Regulatory compliance and standard requirements

NCSC updates CNI Cyber Assessment Framework

Updates to the NCSC’s Cyber Assessment Framework are designed to help providers of critical services better manage their risk profiles Continue Reading

By

• Alex Scroxton, Security Editor

Australian scaleup to bring AI-led data protection to the MoD

The UK’s Ministry of Defence is embracing AI-led data protection in the wake of a major privacy breach, enlisting Australian cyber firm Castlepoint Systems to oversee sensitive records Continue Reading

By

• Alex Scroxton, Security Editor

Proliferation of on-premise GenAI platforms is widening security risks

Research finds increased adoption of unsanctioned generative artificial intelligence platforms is magnifying risk and causing a headache for security teams Continue Reading

By

• Alex Scroxton, Security Editor

The blind spot: digital supply chain is now a board-level imperative

Many companies lack visibility into complex digital supply chains, meaning hidden risks and regulatory exposure. Cyber security requires continuous mapping and board engagement Continue Reading

By

• Tim Grieveson

AI-enabled security pushes down breach costs for UK organisations

Organisations that are incorporating AI and automation into their cyber security practice are seeing improved outcomes when incidents occur, according to an IBM study Continue Reading

By

• Alex Scroxton, Security Editor

Cyber governance practices are maturing - and reshaping leadership expectations

How technology leaders can help organisations shape their cyber governance practices and strengthen their collaboration across the executive team Continue Reading

By

• Susanne Alfs, Cyber4Directors

GDPR’s 7th anniversary: in the AI age, privacy legislation is still relevant

Seven years after GDPR reshaped data protection, AI is forcing a fresh look at governance. GDPR’s principles remain critical, guiding ethical AI use, risk management, and trusted innovation Continue Reading

By

• James Hodge

Industry experts warn crypto infrastructure is ‘creaking’

A report from experts at HSBC, Thales and InfoSec Global claims decades-old cryptographic systems are failing, putting businesses at risk from current vulnerabilities and the threat from quantum computing Continue Reading

By

• Aaron Tan, Informa TechTarget

Senator warns of new UK surveillance risks to US citizens following Apple ‘backdoor’ row

US lawmaker calls for the US to publish an assessment of the risks posed by UK surveillance laws to US citizens in the wake of disclosures that the UK has ordered Apple to introduce ‘backdoors’ in Apple encryption Continue Reading

By

• Bill Goodwin, Investigations Editor

Austrian government faces likely legal challenge over state spyware

Civil society groups are talking to opposition MPs about bringing a legal challenge to the Austrian constitutional court over ‘state trojan’ law Continue Reading

By

• Bill Goodwin, Investigations Editor

What is good automated manufacturing practice (GAMP)?

Good automated manufacturing practice (GAMP) is a set of guidelines for pharmaceutical manufacturers. Continue Reading

By

• Gavin Wright

The UK’s ransomware payment ban is a strategic win

The UK's proposed public sector ransomware payment ban could be a bold step, but it can't operate in isolation. Continue Reading

By

• Rob Dartnall, SecAlliance

Scattered Spider victim Clorox sues helpdesk provider

Cleaning products manufacturer Clorox fell victim to a Scattered Spider social engineering attack two years ago – it blames its IT helpdesk provider, Cognizant Continue Reading

By

• Alex Scroxton, Security Editor

Dutch researchers use heartbeat detection to unmask deepfakes

Dutch method to counter deepfakes analyses blood flow patterns in faces that current deepfake generation tools cannot yet replicate Continue Reading

By

• Kim Loohuis

Monzo’s £21m fine highlights banks’ cyber security failures

Monzo’s recent fine over failings in its customer verification processes highlights wider security and privacy shortcomings in the personal finance world Continue Reading

By

• Nicholas Fearn

WhatsApp is refused right to intervene in Apple legal action on encryption ‘backdoors’

Investigatory Powers Tribunal to hear arguments in public over lawfulness of secret UK order requiring Apple to give UK law enforcement access to users’ encrypted data stored on the Apple iCloud Continue Reading

By

• Bill Goodwin, Investigations Editor

Is it time to rethink the OWASP Top 10?

