The IT Nerd

The UK government has announced new AI cybersecurity measures to identify vulnerabilities in government systems, strengthen defenses against AI-powered attacks and prepare for incidents involving autonomous AI agents.

Speaking October 12, AI Minister Kanishka Narayan said two government pilots used frontier AI to identify and address more than 1,000 vulnerabilities. The government’s centralized vulnerability-monitoring service has also reduced the time needed to remediate identified weaknesses from 50 days to eight.

The government plans to expand AI-based vulnerability detection, develop capabilities to investigate and contain rogue AI agent incidents, and consider amendments to the Cyber Security and Resilience Bill addressing AI-related threats to essential services.

Proposed measures include reporting serious AI incidents and near misses. The UK’s AI Security Institute has also resumed testing advanced AI models, including Gemini 4 Argon.mation Security offer perspectives on the matter.

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security Technology Inc.:

“The UK’s initiative demonstrates the potential of AI to accelerate vulnerability discovery and strengthen remediation efforts. The government reports that two AI pilots helped identify and address more than 1,000 vulnerabilities, while its centralized monitoring service reduced remediation time from 50 days to eight. That’s encouraging progress but finding vulnerabilities faster is only part of the equation.

“From my experience in offensive security, the real value comes when AI helps us move beyond identifying potential weaknesses to validating exploitability, demonstrating attack paths, and producing evidence that helps security teams prioritize what actually matters. A vulnerability score tells us something about severity, but demonstrating how an attacker could exploit a weakness, what systems are reachable, and which business assets are exposed provides the context needed for better remediation decisions.

“As autonomous AI agents gain greater authority, those same principles must apply to the agents themselves. Their permissions, actions, and trust boundaries must be independently tested and validated, not simply assumed secure.”

The objective isn’t simply to find more vulnerabilities. It’s to produce actionable evidence, prioritize real risk, and verify that remediation works.

ㅤ

John Strand, Owner, Black Hills Information Security:

“This proposed legislation looks fantastic. It’s good to see that they’re already using AI to identify vulnerabilities and try to address them throughout the UK.

“My concern is speed. Laws and implementation can take a long time, even after successful pilot programs. There’s a big difference between running a pilot and rolling something like this out across an entire country.

“But I’m very excited to see the UK government taking AI threats, vulnerabilities, and the promise of AI for defense seriously enough to push this initiative forward.”

The UK is good at moving quickly to try and shut off threats from becoming bigger problems. While I do have problems with the implementation of this, other countries could learn a thing or two.

Bank of England Governor Andrew Bailey says regulating AI “is not the right place to start.” In his first Substack article, he called for rigorous testing to find vulnerabilities and build safeguards before any formal rules, pointing to work at the UK’s AI Security Institute. He expects models to “behave unexpectedly” during testing, and warned that frontier AI without a way to intervene could become a system that governs itself. His comments come days after OpenAI held back its latest model over safety concerns, and after President Trump announced a voluntary safety agreement with OpenAI, Anthropic, Nvidia, Meta, Google and SpaceX that leaves each company responsible for the safety of its own technology.

Adrian Culley, offensive security engineer at SafeBreach said this:

“Most of the risk sits in deployment, not in the model at release: agents with tool access, connectors, non-human identities and data flowing through integrations. That is where attackers operate. Prompt injection (MITRE ATLAS AML.T0051, OWASP LLM01) turns a trusted agent into an insider with legitimate credentials, and a voluntary, self-attested safety commitment will not catch it.

Regulators are moving towards evidence, not policy statements. Supervisors will increasingly ask financial firms to show how they validate AI-enabled systems, particularly where many institutions depend on the same underlying models and one failure could be correlated across the sector.

The answer is the discipline security teams already apply elsewhere: assume controls fail, then prove otherwise. Run realistic attack scenarios against deployed AI systems, measure whether intervention controls actually trigger, and repeat as models, prompts and permissions change.

Bailey calls for a system to intervene. That system must be validated under attack, not assumed to work.”

I personally want evidence based legislation in place before any rollout of AI is done. Companies who provide AI and companies who use AI can’t be trusted to do the right thing. Thus they have to have the right imposed upon them 100% of the time.

The UK’s National Cyber Security Centre (NCSC) warned that artificial intelligence is currently positioned to provide greater advantages to cyber attackers than defenders, as attackers face fewer constraints when deploying AI autonomously.

Dave Chismon, the NCSC’s chief technology officer for architecture, said attackers can allow AI agents to operate with broad autonomy, while defenders must account for the risk that autonomous systems could disrupt or damage the networks they are intended to protect. This imbalance could allow AI-enabled attacks to scale faster than automated defenses.

