Last year was one of the most punishing in history for cybersecurity firms. Data from IBM puts the global average cost of a data breach in 2024 at $4.88 million. This is a 10% increase over the previous year and the highest total ever. In the UK, almost three-quarters (74%) of large businesses experienced a breach in their networks last year. Cybercrime is a needle that’s been pushing deeper and deeper into the red for over a decade at this point, and the trend shows little sign of reversing or slowing down. 

New tools, including artificial intelligence (AI) are elevating threat levels at the same time as geopolitical tensions are ramping up. For many organisations, a cyber breach feels less like a matter of “if” than “when,” and with the potential to cost large sums of money, it’s no wonder the topic has the power to inspire a certain fatalism in CISOs.  

Responding to an elevated threat 

However, after multiple high-profile cyber incidents over the last 12 months, industry experts expect rising threat levels to spur the adoption of more robust security frameworks and internal policies. 

“The continued sophistication of cyber-attacks, and the increasing number of endpoints targeted are a specific worry, so we expect this challenge will drive more adoption of zero-trust architecture,” says Jonathan Wright, Director of Products and Operations at GCX. 

The UK Government’s official report on cybersecurity breaches last year notes  that the most common cyber threats result from phishing attempts (84% of businesses and 83% of charities), followed by impersonating organisations in emails or online (35% of businesses and 37% of charities) and then viruses or other malware (17% of businesses and 14% of charities).

The report’s authors note that these forms of attack are “relatively unsophisticated,” advising that relatively simple “cyber hygiene” measures can have a significant impact on an organisation’s resilience to threats. 

Ubiquitous zero trust 

Zero Trust is increasingly becoming an industry standard practice — table stakes for basic “cyber hygiene”. 

To take it one step further, Wright explains that he expects organisations to implement microsegmentation as part of their zero-trust initiatives. “This will enable them to further reduce their individual attack surface in the face of these evolving threats, he says. “As it stands, technology frameworks like Secure Access Service Edge (SASE), and specifically zero-trust have helped organisations secure increasingly complex and evolving cloud environments. However, microsegmentation builds on these principles of visibility and granular policy application by breaking down internal environments; across both IT and OT, into discrete operational segments. This allows for a more targeted application and enforcement of security controls and helps to isolate and contain breaches to these sub segmented areas. As a result, we expect to see continued adoption of microsegmentation strategies throughout 2025, and beyond”. 

Cybersecurity has been and will remain a critical concern for organisations as we enter 2025. Risks that were prevalent over a decade ago — like phishing and ransomware — continue to present challenges for cyber professionals. New technologies are giving bad actors new and better ways to access networks and the data they contain. 

Artificial intelligence (AI) is likely to remain a key element in the strategies of both cyber security professionals and the people they are trying to protect against, and therefore dominates a great deal of the conversation around cybersecurity. As noted in GCHQ’s National Cyber Security Centre (NCSC) annual review, “while AI presents huge opportunities, it is also transforming the cyber threat. Cyber criminals are adapting their business models to embrace this rapidly developing technology – using AI to increase the volume and impact of cyber attacks against citizens and businesses, at a huge cost.”

Breaches are becoming more common, the tools available to cybercriminals more effective. This year, conventional wisdom about striving for ever-more-effective security measures in support of an impenetrable membrane around the business may be phased out, as businesses begin to accept it’s not a matter of “if” but “when” a breach occurs.  

Cyber resilience 

The UK government’s Cyber Security Breaches Survey for 2024 found that half of all businesses and approximately one third of charities (32%) in the country experienced some form of cyber security breach or attack in the last 12 months. 

According to Luke Dash, CEO of ISMS.online, resilience will take “centre stage” in the year ahead, as organisations start prioritising continuity over defence, in what he describes as “a shift from merely defending against threats to ensuring continuity and swift recovery.” 

In tandem with this shift in approach, Dash notes that resilience is also becoming more of a priority from the regulatory side. With “changes to frameworks like ISO 27001 expanding to address resilience, and regulations like NIS 2 introducing stricter incident reporting, organisations will be required to proactively prepare for and respond to cyber disruptions,” he explains, adding that this trend will result in “a stronger focus on disaster recovery and operational continuity, with companies investing heavily in systems that allow them to quickly bounce back from cyber incidents, especially in critical infrastructure sectors.”

Regulatory shifts reflect refocusing on continuity 

Regulations will also spur global action to secure critical infrastructure in 2025, as critical infrastructure like utility grids, data centres, and emergency services are expecting to face mounting cyber threats. 

As noted in the NCSC’s report, “Over the next five years, expected increased demand for commercial cyber tools and services, coupled with a permissive operating environment in less-regulated regimes, will almost certainly result in an expansion of the global commercial cyber intrusion sector. The real-world effect of this will be an expanding range and number of victims to manage, with attacks coming from less-predictable types of threat actor.”

This rising tide of cyber threats — both from private groups and state-sponsored organisations — will, Dash believes, prompt governments and operators to adopt stronger defences and risk management frameworks. “Regulations like NIS 2 will push EU operators to implement comprehensive security measures, enforce prompt incident reporting, and face steeper penalties for non-compliance,” he says. “Governments globally will invest in safeguarding essential services, making sectors like energy, healthcare, and finance more resilient to attacks. Heightened collaboration among nations will also emerge, with increased intelligence sharing and coordinated responses to counteract sophisticated threats targeting critical infrastructure.”

According to the European Union Agency for Cybersecurity’s (ENISA) recently updated Foresight Cybersecurity Threats report, AI will continue redefining cybersecurity until 2030.

Although AI has already significantly reshaped the cyber threat landscape, particularly with the widespread use of GenAI, it is likely to increase the volume and heighten the impact of cyber-attacks by 2025. This is a clear indication that the use cases we’ve seen so far are just the beginning. The true challenge lies in the untapped potential of AI, and the long-term risks it poses. 

The direction AI leads in cyber threat landscape

The increased use of AI has led to a surge in more sophisticated cyber-attacks, from data poisoning to deep fakes. Among these, phishing campaigns and deep fakes stand out as the two main avenues where AI tools are effectively employed to orchestrate highly targeted, near-perfect cyber-attack campaigns.

Gen AI-driven deep fake technology in particular has become a standard tool for threat actors, enabling them to impersonate C-level executives and manipulate others into taking specific actions. While impersonation is not a new tactic, AI tools allow threat actors to craft sophisticated and targeted attacks at speed and scale.

For example, large language models (LLMs) enable threat actors to generate human-like texts that appear genuine and coherent, eliminating grammar as a red flag for such attacks. Beyond this, LLMs take it a step further by hyper-personalising attacks to exploit specific characteristics and routines of particular targets or create individualised attacks for each recipient in larger groups.

However, AI’s impact is not only on the sophistication of attacks but also on the alarming increase in the number of threat actors. The user-friendly nature of Gen AI technology, along with publicly available and easily accessible tools, is lowering the barrier of entry to novice cybercriminals. This means that even less skilled attackers can exploit AI to release sensitive information and run malicious code for financial gain.

AI also plays an essential role in the increasing speed of cyber-attacks. Trained AI models and automated systems can analyse and exfiltrate data faster and more efficiently and perform intelligent actions. Creating ten million personalised emails takes a matter of seconds with these tools. They can quickly scan an organisational network, try several alternative paths in split seconds to find a network vulnerability to attack. Once this happens, they automatically attempt to get a foothold into systems.

Utilising AI in blue teams

Although threat actors will continue to use AI to evolve their tactics and increase the risks and threats, AI is also widely used to arm organisations against these cyber threats and prepare against dynamic attacks.

Consider this in terms of red and blue teams for organisational defence. The red team, armed with AI tools, can launch more effective attacks. However, the same tools are equally available to the blue team. This raises the question of how blue teams can also effectively deploy AI to safeguard organisations and systems.

There are many ways for organisations to utilise AI tools to strengthen their cyber defence. These tools can analyse vast amounts of data in real time, identify potential threats, and mitigate risks more efficiently than traditional methods. AI can also be used in model training, replicating the most advanced AI applications and simulating specific scenarios.

Incorporation of AI into cyber exercises to create attack environments allows organisations to detect weak and vulnerable spots that the most advanced AI application could exploit, and also use AI tools to solve real-world cases.

This means organisations can have a deeper, more comprehensive insight into cybersecurity preparedness and how to arm systems against potential AI powered attacks. It is critical to keep training and exercises up to date with the latest threats and technologies to prepare organisations for AI-powered threats.

The best defense…

However, cybersecurity teams cannot adress the risks posed by AI solely from a defensive perspective. The biggest challenge here is speed and planning for the next big AI-powered attack potential. Organisations should work with the utmost dedication and stay ahead of cyber security trends to create proactive defence strategies.

External security operations center (SOC) services and working with specialised consultants is essential for organisations to be able to move as fast as threat actors and aim to be a step ahead – this is the only way to provide a sense of security in the face of ever-evolving AI threats.

AI as a threat to the whole organisation

AI integration in organisations’ systems is also not without risks. While AI is reshaping the cyber landscape in the hands of threat actors, enterprises are also facing accidental insider threats. AI systems integrations are leading companies to new vulnerabilities, which are well-known internal AI threats in cybersecurity.

Employees using Gen AI tools are accessing more organisational data than ever before. Even in the hands of the most well-intended employees, if they are not cyber-trained, AI tools could lead to unintentional leaks or misplaced access to restricted, sensitive data.

As in every cyber-attack scenario, tackling AI-powered threats is not possible without creating an organisation-wide cyber awareness and resilience culture. Training all employees on using AI tools and the potential risks they pose to an organisation’s systems and integrating AI into daily security operations are the first steps for creating a culture of cyber resilience against AI-powered attacks.

Developing organisational cyber awareness from every responsibility level is critical to avoiding emerging vulnerabilities and evolving AI threats. It not only helps mitigate the risks of employees accidentally misusing AI tools, but also helps build strong organisational cyber awareness and the proactive development of robust security measures.

Artificial intelligence (AI) is making its way into cybersecurity systems around the world, and this trend is only beginning. The potential for AI to revolutionise network security is vast. The technology offers new methods to safeguard systems and reduce the manual workload for IT teams. Moreover, with cybercriminals increasingly adopting AI to create more sophisticated attacks, organisations are starting to consider deploying AI to stay ahead.

However, the question remains: How effective is AI in this space?

Streamlining Cybersecurity Systems 

AI-based network security systems differ significantly to well-established methods of identifying malicious activity on a network. Signature-based detection systems only generate alerts when they identify an exact match of a known indicator of an attack. If there is any variation from the known indicator, then the system will be unable to pick it up.  The alternative is an anomaly-based system, which generates alerts when activity is outside an accepted range of ‘normal behavior. While this takes a more comprehensive view of network activity compared to signature-based systems, it is not without shortcomings. Perhaps the one most often discussed is its tendency to generate false positives when there is unusual activity that is not part of a cyberattack.

Both systems can require extensive manual intervention. IT teams must constantly update databases for signature-based detection systems to ensure that new attack techniques will be recognised as malicious activity. The alternative is that they constantly sift through the alerts generated by an anomaly-based system looking for genuine threats.

AI represents a way to streamline cybersecurity systems, by enabling faster and more precise detection of cyber threats. By processing vast quantities of data, AI systems can identify unusual patterns and behaviours in real time. This imparts key benefits to organisations that leverage AI as part of their cybersecurity defences.

The Value of AI 

Reducing Workload: AI-powered tools can significantly reduce the workload for IT teams. They help cut down the number of false alarms generated by security systems. This allows cybersecurity personnel to stay alert without becoming overwhelmed. This reduction in manual work allows security teams to focus on more complex, strategic tasks.

Increased Protection: AI also offers enhanced protection against cyberattacks. Unlike traditional signature-based detection methods, which struggle to identify zero-day threats, AI excels at recognising emerging threats based on behaviour and patterns. This, coupled with near real-time response capabilities, limits the window of opportunity for attackers to cause damage if they manage to infiltrate a system.