The OWASP Top 10 serves as a key reference point for developers and security professionals, but with a new iteration on the horizon, we need to confront a hard truth: has it lost its effectiveness, or have we failed to implement it meaningfully? Continue Reading

By

• Tim Mackey, Black Duck

Disaster recovery: As-a-service vs on-premise?

It’s easy to backup to the cloud, and we run lots of applications there now, too. So, running DR as-a-service in the cloud makes perfect sense for many. We look at the pros and cons Continue Reading

By

• Stephen Pritchard

Overconfidence in cyber security: a silent catalyst for CNI breaches

Many CNI organisations are perilously overconfident in their ability to manage and combat cyber risks, according to Bridewell research. This is leaving vital systems exposed. Continue Reading

By

• Anthony Young

UK government to bring in ransomware payment ban

Critical infrastructure operators, hospitals, local councils and schools will be among those banned from giving in to cyber criminal demands as the UK moves forward with proposals to address the scourge of ransomware Continue Reading

By

• Alex Scroxton, Security Editor

Interview: How OpenAI is making ChatGPT public and private sector-ready

We speak to OpenAI’s solution engineering lead, Matt Weaver, about enterprise adoption and making ChatGPT secure Continue Reading

By

• Cliff Saran, Managing Editor

UK may be seeking to pull back from Apple encryption row with US

UK government officials say that attempts by the Home Office to require Apple to introduce ‘backdoors’ to its secure encrypted storage service will cross US red lines Continue Reading

By

• Bill Goodwin, Investigations Editor

Darktrace buys network visibility specialist Mira

AI cyber giant Darktrace buys network security firm Mira for an undisclosed sum, seeking to enhance the tech stack it offers to highly regulated sectors Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: Jason Nurse, University of Kent

Jason Nurse, reader in cyber security at the University of Kent, discusses the psychological side of cyber and online safety, why placing blame on users as ‘the weakest link’ is wrong – and why security pros should think about user needs more Continue Reading

By

• Danny Palmer

Netherlands calls for European shift to post-tracking internet as privacy laws fail

Dutch research institute argues decade of regulation hasn’t curbed surveillance capitalism, proposes fundamental business model change Continue Reading

By

• Kim Loohuis

Estimated 96% of EMEA financial services sector not ready for DORA

Research from data backup provider Veeam indicates that vast majority of European financial services firms do not feel ready to meet the resiliency requirements of the EU’s DORA act Continue Reading

By

• Brian McKenna, Enterprise Applications Editor

Current approaches to patching unsustainable, report says

Organisations are struggling to prioritise vulnerability patching appropriately, leading to situations where everything is a crisis, which helps nobody, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Data (Use and Access) Act: Reflections on an eight-month statute

It took a long time, but the government's new data legislation finally made it into the statute book - it holds a lot of promise, but also leaves a lot of unanswered questions Continue Reading

By

• Lord Chris Holmes, House of Lords

Assessing the risk of AI in enterprise IT

We speak to security experts about how IT departments and security leaders can ensure they run artificial intelligence systems safely and securely Continue Reading

By

• Cliff Saran, Managing Editor

MoD supply chain cyber scheme gets up and running

The Ministry of Defence and IASME have launched a certification scheme for organisations working in the UK defence supply chain, with construction firm Morgan Sindall the first business to achieve compliance Continue Reading

By

• Alex Scroxton, Security Editor

European Commission accused of rigging data watchdog appointment

The European Commission has been accused of rigging the selection process for the next European Data Protection supervisor Continue Reading

By

• Bill Goodwin, Investigations Editor
• Sebastian Klovig Skelton, Data & ethics editor

NAO says government should employ data analytics to tackle fraud

The National Audit Office recommends public bodies share and manage data in a way that prevents fraud and saves taxpayers’ money Continue Reading

