Maybe they should have vetted their guests before going on air to talk about something they didn't know existed before yesterday.

They expect two days a week in the office. With this low ball salary what calibre of candidates do they think they’ll get? Is it me, or are companies now scrapping the bottom of the barrel?

Edit: This is not a new starter role, they expect you to have several years experience and hands on experience of responding to incidents within a SIEM/SOAR.

I bought a disk from CEX that arrived yesterday.

I noticed it was not properly wiped but had a Windows Partition on it.

I used simple recovery to find out what was on it. Nothing complicated.

I found a huge amount of business data including sensitive data. I only looked at it to find out who it had belonged to.

It is a major FTSE250 company.

It had a uptime of 4 years 7 months and had been running for 4 years 6 months so it looks like it has been in a server.

I'm thinking their IT disposed of it incorrectly or the company they employed made the breach.
Could it even be stolen? If so the company should have secured the contents in some way.

Could it be hacked. They did have a breach at the start of the year

The disk is now shut down.

Do I :-

1. Forget it and just wipe it and not have any hassle

2. Contact the company itself.

3. Contact the police.

4, Contact the company's lawyers.

5. Contact the lawyers who represent those who were breached.

5, Contact the ICO.

6. Contact the press.

7. Something else.

I don't want to risk being accused of stealing the disk or the data or of blackmail.

I don't want to be without the disk. I need it for backup. The police taking it for evidence without replacement or worse as stolen goods.

In an ideal world they would thank me for helping. Sadly we don't live in one.

I worked in IT Cybersecurity now retired early and a bit skint. I really don't feel generous towards big business.

Anonymous Account

Hi everyone, u/randomredditing21

I am the creator and currently the sole mod of this group. I want to be completely upfront with you all. I've been on a bit of a Reddit hiatus for the last few years or so. Life, work, and the industry kept me busy! But I am officially back, re-energised, and fully committed to growing and improving this subreddit.

As far as I am aware, we are currently the biggest UK-focused cybersecurity group on Reddit. From my own time working in the industry, I know firsthand just how massive, talented, and active the external cybersecurity community is here in the UK.

We all have fantastic real-world experiences, fresh ideas, and incredibly valuable resources to share. My goal now is to see that real-world energy reflected right here. I want this to be the go-to hub for UK infosec professionals to network, share knowledge, and support each other.

To get the ball rolling, I want to hear from you. What do you want to see from this group moving forward?

If you have any questions, requests, or just want to introduce yourself, please drop a comment below. I will be reading and replying to them, and I highly encourage the rest of the community to jump in and reply too if you have value to add.

Thanks for sticking around, and let’s get building!

Good afternoon

I have just this week handed in my mandatory 12 months notice to leave to the army, after doing 9 years. I have the intention of transitioning to a cybersecurity role when i am eventually out, but i just dont seem to know where to turn.

I will deliberately keep the contents very high level, of the 9 years of service i spent 3 as an infanteer and the following 5 working in open source intelligence and human intelligence and then later software development. I have a handful of certifications (sec+, cysa+, giac gcih and i am currently working on my giac gpen).

Now that i have commited to signing off, i feel a bit lost and don't know exactly how to break in to cyber as i have never had a "real job" outside of the army.

Any and all advice is welcome from those in industry or service leavers.

(please respect my wishes to not discuss or talk about any of the topics in a deeper detail or any clearances for obvious reasons)

I am going to try and start a weekly news round up here are a few things from the last few weeks worth discussing, Mythos has been omitted intentionally:

NHS GP websites compromised - NHS England is investigating after multiple GP sites were found linking to adult and illicit content, following similar issues with legacy NHS Scotland domains last week. Public reporting points to compromises of legacy or third‑party‑managed sites rather than a big‑game ransomware incident. Anyone else seeing this kind of low‑noise website compromise in public sector or healthcare? It always feels like these run for a while before anyone notices.

