Threat Analysis: Critical Vulnerabilities and UK Cyber Threats
Latest cyber threats and vulnerabilities impacting UK SMBs this July.
Read more →
115 articles by Mauven MacLeod
Threat Analysis: Russian Email Attack Extended to Outlook, New NPM Risks
Outlook email vulnerabilities and npm package risks highlight threats facing UK SMBs.
Read more →
Threat Analysis: Emerging Android RAT and Botnet Activity
Flying Eagle Android RAT and Dysphoria Botnet expose UK businesses to mobile fraud and sophisticated C2 threats.
Read more →
Threat Analysis: Helpdesk Hijackers and Critical WordPress Exploits, What UK SMBs Need to Know
Helpdesk Hijackers exploit Teams, while WordPress vulnerabilities threaten site security. Act fast!
Read more →
Threat Analysis: Key Vulnerabilities Affecting UK SMBs
Critical vulnerabilities in Microsoft Defender and Java Spring Boot pose risks to UK SMBs. Update now.
Read more →
Threat Analysis: Mistic Backdoor and FortiBleed Campaign, What UK SMBs Need to Know
Mistic backdoor linked to ransomware, and the FortiBleed campaign highlight growing risks. Learn how to protect your SMB.
Read more →
Threat Analysis: AI Security Risks for UK SMBs
New AI vulnerabilities like Dolphin X Stealer and rogue ChatGPT agents are targeting UK businesses. Here’s the analysis.
Read more →
Threat Analysis: UK SMBs and Key Cyber Threats in July 2026
UK SMBs face critical cybersecurity threats from re-extortion ransomware and an exploited Langflow RCE flaw.
Read more →
Threat Analysis: Qilin Ransomware Exploits New VPN Flaw, What UK SMBs Need to Know
A critical VPN flaw exploited by Qilin ransomware poses risks to UK SMBs. Urgent action required.
Read more →
Threat Analysis: ServiceNow RCE Under Active Exploitation, Passkey Vishing, and the FortiBleed Credential Campaign
Three active threats UK SMBs need to act on today: a critical ServiceNow RCE, passkey enrolment vishing, and a large-scale FortiGate credential harvesting campaign.
Read more →
Threat Analysis: FortiSandbox Under Active Exploit, LegacyHive Zero-Day, and ClickFix Everywhere
FortiSandbox flaws are being actively exploited, a Windows zero-day with no patch is now public, and ClickFix attacks are hitting UK businesses daily. Here is what you need to know.
Read more →
Threat Analysis: Scattered Spider Sentenced, Trojanised Collaboration Tools, and the AsyncAPI Supply Chain Compromise
Five and a half years each for the TfL hackers. A Russian group hiding malware inside legitimate collaboration tools. And a supply chain worm loose in the npm ecosystem. Here is what today actually means.
Read more →
Hello, Mauven Here: Why the ICO's Experian Loss Matters More Than You Think
Hello, Mauven here. The Upper Tribunal dismissed the ICO's Experian appeal in April 2024. Here is what the outcome signals about UK data broker regulation.
Read more →
Threat Analysis: SharePoint Under Active Attack, AiTM Phishing Surge, and npm Supply Chain Compromise
Three stories today that UK SMBs cannot afford to ignore: SharePoint flaws being actively exploited, a sophisticated AiTM phishing operation, and a poisoned npm supply chain.
Read more →
Threat Analysis: MFA-Bypassing Phishing Kits and AI-Accelerated Attack Infrastructure, What UK SMBs Need to Know
Your MFA is not the safety net you think it is. Two new phishing kits are bypassing it right now, and AI is doing the heavy lifting for attackers.
Read more →
Threat Analysis: Russian State Actors, ShareFile Emergency Shutdown, and DocuSign RMM Abuse, What UK SMBs Need to Know
The NCSC has joined a Nine-Eyes advisory on Russian state actors targeting poorly configured routers. Meanwhile, Progress ShareFile has ordered an emergency server shutdown over an undisclosed threat.
Read more →
Threat Analysis: CitrixBleed 2 Ransomware Chain, SilabRAT MaaS, and the NHS Email Incident That Should Not Have Happened
Three stories today that together explain exactly how UK SMBs get compromised in 2026. One is a patched vulnerability nobody patched. One is a £3,900-a-month RAT. One is a CC field.
Read more →
Threat Analysis: Microsoft Defender Zero-Day Patched, Vidar Infostealer Surge, and What the NCSC's New Cyber Essentials Pathway Actually Means
A Defender zero-day with public exploit code, a Vidar infostealer surge hitting developer toolchains, and a quiet but significant change to Cyber Essentials Plus certification.
Read more →
Threat Analysis: Ubiquiti UniFi Critical Flaws and Adobe ColdFusion Under Active Exploitation, What UK SMBs Need to Know
Two max-severity vulnerabilities are being actively exploited right now. If your office runs Ubiquiti kit or any ColdFusion-backed web infrastructure, read this first.