By

• Cliff Saran, Managing Editor

M&S calls for mandatory ransomware reporting

The government should extend ransomware reporting mandates to businesses to help gather more intelligence and better support victims, says M&S chairman Archie Norman Continue Reading

By

• Alex Scroxton, Security Editor

SEC and SolarWinds to settle lawsuit over 2020 breach

The US SEC and SolarWinds have reached a settlement in principle to resolve litigation over alleged security failings that led to the 2020 compromise of the supplier’s Orion platform by Russian cyber spies Continue Reading

By

• Alex Scroxton, Security Editor

NHS trust accused of ‘at best cavalier, at worst deceitful’ behaviour after deleting emails

A London hospital trust faces allegations it withheld key evidence from a tribunal hearing after one of its directors attempted to destroy more than 90,000 emails Continue Reading

By

• Tommy Greene

Digital warfare is blurring civilian front lines

Singapore’s defence cyber chief warns that the traditional lines between military conflict and civilian life are blurring, with adversaries now targeting civilian systems and using AI to put the threat landscape on steroids Continue Reading

By

• Aaron Tan, Informa TechTarget

Medow Health AI debuts AI scribe tool in Singapore

The Australian health technology company has launched its AI-powered scribe platform in Singapore to help healthcare professionals automatically capture and structure clinical notes, reports and referral letters Continue Reading

By

• Aaron Tan, Informa TechTarget

Fine-tuning to deliver business AI value

Foundation AI models offer knowledge that spans the internet, but they generally lack an understanding of proprietary business data and processes Continue Reading

By

• Cliff Saran, Managing Editor

Scattered Spider link to Qantas hack is likely, say experts

A developing cyber attack at Australian airline Qantas that started at a third-party call centre is already being tentatively attributed to Scattered Spider. Find out more and learn about the next steps for those affected Continue Reading

By

• Alex Scroxton, Security Editor

Dutch study uncovers cognitive biases undermining cyber security board decisions

Dutch research reveals how cognitive biases can lead to catastrophic security decisions Continue Reading

By

• Kim Loohuis

Cloudflare to let customers block AI web crawlers

Publishers and other providers of creative content now have the option to block AI crawlers from accessing and scraping their intellectual property with new tools from Cloudflare. Continue Reading

By

• Alex Scroxton, Security Editor

Over 2 million affected by US supermarket breach

Belgian-Dutch supermarket operator Ahold Delhaize reveals that more than two million people, including employees, had their data compromised following a November 2024 ransomware attack Continue Reading

By

• Alex Scroxton, Security Editor

One year since being freed, Julian Assange still a victim of state secrecy

If the State Department’s arguments prevail in FOIA litigation, the truth about US action against Julian Assange and WikiLeaks journalists will never be known Continue Reading

By

• Stefania Maurizi

Police to gain powers to grab online data when they seize phones and laptops

Academics and civil liberties experts say that proposed ‘authoritarian’ powers to allow police to trawl online and cloud services used by owners of seized devices should require approval from a judge Continue Reading

By

• Bill Goodwin, Investigations Editor

Clouded judgement: Resilience, risk and the rise of repatriation

Geopolitics, data sovereignty and rising costs are driving a change in cloud thinking, but it’s slow progress Continue Reading

By

• Marc Ambasna-Jones

Cyber Essentials certifications rising slowly but steadily

The number of businesses attaining the NCSC Cyber Essentials certification continues to increase, but much more can be done to raise awareness of the scheme Continue Reading

By

• Alex Scroxton, Security Editor

UK data reforms become law

UK passes wide-ranging data protection reforms to ‘simplify’ organisations’ sharing and processing of data, but questions remain whether changes will be accepted by European Commission when renewing UK data adequacy Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Beyond the AI hype: How data laws quietly handed power to government and Big Tech

