Security policy and user awareness

Researchers firm up ShinyHunters, Scattered Spider link

ReliaQuest researchers present new evidence that firms up a potential link, or outright partnership, between the ShinyHunters and Scattered Spider cyber gangs Continue Reading

By

• Alex Scroxton, Security Editor

UK work visa sponsors are target of phishing campaign

Mimecast identifies a phishing campaign targeting UK organisations that sponsor migrant workers and students, opening the door to account compromise and visa fraud Continue Reading

By

• Alex Scroxton, Security Editor

What boards should look for in a CISO

The role of the chief information security officer has evolved dramatically over the years – and will continue to do so. What should boards really looking for when hiring a security leader in 2025? Continue Reading

By

• Rinki Sethi, Upwind Security

ShinyHunters Salesforce cyber attacks explained: What you need to know

Computer Weekly gets under the skin of an ongoing wave of ShinyHunters cyber attacks orchestrated via social engineering against Salesforce users Continue Reading

By

• Alex Scroxton, Security Editor

How CISOs can adapt cyber strategies for the age of AI

Traditional security measures may not be able to cope with the AI reality. In order to safeguard enterprise operations, reputation and data integrity in an AI-first world, security leaders need to rethink. Continue Reading

By

• Martin Riley, Bridewell Consulting

OpenAI closes gap to artificial general intelligence with GPT-5

As OpenAI’s latest large language model delivers smarter AI, experts are wary of the risks GPT-5 poses to human creativity Continue Reading

By

• Cliff Saran, Managing Editor

Black Hat USA: Startup breaks secrets management tools

Researchers at Cyata, an agentic identity specialist that has just emerged from stealth, found 14 CVEs in the widely used CyberArk Conjur and HashiCorp Vault enterprise secrets management platforms Continue Reading

By

• Alex Scroxton, Security Editor

Cyber criminals would prefer businesses don’t use Okta

Okta details a phishing campaign in which the threat actor demonstrated some unusually strong opinions on what authentication methods they would like their targets to use Continue Reading

By

• Alex Scroxton, Security Editor

Companies House ID verification to start in November 2025

Companies House plans to start vetting director identities from mid-November, but its reliance on the troubled One Login digital identity service may be cause for concern Continue Reading

By

• Alex Scroxton, Security Editor

NCSC updates CNI Cyber Assessment Framework

Updates to the NCSC’s Cyber Assessment Framework are designed to help providers of critical services better manage their risk profiles Continue Reading

By

• Alex Scroxton, Security Editor

Australian scaleup to bring AI-led data protection to the MoD

The UK’s Ministry of Defence is embracing AI-led data protection in the wake of a major privacy breach, enlisting Australian cyber firm Castlepoint Systems to oversee sensitive records Continue Reading

By

• Alex Scroxton, Security Editor

Black Hat USA: Halcyon and Sophos tag-team ransomware fightback

Ransomware experts Halcyon and Sophos are to pool their expertise in ransomware, working together to enhance data- and intelligence-sharing and bringing more comprehensive protection to customers Continue Reading

By

• Alex Scroxton, Security Editor

Proliferation of on-premise GenAI platforms is widening security risks

Research finds increased adoption of unsanctioned generative artificial intelligence platforms is magnifying risk and causing a headache for security teams Continue Reading

By

• Alex Scroxton, Security Editor

Scattered Spider tactics continue to evolve, warn cyber cops

CISA, the FBI, NCSC and others have clubbed together to update previous guidance on Scattered Spider's playbook, warning of new social engineering tactics and exploitation of legitimate tools, among other things Continue Reading

By

• Alex Scroxton, Security Editor

Apple pushes almost 30 security fixes in mobile update

Apple pushes what will likely be the last major security update to its current iPhone and iPad operating systems, fixing 29 vulnerabilities in its mobile ecosystem Continue Reading

By

• Alex Scroxton, Security Editor

MS Authenticator users face passkey crunch time

The deadline for moving to passkeys in Microsoft Authenticator is rapidly approaching, and users are advised to take action now Continue Reading