Read more →
Threat Analysis: Microsoft Teams Helpdesk Scams, Multi-Stage Phishing RATs, and the UK Cyber Pledge Nobody Asked About
Fake IT support on Teams. Steganographic RAT delivery via phishing. And Capita signed a government cyber pledge. It has been that kind of day.
Read more →
Threat Analysis: Adobe ColdFusion CVE-2026-48282 and the Fake Helpdesk Wave Hitting UK Businesses
CVE-2026-48282 is being exploited in the wild. Meanwhile, a criminal group called Pink is ringing your staff and talking their way past MFA. Here is what both mean for your business.
Read more →
Threat Analysis: ARToken M365 Phishing Platform, Avalon Ransomware Framework, and a 2-Million-Device Botnet, What UK SMBs Need to Know
Three active campaigns with direct UK SMB exposure: a sophisticated M365 phishing platform, a legal-lure ransomware framework, and a residential proxy botnet the FBI just cracked open.
Read more →
Threat Analysis: The Gentlemen Ransomware and ARToken Phishing Platform, What UK SMBs Need to Know
Two threats. One kills your endpoint security before you know it's there. The other hands your Microsoft 365 to criminals on a subscription basis.
Read more →
Threat Analysis: BlueHammer Ransomware Escalation and SimpleHelp RMM Exploitation, What UK SMBs Need to Know
Ransomware gangs are now exploiting a Windows Defender privilege escalation flaw confirmed by CISA. If your MSP uses SimpleHelp, you have a second problem to deal with today.
Read more →
Hello, Mauven Here: The UK Data Broker Market Just Got a Legal Upgrade It Did Not Deserve
The Data Use and Access Act 2025 clarifies that direct marketing can be a legitimate interest. The data broker industry is delighted. You should pay attention.
Read more →
Threat Analysis: Oracle EBS Under Active Exploitation and the DriveSurge Drive-By Campaign, What UK SMBs Need to Know
Oracle's E-Business Suite is being actively exploited right now. And a new initial access broker is turning legitimate websites into malware delivery points.
Read more →
The Week Ahead: Stop Treating KEV Like a Newsletter
KEV is not interesting. It is known exploited. Turning the catalogue into a five-minute weekly check is the cheapest security upgrade most SMBs can make.
Read more →
Threat Analysis: Mini Shai-Hulud and CVE-2026-20245 - What UK SMBs Need to Know
Today's focus: Supply chain attacks on npm packages and active zero-day exploitation in Cisco SD-WAN. Crucial for UK SMBs.
Read more →
Threat Analysis: New Backdoor and FortiGate Campaign Uncovered, What SMBs Need to Know
Exploring recent threats: a new backdoor may be linked to ransomware, and a large-scale FortiGate campaign affects security.
Read more →
Threat Analysis: Mistic Backdoor and KongTuke Broker, What UK SMBs Need to Know
UK SMBs must be aware: Mistic backdoor linked to ransomware broker is active. What this means for your security.
Read more →
Defence in Depth Is Not a Bundle You Can Buy
Buying a firewall, endpoint protection, and a backup product is not Defence in Depth. It is a collection of controls. The difference matters.
Read more →
Threat Analysis: Klue Supply Chain Attack and Five Eyes Warning
Klue's Salesforce breach affects UK SMBs. Dive into supply chain vulnerabilities and AI risks.
Read more →
Threat Analysis: Key UK Cyber Threats, Strategic Insights for 2026
Analysing key cyber threats affecting UK businesses today. From supply chain attacks to AI risks, stay informed.
Read more →
Threat Analysis: npm Supply Chain Surge and Splunk Under Active Exploit, What UK SMBs Need to Know
Your developers' tools and your logging stack are both under active attack today. Here is what is actually happening and what to do about it.
Read more →
Threat Analysis: FortiBleed, SocGholish Takedown, and WordPress Supply Chain, 18th June 2026
73,000 Fortinet VPN credentials leaked, Evil Corp's botnet dismantled, and WordPress plugin supply chain compromised again. Three stories that matter to UK small businesses today.
Read more →
Threat Analysis: DragonForce Hides in Microsoft Teams, Joomla Flaw Actively Exploited, and RoguePlanet Still Unpatched
Three active threats UK SMBs cannot ignore today: ransomware hiding in Microsoft's own infrastructure, a Joomla CMS exploit already in the wild, and an unpatched Defender zero-day.
Read more →
Threat Analysis: DragonForce Hides in Microsoft Teams, Fortinet Flaws Hit, and Your WordPress Site Is Probably Compromised
DragonForce is hiding ransomware command traffic inside Microsoft Teams. Fortinet FortiSandbox has critical flaws being actively exploited. Here is what UK SMBs need to know today.