The NCSC has also said AI is rapidly improving offensive capabilities, including vulnerability discovery and exploitation, while defensive uses such as automated mitigation and response carry risks including service disruption, data loss and operational failures.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“The NCSC’s warning that AI may favor attackers needs a harder qualification. Attackers cannot simply give an AI agent broad access and walk away.

“They still have to manage operational security (OPSEC), avoid attribution, control their infrastructure and stop the agent from creating evidence. If it scans the wrong target, contacts a victim or exposes the operator, the consequences can include arrest and prosecution. Criminal liability is a real constraint on offensive autonomy.

“Defenders carry a different risk. A security team whose AI-driven firewall change breaks a VPN may face an outage review, discipline or a lawsuit. The engineer does not usually face an arrest warrant because the agent made a bad change. That makes defensive autonomy a governance problem, not a simple question of whether the technology can act.

“Organizations should reduce that governance and organizational friction by creating pre-approved classes of low-risk, reversible actions, with clear asset ownership, deterministic validation and tested rollback. Changes with broad or uncertain impact should still require human approval. The goal is to remove unnecessary approval friction from routine remediation while keeping consequential actions gated.

“An attacker has to keep an AI agent quiet, scoped and out of the wrong network. A defender has to get an AI agent approved, tested and recoverable. The first is an OPSEC and criminal-liability problem. The second is governance and organizational friction, which defenders can reduce through better ownership, pre-approval and rollback design.”

Lydia Zhang, President & Co-Founder, Ridge Security Technology Inc.:

“The inconvenient truth that Chismon points out in this article has been the reality security teams have been dealing with for years: the imbalance between attackers and defenders in their ability to adopt and operationalize new technologies. AI has obviously widened that gap dramatically.

“But there is also a significant silver lining for defenders: many of the advantages AI gives attackers can also be turned toward defense. AI can help fix vulnerabilities early in the development lifecycle through automated patching, and it can also help remediate vulnerabilities in production.

“We recently demonstrated how an organization can practically combine a security testing tool with a code agent to reduce critical vulnerabilities from 10 to 0 in just four runs.

“So perhaps the challenge is no longer purely technical. The technology is increasingly capable. The bigger challenge is organizational: risk tolerance, processes, accountability, and mindset.”

Donald McFarlane, Board Member, Xcape Inc.:

“Treasury Secretary Scott Bessent articulated a useful starting point this week: accountability. Discussing the Hugging Face incident, he argued that responsibility rests with the humans and organizations deploying these systems, not with an AI agent treated as though it were an independent actor. He has also argued against shielding frontier labs from liability.

“I agree wholeheartedly with that basic principle. More specifically, liability should follow control, causation, intent and duty of care, rather than simply attaching every downstream harm to the person or company who trained the model.

“A malicious user deliberately employing AI to attack someone should bear primary responsibility. An operator that gives an agent powerful credentials, excessive authority and inadequate supervision should be responsible for negligent deployment. Integrators should be accountable for unsafe implementations. Model developers should remain responsible where foreseeable defects, or failures to exercise reasonable care in developing and testing their products, materially contribute to harm.

“That approach also recognizes that responsibility may be shared. Relevant questions would include who controlled what, what risks were reasonably foreseeable, what safeguards were available, and whose acts or omissions materially contributed to the outcome.

“The NCSC is also right that defenders cannot simply mirror attackers. Autonomous defensive action can itself disrupt the systems we are trying to protect, so greater autonomy has to come with governance, bounded authority, recoverability and clear human accountability. Its framework for evaluating potency, scope, criticality, rollout confidence and recoverability is a useful start.

“But I am more optimistic about the defensive side of this equation. AI gives defenders the opportunity to operate at machine speed as well. We should be designing systems that permit progressively greater autonomous action where it can be safely bounded and reversed. And cybersecurity has much to learn from military doctrine and tactics: deception, manoeuvre, shaping the battlespace and channeling adversaries toward ground of the defender’s choosing. AI can make those approaches substantially more powerful.

“AI is an extraordinarily powerful general-purpose technology. We need strong engineering, clearly assigned human accountability, meaningful incident reporting and judicially determinable duties of care. Autonomous software does not somehow break the chain of human responsibility, and we should not create regulatory barriers that only the largest incumbent laboratories can afford.”

John Strand, Owner, Black Hills Information Security:

“Absolutely, AI is going to create more attack opportunities simply because these systems have broad autonomy and more latitude in what they can do, especially when you start looking at open-weight models. But there’s another part of this that I don’t think people fully appreciate. Complexity is the enemy of computer security.

“The more services you have, the more attack surface you create. Even if those services don’t have known vulnerabilities today, AI can rapidly fuzz them, analyze them, and identify weaknesses that attackers may have previously overlooked because finding and exploiting them required significant time and skill.

