Insights

Recent articles

What the 2026 attacks on UK education actually tell us

A government department, a county council and a primary school, all inside three months. The pattern is not sophistication, it is dwell time and shared infrastructure. August 2026

The Companies House flaw, and why accountancy practices should care

Director data for five million UK businesses was reachable by anyone with a login. For practices, the interesting part is what it says about data you do not control. August 2026

Make UK: one in three manufacturers hit, and the line stops

New research puts the figure at 30% in twelve months. The JLR shutdown showed what happens when an IT compromise reaches the plant floor. August 2026

2,300 breach reports to the SRA, and 47 interventions

The regulator is no longer treating cyber as an IT matter. What the enforcement pattern says about where firms are actually failing. August 2026

The GitHub breach, and what it means if you build software for clients

Around 4,000 private repositories exfiltrated, starting from one poisoned editor extension on one laptop. If you hold client code, this is your threat model. August 2026

Common questions

Do you write about your own clients' incidents?

No. Everything here is drawn from public reporting, and we do not comment on work we have done or clients we have worked with, in any identifiable form.

Why not name every organisation involved?

Where an incident is widely reported and the organisation is large, naming it is normal editorial practice. Where the victim is small, we describe the pattern rather than make an example of them. Being breached is not evidence of negligence and we do not write as though it is.

Can I reuse this analysis?

Yes, with a link back. If you would like a version written for your own members or clients, ask.