Insights

Answers, not alarms.

Research, detection engineering notes and plain-English explanations for the questions UK boards, IT managers and security leads actually ask. One substantial piece a week; a short threat brief in between.

Get the fortnightly briefing

Insights12 October 2026

Internet-exposed Danfoss controllers by country, October 2026: France 2,967 against the UK's 15

Britain's exposed controllers: a UK exposure report after the French fridge attack

After Sunday's cyberattack on French supermarket refrigeration, we turned the same question on the UK. Over 800 internet-exposed refrigeration and building-management controllers answer directly to the open internet here, across Danfoss, Carel, Copeland and other vendors, and that figure is a floor rather than a ceiling. Here is what we found, why France was hit and not Britain, and what to do this week.

Peter Bassill9 min read · 124 reads

Insights12 October 2026

Cyberattack defrosts the fridges at hundreds of French supermarkets

Overnight on 11–12 October 2026, attackers reached into the refrigeration controllers of several hundred French supermarkets and switched the fridges and freezers into a defrost cycle that never ended. Intermarché, Coopérative U, Carrefour and Leclerc lost their chilled and frozen stock, the Paris prosecutor has opened an investigation, and the equipment at the centre of it is sitting on the open internet in the UK too.

Peter Bassill11 min read · 174 reads

Insights29 September 2026

Citrix NetScaler again: two exploited zero-days, and why patching is only half the job

Two critical flaws in Citrix NetScaler ADC and Gateway are being exploited in the wild, both scored 9.5, both reachable by an unauthenticated attacker on the internet-facing side of the box. CISA has given federal agencies until 30 September. Here is what the flaws are, why the honest instruction from several national authorities is to take the appliance offline, and why installing the update does not, on its own, get an intruder out.

Peter Bassill10 min read · 33 reads

Insights27 September 2026

One click, one new administrator: the Elementor CSRF flaw explained

A flaw in Elementor 4.3.0 and 4.3.1 lets anyone who can get a WordPress administrator to click a link create themselves an administrator account. No JavaScript, no form, no exploit kit: a plain link. Around two million sites were exposed. Here is how it works, why it is worse than it sounds, what to do this morning, and the Wazuh rules our SOC is using to see it.

Peter Bassill10 min read · 16 reads

Guide15 September 2026

What is a managed SOC, and what does SOC as a service cost in the UK?

A managed SOC is a security operations centre you subscribe to rather than build. Here is what you are actually buying, what it costs in the UK compared with building your own, how the market prices it, and how to choose a provider you will not regret a year later.

Peter Bassill13 min read · 33 reads

Insights12 October 2026

Seeing what your SOC sees: the new SIEM section in Pulse

Managed security has a quiet flaw: when it works, there is nothing to look at. The latest release of Pulse, our client portal, changes that. You can now watch the activity our Security Operations Centre records across your estate as it happens, see every monitored machine, and open the same page for each one that our analysts use. Here is what has changed, why we built it this way, and how to get the most from it.

Peter Bassill19 min read · 6 reads

Insights5 October 2026

The spies, the schools and the supply chain: a week in UK cyber

In the space of a few days MI5 warned a hundred British academics they may have helped Chinese intelligence, a think tank told Europe its patchwork of rules leaves it exposed to Chinese vendors, and the exam regulator quietly reported that England's schools are recovering from cyber incidents faster than ever. Three very different stories, one thread worth pulling.

Peter Bassill10 min read · 14 reads

Insights30 September 2026

The basic cyber skills every UK business owner should have (a plain-English guide)

The government's own research says 57 per cent of UK businesses now lack confidence in basic cyber skills, up sharply on last year. That is around 808,000 businesses. The good news is that 'basic' really does mean basic: nine ordinary tasks, none of which needs a specialist. Here is what they are and how to do each one.

Peter Bassill13 min read · 5 reads

Insights30 September 2026

500,000 faces, one false alarm: what the rail facial-recognition trial really tells us

British Transport Police scanned more than half a million faces at London stations over six months. The system raised a single alert, and it was wrong. Before this is filed under 'surveillance that failed', it is worth understanding why the numbers came out as they did, because the lesson is not the one either side is shouting, and it applies to any organisation thinking about biometrics.

Peter Bassill10 min read · 5 reads

Insights29 September 2026

Why an AI SOC means company owners can sleep better at night

Attackers now use AI to move at machine speed, and they time their work for Friday evenings and weekends, when most security teams are at their thinnest. Our own data for September shows exactly that pattern. Here is what an AI-assisted SOC actually does about it, what it does not do, and why the plain answer is the reassuring one.

Peter Bassill12 min read · 8 reads

Insights27 September 2026

The supplier you stopped using still has your data

Revolut's customers have had their details taken twice in a month, and on neither occasion was Revolut hacked. The second time, the data walked out of a brokerage Revolut had finished migrating away from over a year ago. Supply chain risk does not end when the contract does, and this is what to do about it.

Peter Bassill13 min read · 16 reads

Insights18 September 2026

The phishing page that let Microsoft do the reconnaissance

I spent a few minutes yesterday poking at a phishing page that behaved exactly like the real Microsoft 365 sign-in, because it was the real Microsoft 365 sign-in, relayed through the attacker's server. What made it worth writing about was not the theft of credentials but the quiet way it used Microsoft's own sign-in endpoints to work out, before a password was ever typed, whether it had caught a real account at the right company.

Peter Bassill13 min read · 12 reads

229 articles · page 1 of 20