“AI changes that equation. Vulnerabilities and exploitation opportunities that were previously out of reach for the average attacker are suddenly much more accessible. You no longer need to be an exceptionally skilled vulnerability researcher to find some of these weaknesses. AI can do a tremendous amount of that heavy lifting for you.”

Defenders always should have the advantage. Therefore the balance needs to be reset so that the good guys are the ones that win.

UK lawmakers are considering giving the government emergency powers to deactivate powerful AI systems and shut down data centers if the technology poses a national security threat.

The proposed “kill switch,” introduced as an amendment to the Cyber Security and Resilience Bill, is intended as a last-resort mechanism to stop a runaway AI system before it can compromise critical national infrastructure.

At the same time, the UK government has introduced separate amendments to the same cybersecurity bill that would allow ministers to prevent critical infrastructure organizations from using technology suppliers deemed high risk. The new authority is aimed at supply-chain threats, where attackers can compromise a smaller technology provider and use its access to reach more sensitive organizations.

The move follows a recent cyberattack that forced a small UK power generation facility offline for four days.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“A government-mandated remote shutdown capability for data centers is a pre-installed denial-of-service mechanism waiting for the wrong hands. The amendment to the UK’s Cyber Security and Resilience Bill would require operators to build and maintain the exact infrastructure an attacker would need to cause the disruption the legislation claims to prevent. Compromise the authorization channel, and the government has handed the attacker a shutdown switch labeled “safety.”

“Responsibility for containing an AI system sits with the operator running it. If you’re deploying AI on critical infrastructure and cannot kill your own workload when it goes sideways, a minister reaching for a centralized override just confirms nobody expected operators to manage their own systems.

“Cybersecurity minister Baroness Lloyd rejected the proposal, arguing that directing an organization to stop using a specific AI model is more proportionate than shutting down shared infrastructure thousands of services depend on. She’s right.

“The supply-chain provisions in the same bill, letting ministers block critical infrastructure operators from using high-risk technology suppliers, respond to something real. An Iran-linked cyberattack forced a small UK energy generator offline for four days in July. Controlling which vendors touch critical networks addresses the entry point. A kill switch addresses the blast radius after the breach has already happened, and it does so by adding a new attack surface to defend.”

John Strand, Owner, Black Hills Information Security, Inc.:

“I feel like conversations like this in legislatures around the world are incredibly important, and I think many of the provisions being discussed absolutely should be put in place.

“However, I also think the way the conversation is arcing fundamentally misses the point of what AI actually is.

“AI is not something that can be controlled simply by regulating powerful companies like Anthropic, Google, and OpenAI. The technology is already dispersed. With roughly $5,000 worth of hardware, someone can run a highly functional model locally that may be slower than the most powerful commercial models, but can potentially be every bit as destructive.

“If our entire strategy for AI safety is built around restricting what large companies can do with potentially dangerous models, we’re addressing only one part of the problem. Those restrictions may be valuable, but they don’t address what happens when capable models are downloaded, modified, fine-tuned, and operated completely outside those environments.

“There needs to be a much larger conversation about mitigating controls. We need to be thinking about how organizations detect and respond to AI-enabled attacks, how infrastructure is protected when the attacker has access to these capabilities, and what defensive technologies need to change when powerful AI is available to practically anyone willing to invest a few thousand dollars in hardware.

“Regulating the largest AI companies may be part of the answer.

“It cannot be the entire answer.”

I seriously doubt that this is the answer. Thus I hope this gets the time and consideration that this does deserve.

A UK power plant reportedly went dark for four days in July after a cyberattack linked to Iranian hackers, but the story only surfaced this week, and the UK government still hasn’t confirmed or denied the incident or the attribution

The government said that at no point was there a risk to the UK’s energy system, but the Department for Energy Security and Net Zero (DESNZ) has contacted power companies to advise them about the risk of cyber attacks.

The Telegraph reported that the attack, which took place last month, was carried out by hackers affiliated to the Iranian regime.

For security reasons, neither the government nor the National Cyber Security Centre, which deals with attacks on critical infrastructure, would give further details of the site affected. However this was not an attack on an essential service such as a large power station.

Josh Picolet, VP of Detection & Analysis, Team Cymru

“State-linked activity against critical infrastructure tends to follow patterns that outlast any single incident, and the four-day recovery window here is the detail worth studying closely. That length of disruption usually means the attacker had dwell time inside the environment before detection, which points to a gap in visibility rather than a one-off failure.

It’s worth noting the UK government has neither confirmed nor denied the incident or the attribution to Iran-linked actors, so defenders should treat the public reporting with appropriate caution while still taking the operational lesson seriously. Regardless of formal attribution, the pattern is consistent with what we’ve tracked from Iran-affiliated groups against critical infrastructure across the US, Israel, the Gulf, and now Europe this year. Smaller operators in particular need intelligence that surfaces staging and pre-positioning activity, not just indicators tied to a confirmed actor, because the next facility targeted may not get four days of warning before impact.”