By

• Alex Scroxton, Security Editor

AI-enabled security pushes down breach costs for UK organisations

Organisations that are incorporating AI and automation into their cyber security practice are seeing improved outcomes when incidents occur, according to an IBM study Continue Reading

By

• Alex Scroxton, Security Editor

Cyber governance practices are maturing - and reshaping leadership expectations

How technology leaders can help organisations shape their cyber governance practices and strengthen their collaboration across the executive team Continue Reading

By

• Susanne Alfs, Cyber4Directors

Burnout burden: why CISOs are at breaking point, what needs to change

CISOs face growing burnout as their roles expand beyond security, with high stress, low organisational authority, and short tenure. AI can help but change requires autonomy Continue Reading

By

• Tim Grieveson

What is an input validation attack?

An input validation attack is any malicious cyberattack that involves an attacker manually entering strange, suspicious or unsafe information into a normal user input field of a target computer system. Continue Reading

By

• Rahul Awati
• Laura Fitzgibbons

Dutch researchers use heartbeat detection to unmask deepfakes

Dutch method to counter deepfakes analyses blood flow patterns in faces that current deepfake generation tools cannot yet replicate Continue Reading

By

• Kim Loohuis

Monzo’s £21m fine highlights banks’ cyber security failures

Monzo’s recent fine over failings in its customer verification processes highlights wider security and privacy shortcomings in the personal finance world Continue Reading

By

• Nicholas Fearn

Is it time to rethink the OWASP Top 10?

The OWASP Top 10 serves as a key reference point for developers and security professionals, but with a new iteration on the horizon, we need to confront a hard truth: has it lost its effectiveness, or have we failed to implement it meaningfully? Continue Reading

By

• Tim Mackey, Black Duck

Microsoft confirms China link to SharePoint hacks

Microsoft confirms two known China-nexus threat actors, and one other suspected state-backed hacking group, are exploiting vulnerabilities in SharePoint Server Continue Reading

By

• Alex Scroxton, Security Editor

Chinese cyber spies among those linked to SharePoint attacks

Exploitation of the ToolShell RCE zero-day in Microsoft SharePoint continues to gather pace, with evidence emerging of exploitation by nation state-backed threat actors Continue Reading

By

• Alex Scroxton, Security Editor

UK government to bring in ransomware payment ban

Critical infrastructure operators, hospitals, local councils and schools will be among those banned from giving in to cyber criminal demands as the UK moves forward with proposals to address the scourge of ransomware Continue Reading

By

• Alex Scroxton, Security Editor

UK government signs partnership with OpenAI

Deal sees firm behind ChatGPT collaborate with government on AI security research to explore investment opportunities Continue Reading

By

• Lis Evenstad

The Security Interviews: Jason Nurse, University of Kent

Jason Nurse, reader in cyber security at the University of Kent, discusses the psychological side of cyber and online safety, why placing blame on users as ‘the weakest link’ is wrong – and why security pros should think about user needs more Continue Reading

By

• Danny Palmer

Meet the deepfake fraudster who applied to work at a deepfake specialist

A recruiter at voice fraud specialist Pindrop had a shock when they came face-to-face with the same deepfake job candidate not once, but twice. Hear their story and learn how to start to protect your hiring process Continue Reading

By

• Alex Scroxton, Security Editor

Scattered Spider playbook evolving fast, says Microsoft

Microsoft warns users over notable evolutions in Scattered Spider’s attack playbook, and beefs up some of the defensive capabilities it offers to customers in response Continue Reading

By

• Alex Scroxton, Security Editor

Current approaches to patching unsustainable, report says

Organisations are struggling to prioritise vulnerability patching appropriately, leading to situations where everything is a crisis, which helps nobody, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Brits clinging to Windows 10 face heightened risk, says NCSC