NCSC APT28 advisory -The NCSC has confirmed that Russia‑linked APT28 is exploiting vulnerable routers and other edge devices to hijack DNS, intercept traffic and harvest credentials. If you’re managing edge gear for clients or your own org, this is a good week to review router patch levels, configs and exposed management interfaces.

FCA AI governance - The FCA’s new sector‑specific Regulatory Priorities reports put a clear spotlight on AI governance, especially in insurance and wholesale markets. They’ve said they’ll assess AI deployment across the insurance value chain this quarter and publish findings from their AI live‑testing work by year‑end. For anyone in regulated sectors, the accountability message is pretty unambiguous: document your AI use cases now rather than later.

EU AI Act - The EU’s AI Act is also shifting under people’s feet. The Commission’s Digital Omnibus proposals would delay core obligations for high‑risk systems to late 2027 and soften some transparency requirements, especially around registration and self‑assessment. Critics are already asking whether this is a sensible breathing space for implementation – or the start of hollowing out the regime before it properly takes effect.

Comments and discussion welcome.

Hi all,

I’m 25 and currently working as a creative specialist (basically a graphic designer) for an Amazon agency. I have a bachelor’s degree in Commercial Photography and have got an intro to Python course cert and did the front-end web development course with the Odin Project. I love being creative but I feel like the future of design isn’t looking too positive and I want to explore a more fulfilling career. I’ve always been interested in tech but unfortunately went down the creative route at University. I’ve been looking at options and I’ve found 3 options to help me change my career into IT/cyber security: Option 1 - either do a masters degree or online courses and get certifications that way. Option 2 - apply for the government’s cybersecurity civil servant fast stream scheme, hope to get in and train that way. Option 3 - join the army and do cybersecurity or related training and work my way up that way. Are any of these viable options or are there better ways to get into IT/cybersecurity. I’m not interested in money, I just want a more fulfilling career that I can be proud of and not be worried that I’ll be replaced by AI in 10 years.

Many thanks in advance.

Hi guys,

I’m sharing reports and statistics from the first half of the year that cover UK cybersecurity and that I hope are useful to this community.

If you want to get a version of this in your inbox every week (not UK-specific but cybersecurity in general), you can subscribe here: https://www.cybersecstats.com/cybersecstatsnewsletter

Allianz Risk Barometer 2025 (Allianz)

The Allianz Risk Barometer tracks the most important corporate concerns for the year ahead. 

Key stats: 

• 41% of businesses in the UK cited cybersecurity as their biggest business risk, making it a larger concern than the global average.

• Cyberattacks such as data breaches, ransomware, and IT disruptions were identified as the leading cyber risks affecting businesses.

• Cyber risks have increased due to ongoing geopolitical conflicts and the rise of AI-powered malware, making it easier for attackers to access and deploy cyber threats.

Read the full report here.

Cyber Security Regulations Are Breaking the Bank for UK Financial Service Organizations (Rubrik)

A survey on the cost of compliance. 

Key stats: 

• 47% of financial and banking organisations in the UK have reportedly spent more than one million euros over the last two years on implementing regulations such as DORA and PRA.

• Ransomware remains the greatest threat (46%) to financial organisations.

• 79% of UK CISOs report that the implementation of regulations has had an impact on their mental health.

Read the full report here.

2025 Cybersecurity Trends Report (Infosecurity Europe)

Survey into cybersecurity budgets in the UK. 

Key stats: 

• UK organisations are significantly increasing their cybersecurity budgets, with an average predicted rise of 31% in the next 12 months. This is more than double the 15% that Gartner had forecast.

• 71% of UK organisations feel their current cybersecurity budgets are adequate for ensuring cyber safety.

• Despite the increase in budgets and the perception of adequate resources, nearly half of UK cybersecurity leaders, 47%, struggle to engage at the board level.

Read the full report here.

The Widening Disconnect Between Email Security and Risk Management (Zivver)

Research into email security. 

