Bob Nicolson

The UK Cyber Team is in Warsaw for the European Cybersecurity Challenge 2025 👩‍💻      It’s bringing together top young talent from 38 countries for challenges in cryptography, forensics and a live attack and defence simulation.      This government funded team delivered with the SANS Institute will showcase advanced skills and solidify the country’s commitment to producing future cyber professionals with exciting careers. 

142

4 Comments

Today we published the government's 🇬🇧 UK Cyber Security Sectoral Analysis 2025. It shows another year of very strong growth for the UK cyber sector: ⬆️ Sector revenue up by 12% ⬆️ Gross Value Added (GVA) up by 21% ⬆️ Employment up by 11% The UK cyber sector is a consistent high performer and we have been measuring this performance since 2017. The compound annual growth rate for sector revenue works out at 13%. While venture capital investment has not grown this year, investors surveyed remain bullish and there has been significant other investment activity in the UK market including mergers, acquisitions, loan and equity funding. https://lnkd.in/ea_fMdez Department for Science, Innovation and Technology / techUK / CyberFirst / National Cyber Security Centre / Plexal Cyber / UK Cyber Security Council / UKC3 - UK Cyber Cluster Collaboration / Cyber Security Academic Startup Programme

123

BREAKING: Middlesbrough Council has allocated £25,000 to cyber security for the next 12 months - safeguarding £300 million in public funds, services, and citizen data. That’s 0.0083% of annual turnover. Or £0.11 per resident. Or roughly the cost of a mid-range firewall and a motivational poster about password hygiene. In an era of ransomware-as-a-service, AI-driven fraud, and cascading supply chain breaches, this is a bold gesture - not toward resilience, but toward plausible deniability. What does £25,000 buy you in 2025? • A phishing simulation, two awareness emails, and a laminated “Think Before You Click” sign • A procurement trail proving “something was done” • A future FOI response that reads: “Cyber security measures were in place at the time.” Obviously tongue in cheek, as hopefully they’ve allocated more budget and resources toward cyber security than this, but it got my attention anyway. :) #CyberSecurity #LocalGovernment #DigitalRisk #SymbolicSpending #Middlesbrough #PublicSectorPriorities #Procurement #Accountability #LinkedInIrony

204

82 Comments

❗New Research - Cyber Security in CNI 2025❗ At last week's CNI Cyber Security Summit, we launched our annual research looking at the top cyber threats, trends and challenges facing UK CNI organisations in 2025. Now in it's fifth consecutive year, the research surveyed over 600 respondents across critical sectors. Some of our key findings were: 👉95% of organisations surveyed have experienced a data breach 👉41% of CNI organisations rank data protection as one of their biggest security challenges. 👉37% of CNI organisations have experienced costs in excess of £500,001 due to ransomware Read more ➡️ https://lnkd.in/eC8ceFsQ #CNIResearch2025 #CyberSecurity

28

1 Comment

Companies House has confirmed that compulsory identity verification for directors, LLP members and PSCs will begin on 18 November 2025, with Personal Identification Codes tied to confirmation statements and new appointments. This is a big step for the UK’s corporate register. Stronger identity at the point of control helps close gaps that enable fraud and opaque ownership. But success will come down to execution. What matters next: • Treat this as more than a filing change. Build it into director onboarding and governance, just as you would KYC. • Keep it simple for legitimate users. GOV.UK One Login and authorised corporate service providers both need to deliver a smooth, secure experience. • Plan early. Map your first confirmation statement after 18 November, brief directors and PSCs, and test your process well ahead of the deadline. Identity is a foundation, not a box-ticking exercise. Done well, these checks will strengthen trust in UK business without creating unnecessary friction for genuine people. https://lnkd.in/en7SttQk

42

1 Comment

LDC-backed FSP has acquired Stratia Cyber, a provider of consultancy cyber security services. This acquisition will further enhance FSP's ability to deliver end-to-end cyber protection and defence for clients. Read more here: https://lnkd.in/eVrC4DgY #TrustedwithAmbition

30

1 Comment

NEW: We have fined DPP Law Ltd £60,000 for cyber attack that led to highly sensitive and confidential information being published on the dark web. ❔ What happened? In June 2022, DPP suffered a cyber attack which affected access to the firm’s IT systems for over a week. A third-party consulting firm established that a brute force attempt gained access to an administrator account that was used to access a legacy case management system. This enabled cyber attackers to move laterally across DPP’s network and take over 32GB of data, a fact DPP only became aware of when the National Crime Agency contacted the firm to advise information relating to their clients had been posted on the dark web. DPP did not consider that the loss of access to personal information constituted a personal data breach, so did not report the incident to the ICO until 43 days after they became aware of it. We found DPP failed to put appropriate measures in place to ensure the security of personal information held electronically. This failure enabled cyber hackers to gain access to DPP’s network, via an infrequently used administrator account which lacked multi-factor authentication, and steal large volumes of data. DPP specialises in law relating to crime, military, family fraud, sexual offences and actions against the police. The very nature of this work means it is responsible for both highly sensitive and special category data, including legally privileged information. As the information stolen by the attackers revealed private details about identifiable individuals, DPP has a responsibility under the law to ensure it is properly protected. Andy Curry, Director of Enforcement and Investigations (Interim), said: “Our investigation revealed lapses in DPP’s security practices that left information vulnerable to unauthorised access. “In publicising the errors which led to this cyber attack, we are once again highlighting the need for all organisations to continually assess their cybersecurity frameworks and act responsibly in putting in place robust measures to prevent similar incidents. “Our investigation demonstrates we will hold organisations to account for a failure to notify where there was a clear obligation to do so at the time of the underlying incident. Read more about the case including the full monetary penalty notice and lessons organisations can learn from this case: https://lnkd.in/eFwkKTm8

