The IT Nerd

The UK military is deploying specialized cyber teams overseas to identify and disrupt hostile hackers before they can attack British defense networks, according to a new report from The Times.

Major General Mike Fayers, commander of the UK’s Defence Cyber and Electromagnetic Force, revealed that personnel are conducting forward-deployed operations across Europe and Asia with the consent of host nations. The force, comprising more than 700 military and civilian personnel, also searches Ministry of Defence networks for intruders and hidden malware that could be activated during a conflict.

Fayers warned that AI is accelerating cyberattacks, reducing the time available to respond to newly exploited vulnerabilities from days to minutes. The Ministry of Defence reported approximately 90,000 state-linked cyberattacks over the past two years, double the previous period.

Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security

“Waiting for an attacker to reach your network before looking for them is becoming an increasingly expensive strategy.

“What interests me about the UK’s approach isn’t simply deploying cyber teams overseas. It’s the recognition that effective defense increasingly requires understanding adversaries, their capabilities, and the paths they may take before an attack reaches its intended target.

“AI may compress attack timelines, but speed alone doesn’t determine the outcome. Visibility, preparation, intelligence, and tested security controls still matter.

“Organizations don’t need military cyber teams to adopt this mindset. They need proactive threat hunting, continuous offensive testing, and the discipline to validate complete attack paths rather than simply count vulnerabilities.

“The objective isn’t to win every game of cat and mouse. It’s to make sure the mouse doesn’t already have the keys to the house.”

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock

“Forward hunting buys defenders time, and that time pays off only for those who already know which of their systems an attacker can reach. Behind the 90,000 attacks the MoD reported, the number that decides outcomes is how many found a path that already existed. When the response window shrinks from days to minutes, any weakness you have not already found and closed will be reached first.”

ㅤ

John Strand, Owner, Black Hills Information Security

“I think this kind of forward thinking from militaries around the world is absolutely essential. It also scares me. Both can be true.

“I’ll be one of the first people to say that militaries need offensive cyber capabilities. Full stop. If the NSA, NRO, CIA and, within its authorities, the FBI aren’t looking at how those capabilities fit into their missions, then what the hell are we paying them for?

“The UK is moving in this direction, and I think that’s necessary because our adversaries are already doing it. It’s disturbing to see countries tie their own hands while their adversaries are willing to do whatever they want. There is no scenario where simply hoping the other side shows restraint works out.

“But we also have to talk about escalation. As with almost any military option, cyber or kinetic, there is a risk that your actions trigger a response and that response drives the next escalation. There are going to be problems, and we need to be honest about them.

“You can hold both things in your head at the same time. You can recognize the danger of escalation and still understand the absolute necessity of having offensive capabilities.”

Maybe the US needs to take a page out of the UK playbook here? Just a thought?

The UK’s National Cyber Security Centre (NCSC) has warned that AI-powered malware is highly likely to be used in a ransomware attack against the country’s critical national infrastructure by 2028.

The assessment, published in its 2026 Annual Review, identifies growing risks to essential services as cybercriminals and state-backed attackers increasingly incorporate artificial intelligence into their operations.

The NCSC said AI is accelerating reconnaissance, social engineering, vulnerability discovery and exploit development, allowing attackers to operate at greater speed and scale. It warned that AI-assisted vulnerability discovery could enable attackers to exploit weaknesses before organizations deploy patches.

The annual review recorded 1,831 reported cyberattacks between September 2025 and August 2026, including 337 incidents requiring NCSC assistance and 80 classified as nationally significant.

The agency emphasized that most successful compromises still exploit familiar weaknesses, including unpatched vulnerabilities, stolen credentials and social engineering, while AI is making those existing techniques more efficient.

ㅤDarin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security

“The NCSC’s warning isn’t that ransomware has suddenly developed a mind of its own. It’s that AI is making familiar attack methods faster, more scalable, and potentially more accessible. An attacker doesn’t need to invent a new vulnerability when existing weaknesses, stolen credentials, and poorly understood trust relationships still provide opportunities.

“For critical infrastructure, the concern goes beyond compromised systems. It’s the potential disruption of services that communities depend on every day. I’ve spent much of my career examining the difference between controls organizations believe are protecting them and what those controls withstand when tested. AI could make that gap increasingly consequential.

“We should be careful not to confuse AI-assisted attacks with fully autonomous threats. We should also recognize that AI offers defenders opportunities to discover vulnerabilities, correlate evidence, and prioritize remediation. But capability is different from verification. An AI system reporting that a vulnerability has been fixed is not proof that the attack path has been eliminated.