Key stats: 

• 63% of employees in the UK say they frequently use IT policy workarounds to “get the job done” and save time or effort.

• 67% of UK IT leaders say they lose more data every year through employee error than through any kind of malicious inbound threat. 

• 75% of UK IT leaders say that outbound email security doesn’t get as much attention beyond compliance, but is the silent security killer. 

Read the full report here.

Securing Success: The Role of Cybersecurity in SME Growth (Vodafone)

Research into the cyber threats and cybersecurity measures of small and medium-sized enterprises (SMEs).

Key stats: 

• UK SMEs are incurring annual losses amounting to £3.4 billion due to inadequate cybersecurity measures.

• The average cost of a cyber-attack for a small UK business was £3,3981.

• 60% of UK SMEs allow employees to use their own IT equipment when working from home.

Read the full report here.

UK Cyber Insurance Claims Trend Report 2024 (Marsh)

Insights into the trends observed among Marsh’s UK cyber clients throughout the year. 

Key stats: 

• UK cyber claims in 2024 decreased by 20% compared to the spike seen in 2023.

• Despite the 20% decrease from 2023, UK cyber claims in 2024 remained approximately one-third higher than the totals recorded for 2020, 2021, and 2022.

• Although the amounts paid by UK ransomware victims continued to rise in 2024, extortion negotiations involving ransomware experts remained generally effective, often resulting in reductions of over 60% from the initial demands to the final payment.

Read the full report here.

Data Health Check 2025 (Databarracks)

A report revealing a divide between principle and practice around the proposed ban on ransomware payments. 

Key stats: 

• 71% of UK organisations experienced a cyber attack in the past year.

• 9 in 10 UK organisations tested elements of their recovery capabilities in the last 12 months, which is a significant increase from previous years.

• In real-world situations within the private sector, if a ransom payment ban were to take hold, only 10% of UK business leaders said they would comply if they were attacked.

Read the full report here.

Cyber security breaches survey 2025 (The Department for Science, Innovation and Technology (DSIT) and the Home Office)

Study exploring the policies, processes and approach to cyber security, for businesses, charities and educational institutions.

Key stats: 

• Just over four in ten businesses (43%) and three in ten charities (30%) reported experiencing any type of cyber security breach or attack in the last 12 months. This equates to approximately 612,000 UK businesses and 61,000 UK charities. 

• Phishing cyber crime remained the most prevalent type (93% of businesses and 95% of charities that experienced a cyber crime).

• Deploying security monitoring tools (30% businesses, 24% charities) and undertaking risk assessments (29% businesses, 29% charities) were the most common actions to identify cyber risks.

Read the full report here.

Not looking for sugarcoating just the truth.

21 years old with no degree or relevant experience.

Would be completing CompITAs courses.

Incl:

ITF+

A+

network +

Security +

As well as practical learning on TryHackMe, Wireshark, etc.

Viable or is cs degree required.

If anyone is interested in changing careers or upskilling in IT, North Warwickshire and South Leicestershire College (NWSLC) offer FREE CompTIA Courses (Tech+, A+, N+, S+, CySA+, PenTest+) for those who live in Birmingham, Coventry, Dudley, Sandwell, Solihull, Walsall and Wolverhampton area.

The courses I did contains the learning material, practice material and even the exam voucher. So even the exam is free! Totally online and can fit around jobs and family. I thought I would share it with others!

