Dan Goodfellow

MDR sharpens visibility. Because resilient businesses need a clearer lens. In today’s cyber landscape, what you don’t see often matters more than what you do. Modern security teams face an overload of alerts. MDR steps in to give clarity where it matters most: - Filters noise so only real threats demand attention - Adds context to alerts for faster understanding - Guides action with expert-driven recommendations - Accelerates decisions when time is critical - Strengthens resilience by spotting what tools alone may miss MDR makes your defenses sharper, faster and more reliable. Graftronics is a Sophos MDR partner, transforming IT teams across organizations in multiple industries. Reach out to us for assessing MDR for your setup. - Vimesh Avlani Managed Detection & Response | Cyber Resilience | Trusted by Mid-Market CXOs

20

4 Comments

The UK National Cyber Security Centre (NCSC) has reported a doubling in the number of "nationally significant" cyber incidents between September 2024 and May 2025 compared to the same period the previous year. NCSC CEO Richard Horne revealed this during his keynote at the CYBERUK conference in Manchester, stating that the agency has handled more than 200 incidents overall since September 2024. Link in comments #cybersecurity #ncsc #cyberuk #management #technology #threats

11

1 Comment

It's been a busy few months Rapid7. We've launched Intelligence Hub to provide curated, high-fidelity data to enable organisations to focus on threats relevant to their sector or geo. We 've introduced new features within Remediation Hub, giving security teams a unified view of assets to prioritise and optimise risk mitigation. Additionally our AI teams has been busy leveraging agent AI and automation to scale detection and response, active remediation for MDR and extending AI alert triage for SIEM customers! If you interested to learn more, then dive in by clicking on this link or subscribe to the R7 blog at https://lnkd.in/etdj9-ck https://lnkd.in/etcnQypx

144

Fun writing this, bringing it back to the North West but the implications do stretch beyond the region. We consistently over-focus on the likelihood of cyber incidents happening in comparison to understanding the impact of them when they do. Some thoughts here on what that means and what we can do differently.

13

Cyber security strategy is about aligning business objectives, local and international legal & regulatory frameworks and adapting new technologies following a cyber resilience plan. Adam Hawthorne talked about the practical challenges of cyber security and ways to address them. Great work! #cybersecuritystrategy #resilienceengineering #cybersecurity

16

After years of work, we have decent security standards, but we'll continue to struggle until we adopt security by default. Take the relationship between TLS 1.2 and 1.3, for example. Both protocols can provide reasonable security, but TLS 1.2 supports a kitchen sink of options, and you need to know what you're doing to configure it correctly. TLS 1.3, on the other hand, just works, no further work needed. This is just one example; there are dozens of standards and situations for everyone to consider when it comes to their network infrastructure. Until we get security by default, the only way to stay ahead is to have comprehensive configuration monitoring to catch problems and drift. I created Hardenize to solve exactly this problem. Our free test is still available at hardenize.com, and the commercial product has been rolled into Red Sift's. Now that Mail Check and Web Check are being retired, I am very happy that there is still a way for Hardenize to continue to serve.

13

1 Comment

CovertSwarm is accredited by CREST to deliver CBEST TLPT assessments, the UK’s financial-sector standard for threat intelligence-led security testing. Our red team uses an intelligence led approach to emulate advanced persistent threat actors across all attack vectors to assess cyber resilience under realistic conditions. Learn more about capabilities for financial services: https://hubs.li/Q03lM26Q0

29

Our panel with New Statesman brought together voices from government, research and industry, and the conversation kept circling back to the same idea…the UK cannot treat #cybersecurity as something that sits in the background. It needs to be part of everyday decision making. 💡 Here are a few of the priorities that came through strongly: > See cyber as a strategic risk, not a technical item > Make collaboration between public and private sectors real and consistent > Invest in prevention and not just crisis response > Build stronger awareness and skills at every level There is a real opportunity for the UK to raise its resilience if everyone works together. Read the full article: https://ftnt.net/60467S7iE #Fortinet #CyberResilience #DefendAsOne

2

There’s something quietly powerful about revisiting the places that shaped you. I did this MSc part-time in 2006; back when it was one of the first programmes of its kind. And, like all good education, its value only really compounds in hindsight. If you’re an alumnus, it’s worth a couple of minutes. Not because surveys change the world… but occasionally, they nudge it in a better direction. Long may it continue to evolve.