Greater scalability and adaptability. Another advantage of AI is that it gives organisations more flexibility.  Security teams can quickly respond to increased threat levels or unusual network behavior without having to expand their personnel.

Human Oversight

Although AI offers numerous benefits, it’s crucial to acknowledge the need for human oversight in cybersecurity. We should not think of AI as replacing cybersecurity experts, but rather as a vital tool to support them in running day-to-day operations.

 AI systems can process and analyse data rapidly, however they still rely on humans to validate findings, fine-tune the models, and make final decisions, especially when dealing with complex cyber threats. The stakes are high when it comes to the security of an organisation’s confidential data and technology infrastructure. That’s why human involvement is vital in ensuring that AI operates correctly and that correct procedures are being followed.

Mitigating the Risks of AI

While AI can enhance cybersecurity, it also brings several challenges that need to be managed, which highlight the need for human involvement and decision making. 

Accuracy of datasets: One significant concern is the accuracy of the data AI systems are trained on. AI’s effectiveness is largely determined by the quality of the data it uses to learn. If training data is incomplete or biased, the system may produce inaccurate results, such as false positives, or a false sense of security, in case of false negatives due to non-detection of e.g. malicious agents. To prevent this, organisations need to rigorously assess the data they feed into their AI models.

Privacy: Another potential issue is privacy. AI systems rely on real-world data to monitor network activity and identify anomalies. This data must be protected through anonymisation or other privacy-preserving techniques to avoid misuse – and should be deleted when it is no longer necessary.

Resource consumption: Running AI models, especially on a large scale, can be demanding in terms of both energy and water, which are required to maintain the systems. This contributes to a higher environmental footprint. By optimising the frequency at which AI models are retrained, organisations can reduce resource consumption. Additionally, the usage of resources will be lower once the model is trained.

Conclusion

While AI offers substantial benefits to cybersecurity, it also presents challenges that must be addressed to ensure its safe and effective implementation. The technology can significantly reduce workload, enhance network security through faster and more accurate detection, and adapt to evolving threats. However, without high-quality data, privacy safeguards, and careful resource management, these advantages may be undermined. 

The deployment of AI models should be carefully managed by cybersecurity professionals in order to fully take advantage of its capabilities while minimising risks. AI is a valuable tool – not a substitute for human experience and expertise.

As technology advances, so do the tactics of cybercriminals. The rise of artificial intelligence has significantly transformed the landscape of cybersecurity, particularly in the realm of online scams and phishing attempts. 

This transformation presents both challenges and opportunities for individuals and organisations aiming to safeguard their digital assets. Importantly, senior leaders can no longer simply rely on their IT teams to stay safe; they need to be active participants in the protection of new attack opportunities for cybercriminals in the age of AI.

The Evolution of Online Scams and Phishing

AI has empowered cybercriminals to create more sophisticated and convincing scams. Phishing, a common cyber threat, has evolved from simple email scams to highly targeted attacks using AI to personalise messages. Generative AI can analyse vast amounts of data to craft emails that mimic legitimate communications. This makes is difficult for individuals to discern between real and fake messages. 

AI-driven tools can scrape social media profiles to gather personal information in seconds. This information is then used to tailor phishing emails that appear to come from trusted sources. These emails often contain malicious links or attachments that, when clicked, can compromise personal or organisational data.

Previous phishing attempts were more obvious when the instigators didn’t have English as their first language. Thanks to Generative AI, criminals are now fluent in any language.

AI as a Double-Edged Sword

While AI enhances the capabilities of cybercriminals, it also offers powerful tools for defence. AI-based security systems can analyse patterns and detect anomalies in real-time, providing a proactive approach to cybersecurity. Machine learning algorithms can identify suspicious activities by monitoring network traffic and user behaviour, enabling quicker responses to potential threats.

AI can automate routine security tasks like patch management and threat intelligence analysis, freeing human resources to focus on more complex security challenges. This automation is crucial in managing the vast amount of data generated in today’s digital landscape.

AI is already having a significant impact on cybersecurity. The World Economic Forum estimates that cybercrime will cost the world $10.5 trillion annually by 2025, partly due to the increased sophistication of AI-powered attacks.

A study by Capgemini found that 69% of organisations believe AI will be necessary to respond to cyberattacks, indicating the growing reliance on AI for cybersecurity measures, and an IBM report in 2023 revealed that the average cost of a data breach is $4.45 million, emphasising the financial impact of inadequate cybersecurity.

Strategies for Staying Safe

Individuals and organisations must adopt comprehensive cybersecurity strategies to combat the evolving threats posed by AI-enhanced cybercrime. Here are some that can be easily implemented.

• Educate and Train: Regular training sessions on recognising new AI phishing attempts and cyber threats are essential. Employees should be aware of the latest tactics used by cybercriminals and understand the importance of cybersecurity best practices.
• Implement Multi-Factor Authentication (MFA): MFA adds an extra layer of security by requiring users to provide two or more verification factors to gain access to a resource, making it more difficult for attackers to breach accounts. Every system in your organisation should be enabled with MFA.
• Ask employees to secure their personal accounts: MFA should already be in place for businesses of any size, but employees must engage MFA (also called 2-factor) security on their accounts to reduce the avenues in which criminals can attack an organisation. The website 2fa.directory provides instructions for all major platforms.
• Use AI-Powered Security Solutions: Deploy AI-driven security tools that detect and respond to threats in real-time. These tools can help identify unusual patterns that may indicate a cyberattack.
• Regularly Update Software: Ensure all software and systems are up-to-date with the latest security patches, including personal mobile devices. This reduces vulnerabilities that cybercriminals can exploit.
• Encourage Digital Curiosity: Promote a culture of digital curiosity that encourages individuals to stay informed about the latest technology trends and cybersecurity threats. This proactive approach can help identify and mitigate risks before they become significant.

The Role of a Family Password

In addition to organisational strategies, simple measures like having a “family password” can be effective in personal cybersecurity. With the rise of AI-generated voice clones, the likelihood of a senior executive being targeted with a phone call that appears to come from a distressed family member is becoming increasingly real. 

A family password is a shared secret known only to trusted family members, used to verify identity during unexpected communications. This can prevent unauthorised access and ensure that sensitive information is only shared with verified individuals.

Criminals frustrated by sophisticated security measures in place protecting company data will move to the path of least resistance. Often, that means personal accounts. If you use Gmail for your personal email and haven’t enabled “2-Step Verification”, then can you be sure criminals aren’t already in your account, silently learning all about you and your family?

The digitally curious executive takes the time to deploy measures in their personal life. Simple measures include a password manager and enabling 2-factor authentication on all their accounts, starting with LinkedIn.

Conclusion

As AI continues to shape cybersecurity’s future, individuals and organisations must adapt and evolve their security practices. By leveraging AI for defence, educating users, implementing robust security measures at work and home, and passing some of the security responsibility onto employees, we can mitigate the risks posed by AI-driven cyber threats and create a safer digital environment.

Andrew Grill is an AI-Expert and Author of Digitally Curious: Your Guide to Navigating the Future of AI and All Things Tech.

While the outcome of Artificial Intelligence (AI) initiatives for the business world – driven by its potential as a transformative force for the creation of new capabilities, enabling competitive advantage and reducing business costs through the automation of processes – remains to be seen, there is a darker flipside to this coin. 

The AI-enhanced cyber attack

Organisations should be aware that AI is also creating a shift in cyber threat dynamics, proving perilous to businesses by exposing them to a new, more sophisticated breed of cyber attack. 

According to a recent report by the National Cyber Security Centre The near-term impact of AI on the cyber threat: “Threat actors, including ransomware actors, are already using AI to increase the efficiency and effectiveness of aspects of cyber operations, such as reconnaissance, phishing and coding. This trend will almost certainly continue to 2025 and beyond.” 

Generative AI has helped threat actors improve the quantity and impact of their attacks in several ways. For example, large language models (LLMs), like ChatGPT have helped produce a new generation of phishing and business email compromise attacks. These attacks rely on highly personalised and persuasive messaging to increase their chances of success. With the help of jailbreaking techniques for mainstream LLMs, and the rise in “dark” analogs like FraudGPT and WormGPT, hackers are making malicious messages more polished, professional, and believable than ever. They can churn them out much faster, too.

AI-enhanced malware 

Another way AI tools are contributing to advances in cyber threats is by making malware smarter. For example, threat actors can use AI and ML tools to hide malicious code behind clean programmes that activate themselves at a specific time in the future. It is also possible to use AI to create malware that imitates trusted system components, enabling effective stealth attacks.

Moreover, AI and machine learning algorithms can be used to efficiently collect and analyse massive amounts of publicly available data across social networks, company websites, and other sources. Threat actors can then identify patterns and uncover insights about their next victim to optimise their attack plan.

Those are only some of the ways that AI is impacting the threat organisations face from cybercrime, and the problem will only get worse in the future as threat actors gain access to more sophisticated AI capabilities. 

Using AI to identify system vulnerabilities 

Whether it translates into adaptive malware or advanced social engineering, AI adds considerable firepower to the cybercrime front. Just as organisations can use AI capabilities to defend their systems, hackers can use them to gather information about potential targets, rapidly exploit vulnerabilities, and launch more sophisticated and targeted attacks that are harder to defend against. 

AI-powered tools can scan systems, applications, and networks for vulnerabilities much more efficiently than traditional methods. Additionally, such tools can make it possible for less skilled hackers to carry out complex attacks, which contributes to the rapid expansion of the IT threat landscape. The exceptional speed and scale of AI-driven attacks is also important to mention, as it empowers attacks to overwhelm traditional security defences. In other words, AI has significant potential to identify vulnerabilities in systems, both for legitimate security purposes and for malicious exploitation.

Three types of AI-enabled scams

The types of scams employed by AI-enabled threat actors include: deepfake audio and video scams, next-gen phishing attacks, and automated scams.

Deepfake Audio and Video

Deepfake technology can create highly realistic audio and video content that mimics real people. Scammers have been using this technology to accurately recreate the images and voices of individuals in positions of power. They then use the images to manipulate victims into taking certain actions as part of the scam. At the corporate level, a famous example is the February deepfake incident that affected the Hong Kong branch of Arup, where a finance worker was tricked into remitting the equivalent of $25.6 million to fraudsters who had used deepfake technology to impersonate the firm’s CFO. The scam was so elaborate that, at one point, the unsuspecting worker attended a video call with deepfake recreations of several coworkers, which he later said looked and sounded just like his real colleagues.

Phishing

AI significantly enhances phishing attacks in several ways, and it is clear that AI-driven tactics are reshaping phishing attacks and elevating their effectiveness. Threat actors can use AI tools to craft highly personalised and convincing phishing emails, which are more likely to trick the recipient into clicking malicious links or sharing personal information. In some scenarios, scammers can deploy AI chatbots to engage with victims in real time, making the phishing attempt more interactive, adaptive, and persuasive.

Automated scamming

AI plays a valuable role in automating and scaling scam attempts. For example, AI can be used to automate credential stuffing on websites, increasing the efficiency of hacking attempts. Furthermore, large datasets can be analysed using AI to identify potential victims based on their online behaviour, resulting in highly personalised social engineering attacks. AI tools can also be used to generate credibility for scams, fake stores, and fake investment schemes by streamlining the creation and management of bots, fake social media accounts, and fake product reviews.

IT measures to defend against the AI-cyber attack threat 

Defending against AI-driven threats requires a comprehensive approach that incorporates advanced technologies, robust policies, and continuous monitoring. Key IT measures organisations can implement to protect their systems and data effectively, include:

1. Utilising AI and ML security tools

Deploy systems driven by AI and machine learning to continuously monitor network traffic, system behaviour, and user activities, which helps detect suspicious activity. Useful tools include anomaly detection systems, automated threat-hunting mechanisms, and AI-enhanced firewalls and intrusion detection systems, all of which can improve an organisation’s ability to identify and respond to sophisticated threats.