“The challenge is to use automation to continuously test our assumptions, independently validate outcomes, and strengthen our ability to contain and recover from disruption.

“The question isn’t whether attackers will get faster. It’s whether we can make verified resilience move faster than the threats we’re preparing to face.”

ㅤ

John Strand, Owner, Black Hills Information Security

“More and more organizations are sounding the alarm about AI-powered attacks, and I cannot help but feel we’re being caught flat-footed. A lot of organizations have discussed these attacks as some nebulous problem for the future. For many governments and organizations, that problem is here right now. And it’s only escalating.

“We have no time to waste. Every organization needs to reduce its external attack surface and use deception wherever possible to create tripwires for attackers. Those steps need to happen now as we prepare for the next wave of AI-powered attacks.”

ㅤ

Jacob Krell, Senior Director, Secure AI Solutions & Cybersecurity, Suzu Labs

“The UK’s National Cyber Security Centre (NCSC) put a date on it. Its 2026 Annual Review assesses it as highly likely that AI-powered malware will feature in a ransomware attack on UK critical national infrastructure (CNI) by 2028. Last week’s funding announcement, £60 million for Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, points at discovery. Discovery was never the hard part.

“CNI runs under-patched and under-tested for a rational reason, a patch that bricks a controller at a water treatment works is a service outage, so operators defer. Every operational technology (OT) engineer I’ve met wants to patch. AI-assisted discovery is compressing the window between a published bug and a working exploit, and the people who can safely test those systems, the ones who know which pumps tolerate a five-minute stop, rarely come at public sector pay.

“The same availability fear is what ransomware monetizes. Immutable backups, copies an attacker cannot alter or delete, turn a total-loss event into a recovery exercise. The Cyber Security and Resilience Bill should make them a requirement for CNI operators.”

ㅤ

Joshua Marpet, Senior Product Security Consultant, Finite State

“While much critical infrastructure is primarily a nation-state target, much of it is also a target for commercial cybercrime.

“As AI tokens are still fairly inexpensive, and even a small inference infrastructure can create phishing emails that pluck heartstrings or push a false sense of urgency, it’s relatively trivial to build that route into a company or agency. Once you build the way in, getting someone to click a malicious link is pretty easy.

“This is not “huge ai writes incredibly complex formerly unseen zero-day vulnerability!!!”. This is “tiny AI writes an email to elicit an emotional reaction of sorrow, pity, or urgency”.

“So rather than spending $10k to build a new zero day, I can spend 20 minutes to write an email and some shell code. For free. From hugging face or evilgpt.

“But if you feel the need to build some revolutionary malware, you can always spend about 120k and build your own high end ai infrastructure, with a free Chinese model such as Kimi, Qwen, or deepseek. 120k?!?? One or two good hits on the ransomware, and you’ll make your money back.

“Either way, it’s relatively simple to use AI to find vulnerabilities, or to build phishing emails to deploy malware.

AI is going to be a big problem for you right now. The question is will you answer the call and defend your organization against AI?

ㅤ

“So a warning it may happen? No, I’m sorry. It’s already happening. The horse has left the barn.”

ㅤ

The UK government has announced new AI cybersecurity measures to identify vulnerabilities in government systems, strengthen defenses against AI-powered attacks and prepare for incidents involving autonomous AI agents.

Speaking October 12, AI Minister Kanishka Narayan said two government pilots used frontier AI to identify and address more than 1,000 vulnerabilities. The government’s centralized vulnerability-monitoring service has also reduced the time needed to remediate identified weaknesses from 50 days to eight.

The government plans to expand AI-based vulnerability detection, develop capabilities to investigate and contain rogue AI agent incidents, and consider amendments to the Cyber Security and Resilience Bill addressing AI-related threats to essential services.

Proposed measures include reporting serious AI incidents and near misses. The UK’s AI Security Institute has also resumed testing advanced AI models, including Gemini 4 Argon.mation Security offer perspectives on the matter.

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security Technology Inc.:

“The UK’s initiative demonstrates the potential of AI to accelerate vulnerability discovery and strengthen remediation efforts. The government reports that two AI pilots helped identify and address more than 1,000 vulnerabilities, while its centralized monitoring service reduced remediation time from 50 days to eight. That’s encouraging progress but finding vulnerabilities faster is only part of the equation.

“From my experience in offensive security, the real value comes when AI helps us move beyond identifying potential weaknesses to validating exploitability, demonstrating attack paths, and producing evidence that helps security teams prioritize what actually matters. A vulnerability score tells us something about severity, but demonstrating how an attacker could exploit a weakness, what systems are reachable, and which business assets are exposed provides the context needed for better remediation decisions.