Read more →
Threat Analysis: SearchLeak and Cisco SD-WAN Auth Bypass, What UK SMBs Need to Know Today
Microsoft 365 Copilot has a critical vulnerability chain that lets an attacker steal your mailbox data with a single crafted URL. Cisco SD-WAN is under active exploitation. Both matter to UK SMBs right now.
Read more →
Threat Analysis: AI-Powered Phishing Surge, Novo Nordisk Clinical Data Breach, and What UK SMBs Must Do Now
AI-powered phishing is scaling faster than organisations can train against it. Three stories today that UK SMBs cannot afford to ignore.
Read more →
Threat Analysis: The Gentlemen Ransomware and AI-Powered Phishing, What UK SMBs Need to Know
A high-volume ransomware operation with Russian-speaking roots and an AI-powered phishing platform impersonating trusted brands. Both are active today.
Read more →
Threat Analysis: Fake Helpdesk Vishing Campaign and ClickFix RAT Delivery, What UK SMBs Need to Know
Two active campaigns are hitting organisations that look exactly like UK SMBs. One calls your staff pretending to be IT support. The other fakes LinkedIn and Indeed.
Read more →
Threat Analysis: npm Supply Chain Attack, Five Eyes China Warning, and NCSC Dependency Alert
Three separate threat streams converging today, and all three have direct exposure for UK SMBs and their IT suppliers.
Read more →
Threat Analysis: PhaaS Campaigns, Teams-Based RAT Deployment, and Unpatched Acer Router Zero-Days Threatening UK SMBs
Three active threats converging on UK SMBs today: a mass phishing platform bypassing MFA, a RAT delivered via Microsoft Teams, and two unpatched maximum-severity router vulnerabilities.
Read more →
Threat Analysis: Nimbus RAT via Teams Vishing, Oracle WebLogic KEV, and the npm Supply Chain Under Active Attack
Three active threats that UK SMBs need to act on today: a Java RAT delivered via Microsoft Teams, a two-year-old Oracle flaw now on the CISA KEV list, and 33 malicious npm packages stealing cloud credentials.
Read more →
Threat Analysis: Netlogon RCE and Palo Alto Auth Bypass Now Actively Exploited, What UK SMBs Need to Do Today
Patch windows have closed. Both the Windows Netlogon RCE and Palo Alto GlobalProtect auth bypass are now being exploited in the wild. Here is what that means for your business.
Read more →
Threat Analysis: FortiClient EMS Exploitation, Phoenix PhaaS, and AI-Assisted Attacks, What UK SMBs Need to Know
Three active threats converge today: a FortiClient EMS zero-day delivering infostealers, a PhaaS kit with MFA bypass, and AI-assisted espionage campaigns lowering the barrier for every attacker downstream.
Read more →
Threat Analysis: BlackFile Extortion, ShinyHunters Data Theft, and the Voice Phishing Wave Hitting UK Businesses
Two financially-motivated threat groups are running active campaigns that should concern every UK business with a helpdesk, a SaaS stack, or customers whose data you hold.
Read more →
Threat Analysis: Blockchain C2, LiteSpeed cPanel Exploit, and SRG's Physical Pivot, What UK SMBs Need to Know
Blockchain-based C2 infrastructure, an actively exploited cPanel flaw, and an extortion gang that now shows up in person. Mauven explains what the advisories are not telling you.
Read more →
Threat Analysis: OAuth Device Code Phishing, Laravel Supply Chain Compromise, and an Actively Exploited Drupal Flaw
Three separate threats with direct SMB exposure landed today. One targets Microsoft 365 credentials, one hits developers and their clients, and one is already being exploited in the wild.
Read more →
Threat Analysis: Kali365 MFA Bypass and Laravel Supply Chain Compromise, What UK SMBs Need to Know
MFA is not the safety net you think it is. The FBI confirmed it this week. Here is what UK SMBs need to do right now.
Read more →
Threat Analysis: Drupal SQL Injection Under Active Exploitation, Ubiquiti Max-Severity Flaws, and The Gentlemen Ransomware's UK Reach
Active exploitation of Drupal's SQL injection flaw began within 48 hours of disclosure. If your website or your supplier's runs Drupal, this is not a drill.
Read more →
Threat Analysis: Fox Tempest Malware-Signing Service, Supply Chain npm Attacks, and a Maximum-Severity Cisco Flaw
A malware-signing service is making ransomware harder to detect. npm packages with millions of downloads are compromised. And Cisco just patched a perfect-10 vulnerability.
Read more →
What The NCSC Has Been Telling You About BitLocker For Years
The NCSC's Windows guidance has recommended TPM plus PIN for years. Most UK organisations ignored it. YellowKey just changed what that decision costs.