2. Conducting regular vulnerability assessments

Run periodic penetration tests to evaluate the effectiveness of security measures and uncover potential weaknesses. Regularly scan systems, applications, and networks to identify and patch vulnerabilities.

3. Building up email and communication security

Use email security solutions that can accurately detect and block phishing emails, spam, and malicious attachments. AI deepfake detection tools designed to identify fake audio and video content are also helpful in ensuring secure and authentic communication.

4. Regular security training and education

Conduct regular training sessions to educate employees about the latest AI-driven threats, phishing techniques, and best practices for cybersecurity in the AI age. Run simulated AI-driven phishing attacks to test and improve employees’ ability to recognise and respond to suspicious communication.

5. Data protection and security

Ensure that you back up sensitive data in accordance with best practices for data protection and disaster recovery to mitigate data loss risks from cyber threats. Follow general security recommendations like encryption and identity and access management controls to address both internal and external security threats to sensitive data and systems.

Cyber threats are constantly evolving. In response, organisations need to adapt and enhance their security programs to protect their digital assets. Managed Detection and Response (MDR) services have emerged as a critical component in the battle against cyber threats. 

A good MDR service will help organisations manage operational risk, significantly reduce their meantime to detect and respond to cyberattacks, and ultimately help them grow and scale their security programmes. 

Here, we explore five key ways in which the right MDR service can help you develop and scale more robust security programs.

1. Real-Time Threat Detection and Response

It is essential to have an MDR service which leverages advanced analytics and real-time monitoring across all infrastructure components. Doing this will help you identify and respond to cyber threats as they occur. By taking this proactive approach, you can ensure you detect threats early. This has the benefit of minimising potential damage and reducing the overall impact on the organisation.

Reduced detection time is a key benefit of MDR. With real-time monitoring 24/7/365 by skilled SOC analyst teams, threats can be detected and investigated much faster.

With immediate response, teams of experts can swiftly mitigate identified threats, preventing them from escalating.

By integrating real-time threat detection and response into their security programmes, organisations can stay ahead of cyber threats and ensure continuous protection of their digital assets.

2. Flexible Service

Your MDR service must be designed to address the constantly changing cybersecurity landscape, provide flexible options for coverage and multiple service tiers considering factors such as organisation size, technology stack and security profile. For example, at Obrela our MDR service uses an Open-XDR approach so clients can integrate and monitor existing infrastructure to improve security posture.

With flexibility in an MDR service to incorporate logs, telemetry and alerts from endpoints (desktops, laptops, servers), network infrastructure, physical or virtual data centre infrastructure, cloud infrastructure and OT, organisations can build a 360-degree view of their cybersecurity.

3. Advanced Threat Intelligence

Sophisticated threat intelligence will help an organisation to stay ahead of emerging threats. Threat intelligence and analytics of an MDR service must be continuously updated to identify patterns and predict potential attacks.

An MDR service must always be aligned with the current threat landscape to consider threat actor behaviour and TTPs, and ensure suspicious activity is detected and flagged prior to an attack taking place.

4. Expert Incident Management

Effective incident management is crucial for minimising the impact of cyber incidents. Without it, it’s impossible to ensure organisations can quickly return to normal operations.

An effective MDR service must include comprehensive incident management, from detection through to resolution. This should also include 24/7 support from cyber security experts to manage and resolve incidents effectively. An incident management service should cover every aspect of an incident, from initial detection to post-incident analysis and reporting.

Organisations today face a shortage of skilled and experienced security personnel. However, an MDR service gives you access to expertise on demand. Access to a team of experienced cybersecurity professionals ensures organisations can manage incidents efficiently and effectively.

5. Continuous Improvement and Optimisation

For businesses looking to strengthen their security posture, cybersecurity cannot be a one-time solution. It needs to be an ongoing partnership, aiming to continuously improve and optimise your organisation-wide cyber security. Regular assessments, feedback and updates will help ensure security measures remain effective and relevant.

Regular assessments and updates also ensure security measures evolve with the ever-changing threat landscape, while feedback and analysis from previous incidents help refine and enhance cyber security over time.

Continuous improvement and optimisation ensure your security is always at its best, providing robust protection against cyber threats.

Managed Detection and Response (MDR) services are essential for growing and scaling security programs in today’s dynamic threat environment. 

Utilising a cloud-native PAAS technology stack, our purpose-built Global and Regional Cyber Resilience Operation Centers (ROCs) provide continuous visibility and situational awareness to ensure the security and availability of your business operations. 

When MDR services detect cyber threats, rapid response services restore and maintain operational resilience with minimal client impact. 

By leveraging the right MDR service from an expert provider, organisations unlock the ability to scale with real-time, risk-aligned cybersecurity that covers every aspect of their business, no matter how far it reaches or how complex it grows, bringing predictability to the seemingly uncertain. 

For more information on how MDR services can enhance your organisation’s security programme, visit the Obrela website.

A new directive designed to safeguard critical infrastructure and protect against cyber threats came into force across the European Union (EU) from October. But although the United Kingdom (UK) is no longer part of the EU, understanding these changes is still important, especially if your business operates in the region. 

Plus, the Network and Information Systems Directive (NIS2) closely aligns with the UK’s own robust cybersecurity frameworks, including the Cyber Security and Resilience Bill introduced in the King’s Speech this summer. Preparing now could make it much easier to comply with future UK regulations as they come into effect. 

Why should UK businesses adapt? 

1. Prepare for future regulations 

Although the UK is no longer part of the EU, the interconnected nature of global cyber threats means it’s not practical to reinvent or move away from existing regulation. With that in mind, it’s not surprising that The UK’s upcoming Cyber Security and Resilience Bill is closely aligned to NIS2. By understanding what’s coming, and aligning with NIS2, UK organisations will be much better prepared for future national regulatory changes too – and of course better protected against cyber threats.

2. Strengthen cyber resilience

This goes beyond compliance for compliance’s sake. When it comes into force, NIS2 is designed to protect organisations from cyber attacks and can significantly enhance cyber resilience. With an emphasis on risk management, incident response, and recovery, UK businesses that adopt these practices can better protect themselves, respond more effectively to incidents, and, ultimately, safeguard their operations and reputation.

3. Cement business relationships with EU partners

Many UK organisations rely on strong relationships with EU partners, and it’s likely that NIS2 compliance could become a prerequisite for future contracts, just as we saw with GDPR. Many EU companies may require suppliers and partners to comply with equivalent cybersecurity measures, and failing to do so could limit opportunities for collaboration. By adopting NIS2 standards now, UK businesses will make it easier for EU partners to work with them. And, if nothing else, demonstrating an understanding of and adhering to high cybersecurity standards can help businesses stand out, especially in sectors where security and trust are crucial.

Prepping for the Cyber Security and Resilience Bill 

When the UK government set out plans for a Cyber Security and Resilience Bill, it heralded a significant strengthening of the UK’s cybersecurity resilience. If passed, this legislation aims to fill critical gaps in the current regulatory framework, which needs to adapt to the evolving threat landscape. 

The good news is, because much of the Bill and NIS2 align, if businesses have already started the process of adapting to the EU directive, the burden isn’t as great as it could be.

The Bill at a glance:

1. Stronger regulatory framework: The Bill will put regulators on a stronger footing, enabling them to ensure that essential cyber safety measures are in place. This includes potential cost recovery mechanisms to fund regulatory activities and proactive powers to investigate vulnerabilities.

2. Expanded regulatory remit: The Bill expands the scope of existing regulations to cover a wider array of services that are critical to the UK’s digital economy. This includes supply chains, which have become increasingly attractive targets for cybercriminals, as we saw in the aftermath of recent attacks on the NHS and the Ministry of Defence. This means that more companies need to be aware of potential legislative changes.

3. Increased reporting requirements: an emphasis on reporting, including cases where companies have been held to ransom, will improve the government’s understanding of cyber threats and help to build a more comprehensive picture of the threat landscape, for more effective national response strategies.

If passed, the Cyber Security and Resilience Bill will apply across the UK, giving all four nations equal protection.

Building on current rules 

The UK has a strong foundation when it comes to cybersecurity, and much of this guidance already closely aligns with the principles of NIS2 and the new Cyber Security and Resilience Bill. The National Cyber Strategy 2022, for example, focuses on building resilience across the public and private sectors, strengthening public-private partnerships, enhancing skills and capabilities, and fostering international collaboration. And National Cyber Security Centre NCSC guidance already complements new rules by focusing on incident reporting and response and supply chain security. Companies that follow these rules will be in a strong position as legislators introduce NIS2 and the Bill. 

Cyber protection for a reason 

This is not just about complying with the latest regulations. Cyber attacks can be devastating to the organisations involved and the customers or users they serve. Take for example the ransomware attack on NHS England in June this year, resulting in the postponement of thousands of outpatient appointments and elective procedures. Or the 2023 cyberattack on Royal Mail’s international shipping business that cost the company £10 million and highlighted the vulnerability of the transport and logistics sector. And how about the security breach at Capita also in 2023, that disrupted services to local government and the NHS and resulted in a £25 million loss. 

We live in an interconnected world where business – and legislation – often extends far beyond their original borders. So please don’t ignore NIS2. By understanding and preparing for it, UK businesses can better protect themselves against cyber attacks. Make themselves more attractive to European partners. And contribute to national cyber resilience.

The global cybersecurity threat landscape is expanding, driven by remote connectivity, the rapid convergence of information technology (IT) and operational technology (OT) systems, as well as an increasingly challenging international security and geopolitical environment.

All these issues present significant challenges – but also opportunities – for high-ranking technology leaders in all industries, not least in the context of ever-more-ubiquitous artificial intelligence (AI). 

Ensuring that cybersecurity standards are being met along the entire supply chain, for example, requires dedicated OT security teams to collaborate with their IT security colleagues to identify and address security gaps that are specific to the OT domain. 

‘Business as usual’ is not an option. Experts expect the global cost of cybercrime to reach an astonishing $23.84trn by 2027. Malicious actors, be they nation states, business rivals or cybercriminal gangs intent on blackmail, are deploying a variety of tools to exploit vulnerabilities.

The geopolitical conflicts taking place around the globe, and related campaigns of cyber espionage and intellectual property theft targeting the West, have propelled the issue even further up the business agenda. 

The onus is now on businesses and institutions of all types to ensure that their cybersecurity measures – beginning with strong foundational security controls and a well-implemented reference architecture – are fit for purpose, and that they both become and stay compliant with evolving legislation

Euro vision: the NIS2 directive 

On January 16^th, 2023, the updated Network and Information Security Directive 2 (NIS2) came into force, updating the EU cyber security rules from 2016 and modernising the existing legal framework. Member states have until 17^th October to ensure they have satisfied the measures outlined, which, in addition to more robust security requirements, address both reporting regulations and supply chain security, as well as introducing stricter supervisory and enforcement measures.

Let’s take the reporting obligations as an example. Incident detection and handling in OT is the basis for timely reporting but many industry sectors lack the requisite tools and experience. Under NIS2, businesses must warn authorities of a potentially significant cyber incident within 24 hours. Doing this effectively requires organisations to align their people, process and technology. However, this is often not the case.  

Importantly, unlike NIS1, which targeted critical infrastructure, the new, stricter rules also apply to public and private sector entities, including those that offer ‘essential’ or ‘important’ services, such as energy and water utilities and healthcare providers.

Cyber standards and risk analysis

Other countries and regions may have different rules. Operating in the US, for instance, requires compliance with several laws dependent upon the state, industry and data storage type, including the Cyber Incident Reporting for Critical Infrastructure Act, the rules of which are still under review.

In other words, companies in specific industry sectors need to look beyond these over-arching rules and refer to sector-specific security standards that cover the components, systems or processes that are critical to the functioning of the critical infrastructures they operate. 

Generally, it is good practice to follow existing standards like ISO27000 Series and IEC62443, which might already be the basis for existing cyber security frameworks. Organisations should certainly consider industrial automation systems, IEC 62443 for example, as it mentions so-called ‘essential’ functions such as functional safety, or the functions for monitoring and controlling the system components. 