400

25 Comments

Only 48% of UK businesses undertook a formal cyber security audit and review in the past 12 months according to the NCSC Cyber Security breaches survey 2025. Following the recent high profile cyber attacks on UK businesses, it is now more important than ever before for organisations to undertake an in depth review of their cyber security posture. In our recent Executive Briefing Series video Glen Williams (CEO - Cyberfort) and Emily Rees (CFO – Cyberfort) discussed the importance of cyber security audits and why they are crucial for organisations who want to define and understand their cyber risk profiles. Watch the clip below to find out more or click here to watch the full Executive Briefing Series video - https://lnkd.in/g3h5gAas At Cyberfort our NCSC assured consultants work with businesses and public sector organisations to audit and review their data, people, policies, processes and infrastructure against NCSC best practices. To find out more about Cyberfort Cyber Resilience Audit and Review services click here - https://lnkd.in/eX5_Bea6 #cyber #cybersecurity #cyberresilience #cyberaudits #cyberreview #cyberrisk #riskmanagement #cybergovernance

37

1 Comment

This is encouraging to see. "£16 million in new investment has been announced in 2 cyber sector programmes to kickstart growth. Up to £10 million in additional funding will be invested in the CyberASAP programme over the next 4 years, which will support the UK’s cutting edge academic cyber sector to turn their research into commercial companies. The programme has already supported the creation of 34 spin-out companies which have raised over £43 million in investment. The new funding aims to generate a further 25 spin-outs by 2030 and attract £30 million in additional investment. " #ciso #cybersecurity #infosec #startups https://lnkd.in/eSqAat5M

15

Why should yesterday's £3 million fine issued after ransomware attack – be a wake-up call for UK SMEs? The ICO has just fined a UK software provider £3 million following a 2022 ransomware attack, citing poor security practices and avoidable failures that left customer data exposed. 👉 Read the full article here via link in the comments Why is this significant? Because this wasn’t a huge multinational. This was a software provider servicing UK businesses – many of them probably like yours and mine. Here’s what stood out: • ⚠️ The company hadn’t applied security updates three years after known vulnerabilities were published. • 🔐 Weak passwords and lack of multi-factor authentication (MFA) gave attackers a much easier route in. • 📉 The fine wasn’t for being hacked. It was for failing to take reasonable and expected steps to protect sensitive data. If you’re a small or mid sized business owner, you might assume your company isn’t a target. But attackers increasingly target SMEs because they assume – often rightly – that security might be less robust. This case is a reminder that basic cyber hygiene isn’t just good practice – it’s a regulatory and reputational necessity. If you’re not sure where to start: • Review patch management processes. • Make sure MFA is on literally everything. • Audit where sensitive data lives – and who has access. • And if you’re not confident in your current IT provider’s approach to security, challenge it. Happy to chat or point you towards practical resources if you need a starting point. Let’s keep raising the bar – before the ICO or a hacker makes the point for us. #CyberSecurity #SMEs #DataProtection #Leadership #ICO #Ransomware #BusinessResilience

27

1 Comment

Official: New "Cyber Governance - Code of Practice" published today, 8 April 2025, by HM Government. To summarise the five areas detailed in the attached: 1) Cyber Risk Management: gain assurance that cyber risks are identified & owned, eg so your firm "is resilient to cyber security risks from its supply chain and business partners." 2) Cyber Strategy: gain assurance that your firm is implementing "a cyber strategy that aligns with the agreed cyber risk appetite," eg "so resources are allocated effectively to manage the agreed cyber risks." 3) Cyber & People: promote a cyber security culture, eg for each Director to "undertake training to improve your own cyber literacy." 4) Cyber Incident Recovery:  in summary, to gain assurance that your firm has an effective plan for recovery, eg "at least annual exercising of the plan involving relevant internal and external stakeholders" 5) Cyber Oversight:  in summary, to establish a cyber governance structure, eg "Require formal reporting on at least a quarterly basis, set suitable metrics to track, and agree tolerances for each."

15

#CyberAlert | Foundations for OT cyber security We have joined international partners to release guidance for owners and operators on foundations for operational technology cyber security and asset inventory. Read it here: https://lnkd.in/esEEhNFc

54

3 Comments

British govt agents (NCSC) demand action after UK mega-cyberattacks surge 50%. Cyberattacks that meet upper severity thresholds set by the UK government's cyber agents have risen 50 percent in the last year, despite almost zero change in the volume of cases handled. GCHQ's cyber arm, the National Cyber Security Centre's (NCSC), said in its annual review published today that its incident management team handled 429 cyberattacks on organizations in the past 12 months, one fewer than the same reporting period in last year's review. People close to the matter believe many business and technical leaders in the UK are knowledgeable enough and understand what needs to be done, but it just isn't being enacted quickly enough. Ministers also asked the UK's top companies to demand that their suppliers meet the requirements set out by the NCSC's Cyber Essentials standard... Credits to TheRegister by Connor Jones.                [Source in the comments section]

43

7 Comments