Read more →
Threat Analysis: FlowerStorm PhaaS MFA Bypass and Vidar Go Infostealer, UK SMB Threat Brief 19th May 2026
MFA bypass-as-a-service is now sophisticated enough to defeat most SMB defences. Vidar is back, rebuilt in Go, and harder to detect than ever.
Read more →
43% Breached and Nobody Is Surprised: What the DSIT Survey Really Tells Us About UK Business Security
43% of UK businesses breached. Revenue impact doubled. Board engagement finally rising. Mauven MacLeod reads between the lines of the DSIT survey.
Read more →
Threat Analysis: NGINX Rift Under Active Exploitation and Grafana Source Code Theft, What UK SMBs Need to Know
A days-old NGINX vulnerability is already being probed and exploited. Grafana's source code was stolen via a single access token. Two stories, one theme: patch windows are collapsing.
Read more →
Threat Analysis: Exchange Zero-Day, Device Code Phishing, and npm Supply Chain Attack, What UK SMBs Need to Know
Three active threats converge today: an exploited Exchange zero-day, a surge in device code phishing targeting Microsoft 365, and a supply chain attack that caught OpenAI. All three have direct implications for UK SMBs.
Read more →
Threat Analysis: KongTuke Teams Attacks and Fragnesia Linux Flaw, What UK SMBs Need to Know
An initial access broker is using Microsoft Teams to own corporate networks in five minutes flat. A Linux kernel privilege escalation with working exploit code dropped today. Neither is theoretical.
Read more →
Threat Analysis: The Gentlemen Ransomware and Supply Chain Poisoning, What UK SMBs Need to Know
A new ransomware operation with Qilin connections is accelerating. Supply chain attacks are poisoning developer tools and AI platforms. Here is what matters today.
Read more →
When Cheap IT Voids Your Cyber Cover: The UK Government Numbers Bosses Are Avoiding
Hello, Mauven here. Cyber insurance uptake is up. So are denied claims. The common thread is the IT contract that never asked to read the policy.
Read more →
Threat Analysis: Shai-Hulud Supply Chain Campaign and The Gentleman Ransomware, What UK SMBs Need to Know
Signed packages, a six-minute supply chain blitz, and ransomware using blockchain to hide its C2. Today's brief covers two threats that reach well beyond enterprise targets.
Read more →
Threat Analysis: AI-Generated Exploits, Cloud-Native Phishing, and TrickMo's Blockchain Pivot, What UK SMBs Need to Know
AI is now writing zero-day exploits. Cloud infrastructure is being weaponised against your staff. And TrickMo just made its banking trojan significantly harder to detect.
Read more →
Threat Analysis: APT28 Router Hijacking, Ivanti Zero-Day, and the RMM Abuse Wave Hitting UK SMBs
APT28 is rewriting your router's DNS settings. Ivanti EPMM has a zero-day with active exploitation. And threat actors are abusing remote management tools to drop malware via phishing. Here is what UK SMBs need to know today.
Read more →
Threat Analysis: PAN-OS Zero-Day, Storm-1175 Ransomware, and the Supply Chain Problem Nobody Is Fixing
State-sponsored actors had a month inside Palo Alto firewalls before the advisory came out. Storm-1175 is still moving. And your developers may have already run the poisoned package.
Read more →
Threat Analysis: PAN-OS Zero-Day and MuddyWater's Teams Deception, What UK SMBs Need to Know
A Palo Alto firewall zero-day is being actively exploited right now. And MuddyWater is using Microsoft Teams to walk through your front door. Both matter today.
Read more →
Concern Is Not a Control: Why UK Small Business Cyber Hygiene Went Backwards While Awareness Went Up
Awareness went up. Risk assessments went down. Continuity plans dropped 9 points. If concern was a control, the survey numbers would look very different.
Read more →
Threat Analysis: Trojanised Microsoft Teams Installers, Third-Party Supplier Breaches, and £102M in UK Romance Fraud
A fake Teams installer is dropping backdoors globally. A third-party analytics vendor handed ShinyHunters 119,000 email addresses. And UK romance fraud hit £102M last year. Three stories, one briefing.
Read more →
Threat Analysis: MOVEit Automation Auth Bypass, Linux 'Copy Fail' Exploitation, and PyPI Supply Chain Attack — What UK SMBs Need to Know
Three high-impact threats landed simultaneously on 4th May 2026. If your business uses MOVEit, runs Linux servers, or has developers using Python, read this now.
Read more →
Threat Analysis: TeamPCP Supply Chain Attack and the Coming Patch Tsunami, What UK SMBs Need to Know
A supply chain attack on open-source security tooling and a Linux privilege escalation exploit with working code in the wild. Two threats. One uncomfortable Friday.
Read more →
Threat Analysis: Critical cPanel Exploit, TeamPCP Supply Chain Attacks, and the NCSC's Patch Wave Warning
A critical cPanel flaw is being actively exploited with ransomware already reported. TeamPCP is poisoning open-source security tools. The NCSC says a patch wave is coming. Today is not a quiet day.