Justin Beals, CEO & Founder, Strike Graph

“Four days of downtime at a critical infrastructure facility is not a technical failure. It’s a governance failure. Somewhere in that plant’s compliance program, a control existed on paper that didn’t hold up in practice, and nobody caught the gap until an adversary found it first.

This is the same story we keep seeing across sectors. Organizations treat security posture as something you attest to once a year, not something you verify continuously. A point-in-time audit tells you a plant was secure on the day someone checked. It tells you nothing about the day the attacker showed up.The UK has thousands of smaller energy assets like this one, and most of them are operating on the same annual-attestation model. If this attack is repeatable, and there’s no reason to think it isn’t, the operators still relying on periodic reviews instead of continuous monitoring are the ones who will be explaining a multi-day outage to their regulator next.”

Expect more state sponsored actors to do hacks like this. Because there’s likely more of this out there that is under reported.

UPDATE: John Strand, Owner, Black Hills Information Security, Inc. Had This To Say:

   “This particular breach scares me, not necessarily because it happened in the United Kingdom, but because of how much further behind the United States power grid is compared to Europe. Modernization of the U.S. power grid has been painfully slow for a number of reasons, including legislative capture and the basic economics of how utilities make money. They make money from generating and selling power. They don’t necessarily make money from updating aging infrastructure.

   “Then there’s the interconnected nature of the U.S. power grid, with Texas being the notable exception. A relatively small problem at a substation can create ripple effects across multiple areas of the grid. That’s what makes this such a serious wake-up call. When you combine that interconnectedness with the incredibly slow pace of infrastructure modernization, especially across the power grid, I’m very concerned. I think an attack like this could potentially have a far greater impact in the United States than what we’re seeing in Europe.”

Denis Calderone, CTO, Suzu Labs:

   “What has our attention here is not the size of the generator. A savvy attacker isn’t choosing targets based on grid capacity. They’re probing for the weakest point in the armor, and a facility small enough to fall below mandatory cyber reporting thresholds is exactly the kind of target that’s likely under-defended and overlooked.

   “Two weeks ago in Poland, a compromised wind farm became a direct bridge into a completely separate heating plant’s SCADA system through a shared cellular network. Different threat actor, different country, same playbook: find the overlooked facility, use it as a stepping stone. We’ve been tracking Iran-linked operations against Western critical infrastructure since April, and the pattern keeps escalating. PLCs targeted for operational disruption. Gas station fuel monitoring systems. Water systems across 12 US states in a single month. Five agencies flagged AI-generated tools targeting Siemens PLCs four days ago. And now a UK power facility goes dark for four days.

   “The victim became the victim because of poor hygiene. The advice here is the same as it ever was, because the exposure hasn’t changed. Take controllers off the internet. Change default credentials. Inventory every communication path, especially the integrator-installed remote access links and the backup channels that never made it onto a network diagram. But critical infrastructure operators need to be proactively hunting for these weaknesses and prioritizing remediation before an adversary does the discovery for them. The smaller satellite sites are often the ones that fall under the radar during security reviews, so make sure you look at everything. Small and overlooked is exactly what made this target attractive.”

Donald McFarlane, Advisory Board Member, Xcape, Inc.:

   “There is a real and growing threat to critical infrastructure, however the way we talk about these incidents matters.

   “If this was genuinely a historic cyber-induced shutdown of a British power generator, then operators need to know what made it possible.  Was a PLC directly exposed to the Internet?  Was remote access compromised?  Did attackers manipulate the physical process, or did operators shut the plant down defensively after an IT compromise?  What control would have broken the attack chain?

   “Don’t tell me this was historic and then redact the history.

   “We can protect the identity of the victim and sensitive operational details while still publishing a sanitized technical account.  CERT Polska has shown what responsible disclosure can look like: explain the attack path, identify the class of failure, and give other operators something they can actually use to defend themselves.

   “The same caution applies to attribution.  “Iran-linked” is not the same thing as proving that the Iranian government directed the attack.  We should distinguish what happened to the plant, who conducted the intrusion, and by which nation state it was instructed.  Attribution in cyberspace is an analytical conclusion, not something you read off the source IP address.

   “The larger problem is that too many cyber incidents and near misses disappear into non-disclosure or tightly held incident reports.  One operator learns an expensive lesson while thousands of others are left to learn it again.  The point of incident reporting should not simply be counting attacks.  It should be making the next attack harder.

   “We keep sweeping these incidents and near misses under the rug when we should be dragging them into the light and learning from them.

