IT security

HMRC phishing breach wholly avoidable, but hard to stop

A breach at HMRC saw innocent taxpayers tricked into letting scammers impersonate them through simple phishing attacks leading to account takeover. Such attacks are avoidable, but hard to stop Continue Reading

By

• Alex Scroxton, Security Editor

CISOs: Don't block AI, but adopt it with eyes wide open

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Mike Gillespie and Ellie Hurst, Advent IM

Compliance stakeholders and how to work with them

Stakeholders' involvement can strengthen an organization's compliance program. Learn best practices for engaging key stakeholders in compliance initiatives. Continue Reading

By

• Paul Kirvan

UK’s error-prone eVisa system is ‘anxiety-inducing’

People experiencing technical errors with the Home Office’s electronic visa system explain the psychological toll of not being able to reliably prove their immigration status in the face of a hostile and unresponsive bureaucracy Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Building the foundations: A national roadmap for digital identity and sovereign data

Now the UK government has offered some clarity on the future of private and public sector digital identity services, it's time to work together to put the essential foundations in place to make digital ID work for everyone Continue Reading

By

• David Crack, Association of Digital Verification Professionals

How GitLab is tapping AI in DevSecOps

GitLab CISO Josh Lemos explains how the company is weaving AI, through its Duo tool, into the entire software development lifecycle to enhance efficiency and automate incident response Continue Reading

By

• Aaron Tan, Informa TechTarget

Put ROCs before SOCs, Qualys tells public sector

Putting risk operations before security operations may help government agencies and other public sector bodies better manage the myriad threats they face, and make better decisions for the security of all Continue Reading

By

• Alex Scroxton, Security Editor

NCSC sets out how to build cyber safe cultures

The UK’s National Cyber Security Centre has published guidance for security teams and leaders on how to foster accessible and appropriate cyber security cultures in their organisations Continue Reading

By

• Alex Scroxton, Security Editor

Investigatory powers: Guidelines for police and spies could also help businesses with AI

Computer Weekly talks to Muffy Calder, technology advisor to the UK’s investigatory powers commissioner, about privacy, intrusion and artificial intelligence Continue Reading

By

• Bill Goodwin, Computer Weekly

Microsoft outlines three-pronged European cyber strategy

Microsoft chair Brad Smith outlines an expansive cyber programme targeting governments across Europe with enhanced threat intelligence and support Continue Reading

By

• Alex Scroxton, Security Editor

European Commission should rescind UK data adequacy

Civil society organisations have urged the European Commissioner to not renew the UK’s data adequacy, given the country’s growing divergence from European data protection standards Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Fortifying the future: The pivotal role of CISOs in AI operations

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Aditya K Sood, Aryaka

Dutch university’s rapid response saved it from ransomware devastation

Eindhoven University of Technology has planned multi-factor authentication and regularly practised cyber crisis drills – yet it still fell victim to attackers who exploited gaps in its defences Continue Reading

By

• Kim Loohuis

Infosecurity 2025: SMEs feel on their own in the face of cyber attacks

Project findings to be presented at Infosecurity Europe 2025 highlight vulnerability of SMEs to cyber attack Continue Reading

By

• Brian McKenna, Enterprise Applications Editor

Preparing for AI: The CISO’s role in security, ethics and compliance

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Elliott Wilkes, ACDS

SailPoint charts course for AI-driven identity security

SailPoint is driving the use of agentic AI in identity security with its Harbor Pilot offering while preparing to help enterprises govern and secure AI agents Continue Reading

By

• Aaron Tan, Informa TechTarget

US cyber agency CISA faces stiff budget cuts

CISA is one of several US agencies facing drastic budget cuts under the Trump administration Continue Reading

By

• Alex Scroxton, Security Editor

The hidden security risks of open source AI

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Brian Fox, Sonatype

Cyber and digital get over £1bn to enhance UK’s national security

The government has set out plans to spend over a billion pounds on digital and cyber warfare capabilities to enhance the UK’s ability to defend itself and fight offensive wars Continue Reading

By

• Alex Scroxton, Security Editor

What is a next-generation firewall (NGFW)?

A next-generation firewall (NGFW) is a network security device that combines traditional firewall capabilities with advanced features to detect and block sophisticated cyberattacks. Continue Reading

By

• Casey Clark, TechTarget
• Sharon Shea, Executive Editor

AI security: Balancing innovation with protection

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Javvad Malik, KnowBe4

Infosecurity 2025: NCA cyber intelligence head spells out trends

Will Lyne, head of cyber intelligence at the National Crime Agency, sketches out cyber criminal trends as ransomware and other attack varieties become democratised beyond Russophone, skilled software developers Continue Reading

By

• Brian McKenna, Enterprise Applications Editor

Risk maturity model: How it works and how to use one

Explore risk maturity models and assessment tools for enhancing enterprise risk management. Improve ERM programs to mitigate risk and gain a competitive edge. Continue Reading

By

• Ben Lutkevich, Site Editor

What is security?