Read more →
Threat Analysis: CVE-2026-41940 cPanel Zero-Day, Linux Copy Fail LPE, and UK Breach Rate Holds at 43%
A critical cPanel authentication bypass has been exploited since February. A new Linux root exploit dropped today. And 43% of UK businesses were compromised last year. Pick your priority.
Read more →
Threat Analysis: cPanel Auth Bypass, ClickFix Phishing, and VECT Ransomware — What UK SMBs Need to Know
This week's threat brief covers a critical cPanel auth bypass requiring emergency patching, ClickFix phishing campaigns stealing credentials via PowerShell, and VECT ransomware that wipes files it cannot encrypt.
Read more →
The Cyber Resilience Pledge: What the Corridor Conversations at CyberUK Actually Revealed
I was in the room when the Cyber Resilience Pledge was announced. The speeches were confident. The corridor conversations afterwards were not.
Read more →
Threat Analysis: BlackFile Extortion, Supply Chain Poisoning, and OAuth Phishing — UK SMB Threat Brief, April 2026
Three active campaigns converge on UK small businesses this week: voice-driven extortion, poisoned developer packages, and OAuth phishing that bypasses MFA. Here is what they are not telling you.
Read more →
A Black Box with Flashy Lights: The NCSC's SilentGlass and the Question Nobody Is Asking
NCSC's SilentGlass is technically sound government kit, now available commercially. But if you're still fighting phishing, it's probably not your next purchase.
Read more →
Threat Analysis: PyPI and npm Supply Chain Attacks, What UK SMBs Need to Know About the TeamPCP Campaign
TeamPCP is back. Three concurrent package compromises in one week. Here is what UK businesses using Python or Node.js tooling need to do right now.
Read more →
Threat Analysis: BlackFile Extortion and Supply Chain Poisoning — UK Cyber Threats, 27 Apr 2026
Voice phishing plus credential harvesting. Malicious Python packages with 11 million monthly downloads. This is what active UK cyber threats look like today.
Read more →
Threat Analysis: UK Cyber Threats Roundup, What SMBs Need to Know This Week
A quiet day on the KEV and NVD feeds. Mauven explains why that is not the same as a safe day.
Read more →
The NCSC Built Protective DNS for Government. Private Sector SMBs Are Still Guessing.
The NCSC has blocked 1.5 million malicious domains with Protective DNS. Private sector SMBs do not qualify. Here is what that gap means and how to close it.
Read more →
Preparing for the Next Wave of Cyber Threats: Insights for UK SMBs
63% of UK SMBs faced cyber incidents in 2023. Learn how to prepare and protect your business assets effectively.
Read more →
The War Exclusion in Your Cyber Policy: Why Being Collateral Damage Might Not Be Covered
Your cyber policy probably excludes losses from state-backed attacks. You may not have read that clause. If a nation-state campaign sweeps through your sector, it could void your cover entirely.
Read more →
Unsupported Software and UK GDPR: The Compliance Risk You Cannot Ignore
Article 32 of UK GDPR requires 'appropriate technical measures' to protect personal data. Running unpatched, out-of-support software is very difficult to defend as appropriate.
Read more →
Understanding the Risks of Remote Work: Securing Your Home Office
Your remote workers aren't in your office, but your data still is. Here's why most home working security failures are people problems, not tech problems.
Read more →
Confidence Is Not a Security Control: What Happened When Noel Left Us Unsupervised
Noel left us unsupervised, two bottles of Prosecco, and a microphone. What followed was a serious conversation about the security vulnerability nobody likes to name: overconfidence. The kind that sounds completely reasonable in a meeting — and has preceded some very expensive afternoons.
Read more →
Why SMBs Draw Their Cyber Essentials Scope Around the Comfortable Parts
After years observing how organisations navigate security certification, I have reached a fairly uncomfortable conclusion: most scope failures in Cyber Essentials are not technical errors. They are decisions. Somebody looked at the full picture of what should be in scope, felt the weight of what that would require, and drew the line somewhere more manageable. I understand the impulse. I have watched it play out at every scale. But CE v3.3 closes the ambiguities that made that line defensible. An
Read more →
Russian Hackers Are Silently Reading Your WhatsApp Messages Right Now
Hello, Mauven here. Yesterday, Dutch military and domestic intelligence confirmed what European security agencies have been circling for weeks: Russian state-sponsored hackers are running a large-scale global campaign to take over Signal and WhatsApp accounts. Not by breaking the encryption. By asking for the keys. Two governments have now issued formal warnings. Dutch officials have confirmed their own employees are among the victims. And the attack method is devastatingly simple. If your busin
Read more →
The ICO Called It a "Significant Victory". Try Telling That to 14 Million People Who Got Nothing.