Businesses and consumers alike may not feel the need to upgrade to Windows 11 as its predecessor approaches end-of-life, but they are putting their own security at risk, says the NCSC Continue Reading

By

• Alex Scroxton, Security Editor

Four arrested in M&S cyber attack investigation

Police have made four arrests in connection with a trio of cyber attacks on UK retailers Marks & Spencer, Co-op and Harrods Continue Reading

By

• Alex Scroxton, Security Editor

Qantas details impact of data breach on 5.7 million customers

Australian flag carrier begins notifying millions of individuals after a cyber attack on a call centre, confirming that while financial and passport details are safe, a significant volume of other personal information was compromised Continue Reading

By

• Aaron Tan, Informa TechTarget

M&S calls for mandatory ransomware reporting

The government should extend ransomware reporting mandates to businesses to help gather more intelligence and better support victims, says M&S chairman Archie Norman Continue Reading

By

• Alex Scroxton, Security Editor

Gartner’s view on AI security: A Computer Weekly Downtime Upload podcast

We speaker to Gartner's Nader Heinen about why access control should be built into enterprise AI Continue Reading

By

• Cliff Saran, Managing Editor

Digital warfare is blurring civilian front lines

Singapore’s defence cyber chief warns that the traditional lines between military conflict and civilian life are blurring, with adversaries now targeting civilian systems and using AI to put the threat landscape on steroids Continue Reading

By

• Aaron Tan, Informa TechTarget

US CISA agency extends Iran cyber alert, warns of CNI threat

The US Cybersecurity and Infrastructure Security Agency reiterates guidance for operators of critical national infrastructure as it eyes the possibility of cyber attacks from Iran Continue Reading

By

• Alex Scroxton, Security Editor

Scattered Spider link to Qantas hack is likely, say experts

A developing cyber attack at Australian airline Qantas that started at a third-party call centre is already being tentatively attributed to Scattered Spider. Find out more and learn about the next steps for those affected Continue Reading

By

• Alex Scroxton, Security Editor

Dutch study uncovers cognitive biases undermining cyber security board decisions

Dutch research reveals how cognitive biases can lead to catastrophic security decisions Continue Reading

By

• Kim Loohuis

Better governance is required for AI agents

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions Continue Reading

By

• Mandy Andress, Elastic

Ciaran Martin: AI might disturb attacker-defender security balance

The founder of the National Cyber Security Centre spoke with Computer Weekly at Infosecurity Europe 2025 about how artificial intelligence might disturb the attacker-defender security equilibrium Continue Reading

By

• Brian McKenna, Enterprise Applications Editor

Latest Citrix vulnerability could be every bit as bad as Citrix Bleed

A Citrix NetScaler flaw that was quietly patched earlier in June is gathering widespread attention after experts noted strong similarities to the Citrix Bleed vulnerability that caused chaos in late 2023 Continue Reading

By

• Alex Scroxton, Security Editor

Cyber Skills Today for Economic Growth Tomorrow

Cyber security is a critical enabler of economic growth, fostering a stable environment for innovation and investment, according to the Cyber Security and Resilience Bill: policy statement that ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Police to gain powers to grab online data when they seize phones and laptops

Academics and civil liberties experts say that proposed ‘authoritarian’ powers to allow police to trawl online and cloud services used by owners of seized devices should require approval from a judge Continue Reading

By

• Bill Goodwin, Investigations Editor

Cyber action plan kicks off to ‘supercharge’ UK security sector

UK government says its cyber growth action plan will provide a large boost to Britain’s security industry as it sets out to create a roadmap for future growth Continue Reading

By

• Alex Scroxton, Security Editor

NHS IT the big winner in Reeves’ Spending Review

The chancellor of the exchequer has significantly upped spending on digital and technology initiatives in the current Spending Review period, with the NHS receiving a 50% tech funding increase Continue Reading

By

• Alex Scroxton, Security Editor

Human vs digital therapy: AI falls short when IT pros need help

Stressed IT and cyber professionals are turning to AI chatbots for support, but is handing people's mental wellbeing over to algorithms really such a bright idea? Continue Reading