“As autonomous AI agents gain greater authority, those same principles must apply to the agents themselves. Their permissions, actions, and trust boundaries must be independently tested and validated, not simply assumed secure.”

The objective isn’t simply to find more vulnerabilities. It’s to produce actionable evidence, prioritize real risk, and verify that remediation works.

ㅤ

John Strand, Owner, Black Hills Information Security:

“This proposed legislation looks fantastic. It’s good to see that they’re already using AI to identify vulnerabilities and try to address them throughout the UK.

“My concern is speed. Laws and implementation can take a long time, even after successful pilot programs. There’s a big difference between running a pilot and rolling something like this out across an entire country.

“But I’m very excited to see the UK government taking AI threats, vulnerabilities, and the promise of AI for defense seriously enough to push this initiative forward.”

The UK is good at moving quickly to try and shut off threats from becoming bigger problems. While I do have problems with the implementation of this, other countries could learn a thing or two.

Bank of England Governor Andrew Bailey says regulating AI “is not the right place to start.” In his first Substack article, he called for rigorous testing to find vulnerabilities and build safeguards before any formal rules, pointing to work at the UK’s AI Security Institute. He expects models to “behave unexpectedly” during testing, and warned that frontier AI without a way to intervene could become a system that governs itself. His comments come days after OpenAI held back its latest model over safety concerns, and after President Trump announced a voluntary safety agreement with OpenAI, Anthropic, Nvidia, Meta, Google and SpaceX that leaves each company responsible for the safety of its own technology.

Adrian Culley, offensive security engineer at SafeBreach said this:

“Most of the risk sits in deployment, not in the model at release: agents with tool access, connectors, non-human identities and data flowing through integrations. That is where attackers operate. Prompt injection (MITRE ATLAS AML.T0051, OWASP LLM01) turns a trusted agent into an insider with legitimate credentials, and a voluntary, self-attested safety commitment will not catch it.

Regulators are moving towards evidence, not policy statements. Supervisors will increasingly ask financial firms to show how they validate AI-enabled systems, particularly where many institutions depend on the same underlying models and one failure could be correlated across the sector.

The answer is the discipline security teams already apply elsewhere: assume controls fail, then prove otherwise. Run realistic attack scenarios against deployed AI systems, measure whether intervention controls actually trigger, and repeat as models, prompts and permissions change.

Bailey calls for a system to intervene. That system must be validated under attack, not assumed to work.”

I personally want evidence based legislation in place before any rollout of AI is done. Companies who provide AI and companies who use AI can’t be trusted to do the right thing. Thus they have to have the right imposed upon them 100% of the time.

The UK’s National Cyber Security Centre (NCSC) warned that artificial intelligence is currently positioned to provide greater advantages to cyber attackers than defenders, as attackers face fewer constraints when deploying AI autonomously.

Dave Chismon, the NCSC’s chief technology officer for architecture, said attackers can allow AI agents to operate with broad autonomy, while defenders must account for the risk that autonomous systems could disrupt or damage the networks they are intended to protect. This imbalance could allow AI-enabled attacks to scale faster than automated defenses.

The NCSC has also said AI is rapidly improving offensive capabilities, including vulnerability discovery and exploitation, while defensive uses such as automated mitigation and response carry risks including service disruption, data loss and operational failures.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“The NCSC’s warning that AI may favor attackers needs a harder qualification. Attackers cannot simply give an AI agent broad access and walk away.

“They still have to manage operational security (OPSEC), avoid attribution, control their infrastructure and stop the agent from creating evidence. If it scans the wrong target, contacts a victim or exposes the operator, the consequences can include arrest and prosecution. Criminal liability is a real constraint on offensive autonomy.

“Defenders carry a different risk. A security team whose AI-driven firewall change breaks a VPN may face an outage review, discipline or a lawsuit. The engineer does not usually face an arrest warrant because the agent made a bad change. That makes defensive autonomy a governance problem, not a simple question of whether the technology can act.

“Organizations should reduce that governance and organizational friction by creating pre-approved classes of low-risk, reversible actions, with clear asset ownership, deterministic validation and tested rollback. Changes with broad or uncertain impact should still require human approval. The goal is to remove unnecessary approval friction from routine remediation while keeping consequential actions gated.

“An attacker has to keep an AI agent quiet, scoped and out of the wrong network. A defender has to get an AI agent approved, tested and recoverable. The first is an OPSEC and criminal-liability problem. The second is governance and organizational friction, which defenders can reduce through better ownership, pre-approval and rollback design.”