The ICO's General Counsel called the Currys Court of Appeal ruling "a significant victory." And in strict legal terms, she is right. Lord Justice Warby's judgment closes a dangerous loophole and clarifies that personal data must be assessed from the controller's perspective. But while the lawyers celebrate, roughly 14 million people are sitting with expired limitation periods and no compensation route. The legal system confirmed DSG was in the wrong at the precise moment most victims could no lo
Read more →
Your Cloud Stack Is Not Just Stationery: The Bet Your Business Made Without Realising It
You did not set out to build US-centric infrastructure. You just bought what was on page one of Google. Email, documents, calendars, chat, CRM, help desk, backups, monitoring: all US-owned, all subject to US law, all chosen on price and convenience without a single conversation about jurisdictional risk. Mauven MacLeod explains why your 30-person firm has made exactly the same strategic bet as the NHS and the Ministry of Defence, why "it is just stationery" stopped being true about five years ag
Read more →
Four Game-Changing Cyber Stories in One Episode
The acting head of America's cybersecurity agency just uploaded government secrets to ChatGPT. Meanwhile, a Dublin IT manager discovered £18,000 worth of unused incident response services sitting in his cyber insurance policy. Passkeys can eliminate phishing attacks completely. And those viral Trump cloud cartoons? They're exposing the infrastructure dependency crisis threatening UK businesses. Four critical cybersecurity stories. Three expert guests. 45 minutes that could transform how your bus
Read more →
US Cloud Sovereignty Isn't a Trump Problem, It's a Three-Company Problem: Why UK SMBs Need to Understand Infrastructure Dependency
You've seen the memes. Trump is controlling cloud providers like puppets. Trump is literally unplugging Europe from US infrastructure. They're viral because they touch a nerve about something real: UK businesses run on American infrastructure controlled by American laws. But the political framing misses the actual problem. This isn't about any particular president or administration. This is about 15 years of infrastructure consolidation, creating structural dependency that predates and will outl
Read more →
Fortinet's Security Crisis: Why Does Nobody Care That Your VPN Is a Nation-State Playground?
Here's a question that should keep every director awake: what happens when the device meant to protect your network becomes the primary way attackers get in? Between 2023 and now, Fortinet's SSL VPN has been exploited three separate times using the same type of vulnerability. Chinese intelligence services stole configurations from 20,000 organizations worldwide. Cyber insurers charge double the premiums for businesses using Fortinet kit. Yet Fortinet posted 50% revenue growth and continues to do
Read more →
The Psychology of Risk Denial: Why Smart People Convince Themselves They're Too Small to Matter
Why do intelligent board members hear "43% of UK businesses got breached" and think "that won't happen to us"? It's not stupidity; it's psychology. Optimism bias makes us believe bad things happen to others. Present bias makes tomorrow's disaster less urgent than today's deadline. Availability heuristic makes personal experience trump statistics. Illusion of control makes certificates feel like protection. Normalcy bias treats "it hasn't happened yet" as evidence. Dunning-Kruger creates confiden
Read more →
Why Smart People Keep Ignoring Smart Device Security: The Psychology Behind IoT Blindness
After this week's podcast revelation about the marketing agency losing client files through an unsecured printer, my inbox has been full of variations on the same question: how do intelligent business owners with otherwise solid security miss something this obvious? The answer isn't comfortable, but it's important: IoT security failures aren't about lack of intelligence. They're about systematic psychological blind spots that affect everyone from small business owners to government departments.