By

• Malcolm Hanson, PTSD Revolution

Investor behaviour in the wake of cyber's 'black swan' moment

So-called Black Swan events expose the blind spots in even the most sophisticated forecasting models, signaling a need to rethink how businesses, and those investing in them, quantify and prepare for cyber risk. Continue Reading

By

• Ed Bartlett, Hicomply

HMRC phishing breach wholly avoidable, but hard to stop

A breach at HMRC saw innocent taxpayers tricked into letting scammers impersonate them through simple phishing attacks leading to account takeover. Such attacks are avoidable, but hard to stop Continue Reading

By

• Alex Scroxton, Security Editor

CISOs: Don't block AI, but adopt it with eyes wide open

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Mike Gillespie and Ellie Hurst, Advent IM

Put ROCs before SOCs, Qualys tells public sector

Putting risk operations before security operations may help government agencies and other public sector bodies better manage the myriad threats they face, and make better decisions for the security of all Continue Reading

By

• Alex Scroxton, Security Editor

NCSC sets out how to build cyber safe cultures

The UK’s National Cyber Security Centre has published guidance for security teams and leaders on how to foster accessible and appropriate cyber security cultures in their organisations Continue Reading

By

• Alex Scroxton, Security Editor

Fortifying the future: The pivotal role of CISOs in AI operations

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Aditya K Sood, Aryaka

Infosecurity 2025: SMEs feel on their own in the face of cyber attacks

Project findings to be presented at Infosecurity Europe 2025 highlight vulnerability of SMEs to cyber attack Continue Reading

By

• Brian McKenna, Enterprise Applications Editor

Preparing for AI: The CISO’s role in security, ethics and compliance

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Elliott Wilkes, ACDS

SailPoint charts course for AI-driven identity security

SailPoint is driving the use of agentic AI in identity security with its Harbor Pilot offering while preparing to help enterprises govern and secure AI agents Continue Reading

By

• Aaron Tan, Informa TechTarget

US cyber agency CISA faces stiff budget cuts

CISA is one of several US agencies facing drastic budget cuts under the Trump administration Continue Reading

By

• Alex Scroxton, Security Editor

The hidden security risks of open source AI

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Brian Fox, Sonatype

Cyber and digital get over £1bn to enhance UK’s national security

The government has set out plans to spend over a billion pounds on digital and cyber warfare capabilities to enhance the UK’s ability to defend itself and fight offensive wars Continue Reading

By

• Alex Scroxton, Security Editor

AI security: Balancing innovation with protection

The Security Think Tank considers how CISOs can best plan to facilitate the secure running of AI and Gen AI-based initiatives and ensure employees do not inadvertently leak data or make bad decisions. Continue Reading

By

• Javvad Malik, KnowBe4

Dutch businesses lag behind in cyber resilience as threats escalate

While non-IT business professionals in the middle of their careers face the most disruption from AI, professionals in the IT services sector and their employers must prepare for change Continue Reading

By

• Kim Loohuis

How cyber security professionals are leveraging AWS tools

It’s now essential for IT security teams to have oversight of cloud computing, and AWS offers a plethora of tools to make managing it easier. Find out how cyber pros are using them in the wild Continue Reading

By

• Nicholas Fearn

Cloud migration demands contractual safeguards and clear strategy

Cyber security experts urge organisations to define clear objectives, understand shared security models and implement strong data governance when migrating workloads to the cloud Continue Reading

By

• Aaron Tan, Informa TechTarget

Signalgate is a signal to revisit security onboarding and training

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Mike Gillespie and Ellie Hurst, Advent IM

Zero-trust is redefining cyber security in 2025

The future of zero-trust is about embedding resilience into every facet of an organisation. To achieve this, SRM leaders must reimagine their strategies to address emerging challenges and prioritise key areas. Continue Reading

