# UK Cyber Defence

> UK Cyber Defence is a CREST-accredited cyber security company based at The Officers' Mess, Duxford. Managed SOC, penetration testing, virtual CISO, consulting and Cyber Essentials auditing for UK organisations.

Based at The Officers' Mess, Duxford, UK. Company number 16199391. Contact hello@cyber-defence.io, +44 333 3444 256.

## Services
- [Managed SOC](https://www.cyber-defence.io/services/soc): SOC365 managed detection and response
- [Penetration Testing](https://www.cyber-defence.io/services/penetration-testing): CREST-accredited testing and red teaming
- [Virtual CISO](https://www.cyber-defence.io/services/virtual-ciso): Security leadership on retainer
- [Consulting](https://www.cyber-defence.io/services/consulting): Strategy, compliance and incident readiness
- [Cyber Essentials Auditing](https://www.cyber-defence.io/services/cyber-essentials): Certification and Plus audits

## Tools
- [CVE Explorer](https://www.cyber-defence.io/tools/cve): every CVE with CVSS, EPSS and CISA KEV, refreshed daily, with a plain-English verdict. Individual records at https://www.cyber-defence.io/tools/cve/CVE-YYYY-NNNNN.

## Recent insights
- [Britain's exposed controllers: a UK exposure report after the French fridge attack](https://www.cyber-defence.io/insights/britains-exposed-controllers-uk-exposure-report): After Sunday's cyberattack on French supermarket refrigeration, we turned the same question on the UK. Over 800 internet-exposed refrigeration and building-mana
- [Cyberattack defrosts the fridges at hundreds of French supermarkets](https://www.cyber-defence.io/insights/cyberattack-defrosts-fridges-french-supermarkets): Overnight on 11–12 October 2026, attackers reached into the refrigeration controllers of several hundred French supermarkets and switched the fridges and freeze
- [Citrix NetScaler again: two exploited zero-days, and why patching is only half the job](https://www.cyber-defence.io/insights/citrix-netscaler-two-exploited-zero-days-2026): Two critical flaws in Citrix NetScaler ADC and Gateway are being exploited in the wild, both scored 9.5, both reachable by an unauthenticated attacker on the in
- [One click, one new administrator: the Elementor CSRF flaw explained](https://www.cyber-defence.io/insights/elementor-csrf-flaw-one-click-site-takeover): A flaw in Elementor 4.3.0 and 4.3.1 lets anyone who can get a WordPress administrator to click a link create themselves an administrator account. No JavaScript,
- [What is a managed SOC, and what does SOC as a service cost in the UK?](https://www.cyber-defence.io/insights/what-is-a-managed-soc-and-what-does-soc-as-a-service-cost-in-the-uk): A managed SOC is a security operations centre you subscribe to rather than build. Here is what you are actually buying, what it costs in the UK compared with bu
- [Seeing what your SOC sees: the new SIEM section in Pulse](https://www.cyber-defence.io/insights/seeing-what-your-soc-sees-the-new-siem-section-in-pulse): Managed security has a quiet flaw: when it works, there is nothing to look at. The latest release of Pulse, our client portal, changes that. You can now watch t
- [The spies, the schools and the supply chain: a week in UK cyber](https://www.cyber-defence.io/insights/the-spies-the-schools-and-the-supply-chain-a-week-in-uk-cyber): In the space of a few days MI5 warned a hundred British academics they may have helped Chinese intelligence, a think tank told Europe its patchwork of rules lea
- [The basic cyber skills every UK business owner should have (a plain-English guide)](https://www.cyber-defence.io/insights/basic-cyber-skills-every-uk-business-owner-should-have): The government's own research says 57 per cent of UK businesses now lack confidence in basic cyber skills, up sharply on last year. That is around 808,000 busin
- [500,000 faces, one false alarm: what the rail facial-recognition trial really tells us](https://www.cyber-defence.io/insights/facial-recognition-500k-faces-one-false-alarm): British Transport Police scanned more than half a million faces at London stations over six months. The system raised a single alert, and it was wrong. Before t
- [Why an AI SOC means company owners can sleep better at night](https://www.cyber-defence.io/insights/why-an-ai-soc-means-company-owners-can-sleep-better-at-night): Attackers now use AI to move at machine speed, and they time their work for Friday evenings and weekends, when most security teams are at their thinnest. Our ow