The UK is at risk of becoming an ‘algorithm state’ as the government hands more power to Big Tech and reduces the rights of individuals Continue Reading

By

• James Baker, Platform Power Programme Manager at Open Rights Group

Traditional fake news detection fails against AI-generated content

As generative AI produces increasingly convincing text, Dutch researchers are exploring how linguistic cues, model bias, and transparency tools can help detect fake news. Continue Reading

By

• Kim Loohuis

Cyber action plan kicks off to ‘supercharge’ UK security sector

UK government says its cyber growth action plan will provide a large boost to Britain’s security industry as it sets out to create a roadmap for future growth Continue Reading

By

• Alex Scroxton, Security Editor

What is market concentration?

Market concentration refers to how a market is distributed among competing companies. Continue Reading

By

• Katie Terrell Hanna
• Ivy Wigmore

What is ESG reporting? Importance and how to get started

ESG reporting is a type of corporate disclosure that details an organization's environmental, social and governance (ESG) promises, efforts and progress. Continue Reading

By

• Scott Robinson, New Era Technology
• Cameron Hashemi-Pour, Former Site Editor
• Sean Michael Kerner

Intelligence sharing key to cyber security in Europe, says EU Commission cyber expert

Cyber criminals choose not to attack Europe due to its resilience and preparedness, says the EU Commission’s principal advisor for cyber security coordination, Despina Spanou Continue Reading

By

• Lis Evenstad

What is a compliance audit? (with an example checklist)

A compliance audit is critical for finding any potential compliance gaps in an organization's operations. Here's what companies can do to prepare for them. Continue Reading

By

• Paul Kirvan

Apple encryption row: Does law enforcement need to use Technical Capability Notices?

History shows that law enforcement can bring successful prosecutions without the need for the Home Office to introduce ‘backdoors’ into end-to-end encryption Continue Reading

By

• Professor Peter Sommer, digital evidence expert witness

NHS IT the big winner in Reeves’ Spending Review

The chancellor of the exchequer has significantly upped spending on digital and technology initiatives in the current Spending Review period, with the NHS receiving a 50% tech funding increase Continue Reading

By

• Alex Scroxton, Security Editor

WhatsApp seeks to join Apple in legal challenge against Home Office encryption orders

WhatsApp today applied to intervene in an Investigatory Powers Tribunal case that is considering the UK’s ability to issue a technical capability notice on Apple to ‘weaken encryption’ Continue Reading

By

• Bill Goodwin, Investigations Editor

Investor behaviour in the wake of cyber's 'black swan' moment

So-called Black Swan events expose the blind spots in even the most sophisticated forecasting models, signaling a need to rethink how businesses, and those investing in them, quantify and prepare for cyber risk. Continue Reading

By

• Ed Bartlett, Hicomply

Government using national security as ‘smokescreen’ in Apple encryption row

Senior conservative MP David Davis says the Home Office should disclose how many secret orders it has issued against telecoms and internet companies to Parliament Continue Reading

By

• Bill Goodwin, Investigations Editor

Cyber Bill at risk of becoming a missed opportunity, say MPs

An APPG report warns that the government’s flagship cyber security legislation is too narrow in its scope and risks missing opportunities to embed resilience at the heart of the British economy Continue Reading

By

• Alex Scroxton, Security Editor

How to choose coding standards: Development best practices

Learn how coding standards enhance quality and efficiency in software projects. Follow coding conventions and standards to achieve the five pillars of code quality. Continue Reading

By

• Damon Garn, Cogspinner Coaction

Third-party security weaknesses threaten Europe’s big banks

Security breaches via third parties increased by 25% at Europe’s largest finance firms Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Are we normalising surveillance in schools?