Lydia Zhang, President & Co-Founder, Ridge Security Technology Inc.:

“The inconvenient truth that Chismon points out in this article has been the reality security teams have been dealing with for years: the imbalance between attackers and defenders in their ability to adopt and operationalize new technologies. AI has obviously widened that gap dramatically.

“But there is also a significant silver lining for defenders: many of the advantages AI gives attackers can also be turned toward defense. AI can help fix vulnerabilities early in the development lifecycle through automated patching, and it can also help remediate vulnerabilities in production.

“We recently demonstrated how an organization can practically combine a security testing tool with a code agent to reduce critical vulnerabilities from 10 to 0 in just four runs.

“So perhaps the challenge is no longer purely technical. The technology is increasingly capable. The bigger challenge is organizational: risk tolerance, processes, accountability, and mindset.”

Donald McFarlane, Board Member, Xcape Inc.:

“Treasury Secretary Scott Bessent articulated a useful starting point this week: accountability. Discussing the Hugging Face incident, he argued that responsibility rests with the humans and organizations deploying these systems, not with an AI agent treated as though it were an independent actor. He has also argued against shielding frontier labs from liability.

“I agree wholeheartedly with that basic principle. More specifically, liability should follow control, causation, intent and duty of care, rather than simply attaching every downstream harm to the person or company who trained the model.

“A malicious user deliberately employing AI to attack someone should bear primary responsibility. An operator that gives an agent powerful credentials, excessive authority and inadequate supervision should be responsible for negligent deployment. Integrators should be accountable for unsafe implementations. Model developers should remain responsible where foreseeable defects, or failures to exercise reasonable care in developing and testing their products, materially contribute to harm.

“That approach also recognizes that responsibility may be shared. Relevant questions would include who controlled what, what risks were reasonably foreseeable, what safeguards were available, and whose acts or omissions materially contributed to the outcome.

“The NCSC is also right that defenders cannot simply mirror attackers. Autonomous defensive action can itself disrupt the systems we are trying to protect, so greater autonomy has to come with governance, bounded authority, recoverability and clear human accountability. Its framework for evaluating potency, scope, criticality, rollout confidence and recoverability is a useful start.

“But I am more optimistic about the defensive side of this equation. AI gives defenders the opportunity to operate at machine speed as well. We should be designing systems that permit progressively greater autonomous action where it can be safely bounded and reversed. And cybersecurity has much to learn from military doctrine and tactics: deception, manoeuvre, shaping the battlespace and channeling adversaries toward ground of the defender’s choosing. AI can make those approaches substantially more powerful.

“AI is an extraordinarily powerful general-purpose technology. We need strong engineering, clearly assigned human accountability, meaningful incident reporting and judicially determinable duties of care. Autonomous software does not somehow break the chain of human responsibility, and we should not create regulatory barriers that only the largest incumbent laboratories can afford.”

John Strand, Owner, Black Hills Information Security:

“Absolutely, AI is going to create more attack opportunities simply because these systems have broad autonomy and more latitude in what they can do, especially when you start looking at open-weight models. But there’s another part of this that I don’t think people fully appreciate. Complexity is the enemy of computer security.

“The more services you have, the more attack surface you create. Even if those services don’t have known vulnerabilities today, AI can rapidly fuzz them, analyze them, and identify weaknesses that attackers may have previously overlooked because finding and exploiting them required significant time and skill.

“AI changes that equation. Vulnerabilities and exploitation opportunities that were previously out of reach for the average attacker are suddenly much more accessible. You no longer need to be an exceptionally skilled vulnerability researcher to find some of these weaknesses. AI can do a tremendous amount of that heavy lifting for you.”

Defenders always should have the advantage. Therefore the balance needs to be reset so that the good guys are the ones that win.

UK lawmakers are considering giving the government emergency powers to deactivate powerful AI systems and shut down data centers if the technology poses a national security threat.

The proposed “kill switch,” introduced as an amendment to the Cyber Security and Resilience Bill, is intended as a last-resort mechanism to stop a runaway AI system before it can compromise critical national infrastructure.

At the same time, the UK government has introduced separate amendments to the same cybersecurity bill that would allow ministers to prevent critical infrastructure organizations from using technology suppliers deemed high risk. The new authority is aimed at supply-chain threats, where attackers can compromise a smaller technology provider and use its access to reach more sensitive organizations.