- [The supplier you stopped using still has your data](https://www.cyber-defence.io/insights/the-supplier-you-stopped-using-still-has-your-data): Revolut's customers have had their details taken twice in a month, and on neither occasion was Revolut hacked. The second time, the data walked out of a brokera
- [The phishing page that let Microsoft do the reconnaissance](https://www.cyber-defence.io/insights/the-phishing-page-that-let-microsoft-do-the-reconnaissance): I spent a few minutes yesterday poking at a phishing page that behaved exactly like the real Microsoft 365 sign-in, because it was the real Microsoft 365 sign-i
- [Your supplier was breached. What did you do before it happened?](https://www.cyber-defence.io/insights/supply-chain-due-diligence-what-the-city-relay-breach-teaches): A London property manager has told its customers that bank details, passwords and lockbox codes may have been taken through a cloud reporting tool. The tool was
- [Iranian state spyware ‘CHOSEN BRICK’: what it does and what to do](https://www.cyber-defence.io/insights/chosen-brick-iranian-spyware-targeting-dissidents-activists-and-journalists): The NCSC, FBI and AIVD have exposed Iranian spyware — CHOSEN BRICK — used to surveil dissidents, activists and journalists. What the campaign does, who is reall
- [Trade bodies and membership organisations threat intelligence report — 29 August – 4 September 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-trade-bodies-2026-09-04): Trade bodies and membership organisations face a phishing-first threat picture: 30% of UK charities reported a breach or attack in the past year, and the newly 
- [Defence and government contractors threat intelligence report — 29 August – 4 September 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-defence-government-contractors-2026-09-04): State-linked reconnaissance leads the defence and R&D picture — Volt Typhoon probing contractor login portals and APT41 active across 15+ industries — alongside
- [Healthcare threat intelligence report — 29 August – 4 September 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-healthcare-2026-09-04): Healthcare's week is defined by Boston Scientific's global network outage, the McKesson disclosure of roughly 284 million patient-related records exfiltrated vi
- [Retail threat intelligence report — 29 August – 4 September 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-retail-2026-09-04): Retail remains in a social-engineering-driven era: the Scattered Spider help-desk doctrine, long-running Magecart skimming against major-card payment flows, and
- [Legal services threat intelligence report — 29 August – 4 September 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-legal-services-2026-09-04): Legal-sector risk continues to be driven by rising SRA-reportable breach numbers, the dominance of phishing and completion-payment fraud, and two actively explo
- [Maritime and logistics threat intelligence report — 29 August – 4 September 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-maritime-logistics-2026-09-04): The maritime and logistics picture is shaped by the follow-on impact of the North Carolina Ports cyberattack, sustained APT interest in shipping and port operat
- [Financial services threat intelligence report — 29 August – 4 September 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-financial-services-2026-09-04): The week's financial-services picture is dominated by the actively exploited SonicWall SMA1000 zero-day chain, continued Cl0p leak-site pressure from the PTC PL
- [Threat intelligence briefing — first half of July 2026](https://www.cyber-defence.io/insights/threat-intelligence-briefing-july-2026-first-half): It consolidates the seven vertical-specific products (TI-2026-0717-001 through -007) into a single distribution-ready deliverable.
- [Trade bodies and membership organisations threat intelligence report — 11–17 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-trade-bodies-2026-07-17): The trade body and membership organisation vertical continues to be shaped by three structural characteristics that shape the threat picture: (i) the sector hol
- [Retail threat intelligence report — 11–17 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-retail-2026-07-17): The retail vertical continues to be shaped by the M&S / Co-op / Harrods retrospective — reclassified by UK observers as a "Category 2 cyber hurricane" with tota
- [Maritime and logistics threat intelligence report — 11–17 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-maritime-logistics-2026-07-17): The maritime and logistics vertical continues to be shaped by the operational lessons of the Anubis intrusion of the Adriatic Port Authority (attributed January