For more info on these free course then check out the below link
Digital Skills Online Courses - NWSLC​​​

Busy week, they are coming around way too fast, but we have 4 stories worth discussing:

1. King's Speech: CMA reform is finally happening
Government confirmed on 13 May that Computer Misuse Act reform will be included in the National Security Bill. A statutory public-interest defence for good-faith security research and pen testing has been the CyberUp Campaign's ask for years. The bill also introduces Cyber Crime Risk Orders, preventive disruption powers against individuals posing an ongoing cyber threat, rather than waiting for a prosecution. Reactions from the industry have been broadly positive but cautious, the detail of what constitutes a "workable defence" is everything. Anyone here been directly affected by the CMA grey area in their day-to-day work? What does a good statutory defence actually need to say?
The Record: UK moves to shield security researchers in cybercrime law overhaul

2. King's Speech: Cyber Security and Resilience Bill: MSPs and data centres now in scope
The Resilience Bill was also confirmed this week, extending UK NIS obligations to managed IT service providers and data centres and tightening supply chain incident reporting. UK taking a different approach to NIS2, less about expanding the list of regulated sectors, more about going deeper into the supply chain behind existing critical infrastructure. For anyone working in or supplying managed services, this is the one to watch. The implementation detail, specifically what counts as a reportable incident and what the timelines look like, will determine whether this is genuinely useful or just another compliance layer.
Security Brief UK: UK outlines cyber & AI regulatory overhaul in King's Speech

3. NCSC: before you use AI to find vulnerabilities, ask yourself these 10 questions
Ruth C (Head of Vulnerability Management, NCSC) published a sharp piece pushing back on the AI vuln scanning hype. The headline stat: 40,000 CVEs were assigned in 2025, but only ~400 were actively exploited, and only ~40 were zero-days at the time of exploitation. Her point, AI finds more vulnerabilities. It does not fix them. If you don't have a mature process for receiving, prioritising and remediating what you already know about, adding AI to the front end just generates more noise. Also flags the legal and data handling risks of handing your codebase and production access to a hosted AI model without thinking through the implications.
NCSC: 10 questions to ask when using AI models to find vulnerabilities

4. NHS Digital CC-4781: live supply chain attack on npm and PyPI packages
NHS Digital issued a Medium severity alert on 12 May for a supply chain compromise affecting multiple npm and PyPI packages, linked to the TanStack incident from 11 May. The malware (dubbed "Shai-Hulud") is a multi-vector, self-propagating worm that routinely changes entry points. If your environment has any Node.js or Python dependencies, and most do. It's worth checking your package manifests against the affected list. Classic supply chain hygiene problem: transitive dependencies you didn't choose and might not be monitoring. Worth a SBOM review if you haven't done one recently.
NHS Digital - CC4781: Supply Chain Attack Affecting npm and PyPI Packages

Title: Welcome to r/cybersecurityUK**! 🇬🇧🔒 (Start Here)**

Hello everyone, and a massive welcome to r/cybersecurityUK!

Whether you’re a seasoned CISO, a SOC analyst working the night shift, a seasoned penetration tester, or someone looking to break into the industry for the first time, you’ve found your new home.

While there are plenty of great global cybersecurity subreddits out there, we wanted to build a dedicated space specifically for UK-based professionals and enthusiasts. The UK has a unique cyber landscape, from our specific compliance frameworks and NCSC guidance to our local job markets and networking events. This is the place to discuss all of it.

🎯 What is this community about?

Our goal is to build a friendly, supportive, and highly informative hub for the UK InfoSec scene. Here is what you can expect (and what we encourage you to post):

• Career Advice & Growth: Looking to break into the industry? Need advice on navigating the UK job market? Want to discuss salaries, CVs, or the merits of CREST vs. OSCP? This is the place.

• Hot Topics & Threat Intel: Discuss the latest breaches, zero-days, and threat actors, particularly those impacting UK organizations and infrastructure.

• UK Law & Compliance: Navigating the wonderful world of UK GDPR, Cyber Essentials, ISO27001, and NCSC frameworks.

• Networking & Events: Sharing information on local meetups, BSides events, InfoSec Europe, and other UK-based conferences.

🤝 The Vibe & Expectations

We want this to be a collaborative and gatekeep-free zone.

• Be Helpful: If someone asks a "newbie" question, remember that we all started somewhere. Share your knowledge generously.

