IT security

Gartner: Most firms not tapping cloud’s full potential

Organisations have not fully leveraged the full potential of cloud and must navigate emerging trends such as artificial intelligence, multicloud complexity and security perceptions to stay competitive Continue Reading

By

• Stephen Withers

No workaround leads to more pain for VMware users

There are patches for the latest batch of security alerts from Broadcom, but VMware users on perpetual licences may not have access Continue Reading

By

• Cliff Saran, Managing Editor

Security tests reveal serious vulnerability in government’s One Login digital ID system

A ‘red teaming’ exercise to simulate cyber attacks on the government’s flagship digital identity system has found that One Login can be compromised without detection Continue Reading

By

• Bryan Glick, Editor in chief

How digital identity will empower people and drive economic growth

The government has finally plotted out the future of digital identity in the UK in a way that makes sense for private sector, public sector, and citizens. Now let's make it happen Continue Reading

By

• David Crack, Association of Digital Verification Professionals

The Security Interviews: David Faugno, 1Password

David Faugno, co-CEO of 1Password, discusses how his background led to him joining the company and why maintaining profitability is a key factor in overcoming the challenges of switching markets. Continue Reading

By

• Peter Ray Allison

What is risk appetite?

Risk appetite is the amount of risk an organization or investor is willing to take in pursuit of objectives it deems have value. Continue Reading

By

• Alexander S. Gillis, Technical Writer and Editor

NHS asks suppliers to sign up to cyber covenant

NHS digital and security leaders call on their suppliers to commit to a cyber security charter as the health service works to improve its resilience in the face of growing threat levels Continue Reading

By

• Alex Scroxton, Security Editor

How close is quantum computing to commercial reality?

At a recent event, experts explored the progress towards logical qubits and how these will be applied to empower business IT Continue Reading

By

• Cliff Saran, Managing Editor

Government starts private sector engagement on digital ID and Gov.uk Wallet

Following concerns from the digital identity industry that Gov.uk Wallet would dominate the market, the government has offered private sector providers a ‘critical role’ in its future, as it revealed further details on the wallet Continue Reading

By

• Lis Evenstad

Is IPSIE the game changer that SaaS security demands?

It started with an announcement in October 2024, and now it seems the vision of secure identity in the enterprise is becoming a reality. We look at the prospects for IPSIE Continue Reading

By

• Dan Raywood

Scattered Spider retail attacks spreading to US, says Google

Google’s threat intel analysts are aware of a number of in-progress cyber attacks against US retailers linked to the same Scattered Spider gang that supposedly attacked M&S and Co-op in the UK Continue Reading

By

• Alex Scroxton, Security Editor

Enisa launches European vulnerability database

The EU’s new vulnerability database is designed to offer a broader, more transparent source of information on new cyber vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

It's time to get to grips with DORA

It's not really a surprise so many organisations missed the EU's DORE compliance deadline, but there's no excuse for delaying, says Azul EMEA VP James Johnston Continue Reading

By

• James Johnston, Azul

Why we must reform the Computer Misuse Act: A cyber pro speaks out

Britain’s outdated hacking laws are leaving the UK’s cyber practitioners hamstrung and afraid. Security professional Simon Whittaker reveals how he nearly ran afoul of the Computer Misuse Act, and why he’s speaking out for reform Continue Reading

By

• Alex Scroxton, Security Editor

What is business resilience?

Business resilience is an organization's ability to adapt quickly to disruptions while maintaining continuous business operations and safeguarding people, assets and overall brand equity. Continue Reading

By

• Paul Kirvan

What is penetration testing?