   “If joint cybersecurity advisories can say what went wrong in Minnesota without handing attackers a blueprint, we should be able to tell operators what class of failure took a British peaking plant offline for four days.”

Seemant Sehgal, Founder & CEO, BreachLock: 

   “OT in power plants and water treatment facilities wasn’t designed with adversarial persistence in mind. The visible coordination across a UK facility and dozens of US water systems in the same window indicates that these environments are being mapped and tested well before the disruptive payload arrives. 

   “The teams running these facilities need to know which of their OT assets are reachable, how an attacker would move from IT into operational systems, and where their recovery dependencies sit, because it’s already too late to be asking those questions by the time the outage clock starts.”

 The UK’s National Cyber Security Centre (NCSC) urging organizations deploying agentic AI systems to follow stronger security controls, here are four experts with comments on these recommendations.

Agentic AI systems have shown potential to transform how organisations work, at times delivering unparalleled productivity gains. They can automate complex workflows, reduce routine effort and enable people to focus on higher-value tasks.

As organisations deploy increasingly autonomous uses of AI at pace, it is important to consider how these systems behave when they do not function as envisaged or expected – and plan accordingly.

Recently, there have been several incidents involving AI models and agentic AI systems carrying out unsanctioned or unintended activity. These events highlight why organisations need to carefully consider how these technologies are deployed, constrained, observed and responded to.

John Strand, Owner, Black Hills Information Security, Inc.:

“I absolutely love this.These recommendations and guidelines actually look like they were written by people who have spent time working with AI and testing these systems in the real world. They’re practical, they make sense, and frankly, I wish we’d had guidance like this five years ago. But we’ll take it now. Once again, it feels like the EU is considerably further ahead of the United States when it comes to establishing meaningful guidance and requirements around how these tools are tested and used.”

Seemant Sehgal, Founder & CEO, BreachLock:

“Agentic AI changes the security model because software is no longer just responding to instructions; it is making decisions and taking actions on its own. Giving an AI agent broad access without clear guardrails is similar to handing out privileged accounts without oversight. The strongest offensive security approach is to treat every agent as a potential point of failure, limit what it can reach, require human review for high-impact actions, and continuously verify that its behavior matches its intended purpose.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“The NCSC published a controls checklist for a problem most organizations haven’t scoped yet. Sandboxing, least privilege, human approval gates, continuous monitoring, all sound right. They also assume you know which agents are running in your environment, what credentials they hold, and which systems they can reach. Most enterprises cannot answer those questions.

“Shadow AI is harder to inventory than shadow IT ever was. An employee spinning up a SaaS application left a procurement trail. An employee configuring an AI agent inside an already-approved platform like Salesforce or Microsoft 365 leaves none. The agent inherits the platform’s existing access, never triggers a security review, and no one in procurement knows it exists.

“The gap widens when agents acquire credentials at runtime, spawn subagents, or chain actions across multiple systems in a single task. Every delegation step creates an identity your IAM system was never designed to track. Most organizations have no ownership model for agent identities and cannot trace an agent’s action back to the human who authorized it.

“These recommendations are step three of a three-step problem. Step one is discovery, mapping which agents exist and who deployed them. Step two is measurement, tracking what those agents actually do at runtime. Most organizations are stuck on step one.

“You cannot sandbox what you have not found. You cannot scope permissions for credentials you have not inventoried.”

Doc McConnell, Head of Policy and Compliance, Finite State:

“This NCSC guidance shows that the recent incidents of autonomous AI agents breaking out of testing environments and executing cybersecurity intrusions have already shifted the risk calculus.

“The NCSC offers two specific pieces of guidance that feel provocative in a time when so many organizations are racing to implement agentic AI in faster, more autonomous ways. First, the NCSC recommends formal threat modeling of AI escape scenarios. Second, it applies a familiar ‘zero trust’ model to agentic AI, including robust sandboxing and deny-by-default permission structures. This shifts the conversation around AI governance from treating agents as potentially reckless to treating them as actively adversarial.”

I pretty much said it earlier today but I will say it again. If you are running AI without guard rails, you are asking for trouble. Organizations need to take that into account or bad things wll happen.

Research published by Zen Internet found that half of UK technology leaders believe network outages threaten revenue. The study surveyed 500 senior technology decision-makers across the UK.

The findings point to wider concern about the role of network resilience in business performance. More than half of respondents, 51%, said resilience was business-critical and that outages would significantly affect revenue, operations or customers. A further 94% said resilience was important to their organisation’s success.

Many technology leaders also said complexity within their IT estates was slowing change. Zen found that 78% said technology complexity was holding back transformation, with multiple vendors, platforms and contracts cited as major obstacles.