Certainly, in terms of NIS2, the IEC62443 risk assessment approach for OT environments is a good place to start in terms of a risk analysis: what is the likelihood of a cyberattack? If a hostile actor targeted our facilities, staff or network without our knowledge, what would be the impact on the business?

Existing hazard and operability (HAZOP) and layers of protection analysis (LOPA) studies and analysis can help to create a needed incident response and disaster recovery plan, helping to define subsequent SLAs, redundancies, and backup and recovery systems.

Future-proofing operations

In all scenarios, foundational controls (patching, malware protection, system backups, an up-to-date anti-virus system, etc) are non-negotiable, helping companies active in all industry sectors and jurisdictions to understand how their system is set up, and the potential threat. 

Organisations should view cybersecurity legislation not as a hurdle but as an opportunity to strengthen and refine cyber defences, in collaboration with specialist technology providers. Organisations should ensure that they protect their reputation and their licence to operate, and future-proof their business against cyberattacks as the threat landscape evolves.

When did ransomware truly ramp up? Historically, many victims didn’t document successful attacks. This makes it hard to say with any certainty when this now widespread technique kicked into the mainstream arsenal of threat actors.

The rise of ransomware 

With that said, I feel as though a shift started in the late 2010s – and reports from others have corroborated my hunch.

The UK’s National Cyber Security Centre (NCSC), for example, stated that “ransomware has been the biggest development in cybercrime” since it published its 2017 report on online criminal activity. Similarly, the New Jersey Cybersecurity & Communications Integration Cell affirmed that “after 2017, the number of ransomware attacks have become more prevalent and continue to increase each year”, tallying with the growing popularisation of cryptocurrencies at that time which have enabled payments to be sent anonymously.

Since then, ransomware has remained an ever-present threat. Indeed, by the third quarter of 2021, Gartner revealed that new ransomware models had become the top concern facing executives.

In response, companies of all shapes and sizes have gradually begun to work towards protecting themselves from the evolving threat of ransomware, working to establish effective security policies and protocols. Further, the fightback has also stemmed from other areas, be it the continual evolution of defensive technologies or the heightening of regulations, with enterprises now required to implement more stringent security measures to ensure compliance and avoid fines.

However, without question, there are still several gaps that need to be bridged.

The state of ransomware in 2024

To explore just how effective (or ineffective) enterprises have become in defending against the impacts of ransomware attacks, Semperis recently carried out a survey of  nearly 1,000 IT and security professionals from global organisations across multiple industries in the first half of 2024.

Looking at the data, it’s clear that the threat of ransomware remains a significant problem, with attacks having become both frequent and continuous. According to the report, ransomware attacks impacted 85% of UK organisations in the past 12 months. Almost half of all organisations (45%) were attacked three times or more.

Repercussions of ransomware 

What is more concerning, however, is the rate at which companies are failing to combat these attempts. Indeed, hackers using ransomware successfully breached more than half (54%) of the UK companies we surveyed were in the space of 12 months – sometimes within the same day.

The damages associated with ransomware attacks are well known. From regulatory fines to business downtime and reputational damages, such threats can cause domino effects of problems for firms, with very few respondents having managed to avoid any kind of impact. Globally, almost nine in 10 (87%) experienced some level of disruption, while for a significant group, the effects were much greater. Indeed, 16% had their cyber insurance cancelled, 21% saw layoffs, and one in five (20%) had to close their business permanently.

Given the potentially devastating consequences, firms can feel cornered into cooperating with threat actors. In fact, more than three quarters of respondents in our survey that had suffered such an attack opted to pay the ransom, with 32% having paid out four or more times in the space of just 12 months.

Further, these sums are not insignificant. Indeed, 62% of UK companies that paid a ransom stumped up funds of between £200,001 and £480,000.

It shouldn’t just be the astronomical sums involved here that cause alarm bells to ring. Equally, it is vital for firms to understand that there is no guarantee that meeting the demands of cybercriminals will make their problems disappear during a ransomware attack. In fact, our findings show that more than a third of organisations that paid ransoms failed to receive decryption keys or were unable to recover their files and assets.

Don’t overlook recovery

Such a status quo cannot continue. Instead, enterprises must go back to the drawing board, working to establish more reliable and effective cybersecurity and system recovery strategies that work effectively against the ever-present threat of ransomware.

As part of this rework, companies must continue to test and trial their methods. This is vital to ensure they work when the company needs them. Indeed, our survey shows that 63% of UK companies took more than a day to recover their systems to a good state, while one in eight took over a week.

This is a problem. Indeed, downtime is more than just an inconvenience. Every second that passes during an outage translates into lost revenue, diminished customer trust and lasting damage to an organisation’s reputation. From sales slipping away to consumers questioning the reliability of your company, the implications can be massive.

On the right track to recovery

Promisingly, it appears that many organisations are on the right track, with nearly 70% of respondents stating that they had an identity-focused recovery plan in place. However, despite this, only 27% actually maintained dedicated systems for recovering Active Directory, Entra ID, and identity controls – the Tier 0 infrastructure that all systems depend on for recovery.

Organisations must bridge this gap. For many companies worldwide, AD is the backbone of their operations, serving as the primary identity platform. Cybercriminals are acutely aware of its significance and continue to target it. If they can gain control of an enterprise’s AD, they can effectively bring everything to a halt, applying immense pressure on unprepared organisations.

To avoid such a scenario from unfolding, organisations must prioritise establishing a dedicated system for backing up and recovering AD, ensuring they can restore operations with both speed and integrity in the event of an attack.

Less than a quarter of firms currently have such a system in place, and that needs to change. Yes, preventative measures are important. However, recovery is an aspect that organisations cannot afford to overlook.

Having evolved from a basic premise of locking down a victim’s data with encryption, then demanding a ransom for its release, research now suggests that ransomware will cost around $265 billion (USD) annually by 2031, with a new attack (on a consumer or business) every two seconds.

Against such a pervasive threat, businesses have sought to better prepare themselves against attacks.  They have developed an array of tools, including better backup management, incident recovery procedures, business continuity and recovery plans. Together, they have all made the encryption of victims’ data less profitable.

In addition, security researchers together with national bodies such as the Cybersecurity and Infrastructure Security Agency (CISA) have made substantial progress in identifying the weaknesses in the methods used by attackers, in order to develop decryption solutions. No More Ransomware, promoted by Europol, the Dutch police, and other stakeholders lists approximately one hundred such tools.

In response to these developments, attacker groups are reconsidering their strategy. Rather than risk detection by encrypting valuable data, they now prefer to extract as much information as possible. Then, they threaten to divulge it. Ransomware has become extortion.

Re-energising the threat of publication

The potential public disclosure of sensitive information is the core of leveraging fear to pressure victims into paying a ransom. The reputational damage and financial repercussions of a data breach can be devastating. 

Ransomware gangs have recognised the potential for damage to a brand or group’s reputation simply by being mentioned on the ransomware operators’ sites. A study found that the stock market value of the companies named in a data leak falls by an average of 3.5% within the first 100 days following the incident and struggles to recover thereafter. On average, the companies surveyed can lose 8.6% over one year.

This threat of loss based on association, now quantified and in the hands of cybercriminals has become an effective tool.

Operational disruption and revenue loss

Modern businesses rely heavily on digital systems for daily operations. A ransomware attack can grind operations to a halt, disrupting critical functions like sales, customer service, and production.

 This disruption translates to lost revenue, employee downtime, and potential customer dissatisfaction. The longer the disruption lasts, the greater the financial impact becomes. Attackers exploit this vulnerability, pressuring victims to pay the ransom quickly to minimize their losses. And they do this most effectively by recognising key operational data. 

This then evolves as a ransomware attack on one company can ripple through its entire supply chain. Suppliers and distributors may be unable to access essential data or fulfil orders. This leads to delays and disruptions across the supply chain. 

Knowledgeable attackers now target a single company as a gateway to extort multiple entities within the supply chain, maximising their leverage and potential payout.

Brand Damage at the regulatory level

Brazen ransomware groups have already realised the value in making direct contact with

end-users or companies that are the customers of their targets as it enables the operators to increase pressure.

However, one new avenue of this direct attack on brand reputation is for the gangs to connect with the authorities.  In November 2023, the ALPHV/BlackCat ransomware gang filed a complaint with the United States Securities and Exchange Commission (SEC) regarding their victim, MeridianLink.

In mid-2023, the SEC adopted new requirements for notifying data leaks effective from September 2023. One of these rules requires notification within four business days of any data leak from the moment it is confirmed. Not only did ALPHV/BlackCat take control of the trajectory of the extortion, but they also even circulated the complaint form among specialist forums as part of a promotional campaign.

Targeting the most vulnerable 

Ransomware gangs are not above using sophisticated, customised extortion strategies on the most vulnerable sectors. Healthcare has long been a key target – there is a step change in urgency when critical medical procedures may be delayed if ransom is not paid. 

Just a few months after the international Cronos Operation, the Lockbit group claimed a new victim in the healthcare sector. The Simone-Veil hospital in Cannes suffered a data compromise, adding to the extensive list of attacks conducted in recent months by other ransomware players against the university hospitals of Rennes, Brest and Lille.

Once the data had been extracted from the hospital on April 17, 2024, an announcement concerning their compromise was made on Lockbit’s showcase site on April 29, 2024. According to the cybercriminals’ terms, the hospital had until midnight on May 1, 2024, to pay the ransom.

The lesson here is that attackers exploit the vulnerabilities and pain points specific to each industry, making their extortion tactics more potent. And they do so with no consideration for the victims.

Ransomware attacks are now more than just data encryption schemes. They are sophisticated operations that exploit a range of vulnerabilities to extract maximum leverage from victims. By understanding the multifaceted nature of ransomware extortion, businesses and individuals can develop a more robust defence against this growing threat.

The ongoing effects of the cyber incident impacting Transport for London (TfL) serves as a stark reminder of the vulnerability of national infrastructure to cyberattacks. In an increasingly digital world, where cities like London depend on interconnected systems to keep essential services running smoothly, the ramifications of such an attack can be significant. 

The potential disruption of public transport services alone can bring daily operations to a halt, affecting millions of commuters, businesses, and the broader economy. Fortunately, law enforcement haven’t detected any damage to data. Nevertheless, this incident highlights the urgent need for a comprehensive and effective Disaster Recovery (DR) plan, tailored to manage both traditional disasters and modern cyber risks.

The evolving threat landscape

Historically, DR planning for organisations like TfL focused on physical threats – floods, fires, and power outages for example – but the landscape of risk has evolved enormously. 

Cyber threats, including data exfiltration, ransomware, phishing, and denial-of-service (DDoS) attacks, have become more sophisticated, capable of compromising critical infrastructure in ways that were previously unimaginable. The recent situation at TfL is a clear example of this shift, where attackers can potentially compromise a city’s transport system infrastructure, leading to widespread disruptions.

The lesson here is clear: DR and containment plans must evolve in tandem with these new threats. They must address both traditional risks and cyber risks in a way that ensures continuity of services even when technology is compromised. A cyberattack affecting national infrastructure can no longer be treated as a niche threat – it must be considered a mainstream risk with serious consequences.

The central role of communication in incident response

A crucial lesson to emerge from the TfL incident is the central role that communication plays in responding to such an event. In any large-scale cyberattack, the ability to communicate effectively and rapidly across different levels of the organisation and with external stakeholders can significantly shape the success of the response.

While TfL’s recent cyber incident did not cause any downtime of public services, primarily affecting internal systems, it serves as a reminder that future attacks could have more severe consequences. 

Ensuring a communication strategy is in place for potential service disruptions is essential for minimising public impact and maintaining operational continuity in the face of future threats.

To that end, a robust communication strategy must be a core component of any DR plan. It should account for multiple scenarios, including the potential failure of primary communication systems due to the cyberattack itself. This is particularly important for organisations like TfL, where clear communication is essential for managing both internal response efforts and external public expectations.

