Our Co-Founder, Robin Hill tackled the brilliant @yorkshirepost ‘On the Spot’ Q&A and you can see the results here: app.yorkshirepost.co.uk/t/st… #TheYP #YorkshireBusiness #CyberSecurity

Harrods reported around 430,000 customer records taken in September 2025 through a third-party provider. Names, contact details, marketing preferences. No passwords or payment data. Cards get reissued in a week. Six lessons: buff.ly/H7mQxLW

Ransomware groups often post a victim countdown to their Telegram channel before the onion leak site is updated. For that victim's suppliers and customers, that gap is a short head start, but only if someone is watching at the right time. buff.ly/SdZdZZ4

Old breach corpora from 2016 to 2019 get merged, renamed and resold as "new" collections. Naive monitoring counts each repackaging as a fresh finding, so your exposure number rises while nothing has changed. Alert volume is a vanity metric. Triage model: buff.ly/KYfzpj3

Glasgow City Council, June 2025: the servers at the centre of the incident were managed by a third party in the supply chain, not the council. The disruption, the affected residents and the regulatory duty were still the council's: buff.ly/srWXSuT

Not all credential alerts are equal. An old breach record may need a password reset. An infostealer log can mean passwords, browser data and live session cookies were taken from a compromised device. Full triage guide: buff.ly/Y66WDr4

Your supplier’s breach clock does not pause while they wait for forensics. Third-party incidents often reach you through vendors, processors and fourth parties, long after the initial intrusion. Five gaps traditional vendor assurance keeps missing: buff.ly/TufpPv2

A stealer log is more than a password list. System info, screenshots and session data can reveal whether the infected device was managed, BYOD or personal, and whether security controls were even present. Why password resets alone are not enough: buff.ly/4KwkmTO

Discovery is the easy part of attack surface monitoring software. Deciding whether a forgotten staging server is really yours, and who fixes it, is the hard part. 9 questions to ask vendors first. Read the full article here: buff.ly/rHZwBNl

VIP monitoring protects people. EASM protects infrastructure. Confusing the two can leave executives exposed, create monitoring gaps and lead to duplicated spend. We break down the mistakes security teams need to avoid: buff.ly/1Ws9Z1u #VIPMonitoring #CyberSecurity

ServiceNow vulnerabilities are only half the problem. The real question: how many instances do you have facing the internet, who owns them, and which hold production data? Inventory beats advisories. Read the full article here: buff.ly/OMoxhnY

The scariest part of the Manchester Airports breach isn't 8.7 million records. It's that a phishing text can now quote your real number plate, terminal and travel date. Verifiable detail is what makes people click. Read the full article here: buff.ly/ITs22r4

Most PaperCut NG victims did patch. They patched the print server they knew about and missed the two nobody logged. Patching is the easy part, finding every exposed instance is the job. Read the full article here: buff.ly/2uE9RVo

The digital ID risk that matters is not the honeypot. It is the stolen session, the spoofed portal and the supplier you never audited. Exposure usually surfaces months later. Read the full article here: buff.ly/P6RvvSm

In a third party breach, the failure happens on infrastructure you don't control, but the regulatory clock still starts on your side of the contract. Early signals, a 72-hour runbook and the contract fixes. Read the full article here: buff.ly/6wwIDZs

Citrix NetScaler CVE-2026-19490: CVSS 9.3 unauthenticated auth bypass on Gateway and AAA vservers. Not exploited yet. Fixed in 14.1-73.32 and 13.1-63.21. Check your config for samlAction and vpn vserver, then patch. Read full blog here: buff.ly/d2RMTDW

An attacker running recon on your domain does not care what your CMDB says. They walk DNS, read certificate transparency logs and pull your email domain out of stealer logs. The gap between those lists is where incidents start. Read the full article here: buff.ly/gDaS1Yx

GitLab CVE-2026-19478 (CVSS 9.4) exploited within 2 days of disclosure. Unauthenticated GraphQL code injection, can modify or delete public projects. Self-managed only: patch to 18.11.11 / 19.0.8 / 19.1.6 / 19.2.4. Read full blog here: buff.ly/mitO5Zy

CVE-2026-72898: unauthenticated SQLi in Metabase via /api/session/reset_password. CVSS 10.0, exploited as a zero-day, affects 0.58 and above. Downstream: Framework, n8n (136 records), Tally, Kilo Code. Read full blog here: : buff.ly/5q2NQBN

CERT Polska: first confirmed attack pivoting into OT through a private cellular APN. Exposed FortiGate at a wind farm, then a Teltonika router's SSH into an APN with no client isolation. Read full blog here: buff.ly/gFKSxhe

Rapid7's AI-guided agent found a SharePoint chain reaching unauthenticated RCE: CVE-2026-55040 (JWT bypass, 9.1) plus CVE-2026-63520 (BCS .NET type instantiation, 8.1). Read full blog here: buff.ly/RhSQqkR