Security for information technology (IT) refers to the methods, tools and personnel used to defend an organization's digital assets. Continue Reading

By

• Nick Barney, Technology Writer
• Madelyn Bacon, TechTarget

Rethinking secure comms: Are encrypted platforms still enough?

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Russell Auld, PAC

An explanation of ransomware

Ransomware locks an organization out of its data or digital services until it pays up. To minimize attacks, businesses can enhance security, train employees and back up data. Continue Reading

By

• Tommy Everson, Assistant Editor
• TechTarget Contributor

Dutch businesses lag behind in cyber resilience as threats escalate

While non-IT business professionals in the middle of their careers face the most disruption from AI, professionals in the IT services sector and their employers must prepare for change Continue Reading

By

• Kim Loohuis

How cyber security professionals are leveraging AWS tools

It’s now essential for IT security teams to have oversight of cloud computing, and AWS offers a plethora of tools to make managing it easier. Find out how cyber pros are using them in the wild Continue Reading

By

• Nicholas Fearn

What VMware’s licensing crackdown reveals about control and risk 

An assessments of the risks VMware customers on perpetual licences now need to consider Continue Reading

By

• Iain Saunderson, CTO, Spinnaker Support

Noisy quantum hardware could crack RSA-2048 in seven days

Research highlights the need for quantum safe cryptography given the speed with which quantum computing is evolving Continue Reading

By

• Cliff Saran, Managing Editor

Cloud migration demands contractual safeguards and clear strategy

Cyber security experts urge organisations to define clear objectives, understand shared security models and implement strong data governance when migrating workloads to the cloud Continue Reading

By

• Aaron Tan, Informa TechTarget

Signalgate is a signal to revisit security onboarding and training

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Mike Gillespie and Ellie Hurst, Advent IM

Zero-trust is redefining cyber security in 2025

The future of zero-trust is about embedding resilience into every facet of an organisation. To achieve this, SRM leaders must reimagine their strategies to address emerging challenges and prioritise key areas. Continue Reading

By

• Dale Koeppen, Gartner

RSAC rewind: Agentic AI, governance gaps and insider threats

AI was naturally a major theme of this year's RSAC conference, but we maybe failed to anticipate how it is coming to dominate every conversation. Continue Reading

By

• James Robinson, Netskope

AI and compliance: Staying on the right side of law and regulation

Without careful planning, AI projects risk blundering into a legal and regulatory minefield. We look at the risks from hallucinations, basic errors and coming regulation Continue Reading

By

• Stephen Pritchard

AI compliance: Dealing with data change and proliferation

Podcast: We talk with Vigitrust CEO Mathieu Gorge about staying on top of compliance and artificial intelligence, where the danger is data that changes during AI processing and can also proliferate Continue Reading

By

• Antony Adshead, Storage Editor

Gov.uk Wallet open to public sector bodies

Government departments can soon begin to add documents to Gov.uk Wallet, as the Government Digital Service publishes guidance for public sector bodies on how to use the smartphone app Continue Reading

By

• Lis Evenstad

UK biometric surveillance exists in ‘legal grey area’

The rapid proliferation of ‘biometric mass surveillance technologies’ throughout the UK’s public and private sectors is taking place without legal certainty or adequate safeguards for the public Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Adidas confirms customer data was accessed during cyber attack

Sportswear manufacturer Adidas has confirmed its systems were infiltrated by an unauthorised third party Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

Remote purchase fraud surges 14%, says banking industry

Brits lost over £1bn to payment fraud in its many forms last year, according to the latest banking industry numbers Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Maturing UK fintechs increase tech and cyber security hiring

Increased hiring reflects that fintechs are maturing and now require more cyber security and compliance experts Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

US makes fresh indictments over DanaBot, Qakbot malwares

US charges the operators of two malwares, DanaBot and Qakbot, whose actions led to millions of dollars worth of cyber theft and fraud Continue Reading

By

• Alex Scroxton, Security Editor

Armed forces charity steps in to address cyber mental health crisis

CIISec and military charity PTSD Resolution hope to address a gathering mental health crisis among frontline cyber professionals Continue Reading