You can read the full story here: https://securitybrief.co.uk/story/half-of-uk-tech-leaders-say-outages-threaten-revenue

Commenting on this, Mayur Upadhyaya, CEO at APIContext, said: 

The fact that half of UK technology leaders now see outages as a threat to revenue shows how closely digital resilience and business performance have become linked.

Complexity doesn’t come from the number of systems you have. It comes from the number of dependencies between them. A payment, customer journey or identity transaction can cross multiple APIs, cloud services and third parties before it completes, and organisations don’t always have visibility across that entire chain.

AI and agentic adoption add another dimension. Increasingly, machines are executing those transactions, making decisions and retrying when something degrades. Machines can fail silently, and they fail at machine speed. That means a small degradation can propagate through dependent systems before an operational team even knows there is a problem.

The answer isn’t to slow innovation. It’s to recognise that resilience now means continuously verifying the critical transactions the business depends on, not simply monitoring the individual systems underneath them.”

Outages cripple or kill companies. So stopping outages should be the priority or bad things will happen.

The Police National Legal Database (PNLD), a legal reference service used by all 43 Home Office police forces in England and Wales, confirmed a cyberattack that exposed the contact information of more than 100,000 police officers, police staff and criminal justice professionals.

The breach was discovered on July 26, and the ExfilSquad extortion group has claimed responsibility, alleging it stole 135,000 contact records.

According to PNLD, the compromised information includes names, employing organizations and work email addresses of police officers, government partners and criminal justice personnel, along with the names and email addresses of members of the public who used the “Ask the Police” service.

Seemant Sehgal, Founder & CEO, BreachLock Had This To Say:

“A database of 135,000 verified identities across law enforcement and criminal justice, with employing organizations attached, is not contact information in the ordinary sense. That combination tells an adversary exactly who works where, in what capacity, and how to reach them directly. The downstream risk to be concerned about here is social engineering, targeted harassment, and covert approaches to personnel who would otherwise be a lot more difficult to identify and map.”

Denis Calderone, CTO, Suzu Labs Adds This:

“A simple misconfiguration in a Microsoft Power Pages portal was the impetus for this breach. PNLD’s Anonymous Users web role had read access to backend Dataverse tables, which means the subscriber database was queryable through a standard API call by anyone who visited the site without logging in. And similar to the open S3 bucket issue that was so prevalent a few years ago, ExfilSquad didn’t need to deploy malware or exploit a zero-day, they just had to hunt for misconfigured endpoints. And what was sitting behind those endpoints happened to be the names, force assignments, and work emails of 135,000 police officers, CPS prosecutors, and criminal justice professionals across all 43 forces in England and Wales.

“The real danger here isn’t that officers may get phished. Police are trained observers, professionally skeptical, and most UK forces have had security awareness reinforcement since the PSNI incident in 2023. The danger is what this data enables criminals to do to everyone else. A verified name, force assignment, and work email for a real officer is everything you need to impersonate police when contacting witnesses, victims, solicitors, or other agencies. For organized crime groups specifically, this directory is a counter-intelligence tool. You can cross-reference names and force assignments against your own operations to map who might be investigating you. And then there’s the 21,000 members of the public from Ask the Police, people who already have a relationship with law enforcement and are primed to trust communications that appear to come from police email addresses.

“This is the same group and the same access method that hit the Department for Education the week before, exposing 607,000 records. Researchers have found Dataverse-consistent structures across 11 of ExfilSquad’s 15 claimed victims, so this is clearly a systemic configuration problem across UK public sector Power Pages deployments. If your organization runs Power Pages, open an incognito browser window and query your /_api/ and /_odata endpoints right now. See what comes back without credentials. Microsoft provides a tenant-level governance control that blocks unauthenticated Dataverse reads while still allowing public form submissions. That control should have been validated before deployment, not discovered after 135,000 law enforcement contacts land on the dark web.”

Jeremiah Fowler, Researcher for Black Hills Information Security, Inc. Has This Comment:

“Threat actors often use basic contact information as the starting point for phishing campaigns, social engineering attacks, and credential theft. Law enforcement personnel face unique risks because of the nature of their work and data they may have access to. Even if the exposed information is only of contact details, these can be combined with publicly available information or previously breached datasets to build detailed profiles of officers, investigators, or even government personnel. In 2023 I discovered 500k records that were exposed that contained records associated with vehicle seizures conducted by Ireland’s national police, I have seen firsthand how law enforcement data can become publicly accessible and the risks that come with it. Once data is exposed, you can’t put the genie back in the bottle. 

Law enforcement data exposures by cybercriminals is highly concerning and more steps must be taken to protect the identities and contact information of officers, investigators, and support personnel. Even when these incidents expose limited information, multiple breaches over time can provide threat actors or even nation states with enough intelligence to identify organizational structures, identify specialized units, and target individuals based on their roles or launch a more sophisticated cyberattack. The most concerning part to me is that in the age of AI where criminals have access to advanced technology, we do not know how data exposed today will be used tomorrow.”

