Filings tagged: Commentary

AI is finding and weaponising vulnerabilities faster than any manual process can triage them. Around 900 new CVEs a day, and only a handful that actually matter. This is a genuine question to other teams: what are you doing about it? Here are the things we do, and where you can tell us yours.

The Treasury has designated four cloud and technology providers as Critical Third Parties to UK finance: Amazon, Google, Microsoft, and Oracle. The same four that dominate the market. The state has effectively named the concentration risk, and that changes the questions your customers ask about lock-in.

A voluntary pledge for big firms sounds like it isn't your problem. But one of its three asks is Cyber Essentials across the supply chain, and that supply chain is you. Here's what to do, and why a certificate is not the same as security.

Nominet's Dispute Resolution Service decided 5,525 fights over .uk domain names across 25 years. We analysed every published decision. This is the story they tell, from the first land-grab to the WIPO handover.

With no statute and no judges, .uk domain disputes grew a genuine body of precedent: 3,365 citations anchored on a dozen home-grown decisions. And the foundations are the cases the brands lost.

From Tuesday, the public record of every .uk domain dispute is hosted by WIPO, Nominet's own search tool is on a retirement path, and the data protection basis for the move is a question nobody has publicly answered.

Big brands win .uk domain disputes 95% of the time or better. Individuals win 64%. And one respondent faced 28 complaints across 14 years and won every single one. What 25 years of decisions say about power in the naming system.

Chrome 150 fixes 382 security flaws, 15 critical, including sandbox escapes and remote code execution. None are being exploited yet, and there is no public proof of concept, which is exactly the window to patch in. For most businesses the browser holds every login that matters, so update it before that window closes.

New research shows attackers now sit undetected on a network for an average of two and a half weeks, and nearly half of firms only find out once data has been stolen. Set against fresh UK police figures on ransomware losses, the lesson is that detection, not just prevention, is where most SMEs are exposed.

A new Civo study finds two-thirds of UK businesses could ditch US cloud providers over sovereignty concerns, yet only 15% have actually moved. The gap is a lock-in problem, and the practical lesson for smaller firms is to make switching possible before you ever need to switch.

Most continuity plans quietly assume a ransomware attacker wants paying, which gives you something to negotiate. The Jaguar Land Rover attribution shows an attack dressed as ransomware that wanted no money at all, just the company on the floor. That changes what recovery has to plan for.

UK Report Fraud figures show only 323 organisations reported a ransomware attack in a year, with £270,000 in losses between them. The real number is far higher. Most victims stay quiet because being named feels like an admission of failure. That silence skews the threat picture everyone relies on, and it is worth deciding your reporting path before an incident, not during one.

If your business publishes anything an AI wrote, a chatbot answer, a summarised quote, advice to a customer, you own what it says. 'The AI got it wrong' is not turning out to be a defence, and a German court has just said so about Google.

On 22 June a US executive order set hard deadlines for federal agencies and their contractors to move to post-quantum cryptography. The interesting part is not the deadline. It is the one task it forces everyone to do first.

The Public Accounts Committee says UK cultural institutions have failed to learn from the British Library attack and remain highly vulnerable. The interesting failure is not technical. It is the belief that being low-profile is a form of protection.

A side project that grew into a million requests a day sits on one free Companies House feed. When that feed paused this month, it was a lesson in supply-chain dependency, and in what good engineering does about it.

The FBI's 2025 internet crime report logged $20.9 billion of reported losses, a 26% rise on 2024. Investment fraud is the largest category at $8.6 billion. Business email compromise is the largest enterprise threat at $3 billion. Ransomware, by reported loss, is smaller than either. The shape of the numbers is the story.

Barclays surveyed 1,000 UK business leaders in April. Sixty-eight per cent plan to spend more on cyber security in the next year. Twenty-six per cent say AI brings new risks they cannot answer. Average spend hits £505,000, but a micro business spends £15,000 and a large one spends £1.3 million. The numbers underneath the headline are the more useful ones.

BNP Paribas spent up to €2 million a year on data copying, transformation, and reconciliation across 64 countries. Adding a new data source took more than a year. The fix, announced this month, was to stop copying the data and let consumers query it where it lives. The principle scales down to any SME with more than one system.

On 2 June the UK launched its first new payment scheme since Faster Payments in 2008. Thirty-one founding members, the big nine banks, GoCardless, TrueLayer, Token.io, Yapily. The target is the £1.5 billion a year that UK merchants pay Visa and Mastercard. Wave one is utilities, government, and charities. Wave two is the rest of e-commerce.

London Tech Week 2026 closed with around £7 billion of announced AI investment, £1.1 billion of it a government hardware plan, £200 million for adoption and skills, and £150 million tied to a fund managed by a former Intel CEO. Most of it goes to large companies. A useful slice is reachable by smaller ones.