1. Establishing communication redundancies 

One of the first steps to ensuring effective communication during a disaster is building redundancy into the system. Security teams must put alternative methods – such as secure messaging apps, satellite phones, or third-party platforms – in place to secure the flow of critical information, even when primary channels are compromised. 

For instance, where internal networks may be taken down or compromised during a cyber attack, having a backup communication method ensures key personnel can still coordinate responses, share updates, and make informed decisions in real-time.

2. Engaging stakeholders quickly and transparently

A clear protocol for promptly notifying all relevant stakeholders – both internal and external – is essential. Internal teams, including IT, operations, and management, need to be informed immediately to coordinate the technical response, containment, and recovery efforts. Externally, law enforcement agencies, cybersecurity experts, insurance companies, and business partners must be brought into the loop to ensure compliance with legal obligations, expedite recovery, and manage financial repercussions. 

In the case of public services like TfL, this level of coordination is vital, both for restoring disrupted services but also for maintaining trust with the public and stakeholders.

3. Public communication: managing perception and behaviour

In incidents involving public services like TfL, the ability to communicate clearly with the public is crucial. Providing accurate, timely, and transparent updates can help manage expectations, reduce panic, and guide public behaviour during potential disruptions. Clear messaging allows TfL to inform commuters about the nature of the incident, any expected downtime, and available alternatives. This reduces frustration and confusion, ultimately helping maintain public trust in the organisation.

However, the nature of a cyberattack, which may include elements of uncertainty or ongoing investigation, adds complexity to public communications. TfL must balance transparency with caution. They must ensure that public statements do not inadvertently worsen the situation, such as by sharing details that could aid attackers. 

Establishing a pre-defined communication plan that outlines how to handle public relations during a cyberattack can provide a framework for managing these delicate situations.

The importance of a well-tested DR plan

The TfL incident also emphasises the need for regular testing and updates to DR plans. A DR plan is only as effective as its implementation during a crisis. Conducting regular “fire drill” exercises that simulate cyberattacks allows organisations to identify weaknesses in their plan and ensure that all stakeholders know their roles and responsibilities.

Simulated incidents help to refine both the technical aspects of the DR plan – such as isolating compromised systems and restoring backups – and the softer elements, such as communication protocols and leadership response. In the case of cyberattacks, where rapid containment is often critical, these drills can significantly improve response times and minimise the damage caused by the attack.

Additionally, post-incident reviews are essential for learning and improvement. Following the TfL incident, a detailed analysis of what went well and what failed during the response will provide invaluable insights for future preparedness. Lessons learned from real-world incidents allow organisations to continuously evolve their DR strategies to remain resilient in the face of emerging threats.

Developing a secure recovery strategy

When dealing with cyber incidents, particularly ransomware, it is not enough to simply restore services from backups. 

By restoring data directly to its original environment, security teams risk reinfection if theyhaven’t fully eradicated the malware. Instead, recovery should occur in a secure, isolated environment: a “clean room”. Here, security teams can analyse and neutralise the attack vector before they restore any systems or data.

This careful approach ensures that organisations avoid the costly mistake of reintroducing malware into their networks, which could lead to repeated attacks. Incorporating these steps into a DR plan ensures that recovery is not only fast but also secure and complete.

A call to action for strengthening infrastructure resilience 

The cyberattack on TfL serves as a wake-up call for national infrastructure organisations worldwide. 

The lessons learned from this incident highlight the need for a modern, comprehensive DR plan that addresses the full spectrum of risks – from traditional disasters to complex cyber threats. Central to this is a robust communication strategy, regular testing, and secure recovery processes. 

By taking these lessons on board, organisations can better protect their infrastructure, maintain public trust, and ensure resilience in the face of an increasingly dangerous cyber threat landscape.

Despite the number of cyber attacks in the UK increasing dramatically year-on-year, two-thirds of UK organisations still don’t operate with round-the-clock cybersecurity, according to a new report, “Unfunded and Unaccountable” by Trend Micro. The report claims to have found evidence of “major security gaps and lack of board accountability in many companies.” The results cast the UK economy’s cyber readiness in a worrying light.  

Bharat Mistry, Technical Director at Trend Micro argues that the issues are having dire consequences for UK businesses. “A lack of clear leadership on cybersecurity can have a paralysing effect on an organisation—leading to reactive, piecemeal and erratic decision making,” he says, especially as the frequency and severity of cyber attacks in the UK rises once again year-on-year. 

Cybercrime rising in the UK 

Cybercrime cost the average business in the UK £4,200 in 2022. All told, cybercrime costs the UK approximately £27 billion per year. The average cost of a cyber-attack to a medium-sized UK business was £10,830 in 2024. While that’s a necessarily larger figure than the overall average, the data still indicates a meaningful upward trend.

This year, the UK Government’s Cyber Security Breaches Survey found that half of UK businesses had suffered a cyber attack or security breach in the preceding 12 months — an increase from the previous year.

Trend Micro’s research, which surveyed 100 UK cybersecurity leaders as part of a global study, found that concerns over both the ubiquity of attacks, and the UK economy’s lack of preparedness to combat the threat. As noted by twenty-four IT, this year only 31% of businesses and 26% of charities undertook a cyber security risk assessment, suggesting that many businesses are not adequately prepared for the threat of cyber crime. 

Trend Micro’s report backs up that data. The overwhelming majority (94%) of cybersecurity leaders surveyed reported concerns about their organisation’s attack surface. Over one third (36%) are reported being worried about having a way of discovering, assessing and mitigating high-risk areas. Additionally, 16% said they weren’t able to work from a single source of truth. 

Communication, clarity, and cooperation

Trend Micro’s data pins the blame for UK companies’ failure to achieve these cybersecurity basics squarely on a lack of leadership and accountability at the top of the organisation. Emphasising this, almost half (48%) of global respondents claimed that their leadership doesn’t consider cybersecurity to be their responsibility. On the other hand, only 17% disagreed strongly with that statement. 

When asked who does or should hold responsibility for mitigating business risk, respondents returned a variety of answers, indicating a lack of clarity on reporting lines. Nearly a third (25%) of UK respondents said the buck stops with organisational IT teams. 

This lack of clear direction on cybersecurity strategy may be resulting in widespread frustration. Over half (54%) of UK respondents complained that their organisation’s attitude to cyber risk was inconsistent. Some noted that their organisation’s attitude to cyber risk “varies from month to month.” 

“Companies need CISOs to clearly communicate in terms of business risk to engage their boards. Ideally, they should have a single source of truth across the attack surface from which to share updates with the board, continually monitor risk, and automatically remediate issues for enhanced cyber-resilience,” argues Mistry. 

In an increasingly interconnected world, the importance of robust cybersecurity measures cannot be overstated. 

At present, one of the pressing security concerns facing organisations is supply chain attacks. Supply chain attacks are a sophisticated, extremely harmful threat technique in which cybercriminals target organisations by infiltrating or compromising the least secure aspects of a company’s increasingly broad digital ecosystem.

Critically, these attacks specifically exploit interdependencies between companies and their digital suppliers, service providers or other online third-party partners. This makes them particularly challenging to defend against.

Several notable examples of supply chain attacks highlight their potentially devastating impacts, such as the recent attack on the NHS. Several hospitals were forced to cancel operations and blood transfusions following an attack on IT company Synnovis. The IT company was hit by a major ransomware attack. The consequences have affected thousands of patients. In response, the NHS has issued a major call for blood donors as it struggles to match patient’s blood quickly. 

There was also the Okta supply chain breach disclosed in early 2022. Here, a third-party contractor’s systems were breached, subsequently impacting the leading identity and access management firm. Critically, hackers managed to extract information from Okta’s customer support system. This gave them access to sensitive data such as its clients’ names and email addresses. 

Similarly, the MOVEit breach stands as another noteworthy example. Discovered in 2023, this incident involved the exploitation of a zero-day vulnerability in the MOVEit Transfer software—a widely used file transfer application developed by Progress Software. The breach led to the unauthorised access and theft of data from numerous organisations globally. The attack was so bad that the NCSC provided its own information, advice, and assistance to affected companies.

Indeed, these two incidents, among many, highlight a crucial lesson for organisations: as supply chain threats become increasingly prevalent and complex, firms must recognise that their security is only as strong as the weakest link in their network of suppliers and partners. 

79% of UK businesses have experienced supply chain-related security incidents

Seeking to ascertain just how widespread the issue of supply chain attacks is at present, ISMS.online recently surveyed 1,526 security professionals globally to uncover their own experiences. 

Our latest State of Information Security report details the seriousness of the situation facing UK companies. Critically, we discovered that 41% of UK businesses had been subject to partner data compromises in the last 12 months. Further, a staggering 79% reported having experienced security incidents originating from their supply chain or third-party vendors—up 22% versus the previous year.

The message from this dramatic spike in statistics is clear. Supply chain vulnerabilities are not only becoming more prevalent but are also increasingly exploited by cybercriminals. This highlights the urgent need for comprehensive and collaborative cybersecurity measures across all levels of the supply chain.

Indeed, companies must work to mitigate these threats and minimise their risk exposure by reassessing their cybersecurity strategies. But where and how exactly should they focus their efforts? At ISMS.online, we believe that there are four key areas that companies should prioritise when it comes to achieving best practices.

1. Stronger supply chain vetting processes

First, it is critical to implement rigorous security vetting processes when selecting partners and suppliers. This involves thorough due diligence, assessing potential partners’ security posture and cybersecurity measures, and reviewing past security incidents and responses. Companies should also evaluate compliance with relevant regulations and continually monitor their partners’ security practices where appropriate.

2. Enhanced cybersecurity measures

Of course, it’s not good to demand that partners have robust security measures without adopting best practices yourself. Therefore, bolstering internal cybersecurity measures and extending them to the supply chain is needed to significantly reduce risks.

Here, strategies to consider include the regular auditing of internal systems, comprehensive employee training in cyber threat recognition and response, the adoption of advanced cybersecurity technologies like multi-factor authentication and encryption and keeping an updated and unique incident response plan in case of supply chain breaches.

3. Robust partnership agreements

Detailed and stringent partnership agreements will undoubtedly help establish clear cybersecurity expectations and responsibilities. Indeed, it is important to define security requirements, request regular security status reports, and define access controls to safeguard sensitive information.

4. Alignment with essential standards

Aligning with critical standards and asking that partners and clients do the same can be a highly effective way of ensuring consistent and high-security levels across the supply chain. Of course, there are a variety of standards to consider. However, for UK companies, some of the most important ones to align with include:

• Cyber Essentials: A UK government-backed scheme designed to help organisations protect themselves against common cyber threats by providing clear guidance regarding basic security controls.
• ISO 27001: An international standard for information security management systems that provides a systematic approach to managing sensitive company information, ensuring it remains secure.
• NCSC Supply Chain Security Guidance: A comprehensive supply chain security guide providing recommendations about managing supply chain risks, implementing robust cybersecurity measures, and ensuring continuous monitoring and improvement.

Given the growing threat of supply chain attacks, it is imperative to demand the adoption of cybersecurity best practices both internally and among suppliers, service providers, and partners. 

From aligning with essential standards to developing new partnership agreements, it can feel like a daunting or challenging task. Indeed, the difficulty for many companies is knowing where to start. However, achieving best practices on each of these fronts doesn’t need to be as daunting or burdensome as the businesses might think.

Indeed, with proper support and guidance, best practices can be adopted, followed internally, and advocated externally with relative ease.

Cyber threats have evolved into a formidable force capable of bringing down even the most technologically advanced organisations today. Ransomware attacks, data breaches, and sophisticated malware are some of the overwhelming challenges businesses face. These types of attack can disrupt operations, incur staggering financial losses, and erode customer trust.

The numbers speak volumes: in the past year alone, 50% of businesses in the UK reported cyber security breaches. Major incidents, on average, cost medium and larger businesses more than £10,000. 