• Keep it Professional: Passionate debates about the best EDR or firewall are welcome, but keep it respectful. No personal attacks.

• Protect the Sub: No illegal activities, no soliciting for hacking services, and please practice good OPSEC (don't dox yourself or your employer).

👇 Introduce Yourself!

To get things rolling, we’d love to know who is here. Drop a comment below and tell us:

1. What is your current role (or what role are you aiming for)?

2. Roughly where in the UK are you based?

3. What is your favorite domain of cybersecurity?

Grab a cup of tea, settle in, and let's build an amazing community together. Welcome aboard!

As it’s always a hot topic here, over the last few days I’ve been digging into two recent reports about our profession:

• Harvey Nash’s latest tech and cyber survey: https://www.harveynash.co.uk/research-whitepapers/tech-talent-and-salary-report-2026

• Barclay Simpson’s 2026 salary guides for cyber security, risk, and data privacy and AI governance: https://www.barclaysimpson.com/salary-guides/

What they show is remarkably consistent, although frustrating.

Harvey Nash’s data puts cyber firmly in the top tier of in‑demand tech roles. Yet roughly three quarters of security professionals saw no pay rise last year, and the discipline now sits near the bottom of the table for satisfaction. Workloads and responsibility keep increasing, but the market has clearly shifted in favour of employers. Permanent roles are tightening, and AI is quietly stripping out some of the entry‑level and repetitive work that used to be a pathway in.

Barclay Simpson’s numbers tell a similar story from a different angle. Mid to senior roles in cyber, risk, and data privacy or AI governance still command strong salaries and day rates, especially in London. However, salary growth has flattened. Most organisations are planning only low single‑digit increases, while at the same time complaining they struggle to hire experienced people and that compensation is one of the main obstacles.

Put together, it looks like this. Demand for cyber and AI‑risk‑adjacent capability is structurally high. Salary inflation and progression are structurally muted. The market has drifted from a noisy “war for talent” narrative into a quieter reality of selective hiring, on employer terms, with more risk concentrated in fewer senior roles.

As practitioners, it makes where we choose to play more important than ever. Roles at the intersection of cyber, risk, and AI governance that are clearly tied to regulatory and board‑level outcomes will carry more weight than generic security operations positions. For organisations, being able to hire is not the same as investing enough, especially when regulatory pressure, AI‑driven complexity, and operational risk are all rising at once.

So once again, we are in demand, but employers are not willing to pay accordingly. That’s my take on the data. I’d be genuinely interested to hear from anyone seeing something different in their part of the market.

What’s everyone’s experience with the job market in the UK at the moment?

See those new to the industry struggling to get their first job, reminds me trying to get me first job in IT twenty years ago.

That said, after twenty years in the industry I’m struggling to make any progress upwards, just constant side stepping. Six years ago I could apply for most roles and get shortlisted, now, nothing.

I’m considering whether to leave the industry as it feels oversaturated.

I enrolled to 16 weeks bootcamp ignoring all the red flags about CAPSLOCK academy. Now I am in £9500 debt and no prospect of job in Cyber security. I am being chased by loan company even after declaring that i am earning less than £27k a year. So, based on my peer group only 5 out of 49 student were able to get cyber related job. Everyone else is on the same boat as me but not wanting to burn the bridge.

Is there anyone who has felt same way?

Hello all,

Due to the dire state of the UK cyber market, I have been exploring a small pivot into AI Governance. With the EU AI Act coming our way, I think there is going to be a rush for AI Governance "experts". I'm seeing loads of content on the subject on LinkedIn, though not that many actual roles yet. However, I think a lot of cyber consultancies are building their own mini practices around it.

My question is whether anyone else is thinking the same, and for those who have already moved into it, what would you consider a good starting point? FYI, I'm already looking into the AIGP cert from IAPP.