Railway, a developer platform spending $24 million a year on Google Cloud, was switched off without warning for eight hours. Uber burned through its 2026 AI budget by mid-April. One Dell employee racked up $3,400 of token costs in a day. The numbers behind 'post-cloud' are real, even if the term is over-marketed.

The government finally announced a statutory defence for security researchers under the Computer Misuse Act. The defence covers around 300 people. The UK has 70,000 cybersecurity professionals. The number you remember from this filing is 0.4%.

Two-thirds of open-source maintainers do not know the Cyber Resilience Act exists. Most UK firms shipping software into the EU haven't checked whether it applies to them. The deadline is December 2027 and the obligations include something most SMEs do not yet produce: a software bill of materials.

Gov.uk Pay is switching its payment processor from Stripe to Adyen for around 1,000 services. The interesting thing is not which provider won. It is that £9 billion of public-sector payments can be moved across at all, because the contract was designed for it.

From Bletchley Park on 27 May, the GCHQ director said the UK has a narrowing window to keep its technological edge, and announced a blueprint for an AI-driven national cyber defence. Read between the speech lines: the supply chain into critical infrastructure is the lever they actually have.

On 18 May the Bank of England, the FCA, and the Treasury jointly told regulated firms that frontier AI now exceeds what a skilled attacker can do. If you sell into financial services, the diligence questions you get this year are going to look different.

A new wave of startups is publishing 'AI-native' org charts where seven named LLM agents do most of the work. The first step isn't restructuring around agents. It's making your business legible enough that anything, a new hire, an auditor, or eventually an agent, could read it and act on it. AI can help you get there. Future agent costs are a reason not to skip past it.

Most AI policies are vendor templates with the company name swapped in. They ban the obvious, permit the vague, and tell you nothing about how the business actually wants AI used. A coherent policy is a short one that takes a position.

The 1990 Computer Misuse Act predates the public web. Reform has been promised for six years. The May 2026 King's Speech finally put it in a bill, bundled into the National Security Bill. Here's what's likely to change and what's still vague.

A lot of guidance is telling UK businesses they need an electronic complaint form by 19 June 2026. The statute doesn't say that. It says facilitate, and gives a form as one example. Here's what's actually required and what isn't.

A year on from the April 2025 retail attacks, the numbers are in. M&S has posted £101.6 million in direct costs and a 16.4% fall in fashion sales. The Cyber Monitoring Centre put the combined bill at £270 million to £440 million. The useful lessons for an SME are the unglamorous ones.

Cifas surveyed 2,000 UK employees at large companies. Nearly a quarter know someone who has fiddled expenses. One in eight know someone who has sold a login. Insider risk is a culture problem before it is a tooling problem.

The NCSC has told UK organisations to prepare for a wave of urgent patches as AI accelerates vulnerability discovery. The same week, NHS England decided the answer was to make its open source repositories private. Only one of those approaches actually fixes anything.

Two-thirds of UK IT leaders say they have an AI exit plan. Nearly half admit switching would seriously disrupt the business. A plan you can't execute is not a plan.

The NCSC has flipped its authentication advice at CYBERUK 2026. Passkeys are now the recommended default, and password plus two-step verification is the fallback. The reasoning is worth understanding.

Tickets closed. Rules written. Logs ingested. The NCSC's Dave Chismon argues most security operations metrics actively make detection worse. The one that counts is whether you spot attacks in time.

The UK's data protection regulator is being restructured under the Data (Use and Access) Act 2025. New board, new CEO, new statutory objectives. The name is the least interesting part.

The biggest overhaul of UK security regulation since 2018 is in committee. MSPs are in scope, incident reporting gets a 24-hour clock, and fines go up to £17 million. Here's what it means in practice.

CVE-2026-2441 is actively being exploited in the wild. A use-after-free bug in CSS handling means a crafted webpage is all it takes. Push the update now.

Western Digital's entire HDD capacity for 2026 is sold out. Cloud is 89% of their revenue. HDD prices are up 46% since September. The window for sensible storage pricing is closing.

Schneier and co have reframed prompt injection as 'promptware': a full 7-stage kill chain. The uncomfortable truth: LLMs can't distinguish instructions from data. This isn't a bug you can patch.

Viva.com sends verification emails missing the Message-ID header. Google Workspace and Zoho reject them. The fix is one line of code.

Microsoft's FY2025 numbers tell a clear story. Azure and M365 are two-thirds of revenue. Windows is about 6%. This is a cloud and productivity company.

Notepad++ had its update service hijacked by state-sponsored attackers. Windows Notepad got a CVSS 8.8 command injection. Two editors, two attack vectors, same lesson.

Global Telnet scanning dropped overnight in January 2026. Days later, a critical telnetd authentication bypass was disclosed. The protocol is old. The lesson is current.