Murky Waters: Why deep IoT and OT Device Vulnerability Research Matters More Than Ever (Part 1)
By Alex Teague, Principal Vulnerability Researcher: IoT & Operational Technology Security There is a peculiar irony at the heart of modern industrial and critical infrastructure security. Organisations that would never dream of deploying an enterprise server without patch management, endpoint detection, and network segmentation are routinely running programmable logic controllers, remote terminal units, and building […]
Identity Security Beyond Passwords: addressing the modern attack surface
Identity has become one of the primary targets in modern cyber-attacks. Rather than exploiting software vulnerabilities or deploying malware, attackers increasingly focus on gaining access to legitimate user accounts. Once authenticated, they can operate within systems using valid credentials, potentially avoiding detection if they can blend into ordinary user traffic. This shift has significant implications […]
Strategic Cyber Incident Exercises: Preparing Leadership for the Moments That Matter
Most organisations have an incident response plan, but not all have tested how that plan would perform during a major cyber crisis. Recent cyber incidents continue to demonstrate that technical defences alone are not sufficient. When an organisation experiences a significant breach or ransomware attack, the challenge quickly becomes organisational as opposed to purely technical. […]
When Smart Devices Become Security Risks: From Robot Hoovers to Connected Fridges
IOT or rather “connected devices” are now common in both homes and workplaces. From smart speakers and lighting systems to robot vacuum cleaners and internet-connected refrigerators, the number of Internet of Things (IoT) devices in use continues to grow rapidly. Whilst these devices offer convenience and automation, they also introduce new security considerations. Many consumer […]
Software Supply Chain Attacks Are Increasing: What Organisations Should Do Now
Software supply chains have become an increasingly attractive target for cyber attackers. Rather than compromising individual organisations directly, threat actors are focusing on widely used development tools and open-source components to distribute malicious code across multiple environments simultaneously. Recent research highlighted a campaign where attackers compromised widely used development tools including Trivy and Checkmarx integrations […]
From Vulnerability Discovery to Effective Remediation
Identifying vulnerabilities is only the first step in improving an organisation’s security posture. Many organisations discover that after a penetration test, audit or vulnerability assessment they are left with a significant list of technical findings but limited internal capacity to address them. In practice, remediation can be complex. Security issues often involve configuration changes, system […]
Exploitation of BeyondTrust Remote Support and Privileged Remote Access (CVE-2026-1731)
As an Assured Cyber Incident Response provider, we are sharing the NCSC’s guidance on vulnerability CVE-2026-1731 to help organisations understand the potential risk and take any necessary action. we recommend reviewing the advice carefully. See NCSC advice below: The NCSC are directly aware of the attempted and successful exploitation of CVE-2026-1731. The NCSC advises organisations […]
Ransomware in 2026: Why Extortion Tactics Are Evolving
Ransomware continues to represent one of the most disruptive cyber threats facing organisations. While the techniques used by attackers are evolving, the operational impact remains the same: service disruption, financial loss and reputational damage. If we look to the wider picture, threat intelligence is also indicating to us that ransomware activity is continuing to increase […]
CVE-2026-24061: Critical Telnet Vulnerability Highlights the Ongoing Risk of Legacy Protocols
Prism Infosec have been following the recent disclosure of a critical Telnet vulnerability affecting the GNU InetUtils Telnetd server, which has refocused attention widely on the risks posed by legacy protocols that continue to exist within modern IT Infrastructure. Tracked as CVE-2026-24061, the raised flaw allows an unauthenticated attacker the ability to gain root-level access […]
Beyond Compliance: Building True Cyber Resilience in 2025
Compliance is not enough Across the UK, organisations continue to invest heavily in compliance. ISO 27001 certification, NCSC alignment and annual penetration tests all play an important role. But compliance alone does not guarantee readiness. Compliance demonstrates that controls are in place. Resilience proves they actually work under pressure. Recent incidents have shown that even […]