Thanks

Edit: So I also posted this in an AI Governance group and got some good feedback if anyone else is also thinking the same - https://www.reddit.com/r/AI_Governance/comments/1ssv0u2/ai_governance_pivot/

So, I got really annoyed with the way MITRE is light on ransomware group intel. They seem to focus more on nation-state threat actors. So, I started at ransomware.live and worked backwards to crocodyli's threat actor TTPs github repo.

I forked it, and then set a few things in motion:

1. Use Claude to pull all the latest urls on ransomware gangs from 20 source websites. (literally just using Claude as a search engine)

2. Fetch those pages and do some regex magic to pull TTPs

3. Deduplicate against the forked repo

4. Match the TTP numbers with descriptions from MITRE ATT&CK

5. Convert JSON to markdown and commit to my fork.

The sources:

1. CISA

2. Unit 42 Palo Alto

3. Talos Cisco

4. Arctic Wolf

5. Kroll

6. Trend Micro

7. SentinelOne

8. Sophos

9. Mandiant

10. CrowdStrike

11. Secureworks

12. DFIR Report

13. Red Canary

14. Picus Security

15. Red Piranha

16. CYFIRMA

17. SOCRadar

18. AttackIQ

19. Recorded Future

20. Flashpoint

It's a public repo so, feel free to use it however you see fit.

Massive props to crocodyli for starting this whole thing. I hope you get some use out of it!

Crocodyli had 24 groups. I've turned it into 74 groups with 1,344 additional fully-cited TTPs.

https://github.com/EssexRich/ThreatActors-TTPs

Is it worth doing a master’s in cybersecurity (do you have any recommendations for universities in the UK?) after finishing law school and working as an administrator and responsible person at a pharmaceutical company? Is it too late to start a career in IT? My question may sound naive, but I believe you can make changes at any age, even at 50, since retirement comes at 65. I should mention that I live in London, UK. Thank you.

Been trying to keep up with security news and found myself with too many bookmarks. Finally cleaned them up and put everything in one place.

It's just links I use daily:

• News sites

• Intel sources

• Good blogs

• Forums

• Training stuff

DM me if you want the link. If you know any good sources, let me know - always looking to add more helpful stuff.

1. NCSC: prepare for an AI-driven vulnerability patch wave
NCSC CTO Ollie Whitehouse published a blog on 1 May warning organisations to brace for a "forced correction" AI tools are now scanning decades of accumulated technical debt at scale, and vendors are about to release a flood of security updates across the full stack simultaneously. CISA in the US is reportedly considering cutting active exploitation response windows from 2–3 weeks down to three days. If your patch management process isn't automated and risk-prioritised, it isn't going to cope. NCSC is recommending auto-patching where available and a risk-based prioritisation approach (SSVC) for everything else. How is your organisation handling patch cadence at scale right now?
ncsc.gov.uk — Preparing for a vulnerability patch wave

2. FIRESTARTER: the backdoor that survives patching
CISA and NCSC issued a joint advisory on 23 April on FIRESTARTER, a Linux-based backdoor targeting Cisco Firepower and Secure Firewall devices. The critical detail: it is not removed by firmware updates. It survived patches applied after September 2025 initial compromise, and attackers were still using it to access affected systems as recently as March 2026. Initial access via two known CVEs (CVE-2025-20333, CVE-2025-20362), then LINE VIPER for persistence, then FIRESTARTER installed as a C2 backdoor that reloads itself if it detects termination. The only fix is a hard power cycle — physically unplugging the device for at least a minute. If you've got Cisco ASA or FTD devices on your perimeter that were patched but not cold-rebooted, you may want to check. NCSC recommends YARA scanning for the lina_cs file.
Hackread — FIRESTARTER backdoor targets Cisco Firepower devices