5

Chris Roberts speaking against a punitive approach via phishing tests, with Avishai Avivi on the CISOnomics podcast. Links in comments👇

Good morning Scotland 🏴󠁧󠁢󠁳󠁣󠁴󠁿 Excited to be at Public Sector Cyber Security Scotland today. #DynamicEarth, Holyrood, Edinburgh is welcoming leaders from across the public sector today to hear and learn about #cybersecurity for the UK. John Saunders speaking on is Over-connected, over-exposed? With the acceleration of AI adoption, and top-down directives to “just connect AI” to drive efficiency, growth and cost savings, it is critical to know WHAT we are just connecting AI to… ➡️ Know where it can reach ➡️ Know what matters ➡️ Know who can touch what ➡️ Prove it continuously If you get these right… AI becomes an innovation layer If you skip them… AI becomes an exposure risk Let’s be able to say “Yes” to connected AI everywhere. Just not at the expense of our sensitive data. Netskope #DataSecurity #DSPM #AIsecurity #HolyroodConnect #PublicSector

66

Dan Schnour’s new blog on the UK Cyber Security and Resilience Bill lays out why the CSRB is a major shift in how the UK expects organizations to operate and defend essential services. Stronger governance, tougher supply chain rules, and real resilience requirements are coming fast. Read the blog here. https://lnkd.in/e5ZHx8sK

2

🚨 The Headline: Amaranth Dragon Enters the Fray Security researchers at Check Point have confirmed that Amaranth Dragon, a group closely linked to the prolific APT41, is now weaponising the WinRAR vulnerability (CVE-2025-8088). They aren't just testing the waters; they are actively targeting government and law enforcement organisations across Southeast Asia (Singapore, Thailand, Indonesia, and more) using a sophisticated mix of legitimate tools and custom loaders to bypass traditional security. 🔍 How the Exploit Works (The "ADS" Trick) The vulnerability is a Path Traversal flaw, but it has a nasty twist. It leverages Alternate Data Streams (ADS)—a feature of the Windows NTFS file system that allows data to be hidden "behind" a normal file. 🔻The Lure: You receive a RAR archive containing what looks like a harmless PDF or document. 🔻The Hidden Payload: Hidden within that file’s ADS is the actual malware. 🔻The Escape: Because of the flaw in WinRAR (versions 7.12 and older), the software fails to sanitise the file path. When you extract the "PDF," the malware silently "escapes" the extraction folder and writes itself directly into your Windows Startup folder. 🔻The Persistence: The next time you log in, the malware executes automatically. 💡 Additional Facts You Need to Know 🔻The Timeline: While news is peaking now, Google’s Threat Intelligence Group (GTIG) actually spotted the first signs of abuse as early as mid-July 2025. Amaranth Dragon was on it by mid-August, showing just how fast state-sponsored groups weaponise public exploits. 🔻The Global Reach: This isn't just a regional issue. Before Amaranth Dragon, the Russian-aligned group RomCom used this exact bug to deploy NESTPACKER against Ukrainian targets. Other actors like APT44 and Turla have also been spotted in the wild. 🔻The "Shadow" Infrastructure: Amaranth Dragon is notably using Cloudflare infrastructure to hide their command-and-control (C2) servers, making it even harder for network defenders to block their traffic. 🔻The Fix is Simple: This vulnerability was officially patched in WinRAR version 7.13. If your version starts with a "6" or is 7.12 or lower, you are a sitting duck. 🛠️ What should you do? ✅ Update Immediately: Ensure you are running WinRAR 7.13 or later. ✅Audit Startup Folders: Check %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup for any unexpected .exe, .lnk, or .dll files. ✅Treat Archives with Suspicion: Even if a RAR file looks like it only contains a single PDF, the underlying metadata could be malicious. #CyberSecurity #WinRAR #Infosec #APT41 #AmaranthDragon #MalwareAlert #ThreatIntelligence

10

1 Comment

NHS breaches have highlighted a critical lesson for NHS suppliers: the "castle and moat" defence fails against lateral movement. An attacker, once inside, can move freely, turning an intrusion into a catastrophe. We've got to stop that, together. Zero Trust is the expert, proactive strategy to meet the NHS Cyber Security Charter's highest mandates. It eliminates implicit trust with a "never trust, always verify" principle. This prevents escalation, keeping the impact contained, even if an intrusion occurs. How do you implement Zero Trust reliably? Platformisation is the ultimate answer. See how our platform approach directly addresses the recent NHS Cyber Security Charter principles and fortifies your operations. ➡️ Download the report: https://bit.ly/43T9aVO

2

NIS2+ coming to the UK shortly, in the form of the Cyber Security & Resilience Act. there are big implications for critical industries and their requirements to test and demonstrate resistance to cyber threats and to implement robust cyber risk monitoring of key suppliers. https://lnkd.in/e3F2bauB

7

1 Comment

🏫 “Precautionary shutdown” is becoming a familiar phrase in cyber incidents. After a cyber attack disrupted IT systems, a secondary school in Warwickshire remains closed while investigations and system restoration continue — with students pushed to external resources for learning. What stands out: this wasn’t about stolen data headlines. It was about loss of operational capability. Many education and public-sector organizations don’t fail because of sophisticated exploits — they fail because basic attacker paths weren’t tested before someone abused them. When was the last time your organization validated how far an attacker could actually get? #CyberAttack #SchoolIT #CyberOperations

6

The Bill’s purpose is to close critical gaps in national cyber defenses, impose new obligations on a broader array of digital infrastructure to protect the wider UK economy, and establish the UK as a global leader in cyber regulation: https://lnkd.in/euHdBxRA

1