Read more →
The Psychology of Security Failures: Why Smart People Keep Making the Same Stupid Mistakes
Noel spent Monday and Tuesday explaining what reverse benchmarking is and how to implement it technically. Both excellent. Both necessary. Both completely inadequate if you don't understand why organizations systematically fail to learn from disasters. Here's the uncomfortable truth: most breaches happen not because organisations don't know what to do, but because human psychology actively prevents them from doing it. Normalcy bias makes us believe disasters happen to others. Optimism bias creat
Read more →
Why Personal Accountability Changes Everything: The Psychology of Director Liability
After two days discussing frameworks and technical standards, let's examine why personal accountability actually works when corporate fines consistently fail. The psychology is fascinating and explains decades of regulatory success and failure. When British Airways faced a £20 million fine, nobody lost their job. When HSE prosecutes directors, workplace safety transforms overnight. The difference isn't the amount of money. It's whose money gets spent and whose freedom gets threatened. Human psyc
Read more →
The Psychology of Cybersecurity Negligence: Why Smart People Make Fatal Decisions
Nobody wakes up and decides to let patients die through cybersecurity negligence. Yet that is precisely what happened at Synnovis. The executives who failed to enable multi-factor authentication were not cartoon villains. They were educated professionals running a critical healthcare organisation. So why did they make a decision that, in hindsight, seems obviously catastrophic? The answer lies in the psychological mechanisms that allow intelligent people to rationalise terrible choices, the orga
Read more →
Ofcom's Secret VPN Surveillance: When Britain Embraced the Authoritarian Playbook
Ofcom admits it is monitoring VPN use across Britain with a secret AI tool and unnamed data sources. That should worry any small business that relies on encrypted links for daily work. The tool cannot tell a secure office connection from someone dodging age checks. Section 121 still sits in law, ready to force scanning of encrypted chats. Does that sound like a free internet to you? Document your use. Keep your controls tight. Ask your MP why this is acceptable. Do you want regulators watching y
Read more →
The Nottingham Agency That Spent £47,000 on Cloud Bills They Didn't Need
Twenty-three employees. Eighteen months. Forty-seven thousand pounds wasted on cloud infrastructure they didn't need, SaaS subscriptions nobody used, and auto-scaling rules designed by a consultant who'd never checked back. This isn't a horror story about a massive enterprise with unlimited budget. This is CloudBridge Digital, a Nottingham digital agency that discovered they'd been hemorrhaging cash while Microsoft, AWS, and a parade of SaaS vendors quietly helped themselves to the company bank
Read more →
When the Panic Becomes Obvious
Three Mile Island. You remember it, right? The 1979 nuclear accident that terrified an entire generation and effectively killed nuclear power plant construction in America for 40 years? Microsoft just spent $1.6 billion to restart Unit 1. Not for clean energy virtue signaling. Because they're bloody desperate. Google committed to 500 megawatts of Small Modular Reactors. Amazon's all-in on multiple nuclear projects. Meta wants up to 4 gigawatts. Billions in nuclear investment. Timeline: 2028 to 2
Read more →
The British Library's £7 Million MFA Decision
The British Library decided not to implement MFA on administrator accounts. Their reasoning: "practicality, cost and impact on ongoing programmes." That decision cost them £7 million in recovery, 600GB of staff data dumped on the dark web, and over a year of service disruption. This is Mauven's Take on one of the clearest examples of the doorman fallacy in UK history. When cost-cutting decisions focus narrowly on immediate expense whilst ignoring catastrophic downside risk, you get exactly this
Read more →
When DNS Goes Down, Civilisation's Collapse Plays Out in Your Suburban Flat
All right folks, buckle in. Last Monday, the planet just got schooled yet again in why we've put all our digital eggs in one totally cracked basket. AWS US-EAST-1 region had a DNS hiccup and half the world's internet decided it was nap time. Snapchat, Venmo, even the app that tells you if your cat's used the loo, all snuffed out. Why does a digital sneeze in Virginia take out customer payments in Edinburgh? And here's the kicker: this is the third major outage in five years for the same bloody r
Read more →
Another UK SME Wastes £20k on 'Comprehensive CyberSec': Still Gets Breached
Security vendors are playing you for fools, and they're getting rich doing it. Every week I watch UK business owners waste £20,000 on "comprehensive cybersecurity platforms" when they needed £5,000 of basic IT security. The industry deliberately muddies the difference between InfoSec, CyberSec, and IT Security because confused customers pay premium prices for inappropriate solutions. Meanwhile, 50% of small businesses were breached in 2025, proving that expensive confusion doesn't equal protecti
Read more →
The MFA Reality Check - Why Only 30% of Schools Have It Properly Enabled
Only 30% of schools have Multi-Factor Authentication enabled, but the reality is worse than that statistic suggests. Many schools have "partial MFA" - enabled for head teachers and SENCOs but not teaching assistants or admin staff. From a security perspective, everyone with access needs MFA, or you're not protected. The challenge? Phone-based authenticator apps conflict with safeguarding policies that ban phones near children. Hardware security keys offer the solution. FIDO2-certified tokens fro
Read more →
When Six Ministers Co-Sign a Letter to Your CEO, It's Time to Listen
When the Chancellor, three Cabinet Ministers, the NCSC CEO, and the Director General of the National Crime Agency personally co-sign a letter to UK business leaders, you don't ignore it. The NCSC just reported 204 nationally significant cyber incidents, with 18 highly significant attacks marking a 50% increase for the third consecutive year. Marks & Spencer lost over £300 million. A healthcare attack contributed to a patient death. Empty shelves appeared in supermarkets. The government has g
Read more →
Confessions of a Reformed School Hacker: How Getting Caught Changed My Career
Curiosity, access, and a careless password shaped my career. At sixteen I learned the simplest attack works best. I watched a teacher type admin123! and saw the whole network open up. No exploits. Just human nature. That is the insider threat in plain sight. People bypass clumsy controls to get work done. Do your policies help or hinder? Make secure the easy path with least privilege, SSO, MFA, logging, and coaching. Treat incidents as data, not drama. Channel curiosity before it goes undergroun
Read more →
The DORA Reckoning: How September's Cyberattacks Just Triggered Europe's First Cross-Border Regulatory Crisis
September 2025's Collins Aerospace and JLR cyberattacks weren't just operational disasters - they triggered Europe's first cross-border regulatory crisis under DORA. While aviation experts focused on flight delays, they missed the real story: EU authorities now have direct oversight powers over US companies like Collins Aerospace serving European financial infrastructure. DORA's January 2025 implementation created unprecedented cross-border enforcement mechanisms that most businesses don't under
Read more →
Analyzing the Patterns: When Single IT Manager Models Fail Spectacularly
Let's examine the data: 30 years of single IT manager failures. The patterns are consistent, the outcomes predictable, and the business impact devastating. Here's what happens when your "Dave from IT" model reaches its inevitable breaking point.