The move follows a recent cyberattack that forced a small UK power generation facility offline for four days.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“A government-mandated remote shutdown capability for data centers is a pre-installed denial-of-service mechanism waiting for the wrong hands. The amendment to the UK’s Cyber Security and Resilience Bill would require operators to build and maintain the exact infrastructure an attacker would need to cause the disruption the legislation claims to prevent. Compromise the authorization channel, and the government has handed the attacker a shutdown switch labeled “safety.”

“Responsibility for containing an AI system sits with the operator running it. If you’re deploying AI on critical infrastructure and cannot kill your own workload when it goes sideways, a minister reaching for a centralized override just confirms nobody expected operators to manage their own systems.

“Cybersecurity minister Baroness Lloyd rejected the proposal, arguing that directing an organization to stop using a specific AI model is more proportionate than shutting down shared infrastructure thousands of services depend on. She’s right.

“The supply-chain provisions in the same bill, letting ministers block critical infrastructure operators from using high-risk technology suppliers, respond to something real. An Iran-linked cyberattack forced a small UK energy generator offline for four days in July. Controlling which vendors touch critical networks addresses the entry point. A kill switch addresses the blast radius after the breach has already happened, and it does so by adding a new attack surface to defend.”

John Strand, Owner, Black Hills Information Security, Inc.:

“I feel like conversations like this in legislatures around the world are incredibly important, and I think many of the provisions being discussed absolutely should be put in place.

“However, I also think the way the conversation is arcing fundamentally misses the point of what AI actually is.

“AI is not something that can be controlled simply by regulating powerful companies like Anthropic, Google, and OpenAI. The technology is already dispersed. With roughly $5,000 worth of hardware, someone can run a highly functional model locally that may be slower than the most powerful commercial models, but can potentially be every bit as destructive.

“If our entire strategy for AI safety is built around restricting what large companies can do with potentially dangerous models, we’re addressing only one part of the problem. Those restrictions may be valuable, but they don’t address what happens when capable models are downloaded, modified, fine-tuned, and operated completely outside those environments.

“There needs to be a much larger conversation about mitigating controls. We need to be thinking about how organizations detect and respond to AI-enabled attacks, how infrastructure is protected when the attacker has access to these capabilities, and what defensive technologies need to change when powerful AI is available to practically anyone willing to invest a few thousand dollars in hardware.

“Regulating the largest AI companies may be part of the answer.

“It cannot be the entire answer.”

I seriously doubt that this is the answer. Thus I hope this gets the time and consideration that this does deserve.

A UK power plant reportedly went dark for four days in July after a cyberattack linked to Iranian hackers, but the story only surfaced this week, and the UK government still hasn’t confirmed or denied the incident or the attribution

The government said that at no point was there a risk to the UK’s energy system, but the Department for Energy Security and Net Zero (DESNZ) has contacted power companies to advise them about the risk of cyber attacks.

The Telegraph reported that the attack, which took place last month, was carried out by hackers affiliated to the Iranian regime.

For security reasons, neither the government nor the National Cyber Security Centre, which deals with attacks on critical infrastructure, would give further details of the site affected. However this was not an attack on an essential service such as a large power station.

Josh Picolet, VP of Detection & Analysis, Team Cymru

“State-linked activity against critical infrastructure tends to follow patterns that outlast any single incident, and the four-day recovery window here is the detail worth studying closely. That length of disruption usually means the attacker had dwell time inside the environment before detection, which points to a gap in visibility rather than a one-off failure.

It’s worth noting the UK government has neither confirmed nor denied the incident or the attribution to Iran-linked actors, so defenders should treat the public reporting with appropriate caution while still taking the operational lesson seriously. Regardless of formal attribution, the pattern is consistent with what we’ve tracked from Iran-affiliated groups against critical infrastructure across the US, Israel, the Gulf, and now Europe this year. Smaller operators in particular need intelligence that surfaces staging and pre-positioning activity, not just indicators tied to a confirmed actor, because the next facility targeted may not get four days of warning before impact.”

Justin Beals, CEO & Founder, Strike Graph

“Four days of downtime at a critical infrastructure facility is not a technical failure. It’s a governance failure. Somewhere in that plant’s compliance program, a control existed on paper that didn’t hold up in practice, and nobody caught the gap until an adversary found it first.

This is the same story we keep seeing across sectors. Organizations treat security posture as something you attest to once a year, not something you verify continuously. A point-in-time audit tells you a plant was secure on the day someone checked. It tells you nothing about the day the attacker showed up.The UK has thousands of smaller energy assets like this one, and most of them are operating on the same annual-attestation model. If this attack is repeatable, and there’s no reason to think it isn’t, the operators still relying on periodic reviews instead of continuous monitoring are the ones who will be explaining a multi-day outage to their regulator next.”