By

• Alex Scroxton, Security Editor

Building resilient cyber threat intelligence communities

Cyber threat intelligence is no longer a luxury: intelligence sharing communities must mature, and there are many common lessons to learn. Continue Reading

By

• Rob Dartnall, SecAlliance

Security vs. usability: Why rogue corporate comms are still an issue

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Elliott Wilkes, ACDS

When leaders ignore cyber security rules, the whole system weakens

The US ‘Signalgate’ debacle is a case study in how security collapses when leadership treats basic rules as optional Continue Reading

By

• Raihan Islam, defineXTEND

Preparation and appreciation – the human factor in incident response

A typical incident response effort is highly technical, so where do soft skills come in and how do you know how effective your team is? We look at a measurement option and the human consideration in these scenarios Continue Reading

By

• Dan Raywood

Why we must reform the Computer Misuse Act: A cyber pro speaks out

Britain’s outdated hacking laws are leaving the UK’s cyber practitioners hamstrung and afraid. Security professional Simon Whittaker reveals how he nearly ran afoul of the Computer Misuse Act, and why he’s speaking out for reform. Continue Reading

UK eVisa: Ethical or harmful?

In this week’s Computer Weekly, we examine the criticism being levelled at government proposals to use electronic visa data and biometrics to surveil migrants living in the UK. We also hear from a noted cyber pro about why he thinks the Computer Misuse Act is ripe for reform. And we find out everything there is to know about retrieval augmented generation architectures and how they can be used to infuse generative artificial intelligence (AI) into a business context. Read the issue now. Continue Reading

What are the best practices for securing AWS tech stacks?

An AWS tech stack can aid business growth and facilitate efficient operations, but misconfigurations have become all too common and stall this progress Continue Reading

By

• Nicholas Fearn

Essex Police discloses ‘incoherent’ facial recognition assessment

An equality impact assessment of Essex Police live facial recognition deployments is plagued by inconsistencies and poor methodology, undermining the force’s claim that its use of the technology will not be discriminatory Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Microsoft raises posse to target dangerous Lumma malware

Microsoft, along with a consortium of partners, has seized and disrupted a significant part of the Lumma malware-as-a-service network used to steal data and funds Continue Reading

By

• Alex Scroxton, Security Editor

How to tackle your infrastructure technical debt

Gartner analysts explain how infrastructure and operations teams can address the accumulation of outdated systems and make a compelling business case for upgrades Continue Reading

By

• Stephen Withers

M&S cyber attack disruption likely to last until July

M&S says it has moved into recovery mode after a ransomware attack, but expects some disruption to persist throughout the coming weeks Continue Reading

By

• Alex Scroxton, Security Editor

NCSC: Russia’s Fancy Bear targeting logistics, tech organisations

The NCSC and its partner agencies have blown the whistle on an extensive campaign of malicious cyber attacks orchestrated by the Russian state Fancy Bear operation Continue Reading

By

• Alex Scroxton, Security Editor

What is a passkey?

A passkey is an alternative user authentication method that eliminates the need for usernames and passwords. Continue Reading

By

• Mary E. Shacklett, Transworld Data
• Amanda Stevens

Podcast: RSA 2025 – AI’s risk surface and the role of the CISO

We review RSA 2025 with Vigitrust CEO Mathieu Gorge who looks at the impacts on compliance of AI’s expanding risk surface, the role of the CISO, and a changed supplier approach Continue Reading

By

• Antony Adshead, Storage Editor

UK Fraud Bill targets benefit claimants for mass surveillance

The UK government’s proposed Fraud Bill will disproportionately place millions of benefit claimants under constant surveillance, creating a two-tier system where people are automatically suspected of wrongdoing for seeking welfare Continue Reading

By

• Anna Dent

Capital One pushes out data tokenisation

Organisations using the Databricks and Snowflake platforms will be able to use Capital One’s Databolt tool to secure their data Continue Reading

By

• Cliff Saran, Managing Editor

Strong fintech security posture at risk via third-party weak links

Despite having a strong security posture, the financial technology sector could be open to attack via third parties Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Ransomware attacks dropped by a third last month

Reported ransomware attacks eased off during April following a dramatic spike in the first quarter of 2025 Continue Reading

By

• Alex Scroxton, Security Editor

How to create a remote access policy, with template

Remote work, while beneficial, presents numerous security risks. Help keep your organization's systems safe with a remote access policy. Continue Reading

By

• Paul Kirvan

Dell unveils disaggregated infrastructure strategy

Dell makes push for disaggregated infrastructure, aiming to offer enterprises the independent scaling of three-tier architectures with the operational benefits of hyperconverged systems Continue Reading