A penetration test, also called a 'pen test,' is a simulated cyberattack on a computer system, network or application to identify and highlight vulnerabilities in an organization's security posture. Continue Reading

By

• Kinza Yasar, Technical Writer
• Puneet Mehta, SDG

New security paradigm needed for IT/OT convergence

Industry leaders and policymakers highlight growing cyber threats from the integration of IT and operational technology systems, calling for collaboration and regulatory frameworks to protect critical systems, among other measures Continue Reading

By

• Aaron Tan, TechTarget

May Patch Tuesday brings five exploited zero-days to fix

Microsoft fixes five exploited, and two publicly disclosed, zero-days in the fifth Patch Tuesday update of 2025 Continue Reading

By

• Alex Scroxton, Security Editor

The top 4 sustainable marketing challenges

Sustainable marketing shows consumers that an organization takes environmental and social responsibility seriously. Yet, marketers must use careful language to avoid greenwashing. Continue Reading

By

• Tim Murphy, Site editor

M&S forces customer password resets after data breach

M&S is instructing all of its customers to change their account passwords after a significant amount of data was stolen in a DragonForce ransomware attack Continue Reading

By

• Alex Scroxton, Security Editor

Gov.uk One Login loses certification for digital identity trust framework

The government’s flagship digital identity system has lost its certification against the government’s own digital identity system trust framework Continue Reading

By

• Bryan Glick, Editor in chief

Australian data breaches hit record high in 2024

More than 1,100 data breaches were reported in Australia last year, a 25% jump from 2023, prompting calls for stronger security measures across businesses and government agencies Continue Reading

By

• Aaron Tan, TechTarget

Ransomware: What the LockBit 3.0 data leak reveals

An administration interface instance for the ransomware franchise's affiliates was attacked on 29 April. Data from its SQL database has been extracted and disclosed Continue Reading

By

• Valéry Rieß-Marchive, Rédacteur en chef

What is a security operations center (SOC)?

A security operations center (SOC) is a command center facility in which a team of information technology (IT) professionals with expertise in information security (infosec) monitors, analyzes and protects an organization from cyberattacks. Continue Reading

By

• Kinza Yasar, Technical Writer
• Paul Kirvan
• Sarah Lewis

UK government set to finally meet with digital identity providers - but will anything change?

Wednesday 14 May is set to be an important day in the long, slow, painful evolution of the use of digital identity in the UK. For the first time since the government announced its digital wallet ... Continue Reading

By

• Bryan Glick, Editor in chief

What is risk reporting?

Risk reporting is a method of identifying risks tied to or potentially impacting an organization's business processes. Continue Reading

By

• Brien Posey

What is the Sarbanes-Oxley Act? Definition and summary

The Sarbanes-Oxley Act of 2002 (SOX) is a federal law that established sweeping auditing and financial regulations for public companies. Continue Reading

By

• Katie Terrell Hanna
• Ben Lutkevich, Site Editor

Government will miss cyber resiliency targets, MPs warn

A Public Accounts Committee report on government cyber resilience finds that the Cabinet Office has been working hard to improve, but is likely to miss targets and needs a fundamentally different approach Continue Reading

By

• Alex Scroxton, Security Editor

Preparing for post-quantum computing will be more difficult than the millennium bug

The job of getting the UK ready for post-quantum computing will be at least as difficult as the Y2K problem, says National Cyber Security Centre CTO Ollie Whitehouse Continue Reading

By

• Bill Goodwin, Computer Weekly

What are the top 10 spyware threats?

The top 10 spyware list describes the most common spyware threats behind famous spyware attacks and is frequently identified by leading antispyware tools from vendors like Webroot, Norton and Malwarebytes. Continue Reading

By

• Katie Terrell Hanna
• Andrew Zola

US tells CNI orgs to stop connecting OT kit to the web

US authorities have released guidance for owners of critical national infrastructure in the face of an undisclosed number of cyber incidents Continue Reading

By

• Alex Scroxton, Security Editor

UK government websites to replace passwords with secure passkeys

Government websites are to replace difficult-to-remember passwords with highly secure passkeys that will protect against phishing and cyber attackers Continue Reading

By

• Bill Goodwin, Computer Weekly

Meta awarded $167m in court battle with spyware mercenaries

WhatsApp owner Meta is awarded millions of dollars in damages and compensation after its service was exploited by users of mercenary spyware developer NSO’s infamous Pegasus mobile malware Continue Reading

By

• Alex Scroxton, Security Editor

Chaos spreads at Co-op and M&S following DragonForce attacks

No end is yet in sight for UK retailers subjected to apparent ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