Expect more state sponsored actors to do hacks like this. Because there’s likely more of this out there that is under reported.

UPDATE: John Strand, Owner, Black Hills Information Security, Inc. Had This To Say:

   “This particular breach scares me, not necessarily because it happened in the United Kingdom, but because of how much further behind the United States power grid is compared to Europe. Modernization of the U.S. power grid has been painfully slow for a number of reasons, including legislative capture and the basic economics of how utilities make money. They make money from generating and selling power. They don’t necessarily make money from updating aging infrastructure.

   “Then there’s the interconnected nature of the U.S. power grid, with Texas being the notable exception. A relatively small problem at a substation can create ripple effects across multiple areas of the grid. That’s what makes this such a serious wake-up call. When you combine that interconnectedness with the incredibly slow pace of infrastructure modernization, especially across the power grid, I’m very concerned. I think an attack like this could potentially have a far greater impact in the United States than what we’re seeing in Europe.”

Denis Calderone, CTO, Suzu Labs:

   “What has our attention here is not the size of the generator. A savvy attacker isn’t choosing targets based on grid capacity. They’re probing for the weakest point in the armor, and a facility small enough to fall below mandatory cyber reporting thresholds is exactly the kind of target that’s likely under-defended and overlooked.

   “Two weeks ago in Poland, a compromised wind farm became a direct bridge into a completely separate heating plant’s SCADA system through a shared cellular network. Different threat actor, different country, same playbook: find the overlooked facility, use it as a stepping stone. We’ve been tracking Iran-linked operations against Western critical infrastructure since April, and the pattern keeps escalating. PLCs targeted for operational disruption. Gas station fuel monitoring systems. Water systems across 12 US states in a single month. Five agencies flagged AI-generated tools targeting Siemens PLCs four days ago. And now a UK power facility goes dark for four days.

   “The victim became the victim because of poor hygiene. The advice here is the same as it ever was, because the exposure hasn’t changed. Take controllers off the internet. Change default credentials. Inventory every communication path, especially the integrator-installed remote access links and the backup channels that never made it onto a network diagram. But critical infrastructure operators need to be proactively hunting for these weaknesses and prioritizing remediation before an adversary does the discovery for them. The smaller satellite sites are often the ones that fall under the radar during security reviews, so make sure you look at everything. Small and overlooked is exactly what made this target attractive.”

Donald McFarlane, Advisory Board Member, Xcape, Inc.:

   “There is a real and growing threat to critical infrastructure, however the way we talk about these incidents matters.

   “If this was genuinely a historic cyber-induced shutdown of a British power generator, then operators need to know what made it possible.  Was a PLC directly exposed to the Internet?  Was remote access compromised?  Did attackers manipulate the physical process, or did operators shut the plant down defensively after an IT compromise?  What control would have broken the attack chain?

   “Don’t tell me this was historic and then redact the history.

   “We can protect the identity of the victim and sensitive operational details while still publishing a sanitized technical account.  CERT Polska has shown what responsible disclosure can look like: explain the attack path, identify the class of failure, and give other operators something they can actually use to defend themselves.

   “The same caution applies to attribution.  “Iran-linked” is not the same thing as proving that the Iranian government directed the attack.  We should distinguish what happened to the plant, who conducted the intrusion, and by which nation state it was instructed.  Attribution in cyberspace is an analytical conclusion, not something you read off the source IP address.

   “The larger problem is that too many cyber incidents and near misses disappear into non-disclosure or tightly held incident reports.  One operator learns an expensive lesson while thousands of others are left to learn it again.  The point of incident reporting should not simply be counting attacks.  It should be making the next attack harder.

   “We keep sweeping these incidents and near misses under the rug when we should be dragging them into the light and learning from them.

   “If joint cybersecurity advisories can say what went wrong in Minnesota without handing attackers a blueprint, we should be able to tell operators what class of failure took a British peaking plant offline for four days.”

Seemant Sehgal, Founder & CEO, BreachLock: 

   “OT in power plants and water treatment facilities wasn’t designed with adversarial persistence in mind. The visible coordination across a UK facility and dozens of US water systems in the same window indicates that these environments are being mapped and tested well before the disruptive payload arrives. 

   “The teams running these facilities need to know which of their OT assets are reachable, how an attacker would move from IT into operational systems, and where their recovery dependencies sit, because it’s already too late to be asking those questions by the time the outage clock starts.”