By

• Aaron Tan, Informa TechTarget

Hacking contest exposes VMware security

In what has been described as a historical first, hackers in Berlin have been able to demo successful attacks on the ESXi hypervisor Continue Reading

By

• Cliff Saran, Managing Editor

Retail cyber attacks hit food distributor Peter Green Chilled

Cold chain services provider Peter Green Chilled, which supplies the likes of Aldi, Sainsbury’s and Tesco, has been forced to halt operations after succumbing to a ransomware attack Continue Reading

By

• Alex Scroxton, Security Editor

Tackling the UK’s cyber threats

In this week’s Computer Weekly, we report from the National Cyber Security Centre’s annual update on the state of UK security and examine the emerging threats. The chief data officer of Standard Chartered bank discusses preparing for artificial intelligence. We also look at the networking implications of GPU-based AI datacentres. Read the issue now. Continue Reading

UK at risk of Russian cyber and physical attacks as Ukraine seeks peace deal

UK cyber security chief warns of ‘direct connection’ between Russian cyber attacks and physical threats to the UK Continue Reading

UK critical systems at risk from ‘digital divide’ created by AI threats

GCHQ’s National Cyber Security Centre warns that a growing ‘digital divide’ between organisations that can keep pace with AI-enabled threats and those that cannot is set to heighten the UK's overall cyber risk Continue Reading

Chinese cyber spooks lure laid-off US government workers

A Washington DC-based think tank has published evidence that Chinese intelligence services have been running a network of digital ‘front’ companies targeting laid-off government workers as recruits Continue Reading

By

• Alex Scroxton, Security Editor

Legal Aid Agency breach may encompass millions of people

Legal Aid Agency says the data of anybody who applied for legal aid over the past 15 years has been compromised in a cyber attack Continue Reading

By

• Alex Scroxton, Security Editor

Calm settles over digital identity market - for now... (Hark, is that Big Tech on the horizon?)

A relative calm has settled over the digital identity sector after months of worry and vitriol – for now, at least. Digital ID players have largely welcomed the government’s announcement of the ... Continue Reading

By

• Bryan Glick, Editor in chief

What is a firewall and why do I need one?

A firewall is a network security device that prevents unauthorized access to a network by inspecting incoming and outgoing traffic using a set of predetermined security rules. Continue Reading

By

• Kinza Yasar, Technical Writer
• Ben Lutkevich, Site Editor

What is Universal 2nd Factor (U2F)?

Universal 2nd Factor (U2F) is a physical device that can act as a form of authentication for an account. Continue Reading

By

• Gavin Wright

What is compliance risk?

Compliance risk is an organization's potential exposure to legal penalties, financial forfeiture and material loss, resulting from its failure to act in accordance with industry laws and regulations, internal policies or prescribed best practices. Continue Reading

By

• Katie Terrell Hanna
• Francesca Sales

CW APAC – Trend Watch: API management

Application programming interfaces are subject to the pros and cons of emerging technologies. In this handbook, focused on API management in the Asia-Pacific region, Computer Weekly looks at governance and security, gateway tools, and strategic approaches to creating an automation framework Continue Reading

Jump in cyber attacks should put businesses on high alert

Three principles to help businesses get on top of cyber security Continue Reading

By

• Jason Pyle, Managing Director, Harvey Nash USA & Canada

Gartner: Most firms not tapping cloud’s full potential

Organisations have not fully leveraged the full potential of cloud and must navigate emerging trends such as artificial intelligence, multicloud complexity and security perceptions to stay competitive Continue Reading

By

• Stephen Withers

No workaround leads to more pain for VMware users

There are patches for the latest batch of security alerts from Broadcom, but VMware users on perpetual licences may not have access Continue Reading

By

• Cliff Saran, Managing Editor

Security tests reveal serious vulnerability in government’s One Login digital ID system

A ‘red teaming’ exercise to simulate cyber attacks on the government’s flagship digital identity system has found that One Login can be compromised without detection Continue Reading

By

• Bryan Glick, Editor in chief

How digital identity will empower people and drive economic growth

The government has finally plotted out the future of digital identity in the UK in a way that makes sense for private sector, public sector, and citizens. Now let's make it happen Continue Reading

By

• David Crack, Association of Digital Verification Professionals

The Security Interviews: David Faugno, 1Password

David Faugno, co-CEO of 1Password, discusses how his background led to him joining the company and why maintaining profitability is a key factor in overcoming the challenges of switching markets. Continue Reading

By

• Peter Ray Allison

What is risk appetite?