- [Legal services threat intelligence report — 11–17 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-legal-services-2026-07-17): The legal-services vertical continues to be shaped by the NCSC Cyber Threat Report on the UK legal sector and by the accelerated cadence of intrusions against m
- [Healthcare threat intelligence report — 11–17 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-healthcare-2026-07-17): The healthcare vertical continues to be shaped by the Synnovis retrospective (7 London hospitals, June 2024, Qilin, still generating disruption two years on) an
- [Financial services threat intelligence report — 11–17 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-financial-services-2026-07-17): The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets.
- [Defence and government contractors threat intelligence report — 11–17 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-defence-government-contractors-2026-07-17): The R&D and defence-contractor vertical continues to be shaped by the sustained China-nexus dominance of intrusions against the defence industrial base identifi
- [Cross-sector threat intelligence briefing — 11–17 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-briefing-cross-sector-2026-07-17): It consolidates the seven vertical-specific products (TI-2026-0717-001 through -007) into a single distribution-ready deliverable.
- [Trade bodies and membership organisations threat intelligence report — 4–10 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-trade-bodies-2026-07-10): The trade bodies and membership organisations vertical is characterised by the combination of high personal-data density (member records, event registrations, d
- [Retail threat intelligence report — 4–10 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-retail-2026-07-10): The retail vertical remains defined operationally by the DragonForce / Scattered Spider methodology - voice-phishing IT service desks to reset MFA, help-desk so
- [Maritime and logistics threat intelligence report — 4–10 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-maritime-logistics-2026-07-10): The maritime and logistics vertical is in an actively-adverse threat environment this period. The Adriatic Port Authority intrusion, attributed to Anubis with a
- [Legal services threat intelligence report — 4–10 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-legal-services-2026-07-10): The legal vertical remains a high-value target for both organised criminal extortion crews and, in the top firms, state-linked espionage actors seeking privileg
- [Healthcare threat intelligence report — 4–10 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-healthcare-2026-07-10): The healthcare vertical is in a sustained reconnaissance phase from the perspective of the attackers. SonicWall's mid-year data - 264,000 IPS events across UK h
- [Financial services threat intelligence report — 4–10 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-financial-services-2026-07-10): The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets.
- [Defence and government contractors threat intelligence report — 4–10 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-defence-government-contractors-2026-07-10): The R&D and DIB vertical continues to sit at the highest strategic threat level of any of the covered verticals, with the dominant threat being long-dwell espio
- [Threat intelligence briefing — second half of June 2026](https://www.cyber-defence.io/insights/threat-intelligence-briefing-june-2026-second-half): Coverage this period is dominated by the CISA KEV addition of the SharePoint deserialisation defect (CVE-2026-45659) on 01 Jul with a three-day federal remediat
- [Trade bodies and membership organisations threat intelligence report — 27 June – 3 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-trade-bodies-2026-07-03): Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659, sustained credential-stuffing volumes against member portals, and the continuing b
- [Retail threat intelligence report — 27 June – 3 July 2026](https://www.cyber-defence.io/insights/threat-intelligence-report-retail-2026-07-03): Coverage this period is dominated by the NCA arrests on 30 Jun 2026 of four UK nationals connected to the M&S / Co-op / Harrods DragonForce / Scattered Spider c

## Feeds
- RSS: https://www.cyber-defence.io/feed.xml
- Sitemap: https://www.cyber-defence.io/sitemap.xml