth pulling.

Peter Bassill10 min read · 11 reads

Insights30 September 2026

The basic cyber skills every UK business owner should have (a plain-English guide)

The government's own research says 57 per cent of UK businesses now lack confidence in basic cyber skills, up sharply on last year. That is around 808,000 businesses. The good news is that 'basic' really does mean basic: nine ordinary tasks, none of which needs a specialist. Here is what they are and how to do each one.

Peter Bassill13 min read · 3 reads

Insights30 September 2026

500,000 faces, one false alarm: what the rail facial-recognition trial really tells us

British Transport Police scanned more than half a million faces at London stations over six months. The system raised a single alert, and it was wrong. Before this is filed under 'surveillance that failed', it is worth understanding why the numbers came out as they did, because the lesson is not the one either side is shouting, and it applies to any organisation thinking about biometrics.

Peter Bassill10 min read · 4 reads

Insights29 September 2026

Why an AI SOC means company owners can sleep better at night

Attackers now use AI to move at machine speed, and they time their work for Friday evenings and weekends, when most security teams are at their thinnest. Our own data for September shows exactly that pattern. Here is what an AI-assisted SOC actually does about it, what it does not do, and why the plain answer is the reassuring one.

Peter Bassill12 min read · 7 reads

Insights27 September 2026

The supplier you stopped using still has your data

Revolut's customers have had their details taken twice in a month, and on neither occasion was Revolut hacked. The second time, the data walked out of a brokerage Revolut had finished migrating away from over a year ago. Supply chain risk does not end when the contract does, and this is what to do about it.

Peter Bassill13 min read · 13 reads

Insights18 September 2026

The phishing page that let Microsoft do the reconnaissance

I spent a few minutes yesterday poking at a phishing page that behaved exactly like the real Microsoft 365 sign-in, because it was the real Microsoft 365 sign-in, relayed through the attacker's server. What made it worth writing about was not the theft of credentials but the quiet way it used Microsoft's own sign-in endpoints to work out, before a password was ever typed, whether it had caught a real account at the right company.

Peter Bassill13 min read · 12 reads

Insights18 September 2026

Your supplier was breached. What did you do before it happened?

A London property manager has told its customers that bank details, passwords and lockbox codes may have been taken through a cloud reporting tool. The tool was the supplier's; the decision about what it could read was not. Here is how to review your supply chain, write it down, and be able to show your working when the inevitable happens.

Peter Bassill18 min read · 22 reads

Insights15 September 2026

Iranian state spyware ‘CHOSEN BRICK’: what it does and what to do

The NCSC, FBI and AIVD have exposed Iranian spyware — CHOSEN BRICK — used to surveil dissidents, activists and journalists. What the campaign does, who is really at risk, and the practical steps that protect the people targeted and the organisations around them.

Peter Bassill11 min read · 92 reads

Threat briefing4 September 2026

Trade bodies and membership organisations threat intelligence report — 29 August – 4 September 2026

Trade bodies and membership organisations face a phishing-first threat picture: 30% of UK charities reported a breach or attack in the past year, and the newly listed Starlette vulnerability reaches the FastAPI back-ends behind many membership portals.

Peter Bassill8 min read · 6 reads

226 articles · page 1 of 19