 The UK’s National Cyber Security Centre (NCSC) urging organizations deploying agentic AI systems to follow stronger security controls, here are four experts with comments on these recommendations.

Agentic AI systems have shown potential to transform how organisations work, at times delivering unparalleled productivity gains. They can automate complex workflows, reduce routine effort and enable people to focus on higher-value tasks.

As organisations deploy increasingly autonomous uses of AI at pace, it is important to consider how these systems behave when they do not function as envisaged or expected – and plan accordingly.

Recently, there have been several incidents involving AI models and agentic AI systems carrying out unsanctioned or unintended activity. These events highlight why organisations need to carefully consider how these technologies are deployed, constrained, observed and responded to.

John Strand, Owner, Black Hills Information Security, Inc.:

“I absolutely love this.These recommendations and guidelines actually look like they were written by people who have spent time working with AI and testing these systems in the real world. They’re practical, they make sense, and frankly, I wish we’d had guidance like this five years ago. But we’ll take it now. Once again, it feels like the EU is considerably further ahead of the United States when it comes to establishing meaningful guidance and requirements around how these tools are tested and used.”

Seemant Sehgal, Founder & CEO, BreachLock:

“Agentic AI changes the security model because software is no longer just responding to instructions; it is making decisions and taking actions on its own. Giving an AI agent broad access without clear guardrails is similar to handing out privileged accounts without oversight. The strongest offensive security approach is to treat every agent as a potential point of failure, limit what it can reach, require human review for high-impact actions, and continuously verify that its behavior matches its intended purpose.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“The NCSC published a controls checklist for a problem most organizations haven’t scoped yet. Sandboxing, least privilege, human approval gates, continuous monitoring, all sound right. They also assume you know which agents are running in your environment, what credentials they hold, and which systems they can reach. Most enterprises cannot answer those questions.

“Shadow AI is harder to inventory than shadow IT ever was. An employee spinning up a SaaS application left a procurement trail. An employee configuring an AI agent inside an already-approved platform like Salesforce or Microsoft 365 leaves none. The agent inherits the platform’s existing access, never triggers a security review, and no one in procurement knows it exists.

“The gap widens when agents acquire credentials at runtime, spawn subagents, or chain actions across multiple systems in a single task. Every delegation step creates an identity your IAM system was never designed to track. Most organizations have no ownership model for agent identities and cannot trace an agent’s action back to the human who authorized it.

“These recommendations are step three of a three-step problem. Step one is discovery, mapping which agents exist and who deployed them. Step two is measurement, tracking what those agents actually do at runtime. Most organizations are stuck on step one.

“You cannot sandbox what you have not found. You cannot scope permissions for credentials you have not inventoried.”

Doc McConnell, Head of Policy and Compliance, Finite State:

“This NCSC guidance shows that the recent incidents of autonomous AI agents breaking out of testing environments and executing cybersecurity intrusions have already shifted the risk calculus.

“The NCSC offers two specific pieces of guidance that feel provocative in a time when so many organizations are racing to implement agentic AI in faster, more autonomous ways. First, the NCSC recommends formal threat modeling of AI escape scenarios. Second, it applies a familiar ‘zero trust’ model to agentic AI, including robust sandboxing and deny-by-default permission structures. This shifts the conversation around AI governance from treating agents as potentially reckless to treating them as actively adversarial.”

I pretty much said it earlier today but I will say it again. If you are running AI without guard rails, you are asking for trouble. Organizations need to take that into account or bad things wll happen.

Research published by Zen Internet found that half of UK technology leaders believe network outages threaten revenue. The study surveyed 500 senior technology decision-makers across the UK.

The findings point to wider concern about the role of network resilience in business performance. More than half of respondents, 51%, said resilience was business-critical and that outages would significantly affect revenue, operations or customers. A further 94% said resilience was important to their organisation’s success.

Many technology leaders also said complexity within their IT estates was slowing change. Zen found that 78% said technology complexity was holding back transformation, with multiple vendors, platforms and contracts cited as major obstacles.

You can read the full story here: https://securitybrief.co.uk/story/half-of-uk-tech-leaders-say-outages-threaten-revenue

Commenting on this, Mayur Upadhyaya, CEO at APIContext, said: 

The fact that half of UK technology leaders now see outages as a threat to revenue shows how closely digital resilience and business performance have become linked.

Complexity doesn’t come from the number of systems you have. It comes from the number of dependencies between them. A payment, customer journey or identity transaction can cross multiple APIs, cloud services and third parties before it completes, and organisations don’t always have visibility across that entire chain.

