SOC status:Duty analyst on shift
Sectors
Our SOC publishes a threat intelligence report for each of the sectors below every week — the same reports our clients receive, minus their estate-specific detail. Pick your sector to see the current picture and how we defend it.
Financial servicesLegalHealthcareMaritime and logisticsRetailDefence and government
Sectors
Banks, insurers, payment firms and fintechs under FCA, PRA and DORA scrutiny, facing ransomware crews, helpdesk social engineering and edge-appliance exploitation.
Solicitors, barristers and legal service providers protecting client-matter confidentiality and completion funds from payment diversion and data extortion.
NHS trusts, private providers and suppliers where an outage postpones care: clinical systems, medical devices and the supply chain behind them.
Ports, shipping lines, hauliers and 3PLs whose vessels, terminals and telematics attract ransomware and state interest alike.
Store estates and e-commerce platforms after the 2025 UK retail attacks: helpdesk pretexting, payment-page skimming and peak-season disruption.
R&D organisations and suppliers to defence and government, where the threat is patient state espionage rather than opportunistic crime.
Associations, institutes and charities holding member data and running events with small teams and big lists.
Common ground
Every sector has its own language, regulation and technology, but most of the ways in is the same. Our method is consistent — threat-led, intelligence-driven, engineering-focused — and the sector pages show how we apply it.
Entra ID, Microsoft 365 and SaaS access for staff, contractors and partners — the identity layer is where most 2026 intrusions begin.
VPN concentrators, firewalls and remote-access gateways whose vulnerabilities are exploited within days of disclosure.
Payment diversion, credential harvesting and AI-assisted pretexting aimed at the processes each sector runs on.
Industrial control, medical devices, vessel and warehouse automation that cannot simply be patched.
Double extortion remains the dominant criminal business model; the aim is to make you a bad target and a fast recoverer.
FCA, DORA, NIS, DSPT, DEF STAN, PCI DSS and Cyber Essentials — evidence that stands up to an auditor, produced as a by-product of doing the work.
This week
Trade bodies and membership organisations face a phishing-first threat picture: 30% of UK charities reported a breach or attack in the past year, and the newly listed Starlette vulnerability reaches the FastAPI back-ends behind many membership portals.
State-linked reconnaissance leads the defence and R&D picture — Volt Typhoon probing contractor login portals and APT41 active across 15+ industries — alongside KEV additions for JFrog Artifactory and BerriAI LiteLLM that bear directly on build chains and AI workflows.
Healthcare's week is defined by Boston Scientific's global network outage, the McKesson disclosure of roughly 284 million patient-related records exfiltrated via third-party applications, and Medusa ransomware passing 500 victims.
Retail remains in a social-engineering-driven era: the Scattered Spider help-desk doctrine, long-running Magecart skimming against major-card payment flows, and the SonicWall SMA1000 zero-day chain dominate the week.
Legal-sector risk continues to be driven by rising SRA-reportable breach numbers, the dominance of phishing and completion-payment fraud, and two actively exploited SonicWall SMA1000 zero-days that matter to firms using SMA appliances for remote access.
The maritime and logistics picture is shaped by the follow-on impact of the North Carolina Ports cyberattack, sustained APT interest in shipping and port operators, and a 103% year-on-year rise in recorded maritime cyber incidents.
Start a conversation
Many clients span several sectors or sit in a niche of their own. Tell us about your environment and we will map the right combination of monitoring, testing and advice.