This underscores an urgent need for a strategic approach to cyber resilience, one that requires a fundamental shift in mindset and a relentless pursuit of adaptation and innovation, involving both technical measures and a security-conscious company culture.

It’s About Mindset and Culture: Moving from Response to Resilience 

The ripple effect of these breaches extends far beyond the target company, crippling entire ecosystems. That is why cyber security has catapulted to the top of boardroom agendas. Forward-thinking enterprises understand that cyber security is not a mere IT issue. They understand cybersecurity is a core business risk that demands a comprehensive approach. 

Ensuring business continuity in the face of evolving cyber threats encapsulates the proactive shift in corporate strategies towards cyber resilience. 

In today’s interconnected digital landscape, businesses no longer solely react to cyber threats but embrace resilient frameworks that safeguard operations amidst constant evolution in threat landscapes. This approach transforms cybersecurity from a reactive measure into a strategic asset. Vitally, it ensures that investments in technology and operations are safeguarded against emerging threats. 

As businesses navigate a landscape marked by digital transformation and interconnectedness, cyber resilience emerges as the linchpin for maintaining trust, preserving operational integrity, and sustaining growth in an increasingly digital world.

Building a Strong Foundation for Cybersecurity

Leveraging AI is no longer an option but a necessity. By harnessing the capabilities of AI, enterprises can achieve unprecedented levels of threat detection accuracy (92.5%), reduce false positives (3.2%), and cut response time (40%). 

AI systems can analyse millions of daily attacks, identifying emerging threats through advanced pattern recognition. This bolsters defences against sophisticated attacks. AI is revolutionising the development of secure code and preventing vulnerabilities from appearing in the first place. AI-powered automation can streamline migration, upgrades, and modernization, reducing risks from manual processes.  

Organisations are also adopting AI-enhanced cybersecurity maturity assessments, which help enterprises build robust, adaptive defences in an evolving threat landscape. These should go beyond traditional crisis response plans and encompass the threat landscape. 

Data Loss Prevention (DLP) solutions are crucial, particularly in the era of open banking and third-party applications. These solutions can identify, monitor, and control access to sensitive data and help enterprises respond to attacks while complying with regulations. 

Partnerships with cyber security firms and the integration of threat intelligence feeds can also be leveraged to provide invaluable insights into the latest attack vectors and emerging threats, empowering organisations to stay ahead and fortify their defences. Additionally, incorporating threat intelligence into an incident response plan can significantly reduce post-breach recovery time. 

From SOC to Cyber Fusion Centre 

Transforming a Security Operations Centre (SOC) into a Cyber Fusion Centre represents a strategic evolution in cybersecurity capabilities, aligning defence strategies with the dynamic and interconnected nature of modern threats. 

Unlike traditional SOCs focused primarily on incident response and threat detection, Cyber Fusion Centres integrate intelligence gathering, analytics, and collaboration across teams and technologies. This proactive approach enhances situational awareness by synthesising data from multiple sources—such as network traffic, endpoint devices, and threat intelligence feeds—into actionable insights. By fostering synergy among cybersecurity teams, including analysts, engineers, and incident responders, Cyber Fusion Centres enable rapid detection, response, and mitigation of sophisticated cyber threats. Moreover, these centres facilitate real-time decision-making through advanced automation and orchestration, empowering organisations to pre-emptively address emerging threats before they escalate. 

As cyber threats continue to evolve in complexity and scale, Cyber Fusion Centres emerge as pivotal hubs for orchestrating comprehensive defence strategies that safeguard critical assets, uphold regulatory compliance, and maintain stakeholder trust in an increasingly digital and interconnected world.

Creating firewalls in the boundaryless world of digital ecosystems requires a paradigm shift towards dynamic and adaptive cybersecurity measures. In today’s interconnected landscape, where data flows seamlessly across platforms and devices, traditional perimeter defences are no longer sufficient. Organisations must deploy sophisticated firewalls that not only protect against external threats but also monitor and manage internal risks effectively. 

This entails implementing robust intrusion detection systems, advanced threat analytics, and continuous monitoring protocols. Moreover, integrating firewalls into the fabric of digital ecosystems ensures that security measures evolve alongside technological advancements, providing resilience against ever-evolving cyber threats.

Additional techniques to enhance security include web content filtering, endpoint security agents, file upload application protection, sandbox testing of applications, browser isolation, off-network security filtering for company devices, prevention of unapproved software installations, and revocation of user access when necessary. 

Best Practices for Building Cyber Resilience

To fortify their cyber resilience, enterprises must adopt a holistic approach. This must include an incident response plan, meticulously tested with all relevant teams including IT, legal, communications and human resources. 

This ensures that the roles and responsibilities are spelled out. Pre-established contracts with legal, communications, and forensics specialists can save valuable time after an attack.

This demands a practical strategy, starting with recovery planning that must occur before an attack. An integrated view of application, server, and network vulnerabilities must be accessible to all management levels, leveraging AI-driven threat intelligence.

Regular and mandatory employee training should also be an essential part of this strategy. Many top risks stem from internal behaviour and compromised or stolen devices. 

In today’s connected systems landscape, implementing a Zero-trust model with shared security and compliance across employees, vendors, and partners is essential.

Lastly, always operate with the mindset that the business will be attacked and that attackers are already in your environment. By integrating these strategies, businesses can enhance their resilience and better navigate the modern digital landscape.

In response to the escalating frequency and complexity of cyber-attacks, the US has implemented measures to bolster cyber resilience. In May 2021, President Biden signed an Executive Order, leveraging  $70 billion worth of US government IT spending power to mandate all federal bodies and their private sector partners to incorporate zero-trust policies throughout their IT infrastructure. 

The legislation enacted gives those in question until September 2024 to comply with tighter security regulations. The implications of which, however, extend far beyond US organisations to any organisation with ties to US business. As such, this policy has international ramifications. All organisations within federal supply chains, regardless of their location, must adhere to these standards. 

This legislation comes at a time when external attack surfaces are under increasing threat, with data breaches increasing by 72% between 2021 and 2023. This legislation makes clear that new security measures must be taken to mitigate these increasing threats across the entire attack surface. This includes increasing identity monitoring and visibility across endpoints, networks and cloud security architecture through to user application protection.

Implementing these comprehensive cybersecurity measures can seem like a complex undertaking and developing a robust and adaptable strategy isn’t always easy, but it is becoming crucial in the face of evolving threats. Let’s unpack. 

The need for collaboration

Zero-trust policies treat every access attempt with suspicion, whether it originates from inside or outside a network. By scrutinising each request, zero-trust enables finer control over who gets access to data and what they can do. This policy creates a security net where nothing slips through unchallenged. The result? A robust defence that keeps cyber threats at bay.

Despite being US legislation, UK businesses with US partners will naturally need to comply with these tighter security regulations. This is because the nature of modern international business means that data is often shared between companies and up and down supply chains.

Considering the extent of the supply chains in question often spans several countries, this presents several complex challenges. These range from navigating diverse data residency laws to bridging communication gaps and aligning with a patchwork of compliance regimes. If these challenges aren’t met, businesses leave themselves open to data breaches that could result in financial and reputational damages. Standard global security policies combined with innovative security solutions can help bolster resilience on a global scale. 

Enhancing visibility 

Properly managing supply chain security leaves a lot to keep track of, and even today, we see siloed approaches to cybersecurity, wherein organisations adopt singular tools to address singular challenges, but this is only a short-term solution. Effective zero-trust policies set out by the US mandate require enhanced visibility across the attack surface. This is because there are more policies to implement, and therefore more techniques and run books to be applied, so increased visibility provides the scope and platform to constantly monitor and resolve threats – a key principle as they increase in volume and sophistication. 

With so many siloed tools out there, organisations should consider deploying network security overlays in a single stack, as this allows them to easily underpin their networks with zero-trust. For example, Software Defined Wide Area Network (SD-WAN), which was built for on-site work, is still prominent today.  The shift to hybrid and remote work accelerated cloud adoption. As a result, cloud security architectures, such as Secure Access Service Edge (SASE), have become increasingly critical.  Deploying both as part of a single stack solution would fortify the supply chain attack surface and unify network operating metrics so they are all visible in one place. 

This is vital in the context of this legislation given its focus on supply chains. Furthermore, while the US has set the mandate, we are now seeing similar proposals to strengthen supply chain security, the European Union’s NIS2 measures and UK’s recently announced cyber security and resilience bill for example. These are great steps in standardising global security practices and must continue if organisations want to tighten security protocols on a global scale. 

Leveraging industry expertise

Years of experience and gathered expertise leave Managed Service Providers (MSPs) uniquely positioned to help organisations through the complexities of the zero-trust mandate. Strengthening cyber defences requires a unique industry perspective, one that can help many navigate increasingly challenging environments. 

MSPs can ensure due diligence is done. They can ensure that businesses can adopt and maintain effective zero-trust policies, strategies and management systems. For example, a single-stack solution would reduce the pressure on in-house IT teams. This comes at a time when these teams are increasingly pressed by the growing attack surface. Equally, a single-stack solution would provide a platform to bolster security and free up internal resources to focus on driving efficiency and innovation.

September 2024 is just around the corner. However, the mandate should not be seen as an inconvenience or hurdle, but rather an opportunity for transformative security enhancements. 

Adopting zero-trust architecture into a single-stack offers a dual benefit in more robust security measures. But there are additional benefits. It also streamlines IT operations that offset skills shortages and the chaos of siloed security tools. 

Embracing zero-trust isn’t simply just about compliance. It’s about protecting your organisation for the future. By partnering with MSPs and committing to the requirements of this mandate, businesses can transform potential challenges into strategic advantages. In doing so, they will position themselves at the forefront of secure, efficient and agile operations.

Over just six months the number of reported cyber-dependent crime incidents in the UK rose by over 20%. As AI continues to lower the barrier to entry for criminals, that number will likely grow even faster over the next two years.

We’re no longer facing a flood of cyber attacks. We’re facing a tsunami. And as we prepare our defences for the colossal wave of threats heading our way, we can take inspiration from the early-warning detection systems used to protect against tsunamis.

Backed by a robust communications infrastructure, these systems harness a network of sensors to detect and verify the threat before issuing timely alarms. Local authorities can notify those at risk in advance and preparations can be made to prevent loss of life and damage to property.

Similarly, in cyber security, Threat Detection and Response (TDR) systems can help identify threats early and mitigate any potential damage. They too utilise effective communications and a network of ‘sensors’ to alert security professionals of any irregularities requiring their attention.

However, for TDR systems to be effective against the current surge of threats, security teams much introduce them as part of an integrated mesh architecture.

Modern security for modern infrastructure

For many years, organisations protected themselves against cyber attacks by establishing defensive measures around a defined perimeter, such as their company intranets. Defences typically comprised of firewalls, antivirus software, and intrusion detection systems. While these are still important tools for defending private networks against outside threats, in today’s digital world they are no longer enough.

Businesses have been rapidly transferring processes and storage to cloud networks. This, combined with the rise in remote working and Software as a Service (SaaS) offerings, has all but dissolved the perimeter that traditional security measures were designed to shield. As companies move assets off-premises, security teams must extend controls into all systems where data is stored.

This once again draws parallels with the tsunami early-warning systems. A sensor on the coastline (the defined perimeter) will still provide a tsunami warning, but it is unlikely that you will be able to do anything about it when it’s already at your door. However, placing a sensor further out at sea provides more advanced notice. The sensor can prompt people to take action before the wave reaches the shore.

Likewise, when properly integrated, TDR can extend security monitoring across your entire IT infrastructure, including third-party applications. This helps security teams detect and respond to threats earlier and greatly reduces the amount of damage they can cause.

Extended visibility with TDR

An effectively integrated TDR collects, aggregates, and analyses security data from various tools to provide comprehensive, accurate threat detection in real-time. It simplifies the approach, while providing greater visibility across on-premises and cloud environments. Achieving this requires focusing on three cyber security solutions at once.