Europe leads shift from cyber security ‘headcount gap’ to skills-based hiring

Research from Sans Institute reveals European organisations are leading a global shift in hiring priorities, driven by regional regulatory frameworks Continue Reading

By

• Kim Loohuis

Oxford Uni adds cyber resilience module to MBA programme

Oxford University’s Saïd Business School is working with cyber response specialist Sygnia to help future business leaders get on top of security Continue Reading

By

• Alex Scroxton, Security Editor

UK at risk of Russian cyber and physical attacks as Ukraine seeks peace deal

UK cyber security chief warns of ‘direct connection’ between Russian cyber attacks and physical threats to the UK Continue Reading

By

• Bill Goodwin, Computer Weekly

DSIT aims to bolster expertise with year-long secondments

To drive forward its Plan for Change, the Labour government is looking to hire 25 experts for the Department for Science, Innovation and Technology Fellowship programme Continue Reading

By

• Cliff Saran, Managing Editor

UK critical systems at risk from ‘digital divide’ created by AI threats

GCHQ’s National Cyber Security Centre warns that a growing ‘digital divide’ between organisations that can keep pace with AI-enabled threats and those that cannot is set to heighten the UK's overall cyber risk Continue Reading

By

• Bill Goodwin, Computer Weekly

Government industrial strategy will back cyber tech in drive for economic growth

With over 2,000 cyber security businesses across the UK, the government plans to target cyber as a priority to grow the economy  Continue Reading

By

• Bill Goodwin, Computer Weekly

Unspoken risk: Human factors undermine trusted platforms

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Aditya K Sood, Aryaka

Data issues cost Australian businesses nearly A$500k annually

Research reveals Australian organisations are losing an average of nearly half a million dollars annually due to poor data integrity, hindering their ability to leverage AI and eroding their competitive edge Continue Reading

By

• Aaron Tan, TechTarget

Beyond the hook: How phishing is evolving in the world of AI

Phishing attacks are evolving. Gone are the days of clumsy, error-ridden emails that were easy to spot – today’s campaigns harness advanced techniques to bypass even the latest defences. A new approach is needed Continue Reading

By

• Isla Sibanda

Security and verification concerns dog debate over Data (Use & Access) Bill

With the long-awaited Data (Use & Access) Bill returning to the House of Commons on 7 May, there remain pros and cons in the bill in relation to financial crime and cyber security Continue Reading

By

• Andrew Churchill

What is segregation of duties (SoD)?

Segregation of duties (SoD) is an internal control mechanism designed to prevent errors and fraud by ensuring at least two individuals are responsible for the separate parts of any task. Continue Reading

By

• Katie Terrell Hanna
• Rahul Awati

Security Think Tank: What CISOs can learn from Signalgate

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Javvad Malik, KnowBe4

Retail cyber crime spree a ‘wake-up call’, says NCSC CEO

The National Cyber Security Centre confirms it is providing assistance to M&S, Co-op and Harrods as concerns grow among UK retailers Continue Reading

By

• Alex Scroxton, Security Editor

Government and Ofcom disagree about scope of Online Safety Act

MPs heard different views from the online harms regulator and the UK government about whether and how the Online Safety Act obliges platforms to deal with disinformation Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Explaining what’s happening in a cyber attack is hard but crucial

The recent attacks on Marks and Spencer, Harrods and the Co-op show why it is essential for organisations to have a strategy to communicate effectively with customers affected Continue Reading

By

• Mikey Hoare, Kekst CNC

Harrods becomes latest UK retailer to fall victim to cyber attack

Harrods confirms it is the latest UK retailer to experience a cyber attack, shutting off a number of systems in an attempt to lessen the impact Continue Reading

By

• Alex Scroxton, Security Editor

Signalgate: Learnings for CISOs securing enterprise data

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what CISOs can learn from this potentially fatal error Continue Reading

By

• Todd Thiemann, Principal Analyst

Co-op instructs staff to be wary of lurking hackers

Co-op tells staff to stop using their VPNs and be wary that their communications channels may be being monitored, as a cyber attack on the organisation continues to develop Continue Reading

By

• Alex Scroxton, Security Editor

Thomas Herdman’s legal battle over Sky ECC encrypted phone distribution set to enter fifth year

Computer Weekly speaks to Julie Kawai Herdman, daughter of Thomas Herdman, the only person in custody for distributing Sky ECC encrypted phones Continue Reading

By

• Bill Goodwin, Computer Weekly
• Rebecca Tidy

Is the Investigatory Powers Tribunal powerless?