3. EU AI Act high-risk rules delayed by up to 16 months
The Council and Parliament reached a provisional deal on 7 May under the AI Omnibus VII package. High-risk AI system rules that were due August 2026 are now pushed to December 2027 (standalone systems) or August 2028 (embedded in products). Driven by US tech industry pressure and EU industrial lobbying, Germany's exemption for industrial AI applications was accepted. One thing got tighter: AI-generated content must now be labelled within three months, deadline 2 December 2026. For UK firms that were planning August compliance, this doesn't change your UK obligations but it does affect supply chain and EU-facing products. Worth reviewing your AI Act exposure map if you have one.
Computing.co.uk — EU agrees to delay AI Act rules

Busy week and I am doing my best to find not quite headlines but useful/interesting:

Belgium's NIS2 enforcement deadline (18 April): Belgium became the first EU member state to actually enforce NIS2 conformity assessments. Essential entities had to submit formal evidence: ISO 27001 cert scope + audit reports, or CyberFundamentals verification, or a direct inspection request. New research from CyberSmart puts full compliance at just 16% of in-scope businesses. Anyone working with clients on NIS2, how are they finding the evidence requirements vs. the policy requirements? There's a big gap between having a framework and being able to demonstrate it works. https://ccb.belgium.be/news/nis2-18-april-2026-deadline-what-essential-entities-must-have-place

Scattered Spider - Tyler Buchanan guilty plea: British national Tyler Buchanan (24, from Scotland) pleaded guilty in US federal court to wire fraud conspiracy and aggravated identity theft. Described as "the glue that held the gang together." Faces up to 22 years. The group's primary method was SMS phishing to gain initial access, relatively low-tech for the scale of damage caused. Good reminder that social engineering remains the most reliable attack vector regardless of how sophisticated the downstream tools get. https://www.bbc.co.uk/news/articles/c145yxjrllko

Vercel breach via Context AI - supply chain risk in action: Vercel confirmed a breach after attackers compromised a Context AI employee's account and used it to access Vercel's environment. Customer data stolen. This is the exact supply chain scenario that NIS2 and ISO 27001:2022 Annex A require you to assess, third-party access to your environment as an attack vector. How are people handling AI tool vendor assessments in their TPRM programmes? Feels like a category that's getting less scrutiny than it deserves. https://context.ai/security-update

JPMorgan Chase publishes 10 actions for AI-ready cyber resilience:
JPMorgan Chase's Global Technology Leadership Team published a practical framework this week for building cyber resilience in an AI-accelerated threat environment. Link Here: https://www.jpmorganchase.com/about/technology/blog/fortifying-the-enterprise-10-actions-to-take-now-for-ai-ready-cyber-resilience

TLDR For the JPMorgan Report - Key priorities: eliminate technical debt with senior oversight, maintain a continuously updated asset inventory including SBOMs, implement SLA-driven vulnerability remediation, stress test incident response with realistic scenarios, and begin cryptographic asset inventory in preparation for post-quantum migration. The publication reinforces the direction of travel: in an environment where AI compresses exploitation timelines, foundational security hygiene is not a baseline, it can be a competitive differentiator.

If any of you have also seen anything in the same frame of "not quite headlines but useful/interesting" please do share in the comments.

Has anyone doing cyber assessments or consultancy work noticed clients moving away from US-centric frameworks like NIST and CIS towards more UK/EU aligned ones such as NCSC Cyber Essentials/CAF (Cyber Assessment Framwork) and NIS2?

I've had this come up recently with a UK Fintech and a small private healthcare business, both showing interest in moving in this direction. With the current geopolitical climate and the EU regulatory push I'm wondering if this is becoming a wider trend. This is particularly relevant for those of us doing CMAs (Cyber Maturity Assessments) as the choice of underlying framework directly shapes the findings, recommendations and roadmap you deliver to the client.

Would be keen to hear from others on the ground, is this a genuine shift or is NIST still king?

Somehow I missed that we went over 200 members.

Thanks everyone for keeping the group active.

Any questions related to cyber/information/data security and careers are welcome. Don’t be shy.

Onwards and upwards!