By

• Dale Koeppen, Gartner

RSAC rewind: Agentic AI, governance gaps and insider threats

AI was naturally a major theme of this year's RSAC conference, but we maybe failed to anticipate how it is coming to dominate every conversation. Continue Reading

By

• James Robinson, Netskope

AI and compliance: Staying on the right side of law and regulation

Without careful planning, AI projects risk blundering into a legal and regulatory minefield. We look at the risks from hallucinations, basic errors and coming regulation Continue Reading

By

• Stephen Pritchard

US makes fresh indictments over DanaBot, Qakbot malwares

US charges the operators of two malwares, DanaBot and Qakbot, whose actions led to millions of dollars worth of cyber theft and fraud Continue Reading

By

• Alex Scroxton, Security Editor

Armed forces charity steps in to address cyber mental health crisis

CIISec and military charity PTSD Resolution hope to address a gathering mental health crisis among frontline cyber professionals Continue Reading

By

• Alex Scroxton, Security Editor

Building resilient cyber threat intelligence communities

Cyber threat intelligence is no longer a luxury: intelligence sharing communities must mature, and there are many common lessons to learn. Continue Reading

By

• Rob Dartnall, SecAlliance

Security vs. usability: Why rogue corporate comms are still an issue

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Elliott Wilkes, ACDS

When leaders ignore cyber security rules, the whole system weakens

The US ‘Signalgate’ debacle is a case study in how security collapses when leadership treats basic rules as optional Continue Reading

By

• Raihan Islam, defineXTEND

Preparation and appreciation – the human factor in incident response

A typical incident response effort is highly technical, so where do soft skills come in and how do you know how effective your team is? We look at a measurement option and the human consideration in these scenarios Continue Reading

By

• Dan Raywood

What are the best practices for securing AWS tech stacks?

An AWS tech stack can aid business growth and facilitate efficient operations, but misconfigurations have become all too common and stall this progress Continue Reading

By

• Nicholas Fearn

NCSC: Russia’s Fancy Bear targeting logistics, tech organisations

The NCSC and its partner agencies have blown the whistle on an extensive campaign of malicious cyber attacks orchestrated by the Russian state Fancy Bear operation Continue Reading

By

• Alex Scroxton, Security Editor

Podcast: RSA 2025 – AI’s risk surface and the role of the CISO

We review RSA 2025 with Vigitrust CEO Mathieu Gorge who looks at the impacts on compliance of AI’s expanding risk surface, the role of the CISO, and a changed supplier approach Continue Reading

By

• Antony Adshead, Storage Editor

Ransomware attacks dropped by a third last month

Reported ransomware attacks eased off during April following a dramatic spike in the first quarter of 2025 Continue Reading

By

• Alex Scroxton, Security Editor

How to create a remote access policy, with template

Remote work, while beneficial, presents numerous security risks. Help keep your organization's systems safe with a remote access policy. Continue Reading

By

• Paul Kirvan

Chinese cyber spooks lure laid-off US government workers

A Washington DC-based think tank has published evidence that Chinese intelligence services have been running a network of digital ‘front’ companies targeting laid-off government workers as recruits Continue Reading

By

• Alex Scroxton, Security Editor

CW APAC – Trend Watch: API management

Application programming interfaces are subject to the pros and cons of emerging technologies. In this handbook, focused on API management in the Asia-Pacific region, Computer Weekly looks at governance and security, gateway tools, and strategic approaches to creating an automation framework Continue Reading

NHS asks suppliers to sign up to cyber covenant

NHS digital and security leaders call on their suppliers to commit to a cyber security charter as the health service works to improve its resilience in the face of growing threat levels Continue Reading

By

• Alex Scroxton, Security Editor

Is IPSIE the game changer that SaaS security demands?