Children and teenagers are subjected to a vast array of surveillance technologies in schools. These are intended to keep them safe, but are we normalising surveillance for young people? Continue Reading

By

• Peter Ray Allison

US lawmakers say UK has ‘gone too far’ by attacking Apple’s encryption

US politicians are calling for Congress to rewrite the US Cloud Act to prevent the UK issuing orders to require US tech companies to introduce ‘backdoors’ in end-to-end encrypted messaging and storage Continue Reading

By

• Bill Goodwin, Investigations Editor

CISOs must translate cyber threats into business risk

To manage risk effectively and secure board-level buy-in, CISOs must stop talking about technology and start speaking the language of business, according to a senior Check Point executive Continue Reading

By

• Stephen Withers

HMRC phishing breach wholly avoidable, but hard to stop

A breach at HMRC saw innocent taxpayers tricked into letting scammers impersonate them through simple phishing attacks leading to account takeover. Such attacks are avoidable, but hard to stop Continue Reading

By

• Alex Scroxton, Security Editor

CISOs: Don't block AI, but adopt it with eyes wide open

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Mike Gillespie and Ellie Hurst, Advent IM

UK’s error-prone eVisa system is ‘anxiety-inducing’

People experiencing technical errors with the Home Office’s electronic visa system explain the psychological toll of not being able to reliably prove their immigration status in the face of a hostile and unresponsive bureaucracy Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Put ROCs before SOCs, Qualys tells public sector

Putting risk operations before security operations may help government agencies and other public sector bodies better manage the myriad threats they face, and make better decisions for the security of all Continue Reading

By

• Alex Scroxton, Security Editor

NCSC sets out how to build cyber safe cultures

The UK’s National Cyber Security Centre has published guidance for security teams and leaders on how to foster accessible and appropriate cyber security cultures in their organisations Continue Reading

By

• Alex Scroxton, Security Editor

Investigatory powers: Guidelines for police and spies could also help businesses with AI

Computer Weekly talks to Muffy Calder, technology advisor to the UK’s investigatory powers commissioner, about privacy, intrusion and artificial intelligence Continue Reading

By

• Bill Goodwin, Investigations Editor

Fortifying the future: The pivotal role of CISOs in AI operations

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Aditya K Sood, Aryaka

Dutch university’s rapid response saved it from ransomware devastation

Eindhoven University of Technology has planned multi-factor authentication and regularly practised cyber crisis drills – yet it still fell victim to attackers who exploited gaps in its defences Continue Reading

By

• Kim Loohuis

Preparing for AI: The CISO’s role in security, ethics and compliance

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Elliott Wilkes, ACDS

SailPoint charts course for AI-driven identity security

SailPoint is driving the use of agentic AI in identity security with its Harbor Pilot offering while preparing to help enterprises govern and secure AI agents Continue Reading

By

• Aaron Tan, Informa TechTarget

US cyber agency CISA faces stiff budget cuts

CISA is one of several US agencies facing drastic budget cuts under the Trump administration Continue Reading

By

• Alex Scroxton, Security Editor

The hidden security risks of open source AI

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Brian Fox, Sonatype

Cyber and digital get over £1bn to enhance UK’s national security

The government has set out plans to spend over a billion pounds on digital and cyber warfare capabilities to enhance the UK’s ability to defend itself and fight offensive wars Continue Reading

By

• Alex Scroxton, Security Editor

AI security: Balancing innovation with protection

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Javvad Malik, KnowBe4

Rethinking secure comms: Are encrypted platforms still enough?

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what CISOs can learn from this potentially fatal error Continue Reading

By

• Russell Auld, PAC

Dutch businesses lag behind in cyber resilience as threats escalate

While non-IT business professionals in the middle of their careers face the most disruption from AI, professionals in the IT services sector and their employers must prepare for change Continue Reading

By

• Kim Loohuis

How cyber security professionals are leveraging AWS tools

It’s now essential for IT security teams to have oversight of cloud computing, and AWS offers a plethora of tools to make managing it easier. Find out how cyber pros are using them in the wild Continue Reading

By

• Nicholas Fearn

Zero-trust is redefining cyber security in 2025

The future of zero-trust is about embedding resilience into every facet of an organisation. To achieve this, SRM leaders must reimagine their strategies to address emerging challenges and prioritise key areas. Continue Reading

