General

Construction firms can keep site phones, tablets and laptops secure without slowing crews by managing devices centrally and making secure settings the default. In practice, construction site device security should combine encryption, strong sign-in controls, prompt software updates, remote management and consistent device setup. NCSC guidance recommends centralised device management,...

Fast-growing recruitment firms can lose control of user access because hiring, role changes and new software often move faster than access-management processes. Common risks include excessive permissions, dormant accounts, shared credentials, unmanaged applications and access that remains active after someone leaves. Each creates another route to candidate or client information...

Managed SOC and MDR overlap more than many comparisons suggest. A Security Operations Centre (SOC) is an operational capability built around people, processes and technology for monitoring, investigating and responding to security events. Managed Detection and Response (MDR) is an outsourced service that provides detection, investigation and response using a...

Yes. An email can contain instructions aimed at an AI assistant rather than the person reading it. Microsoft calls this prompt injection. Attackers can hide instructions in the message body, quoted replies, attachments, metadata, invisible text or encoded content. If an AI assistant processes the email, those instructions may try...

If a web page tells you to copy a command and run it to fix an error or prove you are human, treat it as suspicious. ClickFix is a social-engineering technique that persuades the user to execute an attacker’s command, often through Windows Run, PowerShell, Terminal or another trusted system...

Connecting a third-party application to Salesforce, Microsoft 365 or another SaaS platform can give that application continuing access to business data through OAuth permissions. Microsoft’s recent research shows why those trusted connections need the same scrutiny as user accounts. In campaigns observed from mid-2025 to mid-2026, Microsoft identified activity using...

A Russian state-supported threat group has been using a zero-click technique against vulnerable Zimbra Collaboration Suite installations to steal sensitive email data without requiring users to click a link or open an attachment. On 23 July 2026, the UK’s National Cyber Security Centre and cyber agencies from 15 other countries...

From 1 September 2026, Microsoft Entra ID will automatically enable passkeys for users currently enabled for SMS or voice authentication. When those users next sign in and complete multi-factor authentication, Microsoft’s registration campaign will prompt them to create a passkey. The prompt can initially be postponed, but Microsoft-provided SMS and...

The Bank of England’s July 2026 Financial Stability Report places cyber resilience firmly among the financial sector’s leading concerns. In the Bank’s 2026 H1 Systemic Risk Survey, 82% of respondents identified cyberattack as one of the five risks that could have the greatest impact on the UK financial system. This...

The UK’s July heatwave provided a timely warning for businesses that rely on server rooms, network cabinets and small communications cupboards. By 10 July 2026, the Met Office recorded an unprecedented run of days above 34 degrees. It reported eight days above 34°C during 2026, more than in any previous...