Risk appetite is the amount of risk an organization or investor is willing to take in pursuit of objectives it deems have value. Continue Reading

By

• Alexander S. Gillis, Technical Writer and Editor

NHS asks suppliers to sign up to cyber covenant

NHS digital and security leaders call on their suppliers to commit to a cyber security charter as the health service works to improve its resilience in the face of growing threat levels Continue Reading

By

• Alex Scroxton, Security Editor

How close is quantum computing to commercial reality?

At a recent event, experts explored the progress towards logical qubits and how these will be applied to empower business IT Continue Reading

By

• Cliff Saran, Managing Editor

Government starts private sector engagement on digital ID and Gov.uk Wallet

Following concerns from the digital identity industry that Gov.uk Wallet would dominate the market, the government has offered private sector providers a ‘critical role’ in its future, as it revealed further details on the wallet Continue Reading

By

• Lis Evenstad

Is IPSIE the game changer that SaaS security demands?

It started with an announcement in October 2024, and now it seems the vision of secure identity in the enterprise is becoming a reality. We look at the prospects for IPSIE Continue Reading

By

• Dan Raywood

Scattered Spider retail attacks spreading to US, says Google

Google’s threat intel analysts are aware of a number of in-progress cyber attacks against US retailers linked to the same Scattered Spider gang that supposedly attacked M&S and Co-op in the UK Continue Reading

By

• Alex Scroxton, Security Editor

Enisa launches European vulnerability database

The EU’s new vulnerability database is designed to offer a broader, more transparent source of information on new cyber vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

It's time to get to grips with DORA

It's not really a surprise so many organisations missed the EU's DORE compliance deadline, but there's no excuse for delaying, says Azul EMEA VP James Johnston Continue Reading

By

• James Johnston, Azul

Why we must reform the Computer Misuse Act: A cyber pro speaks out

Britain’s outdated hacking laws are leaving the UK’s cyber practitioners hamstrung and afraid. Security professional Simon Whittaker reveals how he nearly ran afoul of the Computer Misuse Act, and why he’s speaking out for reform Continue Reading

By

• Alex Scroxton, Security Editor

What is business resilience?

Business resilience is an organization's ability to adapt quickly to disruptions while maintaining continuous business operations and safeguarding people, assets and overall brand equity. Continue Reading

By

• Paul Kirvan

What is penetration testing?

A penetration test, also called a 'pen test,' is a simulated cyberattack on a computer system, network or application to identify and highlight vulnerabilities in an organization's security posture. Continue Reading

By

• Kinza Yasar, Technical Writer
• Puneet Mehta, SDG

New security paradigm needed for IT/OT convergence

Industry leaders and policymakers highlight growing cyber threats from the integration of IT and operational technology systems, calling for collaboration and regulatory frameworks to protect critical systems, among other measures Continue Reading

By

• Aaron Tan, Informa TechTarget

May Patch Tuesday brings five exploited zero-days to fix

Microsoft fixes five exploited, and two publicly disclosed, zero-days in the fifth Patch Tuesday update of 2025 Continue Reading

By

• Alex Scroxton, Security Editor

The top 4 sustainable marketing challenges

Sustainable marketing shows consumers that an organization takes environmental and social responsibility seriously. Yet, marketers must use careful language to avoid greenwashing. Continue Reading

By

• Tim Murphy, Site editor

M&S forces customer password resets after data breach

M&S is instructing all of its customers to change their account passwords after a significant amount of data was stolen in a DragonForce ransomware attack Continue Reading

By

• Alex Scroxton, Security Editor

Gov.uk One Login loses certification for digital identity trust framework

The government’s flagship digital identity system has lost its certification against the government’s own digital identity system trust framework Continue Reading

By

• Bryan Glick, Editor in chief

Australian data breaches hit record high in 2024

More than 1,100 data breaches were reported in Australia last year, a 25% jump from 2023, prompting calls for stronger security measures across businesses and government agencies Continue Reading

By

• Aaron Tan, Informa TechTarget

Ransomware: What the LockBit 3.0 data leak reveals

An administration interface instance for the ransomware franchise's affiliates was attacked on 29 April. Data from its SQL database has been extracted and disclosed Continue Reading

By

• Valéry Rieß-Marchive, Rédacteur en chef

What is a security operations center (SOC)?

A security operations center (SOC) is a command center facility in which a team of information technology (IT) professionals with expertise in information security (infosec) monitors, analyzes and protects an organization from cyberattacks. Continue Reading

By

• Kinza Yasar, Technical Writer
• Paul Kirvan
• Sarah Lewis