First is Endpoint Detection and Response (EDR), a security solution used to monitor endpoints – i.e., computers, tablets, phones etc – and detect and investigate any potential threats. It uses data analytics to identify suspicious network activity. When it detects suspicious activity, it blocks any malicious actions and alerts security teams.

The second solution is Network Detection and Response (NDR) which, as the name suggests, executes a similar task but at the network level. It uses AI, machine learning and behavioural analytics to monitor traffic. This then allows it to establish a baseline of activity. The NDR solution can then measure activity agains the benchmar to track malicious or anomalous activity.

Finally, at the heart of this approach is Security Incident and Event Management (SIEM). It collects and analyses the data from your EDR and NDR solutions, along with additional security logs, and provides a central view of all potential threats.

Combining these three solutions results in an extended detection and response (XDR) system that reduces false positive alerts, provides better threat identification, and offers greater visibility over network assets. It also presents security teams with contextually rich, triangulated cases assembled from a unique set of high-fidelity detections across multiple layers – giving them the detailed information required to prepare a more effective and timely response.

The implementation and management of XDR systems can be a time consuming and resource intensive process, but it has become an increasingly important part of modern cyber security.

Early warning for a better response

In the face of an escalating cyber tsunami, spurred on by the advanced capabilities of AI, the need for security measures that transcend traditional defences has never been more critical. To quickly identify threats outside the traditional security perimeter, businesses need access to detailed information showing which actions to take.

Much like how tsunami early-warning systems pull together various signals to identify and verify a potential threat, a well-integrated XDR can achieve this by collating data from numerous touchpoints. This further enhances visibility across the entire IT infrastructure, allowing security teams to respond swiftly and effectively to any potential attack.

Ultimately, the evolution of the threat landscape demands an equally dynamic and proactive approach to security. Businesses will be better prepared and more resilient to the ever-growing wave of threats by embracing the principles of early detection, comprehensive monitoring and integrated response mechanisms.

2024 will see half of the global population head to the polls. This includes elections in the US, Europe, Africa, India, and of course, the UK. While this should be a cause for celebration, the threat of cyberwarfare is now jeopardising democracy.

The digital realm has erupted into an invisible war in which the UK is under constant attack. In this kind of warfare, everyone is on the front line; every company, every person. There are no borders. That’s what makes cyberattacks such an effective form of warfare. It’s not simply about data breaches or financial gains either, these attacks are a calculated assault on public trust, aimed at destabilising economies, crippling entire systems and eroding the fabric of democracy.

A parliamentary committee accused the UK government of burying its head in the sand over the “large and imminent” national cyber threat it’s facing. Moreover, global tensions are only heightening this threat, with the National Cyber Security Centre (NCSC) recently exposing Russian intelligence services attempting to interfere in UK politics and its democratic processes.

Now, 37% of IT leaders in the UK believe that cyberwarfare could affect the integrity of an election, spiking significantly from those within the three major pillars of our society: government (60%), healthcare (67%) and financial services (71%). Make no mistake, the nation is teetering on the precipice of a digital catastrophe.  And democracy is in danger.

Democracy on a tightrope

The NCSC highlighted that all types of cyber threat actors – state and non-state, skilled and less skilled – are using and weaponising AI, amplifying their ability to cause harm and supercharging the volume and impact of cyberwarfare. Combine that with the rising geopolitical tensions between the UK and Eastern Axis enemies, and we’re entering a very fragile situation.

Adding insult to injury, the Russian state has also played a proactive and malign role in attacking elections held in the West for years, which is why 45% of UK organisations say that Russia poses a greater threat to global security compared to China. With the UK general elections expected sometime in November 2024, the nation needs the government to step up its cyber defences.

The UK needs to step up and defend its elections

Yet, over half (52%) of UK IT leaders lack faith in the government, believing it can’t defend its citizens and enterprises against an act of cyberwarfare. What’s worse, it’s a significant change in sentiment compared to a year ago. Then, 77% of UK IT leaders had confidence in the government. It’s now simply failing in its first duty: “To keep citizens safe and the country secure”.

In addition, new research shows that 45% also say cyberwar can result in cyberattacks on the media. Nothing is safe. Bad actors have already planted tbhe seeds of discord. From Russian-based disinformation campaigns spreading false content about the Princess of Wales on social media to China attacking UK lawmakers and the national election body, nation-threat actors are destabilising society and democracy is simply balancing  precariously on a tightrope.

Despite this, almost half (46%) of IT leaders say they’re unconcerned or indifferent about the impact of cyberwarfare; a 13% YOY increase. However, it’s not indifference. It’s a result of being overwhelmed. A lack of automation has left 29% of cybersecurity teams feeling overwhelmed, hindering security and IT professionals from effectively remediating or prioritising threats. Faced with a further deluge of information, the mounting pressure to maintain constant vigilance and a lack of  resources, it’s easy to understand why some IT leaders are seemingly indifferent.

However, this is not an excuse for inaction. Especially with democracy on the line. If we’re to mitigate the threat of foreign interference within the electoral process – and avoid democracy being knocked off the tightrope – we must take a more proactive approach.

Taking matters into our own hands

In the face of these escalating threats, it’s crucial for the government and organisations to proactively rebuild national confidence by enhancing defensive cybersecurity strategies. And that starts with being able to see the entire attack surface.

To effectively defend against cyber threats, you need to know what you’re up against. That’s why organisations must conduct a comprehensive assessment of their attack surface. Do to this, they must map all the entry points and vulnerabilities that bad actors could exploit. Most importantly, they need to follow mapping with investment into technology that can help identify and monitor any threats.

With tens of thousands of physical and virtual assets connected to any organisation’s networks on an average day, and over 40% remaining unmonitored, its time organisations start defending against current threats while also positioning themselves for the dynamic challenges and evolving vulnerabilities that lie ahead.

A complex, thorny problem

With that, it’s important to remember that not all vulnerabilities are created equal. In 2023, the cybersecurity community identified and dealt with an astonishing 65,000 unique Common Vulnerabilities and Exposures (CVEs), yet the patch rates for critical CVEs remained noticeably lower than others. Put simply, organisations are failing to prioritise the right vulnerabilities.

From a deluge of data and too many different tools for managing assets connected to a network, organisations must instead equip themselves with the right tools to combat cyberwarfare. Implementing technology that can help teams understand and focus on the vulnerabilities affecting assets, particularly ones that are critical to the core function of the organisation, or are in a vulnerable context, is now a necessity for a robust cybersecurity posture.

Additionally, as cyberwarfare tactics are constantly evolving, organisations must stay ahead of the curve with continuous threat intelligence. Solutions that act as an early warning system, using AI and machine learning to scan the dark web, whilst setting dynamic ‘honeypots’ for bad actors, provides actionable data ahead of vulnerabilities, attacks and impacts.

By combining these early warning systems with automation and other AI-powered solutions, security teams can proactively address threats to elections. After all, nation-state actors are increasingly using AI for attacks, so it’s time to start using it for defence.

Building a digital defence

Global attack attempts more than doubled in 2023, increasing 104% and, when combined with rising geopolitical tensions, the UK has found itself in the crosshairs of bad actors, nation-state or otherwise. With 2024 being such a crucial year for democracy, it’s time organisations – as well as the government – come together to rebuild national trust. The time to act is now.

Starting with a robust investment in cybersecurity, coupled with the deployment of AI-driven tech that can see, secure, protect and manage billions of assets around the world in real-time will be key in an organisation’s cyber defence. If government and organisations take a proactive approach today, then there’s a chance we can still shield democracy from the threat of cyberwarfare.

Designed to exploit weaknesses in third party suppliers, a software supply chain attack turns a trusted supplier into an unsuspecting Trojan horse. In recent years, collective awareness of cyber risk has grown, leading to widespread adoption of stronger safety measures. This has made direct attacks on large organisations more challenging. 

So, hackers have turned to enterprises’ supplier networks as a new source of vulnerabilities to exploit. Smaller software suppliers often have weaker security measures, making them easier targets. Once compromised, these suppliers’ software can be injected with malicious code, providing hackers with a way to breach their target from within.

The results can be catastrophic. According to a new report from BlackBerry, UK companies are especially likely to be at risk of cyberattack in their supply chain. 

 “Unknown components and a lack of visibility on the software supply chain introduce blind spots containing potential vulnerabilities that can wreak havoc across not just one enterprise, but several, through loss of data and intellectual property, operational downtime along with financial and reputational impact,” commented Christine Gadbsy, VP of Product Security at BlackBerry in the report. “How companies monitor and manage cybersecurity in their software supply chain has to rely on more than just trust.”

BlackBerry’s report highlighted the 2020 hacking campaign which targeted a vulnerability in SolarWinds software and managed to penetrate US government departments including the Department of Homeland Security and part of the Pentagon. New research from BlackBerry highlights the extent of the problem for UK software supply chain security. 

UK firms battered by cybersecurity threats 

BlackBerry’s study found that four out of five software supply chains have been either notified of a vulnerability or the target of cyber attacks in the past year. 

Out of those who experienced an attack, 59% were operationally compromised, 58% lost data, 55% lost intellectual property, 52% suffered a perceived loss to their reputation, and 49% were hurt financially. 

Recovery times following an attack were also longer than ideal for many firms. Nine out of ten companies took up to a month for their operations to recover following a software supply chain attack. According to BlackBerry’s researchers, “the damage to reputation and brand lasts much longer.”

This data not only identified an increase in attack frequency but also shows a greater financial impact compared to data from 2022.

One alarming discovery from the report was the presence of hidden entities within software supply chains. According to BlackBerry, three in four businesses uncovered hidden entities in their supply chain, with over two-thirds (68%) of businesses only recently identified these unknown participants. 

This vulnerability typically arises as the result of gaps in regulatory and compliance processes. Troublingly, fewer than 20% of UK companies request security compliance evidence from suppliers beyond the initial onboarding stage.

Also, despite reporting high levels of confidence in their suppliers’ ability to identify and prevent vulnerabilities, few companies consistently verified compliance. This lack of verification and visibility, the report’s authors argue, leaves opportunities for cyber criminals to exploit.

At a time when organisations face higher levels of cyber threat than ever before, it’s not a huge surprise that zero-trust strategies are growing in popularity.

According to a new report from Gartner, 63% of organisations worldwide have implemented some kind of zero-trust strategy, either fully or to a partial degree. 

However, while the number of organisations exploring zero-trust is growing, Gartner also found that the approach typically covers less than half of an organisation’s IT environment. 

What is zero-trust? 

Zero-trust is an approach to security which treats everyone, whether they’re inside or outside the company network, as a potential risk. In practice, zero-trust environments constantly authenticate, authorise, and continuously validate everyone inside or outside the network. 

Zero-trust means an end to the idea of a traditional network edge. As a result, networks can be local, in the cloud, or a mix of both, and people can connect to them from anywhere. Zero trust has been particularly in vogue since the COVID-19 pandemic drove a worldwide spike in remote and hybrid working. 

Widespread adoption troubled by lack of clear vision 

Gartner’s survey found that more than half (54%) of organisations pursuing zero-trust as their primary cybersecurity strategy were doing so because they see the approach as a best-practice for the industry. 

“Despite this belief, enterprises are not sure what top practices are for zero-trust implementations,” said John Watts, VP Analyst, KI Leader at Gartner. “For most organisations, a zero-trust strategy typically addresses half or less of an organisation’s environment and mitigates one-quarter or less of overall enterprise risk.”

Three steps to zero trust 

Gartner recommends three steps for best-practice zero-trust adoption. 

Practice 1: Set Clear Scope for Zero-Trust Early On

To nail zero-trust, organisations should know what part of their setup they’re covering, which domains are included, and how much risk they’re cutting down. Reportedly, most organisations don’t cover their whole setup with zero-trust. In fact, 16% cover 75% or more, while only 11% cover less than 10%.

