Insights

Answers, not alarms.

Research, detection engineering notes and plain-English explanations for the questions UK boards, IT managers and security leads actually ask. One substantial piece a week; a short threat brief in between.

Get the fortnightly briefing

Insights29 September 2026

Citrix NetScaler again: two exploited zero-days, and why patching is only half the job

Two critical flaws in Citrix NetScaler ADC and Gateway are being exploited in the wild, both scored 9.5, both reachable by an unauthenticated attacker on the internet-facing side of the box. CISA has given federal agencies until 30 September. Here is what the flaws are, why the honest instruction from several national authorities is to take the appliance offline, and why installing the update does not, on its own, get an intruder out.

Peter Bassill10 min read · 16 reads

Insights27 September 2026

One click, one new administrator: the Elementor CSRF flaw explained

A flaw in Elementor 4.3.0 and 4.3.1 lets anyone who can get a WordPress administrator to click a link create themselves an administrator account. No JavaScript, no form, no exploit kit: a plain link. Around two million sites were exposed. Here is how it works, why it is worse than it sounds, what to do this morning, and the Wazuh rules our SOC is using to see it.

Peter Bassill10 min read · 9 reads

Guide15 September 2026

What is a managed SOC, and what does SOC as a service cost in the UK?

A managed SOC is a security operations centre you subscribe to rather than build. Here is what you are actually buying, what it costs in the UK compared with building your own, how the market prices it, and how to choose a provider you will not regret a year later.

Peter Bassill13 min read · 17 reads

Insights29 September 2026

Why an AI SOC means company owners can sleep better at night

Attackers now use AI to move at machine speed, and they time their work for Friday evenings and weekends, when most security teams are at their thinnest. Our own data for September shows exactly that pattern. Here is what an AI-assisted SOC actually does about it, what it does not do, and why the plain answer is the reassuring one.

Peter Bassill12 min read · 5 reads

Insights27 September 2026

The supplier you stopped using still has your data

Revolut's customers have had their details taken twice in a month, and on neither occasion was Revolut hacked. The second time, the data walked out of a brokerage Revolut had finished migrating away from over a year ago. Supply chain risk does not end when the contract does, and this is what to do about it.

Peter Bassill13 min read · 8 reads

Insights18 September 2026

The phishing page that let Microsoft do the reconnaissance

I spent a few minutes yesterday poking at a phishing page that behaved exactly like the real Microsoft 365 sign-in, because it was the real Microsoft 365 sign-in, relayed through the attacker's server. What made it worth writing about was not the theft of credentials but the quiet way it used Microsoft's own sign-in endpoints to work out, before a password was ever typed, whether it had caught a real account at the right company.

Peter Bassill13 min read · 11 reads

Insights18 September 2026

Your supplier was breached. What did you do before it happened?

A London property manager has told its customers that bank details, passwords and lockbox codes may have been taken through a cloud reporting tool. The tool was the supplier's; the decision about what it could read was not. Here is how to review your supply chain, write it down, and be able to show your working when the inevitable happens.

Peter Bassill18 min read · 21 reads

Insights15 September 2026

Iranian state spyware ‘CHOSEN BRICK’: what it does and what to do

The NCSC, FBI and AIVD have exposed Iranian spyware — CHOSEN BRICK — used to surveil dissidents, activists and journalists. What the campaign does, who is really at risk, and the practical steps that protect the people targeted and the organisations around them.

Peter Bassill11 min read · 88 reads

Threat briefing4 September 2026

Trade bodies and membership organisations threat intelligence report — 29 August – 4 September 2026

Trade bodies and membership organisations face a phishing-first threat picture: 30% of UK charities reported a breach or attack in the past year, and the newly listed Starlette vulnerability reaches the FastAPI back-ends behind many membership portals.

Peter Bassill8 min read · 6 reads

Threat briefing4 September 2026

Defence and government contractors threat intelligence report — 29 August – 4 September 2026

State-linked reconnaissance leads the defence and R&D picture — Volt Typhoon probing contractor login portals and APT41 active across 15+ industries — alongside KEV additions for JFrog Artifactory and BerriAI LiteLLM that bear directly on build chains and AI workflows.

Peter Bassill8 min read · 6 reads

Threat briefing4 September 2026

Healthcare threat intelligence report — 29 August – 4 September 2026

Healthcare's week is defined by Boston Scientific's global network outage, the McKesson disclosure of roughly 284 million patient-related records exfiltrated via third-party applications, and Medusa ransomware passing 500 victims.

Peter Bassill8 min read · 12 reads

Threat briefing4 September 2026

Retail threat intelligence report — 29 August – 4 September 2026

Retail remains in a social-engineering-driven era: the Scattered Spider help-desk doctrine, long-running Magecart skimming against major-card payment flows, and the SonicWall SMA1000 zero-day chain dominate the week.

Peter Bassill8 min read · 6 reads

223 articles · page 1 of 19