Read more →
Five Questions That Reveal Your Business Needs Strategic IT Leadership (And It's Not What You Think)
Most UK businesses think they're fine without strategic IT leadership until they're not. These five diagnostic questions expose the difference between thriving with technology and merely surviving despite it. Question 1: Are technology decisions made strategically or reactively? If you're replacing servers because they died rather than planned refresh cycles, you need help. Question 5: Will current systems scale gracefully as you grow? Planning to double in size without considering technology im
Read more →
Why Small Businesses Must Rethink Cybersecurity NOW (Before It’s Too Late)
Cybersecurity is not just an enterprise problem. With 96% of attacks targeting small businesses and 60% of victims closing within six months, UK SMEs face a survival crisis. This article exposes the myths keeping businesses vulnerable, the real financial impact of attacks, and the role of supply chain risk. It explains why Cyber Essentials and board-level governance are no longer optional, but essential. Written for directors and leaders, it lays out practical steps to protect your business befo
Read more →
The Psychology of Cyber Essentials: Why Smart People Make Terrible Security Decisions
Hello, Mauven here. After Monday's podcast and yesterday's technical deep-dive, I want to tackle the elephant in the room: if Cyber Essentials is so brilliant, why do smart business owners avoid it like a tax audit? The answer isn't ignorance or stubbornness - it's human psychology. Our brains evolved to make quick survival decisions, not manage enterprise cybersecurity frameworks. We're fighting millions of years of evolution with documentation requirements and compliance deadlines. Understandi
Read more →
The CVE-2025-53770 Crisis: Why Your SharePoint Response Reveals More About Human Psychology Than Technical Competence
After analyzing the global response to CVE-2025-53770, the critical SharePoint zero-day that's compromised 75+ organizations in 48 hours, I'm convinced this isn't about technical competence. It's about human psychology. Right now, IT administrators who know their systems are vulnerable (CVSS 9.8) are doing nothing because of normalcy bias, sunk cost fallacy, and optimism bias. The organizations getting breached aren't those lacking knowledge - they're the ones whose psychology prevents acting on
Read more →
The Psychology of Technical Debt: Why Smart Teams Make Tomorrow's Security Problems
After this week's podcast on technical debt and supply chain failures, I want to examine why intelligent, well-meaning IT teams consistently create tomorrow's security disasters. Technical debt isn't just a coding problem - it's a psychological trap that 78% of UK businesses fall into repeatedly. We take shortcuts under pressure, defer security updates for stability, and convince ourselves that "temporary" solutions won't become permanent vulnerabilities. Understanding the cognitive biases behin
Read more →
Catwatchful Exposed: When Surveillance Technology Becomes a Weapon
Former UK Government Cyber analyst Mauven MacLeod exposes the disturbing Catwatchful stalkerware operation that suffered a massive breach in June 2025, revealing 62,000 customer accounts and 26,000 monitored victims across seven countries. This isn't just cybersecurity failure - it's weaponised surveillance technology enabling domestic abuse and stalking. The breach exposed plaintext passwords, comprehensive victim data dating to 2018, and the operation's Uruguay-based administrator. From a government security
Read more →
The Psychology of Password Chaos: Why Smart People Make Terrible Choices
After Monday's podcast and yesterday's NCSC deep-dive, I want to tackle the elephant in the room: if three random words are so brilliant, why do smart business owners still use "password123"? Why does 78% password reuse persist despite constant breach warnings? The answer isn't technical ignorance - it's human psychology. We're fighting millions of years of evolution with spreadsheets and complexity requirements. Our brains aren't wired for digital security, they're wired for survival shortcuts.
Read more →
Middle East Conflict Escalation Creates Immediate Cyber Threats for UK Small Businesses
Last Friday, it was someone else's war. Over the weekend, Iranian hackers considered your Microsoft 365 account enemy infrastructure. American B-2 bombers dropped 14 bunker-busters on Iranian nuclear facilities over the weekend. The cyber retaliation has already begun, and UK small businesses as we all use US cloud services are the in the firing line primary targets. Remember NotPetya? Ukrainian attack, global devastation. Windows is Windows regardless of location. Your customer database could b
Read more →