Practice 2: Share Zero-Trust Wins with the Right Metrics

Of the organisations with some level of zero-trust in place, 79% have strategic metrics to track progress, and of those, 89% have risk metrics too. When sharing these metrics, security leaders should tailor them for zero-trust, not just recycle old ones. CIOs, CEOs, and the board back an estimated 59% of zero-trust projects.

“Metrics for zero-trust should focus on its specific goals, like cutting down malware movement, rather than just general cybersecurity stats,” said Watts.

Practice 3: Expect Higher Costs and Staffing Needs, But No Extra Delays

According to Gartner, 62% of organisations think costs will go up, and 41% expect to need more staff for zero-trust.

“The cost of zero-trust varies based on the scale and robustness of the strategy from the start,” said Watts. “It can increase costs as organisations work on maturing their risk-based and adaptive controls.” While only 35% faced setbacks in their zero-trust rollout, having a solid plan with clear metrics helps keep things on track.

Over the past decade, every company has ostensibly become a tech company. Nowhere is this more true than in the automotive sector. In 2021, there were an estimated 237 million connected cars on the road. By next year, that number is expected to hit 400 million. 

The era of the software defined vehicle 

Cars are becoming increasingly suffused with technology. 

So much is this the case that (in a sort of Armageddon oil drillers in space situation) tech companies like Xiaomi and (maaaybe, probably not any more) Apple are getting into the car game.  

Next generation electric vehicles aside, the average car is, according to Luca de Meo, CEO of the Renault Group, more about software than hardware. “The car must now go beyond the physical object. Today, it’s all about connecting it to the cloud, to the digital ecosystem, and turning it into an extension of our digital spaces,” he wrote in March of last year. 

The average passenger vehicle contains hundreds of sensors, cameras, and enough microchips for the global semiconductor shortage to hit the auto industry harder than it hit the smartphone market. The most technologically sophisticated passenger cars contain as many as 3,000 microchips guided by 150 million lines of software code. According to a report by the United Nations’ economic commission, cars could become twice as complex by the end of the decade.

De Meo even notes that the “computer systems and practical software features” have become the main selling points of modern vehicles. 

These software defined vehicles (SDVs) are defined by De Meo as operating based on a centralised electronic architecture, being equipped with artificial intelligence (AI), have the potential to be paired with a digital twin, and most importantly are connected to the cloud during their entire lifecycle. 

Car’s aren’t just getting smarter. They’re also more inseparably and permanently connected to the internet. Automakers are constantly updating, even improving SDVs, argues De Meo. He says SDVs will “become better and improve themselves day by day. As a result, they will be better when you sell them than when you buy them.” 

Smarter cars mean more cyber risk 

Despite the benefits touted by the auto industry of an always-on, always-connected car, perpetual connection to the internet via a plethora of IoT devices also has its risks. 

More technology makes cars safer, smarter, and more convenient to use. However, it also presents a troubling new threat vector. As the electronic (and always connected) systems inside cars become increasingly sophisticated, they present a more inviting target for cyberattacks. 

What kinds of cyberattacks?

The infotainment system in an SDV connects to the internet and other devices around it via wifi, bluetooth, cellular, and USB connections. These systems—much the same as for a personal computer—can provide an entry point for hackers to exploit. Ivan Reedman, director of secure engineering at IO Active, argues that this could allow these hackers to “access and control vehicle functions remotely, endangering human safety.” 

It’s more likely, however, for hackers to be interested in attacking a car for the same reason they breach many other systems: data. “Infotainment systems also store personal information, such as personal contacts and location data, which can attract cybercriminals,” says Reedman. Personal data is vulnerable to attack whether users store is in the car itself, or on a device that trusts the car.

Cybersecurity in the auto industry shifting gears 

The simple fact is that the auto industry is going to have to adopt a cybersecurity-conscious mindset and invest heavily into ensuring the SDVs of the future don’t represent a huge potential cyber risk. 

A McKinsey report notes that “cybersecurity will be nonnegotiable” for automakers looking to bring connected cars to market. Despite the fact that “Unlike in other industries, such as financial services, energy, and telecommunications, cybersecurity has so far remained unregulated in the automotive sector,” new regulations are changing the landscape faster than some automakers can adapt. 

New EU cybersecurity rules set to take effect in June have reportedly resulted in the scrapping of two new Porsche cars, the 718 Boxster and 718 Cayman for failing to live up to new cybersecurity standards. Porsche says it plans to continue selling the cars outside of the EU. 

The evolution of the SDV will undoubtedly have major consequences for the auto industry. However, the success of smarter, more connected cars relies on automaker’s ability to not only make them physically safe, but cyber-secure as well. “Cars are an extension of the home, and we want to feel protected there,” Ronen Smoly, Chief Executive of Argus Cyber Security recently told Automotive World. “We don’t want anyone to spy on us or download personal data that exists in the car.” 

Change seems to be the only true constant in cybersecurity. 

True to form, the 2024 cybersecurity landscape looks set to tread unfamiliar ground, as generative AI emerges into a powerful tool for hackers and cybersecurity professionals alike. At the same time, new systematic approaches like Continuous Threat Exposure Management are requiring organisational and cultural shifts in the cybersecurity function and throughout the rest of the organisation. Poor communication, third-party exposure, and human error round out the list. (Some things do always stay the same, it seems). 

1. Generative AI finds new applications—not all of them good 

Generative artificial intelligence dominated the technology conversation last year. In 2024, however, hype around generative AI tools like ChatGPT has started to give way to people taking a long hard look at finding real world applications for the technology. 

One of those applications, it seems, is cybercrime. In a report released by IBM’s X-Force, experts say that generative AI comes uncomfortably close to human capabilities when used as a tool for phishing and social engineering campaigns. 

“Just this year we’ve seen scammers increasingly use voice clones generated by AI to trick people into sending money, gift cards or divulge sensitive information,” writes Stephanie Carruthers, one of IBM’s chief white hat hackers. “While humans may still have the upper hand when it comes to emotional manipulation and crafting persuasive emails, the emergence of AI in phishing signals a pivotal moment in social engineering attacks.” 

It’s not all bad news, however. Generative AI also has the potential to augment the capabilities of cybersecurity professionals.

“Generative AI, the most transformative tool of our time, enables a kind of digital jiu jitsu”

David Reber Jr., CSO, NVIDIA

Colourfully put by David Reber Jr., chief security officer for NVIDIA, “Generative AI, the most transformative tool of our time, enables a kind of digital jiu jitsu. It lets companies shift the force of data that threatens to overwhelm them into a force that makes their defences stronger.”

Generative AI’s ability to rapidly examine vast amounts of data, flag irregularities, and act as an intermediary layer between other types of software could significantly benefit security. Generative AI models can even create vast amounts of synthetic data in order to simulate “never-before-seen attack patterns,” and better train cybersecurity tools. 

2. CTEM is the next big security differentiator 

 Continuous Threat Exposure Management (CTEM) is an increasingly popular approach to cybersecurity that shows immense promise.

Gartner predicts that organisations prioritising CTEM-based security investments will experience two-thirds fewer breaches by 2026 

CTEM, in short, is a systematic approach to assessing digital and physical asset vulnerability. Rather than traditional approaches, which are reactionary and retroactive, CTEM is proactive threat identification and management, continually. This is achieved by continually simulating new attacks in order to identify and neutralise weaknesses in an organisation’s defences.

Generative AI, with its ability to create synthetic data and simulate new attack patterns, is expected to play a role in fueling CTEM practices. 

3. Security culture beats security tech every time

In a world where cybersecurity technology constantly evolves, it’s easy to lose sight of the fact that human error remains one of the most common causes of a breach.

Gartner expects 2024 to be the year that “security leaders realise the importance of moving from mere awareness to changing behaviours to mitigate cybersecurity risks.”

Soft skills that promote a more productive working relationship between cybersecurity and the rest of the business are the name of the game. By 2027, half of large enterprise CISOs are expected to adopt human-centric security practices, reducing friction and enhancing control adoption.

Over the last few years, large scale data breaches have become disturbingly commonplace across multiple industries. Nowhere is this more worrying, however, than the healthcare sector, however. As healthcare organisations begin to feel the positive effects of their digital transformation efforts, escalating cybersecurity risks threaten to undermine hard-won progress.  

Unified health data platforms create new vulnerabilities 

Among the most recent breaches is the February 2024 attack on United Health Group’s (UHG) prescription provider, Optum. On February 21, UHG confirmed to the press that Optum was forced to temporarily shut down its IT systems due to a massive cyber attack, Pymnts reported. These systems include the Change Healthcare Platform, the largest payment exchange platform between doctors, pharmacies, healthcare providers, and patients in the US.

The attack caused widespread disruption across the country. This included leaving many patients unable to process insurance claims or accept certain kinds of discount prescription cards. As a result, patients went without potentially lifesaving medicine. The breach was so serious that the American Hospital Association issued a statement recommending “all health care organisations that were disrupted or are potentially exposed by this incident consider disconnection from Optum until it is independently deemed safe to reconnect to Optum.”

The danger is that, while the negative effects of siloed, legacy healthcare data management systems have been felt for years, the digital tools used to alleviate these pain points come with added vulnerabilities of their own. Nevertheless, the benefits of a digitally transformed healthcare data platform are needed now more than ever. 

Digital healthcare platforms fight clinician burnout, staff shortages, and more

In 2022, the World Health Organisation (WHO) data suggesting an estimated 41% to 52% of healthcare workers suffer from burnout. At least 25% healthcare workers reported symptoms of anxiety, depression, and burnout. 

A report by Wolters Kluwer argues: “the first step to creating systems that help reduce burnout is modernising clinical workflows.” Successfully accomplishing this would, they argue, “reduce administrative burden and increase efficiency.” 

The UK’s National Health Service (NHS) is experiencing more burnout than ever, according to a 2024 report. According to the British Medical Journal (BMJ), burnout significantly impacts retention throughout the NHS. As a result, more staff are reportedly thinking about leaving than ever before. Admittedly, burnout is a long-standing issue in the NHS and healthcare organisations in general. However, NHS Employers’ report notes that the pandemic placed further burdens on NHS staff and exacerbated the problem. 

As the world’s largest nationalised healthcare organisation, the NHS serves approximately 65 million people. Supposedly, the NHS has the ability to use huge amounts of its data to make better decisions. This, in conjunction with experienced staff and cutting edge technology, could help not only improve decisonmaking, but also reduce clinician burnout. Some examples of possible applications include: 

• Using patient data in conjunction with Google’s DeepMind to predict when patients are at risk of developing kidney failure.
• Collaborating with NVIDIA to deploy open source AI across several hospital trusts in order to quickly analyse medical imagery. The deployment has already shown promise in speeding the detection of Covid-19, breast cancer, brain tumours, dementia, and strokes.

The Federated Data Platform—all the NHS’ eggs in one basket? 

Right now, the NHS is in the process of centralising the personal patient records of millions of UK citizens. The Federated Data Platform aims to unite all the patient data used in the above examples. The project will drive cutting edge AI deployments to improve quality of care. Not onyl that, but it is expected to improve the quality of life and work for clinicians across the country. “Clinicians will be able to access live data of available theatre slots, staff availability and individual patient data suitable for particular procedures at the touch of a button,” said Matthew Taylor, NHS Confederation CEO.

The NHS has previously struggled to unify its data, with opposition forcing it to abandon two similar projects since 2012. One risk is the organisation’s entanglement with controversial data mining company Palantir. Some fear that association with the US firm could further complicate the process of obtaining public approval. Other critics highlight the increased risk of a high profile, large scale data breach the likes of which hit Optum. 

“Inevitably, this will bring many challenges,” wrote tech author Bernard Marr in a recent op-ed. “Healthcare data is some of the most sensitive data that there is, and the task of keeping it secure while still ensuring that it’s accessible when and where it’s needed is no simple feat.”

Healthcare organisations desperately need the benefits that unified data management platforms can provide. However, if these benefits are to be realise, then cybersecurity remains the biggest challenge to be faced.