By

• Dale Koeppen, Gartner

RSAC rewind: Agentic AI, governance gaps and insider threats

AI was naturally a major theme of this year's RSAC conference, but we maybe failed to anticipate how it is coming to dominate every conversation. Continue Reading

By

• James Robinson, Netskope

AI and compliance: Staying on the right side of law and regulation

Without careful planning, AI projects risk blundering into a legal and regulatory minefield. We look at the risks from hallucinations, basic errors and coming regulation Continue Reading

By

• Stephen Pritchard

AI compliance: Dealing with data change and proliferation

Podcast: We talk with Vigitrust CEO Mathieu Gorge about staying on top of compliance and artificial intelligence, where the danger is data that changes during AI processing and can also proliferate Continue Reading

By

• Antony Adshead, Storage Editor

Gov.uk Wallet open to public sector bodies

Government departments can soon begin to add documents to Gov.uk Wallet, as the Government Digital Service publishes guidance for public sector bodies on how to use the smartphone app Continue Reading

By

• Lis Evenstad

UK biometric surveillance exists in ‘legal grey area’

The rapid proliferation of ‘biometric mass surveillance technologies’ throughout the UK’s public and private sectors is taking place without legal certainty or adequate safeguards for the public Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Maturing UK fintechs increase tech and cyber security hiring

Increased hiring reflects that fintechs are maturing and now require more cyber security and compliance experts Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Building resilient cyber threat intelligence communities

Cyber threat intelligence is no longer a luxury: intelligence sharing communities must mature, and there are many common lessons to learn. Continue Reading

By

• Rob Dartnall, SecAlliance

Security vs. usability: Why rogue corporate comms are still an issue

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Elliott Wilkes, ACDS

When leaders ignore cyber security rules, the whole system weakens

The US ‘Signalgate’ debacle is a case study in how security collapses when leadership treats basic rules as optional Continue Reading

By

• Raihan Islam, defineXTEND

Preparation and appreciation – the human factor in incident response

A typical incident response effort is highly technical, so where do soft skills come in and how do you know how effective your team is? We look at a measurement option and the human consideration in these scenarios Continue Reading

By

• Dan Raywood

What are the best practices for securing AWS tech stacks?

An AWS tech stack can aid business growth and facilitate efficient operations, but misconfigurations have become all too common and stall this progress Continue Reading

By

• Nicholas Fearn

Podcast: RSA 2025 – AI’s risk surface and the role of the CISO

We review RSA 2025 with Vigitrust CEO Mathieu Gorge who looks at the impacts on compliance of AI’s expanding risk surface, the role of the CISO, and a changed supplier approach Continue Reading

By

• Antony Adshead, Storage Editor

UK Fraud Bill targets benefit claimants for mass surveillance

The UK government’s proposed Fraud Bill will disproportionately place millions of benefit claimants under constant surveillance, creating a two-tier system where people are automatically suspected of wrongdoing for seeking welfare Continue Reading

By

• Anna Dent

Strong fintech security posture at risk via third-party weak links

Despite having a strong security posture, the financial technology sector could be open to attack via third parties Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Chinese cyber spooks lure laid-off US government workers

A Washington DC-based think tank has published evidence that Chinese intelligence services have been running a network of digital ‘front’ companies targeting laid-off government workers as recruits Continue Reading

By

• Alex Scroxton, Security Editor

What is compliance risk?

Compliance risk is an organization's potential exposure to legal penalties, financial forfeiture and material loss, resulting from its failure to act in accordance with industry laws and regulations, internal policies or prescribed best practices. Continue Reading

By

• Katie Terrell Hanna
• Francesca Sales

NHS asks suppliers to sign up to cyber covenant

NHS digital and security leaders call on their suppliers to commit to a cyber security charter as the health service works to improve its resilience in the face of growing threat levels Continue Reading

By

• Alex Scroxton, Security Editor