It started with an announcement in October 2024, and now it seems the vision of secure identity in the enterprise is becoming a reality. We look at the prospects for IPSIE Continue Reading

By

• Dan Raywood

Scattered Spider retail attacks spreading to US, says Google

Google’s threat intel analysts are aware of a number of in-progress cyber attacks against US retailers linked to the same Scattered Spider gang that supposedly attacked M&S and Co-op in the UK Continue Reading

By

• Alex Scroxton, Security Editor

It's time to get to grips with DORA

It's not really a surprise so many organisations missed the EU's DORE compliance deadline, but there's no excuse for delaying, says Azul EMEA VP James Johnston Continue Reading

By

• James Johnston, Azul

New security paradigm needed for IT/OT convergence

Industry leaders and policymakers highlight growing cyber threats from the integration of IT and operational technology systems, calling for collaboration and regulatory frameworks to protect critical systems, among other measures Continue Reading

By

• Aaron Tan, Informa TechTarget

May Patch Tuesday brings five exploited zero-days to fix

Microsoft fixes five exploited, and two publicly disclosed, zero-days in the fifth Patch Tuesday update of 2025 Continue Reading

By

• Alex Scroxton, Security Editor

Australian data breaches hit record high in 2024

More than 1,100 data breaches were reported in Australia last year, a 25% jump from 2023, prompting calls for stronger security measures across businesses and government agencies Continue Reading

By

• Aaron Tan, Informa TechTarget

Government will miss cyber resiliency targets, MPs warn

A Public Accounts Committee report on government cyber resilience finds that the Cabinet Office has been working hard to improve, but is likely to miss targets and needs a fundamentally different approach Continue Reading

By

• Alex Scroxton, Security Editor

Preparing for post-quantum computing will be more difficult than the millennium bug

The job of getting the UK ready for post-quantum computing will be at least as difficult as the Y2K problem, says National Cyber Security Centre CTO Ollie Whitehouse Continue Reading

By

• Bill Goodwin, Investigations Editor

US tells CNI orgs to stop connecting OT kit to the web

US authorities have released guidance for owners of critical national infrastructure in the face of an undisclosed number of cyber incidents Continue Reading

By

• Alex Scroxton, Security Editor

UK government websites to replace passwords with secure passkeys

Government websites are to replace difficult-to-remember passwords with highly secure passkeys that will protect against phishing and cyber attackers Continue Reading

By

• Bill Goodwin, Investigations Editor

Europe leads shift from cyber security ‘headcount gap’ to skills-based hiring

Research from Sans Institute reveals European organisations are leading a global shift in hiring priorities, driven by regional regulatory frameworks Continue Reading

By

• Kim Loohuis

Oxford Uni adds cyber resilience module to MBA programme

Oxford University’s Saïd Business School is working with cyber response specialist Sygnia to help future business leaders get on top of security Continue Reading

By

• Alex Scroxton, Security Editor

Unspoken risk: Human factors undermine trusted platforms

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Aditya K Sood, Aryaka

Beyond the hook: How phishing is evolving in the world of AI

Phishing attacks are evolving. Gone are the days of clumsy, error-ridden emails that were easy to spot – today’s campaigns harness advanced techniques to bypass even the latest defences. A new approach is needed Continue Reading

By

• Isla Sibanda

Signalgate: Learnings for CISOs securing enterprise data

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what CISOs can learn from this potentially fatal error Continue Reading

By

• Todd Thiemann, Principal Analyst

Co-op shuts off IT systems to contain cyber attack

A developing cyber incident at Co-op has forced the retailer to pull the plug on some of its IT systems as it works to contain the attack Continue Reading

By

• Alex Scroxton, Security Editor

M&S systems remain offline days after cyber incident

M&S is still unable to provide contactless payment or click-and-collect services amid a cyber attack that it says has forced it to move a number of processes offline to safeguard its customers, staff and business Continue Reading

By

• Alex Scroxton, Security Editor

Challenges persist as UK’s Cyber Security and Resilience Bill moves forward

Elements of the Cyber Security and Resilience Bill are welcome but questions remain about how best to act in the face of persistent challenges like geopolitical chaos, threats to critical infrastructure, and technological advances Continue Reading

By

• James Morris, CSBR