AI and agentic adoption add another dimension. Increasingly, machines are executing those transactions, making decisions and retrying when something degrades. Machines can fail silently, and they fail at machine speed. That means a small degradation can propagate through dependent systems before an operational team even knows there is a problem.

The answer isn’t to slow innovation. It’s to recognise that resilience now means continuously verifying the critical transactions the business depends on, not simply monitoring the individual systems underneath them.”

Outages cripple or kill companies. So stopping outages should be the priority or bad things will happen.

The Police National Legal Database (PNLD), a legal reference service used by all 43 Home Office police forces in England and Wales, confirmed a cyberattack that exposed the contact information of more than 100,000 police officers, police staff and criminal justice professionals.

The breach was discovered on July 26, and the ExfilSquad extortion group has claimed responsibility, alleging it stole 135,000 contact records.

According to PNLD, the compromised information includes names, employing organizations and work email addresses of police officers, government partners and criminal justice personnel, along with the names and email addresses of members of the public who used the “Ask the Police” service.

Seemant Sehgal, Founder & CEO, BreachLock Had This To Say:

“A database of 135,000 verified identities across law enforcement and criminal justice, with employing organizations attached, is not contact information in the ordinary sense. That combination tells an adversary exactly who works where, in what capacity, and how to reach them directly. The downstream risk to be concerned about here is social engineering, targeted harassment, and covert approaches to personnel who would otherwise be a lot more difficult to identify and map.”

Denis Calderone, CTO, Suzu Labs Adds This:

“A simple misconfiguration in a Microsoft Power Pages portal was the impetus for this breach. PNLD’s Anonymous Users web role had read access to backend Dataverse tables, which means the subscriber database was queryable through a standard API call by anyone who visited the site without logging in. And similar to the open S3 bucket issue that was so prevalent a few years ago, ExfilSquad didn’t need to deploy malware or exploit a zero-day, they just had to hunt for misconfigured endpoints. And what was sitting behind those endpoints happened to be the names, force assignments, and work emails of 135,000 police officers, CPS prosecutors, and criminal justice professionals across all 43 forces in England and Wales.

“The real danger here isn’t that officers may get phished. Police are trained observers, professionally skeptical, and most UK forces have had security awareness reinforcement since the PSNI incident in 2023. The danger is what this data enables criminals to do to everyone else. A verified name, force assignment, and work email for a real officer is everything you need to impersonate police when contacting witnesses, victims, solicitors, or other agencies. For organized crime groups specifically, this directory is a counter-intelligence tool. You can cross-reference names and force assignments against your own operations to map who might be investigating you. And then there’s the 21,000 members of the public from Ask the Police, people who already have a relationship with law enforcement and are primed to trust communications that appear to come from police email addresses.

“This is the same group and the same access method that hit the Department for Education the week before, exposing 607,000 records. Researchers have found Dataverse-consistent structures across 11 of ExfilSquad’s 15 claimed victims, so this is clearly a systemic configuration problem across UK public sector Power Pages deployments. If your organization runs Power Pages, open an incognito browser window and query your /_api/ and /_odata endpoints right now. See what comes back without credentials. Microsoft provides a tenant-level governance control that blocks unauthenticated Dataverse reads while still allowing public form submissions. That control should have been validated before deployment, not discovered after 135,000 law enforcement contacts land on the dark web.”

Jeremiah Fowler, Researcher for Black Hills Information Security, Inc. Has This Comment:

“Threat actors often use basic contact information as the starting point for phishing campaigns, social engineering attacks, and credential theft. Law enforcement personnel face unique risks because of the nature of their work and data they may have access to. Even if the exposed information is only of contact details, these can be combined with publicly available information or previously breached datasets to build detailed profiles of officers, investigators, or even government personnel. In 2023 I discovered 500k records that were exposed that contained records associated with vehicle seizures conducted by Ireland’s national police, I have seen firsthand how law enforcement data can become publicly accessible and the risks that come with it. Once data is exposed, you can’t put the genie back in the bottle. 

Law enforcement data exposures by cybercriminals is highly concerning and more steps must be taken to protect the identities and contact information of officers, investigators, and support personnel. Even when these incidents expose limited information, multiple breaches over time can provide threat actors or even nation states with enough intelligence to identify organizational structures, identify specialized units, and target individuals based on their roles or launch a more sophisticated cyberattack. The most concerning part to me is that in the age of AI where criminals have access to advanced technology, we do not know how data exposed today will be used tomorrow.”

Thoughts and prayers to anyone affected. But given that we’re in the six digits here in terms of those affected, thoughts and prayers may not be enough.