Thoughts and prayers to anyone affected. But given that we’re in the six digits here in terms of those affected, thoughts and prayers may not be enough.

The UK’s National Cyber Security Centre (NCSC) is urging network device manufacturers to embed stronger “forensic observability” into their products to help organizations detect, investigate and respond to cyberattacks. 

New guidance, developed with international partners, calls on vendors to improve the collection and preservation of forensic data to support incident response and recovery. 

The guidance outlines 31 recommendations across areas including logging, time synchronization, event recording, forensic data collection and secure storage. NCSC said network devices are increasingly targeted by sophisticated threat actors, making it critical for organizations to have sufficient forensic evidence to determine how a compromise occurred and what systems were affected. 

Donald McFarlane, Advisory Board Member, Xcape, Inc Had this comment: 

“Government guidance is increasingly acknowledging that cybersecurity is about more than prevention, and that it requires enabling rapid investigation, containment, and recovery for when prevention fails. Forensic observability should be viewed as a core design requirement for network infrastructure, not an optional feature. 
 
“Network devices have historically prioritized forwarding packets over recording evidence. Today, defenders need trustworthy, tamper-resistant forensic data to determinewhat happened, what was affected, and how to recover. You can’t investigate what you didn’t record. 
 
“It’s also worth viewing this alongside the recent Five Eyes guidance on preparing critical infrastructure to operate while intentionally isolated from external dependencies during a major cyber incident. Those recommendations aren’t in tension: organizations must be prepared to operate independently during a crisis, but collective defense still depends on sharing high-quality telemetry, forensic evidence, and threat intelligence before and after an incident. Resilience requires both the ability to stand alone and the ability to learn together.” 

Denis Calderone, CTO, Suzu Labs follows with this: 

“We generally love the direction this guidance is heading. What the NCSC is really asking for is EDR-level telemetry on network devices, and I’d argue that it’s long overdue. This incorporates devices that sit on the perimeter.  These devices are the way into the target, the way attackers exfiltrate data out of the targets and are often the internal boundary that must be traversed while moving from zone to zone and internal network to network.  In short, they see an awful lot, and that’s the data you need when working a real incident. The telemetry they could be providing about attacker movement, tooling, and data flows between environments is invaluable for an investigation. During incident response it’s not uncommon for the handlers to request log data, only to find that it falls short of their needs. 

“If I had a nickel for every time I’d heard “oh, we weren’t collecting that log data”, or “it only goes back 2 days”, well, I’d have a lot of nickels. This could allow us to maybefinally see the early promises of SIEM come true, where all events were going to be perfectly correlated across all layers of the stack. If vendors actually deliver on this guidance, we may end up with meaningful telemetry from the network infrastructure flowing into the same correlation engines that are already processing endpoint and cloud data. You could trace lateral movement across zone boundaries, identify what tools the attacker used, and quantify how much data moved between segments. That changes the quality of an investigation completely.  

“There’s a lot in this, but one thing I really do like is the emphasis on log shipping and the recommendation that devices should alert administrators when remote logging is disabled or misconfigured. That’s a simple thing that would catch a lot of problems early, including attackers who disable logging as one of their first moves after compromise. It would be great to correlate all the data in an intelligent way, but just having the data there at all is a huge plus over what we often find during actual incidents. 

“It’s also worth noting that this isn’t just a UK initiative. CISA, the FBI, and the Australian, Canadian, and New Zealand equivalents all co-authored the underlying guidance back in February 2025, and NIST currently has nothing this specific for network devices. This is currently the most detailed framework out there for what manufacturers should be building, and it has Five Eyes backing.  

“The one concern I’d flag is telemetry overload, particularly around capturing all DNS queries on a busy network device. That’s a lot of data, and organizations that are already managing high SIEM costs and alert fatigue need to think carefully about how they consume and operationalize this without drowning in it. That said, the volatile data collection recommendations are excellent. Capturing the running state of a device during an incident, process trees, memory maps, network connections, and particularly the CAM tables and DHCP lease tables, that’s the kind of data that can completely change an investigation. Knowing which MAC addresses were on which switch ports and which IPs were leased at the time of compromise could be a real game changer during an actual incident.” 

Josh Marpet, Senior Product Security Consultant, Finite State: 

“The NCSC has put out a security posture recommendation. Network devices should be able to log, secure, and be forensically available for examination, for both volatile and static data. 

“Why? Because for so long, network device manufacturers built the cheapest hardware they could, to be competitive in price. But that means that firmware is squeezed into flash too small to back itself up, hardware doesn’t have the space to store logs, or have the capability to be attached to a forensic duplicator. 