Five judges have found the Investigatory Powers Tribunal has no statutory powers to impose financial sanctions against police and intelligence services. Their findings raise significant and serious concerns about the integrity of our legal system. Continue Reading

By

• Maria Theodoulou, Partner at Stokoe Partnership Solicitors

Current SaaS delivery model a risk management nightmare, says CISO

JPMorgan Chase security chief Patrick Opet laments the state of SaaS security in an open letter to the industry and calls on software providers to do more to enhance resilience Continue Reading

By

• Alex Scroxton, Security Editor

Co-op shuts off IT systems to contain cyber attack

A developing cyber incident at Co-op has forced the retailer to pull the plug on some of its IT systems as it works to contain the attack Continue Reading

By

• Alex Scroxton, Security Editor

How AI can attack corporate decision-making

As AI gets embedded in corporate systems, experts warn of emerging security risks caused by influencing retrieval augmentation systems Continue Reading

By

• Cliff Saran, Managing Editor

RSAC Conference 2025 video reports

We chatted on camera with attendees and presenters at RSAC 2025. Check out this video collection to get highlights from one of the world's major cybersecurity conferences. Continue Reading

By

• Brenda L. Horrigan, Executive Managing Editor

AI in national security raises proportionality and privacy concerns

AI could enable investigations to cover far more individuals than was ever previously possible, which is why oversight is needed Continue Reading

By

• Cliff Saran, Managing Editor

Scattered Spider on the hook for M&S cyber attack

The infamous Scattered Spider hacking collective may have been behind the ongoing cyber attack on Marks and Spencer that has crippled systems at the retailer and left its ecommerce operation in disarray. Continue Reading

By

• Alex Scroxton, Security Editor

Gov.uk One Login yet to meet government cyber security standards for critical public services

The government’s flagship digital identity system still does not fully conform to key national security standards three years after launch, while questions remain over whether historic security problems have been resolved Continue Reading

By

• Bryan Glick, Editor in chief

Kaspersky calls for cyber immunity amid growing cyber threats

The rise of professional cyber crime groups and state-sponsored actors targeting critical infrastructure requires a move towards inherently secure ‘cyber immune’ systems, says Kaspersky CEO Eugene Kaspersky Continue Reading

By

• Aaron Tan, TechTarget

Making divorce digital

In this week’s Computer Weekly, we talk to the CEO of the National Family Mediation charity about its tech overhaul and how divorce is going digital. The government’s One Login digital identity system is under scrutiny over security problems – we examine the issues. And we explain what’s happening in the UK competition watchdog’s investigation into AWS and Microsoft cloud services. Read the issue now. Continue Reading

Maintaining Your Borders

It seems like every other – and that’s being conservative – conversation I have in my day job, every other post on the likes of LinkedIn and even on the BBC website is talking about how AI is ... Continue Reading

By

• Steve Broadhead, Broadband Testing

What is a risk map (risk heat map)?

A risk map, or risk heat map, is a data visualization tool for communicating specific risks an organization faces. Continue Reading

By

• Mary K. Pratt
• Mekhala Roy

UK MoJ crime prediction algorithms raise serious concerns

The Ministry of Justice is using one algorithm to predict people’s risk of reoffending and another to predict who will commit murder, but critics say the profiling in these systems raises ‘serious concerns’ over racism, classism and data inaccuracies Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

M&S suspends all online sales as cyber attack worsens

M&S shuts down online sales as it works to contain and mitigate a severe cyber attack on its systems Continue Reading