“The NCSC is asking manufacturers to make sure that network devices, long the target of cybercriminals and rogue nation-states, can perform basic security hygiene and has the basic security and compliance capabilities to make it simpler and faster for enterprises to perform incident response, disaster recovery, and be a modern mature workplace. 

“None of it is extraordinary, most of it is fundamental steps. Rich log data, solid logs of all major events, protection of keys, physical protection of protected hardware modules (TPM, HSM, etc), and the ability to do remote logging and maybe even local logging. 

“Again, nothing crazy. Fundamental security, especially for a device that traffics all of the data from the enterprise. Good ideas. Solid guidance. Manufacturers! Follow it!!!” 

Basic logging and a basic security posture… Sounds like a very good idea to me. This should be copied elsewhere as the UK seems to have a few good ideas.

The UK government has added cyberattacks targeting data infrastructure, water systems and police networks to its 2026 National Risk Register, which outlines the most serious risks facing the country.

The updated register also includes “digital resilience failure” as a new risk, drawing on lessons from the July 2024 CrowdStrike outage. The government cited the increasing sophistication of artificial intelligence as one factor affecting the cyber threat landscape.

The UK plans to conduct its largest home defense exercise in decades in 2027, testing government and public-sector responses to hybrid threats including cyberattacks, disinformation and critical infrastructure sabotage.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “Seven new risks on the UK’s National Risk Register. The one that undermines the rest is “interference in democratic processes.” Every other addition, cyberattacks on water operational technology (OT), police networks and colocation data centers, has an identifiable technical failure state and a technical remediation path. Democratic interference does not. Once the integrity of the information environment becomes a national security risk, someone in government must decide what constitutes manipulation, disinformation, or an unacceptable influence operation. Those are political judgments, and the standards will change with the government making them.

   “Operation Albiston Shadow, the UK’s largest home defense exercise in decades, is supposed to test readiness for cyberattacks and infrastructure sabotage. To the extent the scenario requires officials to adjudicate information quality, it stops being a purely technical drills.

   “The technical risks themselves are overdue, though I’d feel better if the UK’s follow-through matched the announcements. In just over a week, the government released Cyber Shield’s blueprint for autonomous AI defense at machine speed, the Risk Register update and Albiston Shadow. Three announcements centered on identifying, modeling, and exercising risk, with no funded remediation commensurate with the risks being announced. The National Audit Office (NAO) reported in January 2025 that departments were running at least 228 legacy IT systems and lacked fully funded remediation plans for 120 of them, 53%.

   “Discovery is the easy part. Critical infrastructure teams too often avoid testing production OT because they lack the tooling or the risk appetite to touch systems that can’t go down. The vulnerability scan runs on the IT side, the OT side gets a paper assessment, and the exercise report says “tested.” That’s how exercises become security theater. Albiston Shadow runs in 2027, and without funded remediation, it risks testing many of the same weaknesses the government already knows about.”

Donald McFarlane, Advisory Board Member, Xcape, Inc.:

   “The most significant development in the UK’s National Risk Register isn’t simply the recognition of growing cyber threats, it’s the recognition that digital resilience is now a national resilience issue. The strategic question is not whether we can prevent every cyber attack, it is whether society can continue functioning when digital systems fail.”

   “This is part of a broader international shift. In the United States, initiatives such as the June AI Executive Order, the Gold Eagle public-private cybersecurity partnership, and increasingly realistic resilience exercises all point toward the same conclusion: cybersecurity must evolve to address cyber civil defense. Governments don’t own most critical infrastructure, so resilience must be built through trusted public-private partnerships, shared situational awareness, and a collective defense which measures and addresses the exposures before a real crisis reveals them. Plans don’t build resilience. Realistic adversarial emulation, quantitative performance metrics, and OODA loops do.”

   “Artificial intelligence is accelerating this transformation for both attackers and defenders. Human-speed defensive workflows will increasingly struggle to keep pace with machine-speed offensive operations. The limiting factor is no longer finding flaws, but the speed and effectiveness of coordinated response. Ultimately, success should be measured not simply by whether attackers gained access, but by whether essential services remained available and recovered quickly when disruption occurred, and whether the attack remains contained, or affects adjacent infrastructures.”

Seemant Sehgal, Founder & CEO, BreachLock:

   “The UK government putting cyberattacks on the same list as floods and pandemics is a policy signal worth reading carefully.

   “What stands out to me about the UK’s approach is the inclusion of digital resilience failure as a distinct risk, because the CrowdStrike outage showed that the most disruptive events can originate inside your own trusted systems, not from an adversary at all.

   “The 2027 exercise is the right instinct, but the gap between planning for a scenario and actually being prepared for it is where most organizations need to focus on closing.”

The USA should copy the UK as clearly the UK are on the right side of history.