By

• Alex Scroxton, Security Editor

M&S systems remain offline days after cyber incident

M&S is still unable to provide contactless payment or click-and-collect services amid a cyber attack that it says has forced it to move a number of processes offline to safeguard its customers, staff and business Continue Reading

By

• Alex Scroxton, Security Editor

Data breach class action costs mount up

Organisations exposed to the US market paid out over $150m in class action settlements in just six months. Security leaders must do more to address cyber gaps, respond better to incidents and demonstrate compliance Continue Reading

By

• Alex Scroxton, Security Editor

Challenges persist as UK’s Cyber Security and Resilience Bill moves forward

Elements of the Cyber Security and Resilience Bill are welcome but questions remain about how best to act in the face of persistent challenges like geopolitical chaos, threats to critical infrastructure, and technological advances Continue Reading

By

• James Morris, CSBR

Podcast: RSA 2025 to grapple with AI compliance, US and EU regulation

We preview RSA 2025 with Vigitrust CEO Mathieu Gorge who looks forward to learning lots around compliance and regulation as CIOs wrestle with artificial intelligence and geopolitical upheavals Continue Reading

By

• Antony Adshead, Storage Editor

Ericsson boosts NetCloud SASE with integrated clientless ZTNA for wireless WAN

Leading comms tech provider claims industry’s first fully integrated clientless zero-trust network access, designed for wireless wide area network with update to core secure access service edge platform Continue Reading

By

• Joe O’Halloran, Computer Weekly

March ransomware slowdown probably a red herring

An apparent slowdown in ransomware attack volumes is raising eyebrows, but the statistics never tell the full story Continue Reading

By

• Alex Scroxton, Security Editor

What is risk exposure in business?

Risk exposure is the quantified potential loss from currently underway or planned business activities. Continue Reading

By

• Dave Shackleford, Voodoo Security
• Ben Cole, Executive Editor

Rethink authentication to remove the burden on users

The rise of AI powered threats and non-human identities will push an already strained identity security model over the edge Continue Reading

By

• Patrick Wardrop, IBM

Financially motivated cyber crime remains biggest threat source

Mandiant’s latest annual threat report reveals data on how financially motivated cyber criminals, such as ransomware gangs, dominate the cyber security landscape Continue Reading

By

• Alex Scroxton, Security Editor

Enterprise strategies for API management

Application programming interfaces are the connective tissue of the modern enterprise, driving innovation and integration. But managing them effectively requires enterprises to consider governance, security and lifecycle management while preparing for emerging threats and technologies like AI Continue Reading

By

• Aaron Tan, TechTarget

Amid uncertainty, Armis becomes newest CVE numbering authority

Amid an uncertain future for vulnerability research, exposure management company Armis has been given the authority to assign CVE IDs to newly discovered vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

Qualys goes to bat for US cricket side San Francisco Unicorns

Cloud security specialist Qualys partners with US T20 cricket squad San Francisco Unicorns and its Sparkle Army fanclub as the team prepares for its summer 2025 campaign Continue Reading

By

• Alex Scroxton, Security Editor

Digital ID sector calls for changes to government data legislation

Suppliers urge technology secretary to work more collaboratively with private sector over concerns government’s digital wallet will gain a monopoly in the market Continue Reading

By

• Bryan Glick, Editor in chief

Cyber attack downs systems at Marks & Spencer

A cyber attack at Marks & Spencer has caused significant disruption to customers, leaving them unable to make contactless payments or use click-and-collect services Continue Reading

By

• Alex Scroxton, Security Editor

Cyber ‘agony aunts’ launch guidebook for women in security

Cyber ‘agony aunts’ Amelia Hewitt and Rebecca Taylor are launching a book aimed at empowering women in their cyber security careers Continue Reading

By

• Alex Scroxton, Security Editor

Secure Future Initiative reveals Microsoft staff focus

IT security is now a metric in the Microsoft employee appraisal process Continue Reading

By

• Cliff Saran, Managing Editor

Beyond baselines - getting real about security and resilience

In an increasingly contested world, the UK government needs a security certification that goes beyond baseline measures. Continue Reading

By

• Neil Ashdown and Tash Buckley

Ofcom bans leasing of Global Titles to crackdown on spoofing

Telco regulator Ofcom is cracking down on a loophole being exploited by cyber criminals to access sensitive mobile data Continue Reading

By

• Cliff Saran, Managing Editor

AI-powered APIs proving highly vulnerable to attack

The growth of AI is proving a double-edged sword for API security, presenting opportunities for defenders to enhance their resilience, but also more risks from AI-powered attacks, according to report Continue Reading

By

• Alex Scroxton, Security Editor

Investigatory Powers Tribunal has no power to award costs against PSNI over evidence failures

Investigatory Powers Tribunal judges have called for the Home Secretary to step in after finding they have no powers to award costs against government bodies that fail to disclose evidence Continue Reading

By

• Bill Goodwin, Computer Weekly

What is a brute-force attack?

A brute-force attack is a trial-and-error hacking method cybercriminals use to decode login information and encryption keys to gain unauthorized access to systems. Continue Reading

By

• Mary E. Shacklett, Transworld Data
• Katie Terrell Hanna

Top APAC firms recognised at innovation awards

Citic Telecom, CapitaLand Investment and DBS Bank were among the region’s top industry innovators recognised for their digital transformation efforts at the Computer Weekly Innovation Awards APAC 2025 Continue Reading

By

• Aaron Tan, TechTarget

CW Innovation Awards: Transforming cyber security with AI

Facing rising cyber threats and a shortage of experts, Citic Telecom International CPC developed an AI-powered penetration testing tool to automate security audits and reduce costs Continue Reading

By

• Ai Lei Tao

How do cybercriminals steal credit card information?

Cybercriminals have various methods at their disposal to hack and exploit credit card information. Learn what they are, how to prevent them and what to do when hacked. Continue Reading

By

• Stephen J. Bigelow, Senior Technology Editor

Norway says ‘no way’ to global financial crime

Oslo’s startup ecosystem is fighting back against cyber criminals with tech to wipe out attacks rather than just detect them. Continue Reading

CW EMEA: Shutting down cyber crime

In the Netherlands, the average ransomware attack costs firms about €514,000, and these huge sums mean it makes sense that the police invest their time and resources into combating it. One PhD student spent four years embedded in Dutch police cyber teams to conduct research on their efficacy. Continue Reading

Dutch police disrupt half of ransomware operations, finds embedded PHD student

Dutch PhD study reveals the impact of centralised intelligence and strategic interventions in the fight against ransomware. Continue Reading

Tariff turmoil is making supply chain security riskier

Many businesses around the world are taking the decision to alter their supplier mix in the face of tariff uncertainty, but in doing so are creating more cyber risks for themselves, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Collaboration is the best defence against nation-state threats

The rise of DeepSeek has prompted the usual well-documented concerns around AI, but also raised worries about its potential links to the Chinese state. The Security Think Tank considers the steps security leaders can take to counter threats posed by nation state industrial espionage? Continue Reading

By

• Stephen McDermid, Okta

Standard Chartered grounds AI ambitions in data governance

The bank’s group chief data officer, Mohammed Rahim, outlines how the bank is modernising its data infrastructure and governance practices to support its AI initiatives Continue Reading

By

• Aaron Tan, TechTarget

What is Pretty Good Privacy and how does it work?

Pretty Good Privacy, or PGP, was a popular program used to encrypt and decrypt email over the internet, as well as authenticate messages with digital signatures and encrypted stored files. Continue Reading

By

• Alexander S. Gillis, Technical Writer and Editor
• Peter Loshin, Former Senior Technology Editor
• Rob Wright, Senior News Director

Footballers object to processing of performance data

Football players are seeking to gain more control of their performance data through ‘stop processing’ requests, in an attempt to strike a better balance between firms’ commercial interests and the data rights of footballers Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

CISA extends Mitre CVE contract at last moment

The US Cybersecurity and Infrastructure Security Agency has ridden to the rescue of the under-threat Mitre CVE Programme, approving a last-minute, 11-month contract extension to preserve the project’s vital security vulnerability work Continue Reading

By

• Alex Scroxton, Security Editor