Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Same logs, two places, overlapping outcomes. It's time to rethink the SIEM vs. XDR question. In my last blog, I asked where XDR fits into the SIEM-less conversation. To answer that, start with the endpoint. If every threat could be stopped there, there would be less need for detection and response products such as endpoint detection and response (EDR). But attackers got better at evading even the most robust endpoint security, for example by abusing dual-use tools in living-off-the-land (LOTL) attacks.

This year’s State of Ransomware survey showed financial services and insurance providers handing over less money to attackers than it did a year ago. Median ransom demands fell by two-thirds and median payments continued a three-year slide. The recovery story was less positive. The sector took a week longer to recover than last year, and its typical recovery bill is double the median across all sectors.

October was a busy month for AI and security, with the story that got the most attention being PHP2Shell. On 20th October the PHP security team announced an out-of-cycle release for two critical remote code execution flaws in the PHP interpreter (CVE-2026-109618 and CVE-2026-109619), affecting every version of PHP, from 5.4 through 8.5.

Threat intelligence is one of the few corners of UK cyber security where demand for experienced people is holding firm. Below are 10 threat intelligence and cyber intelligence roles open in the UK right now, along with the latest numbers on where the market is heading.

Keeper Security, the leading zero-trust and zero-knowledge identity security platform, today announces Self-Managed Keeper, a new self-hosted deployment option that brings Keeper’s core Privileged Access Management (PAM) capabilities to environments where external cloud connectivity is restricted, unavailable or prohibited.

AI Agents now act on the web for millions of people. To a Site, an Agent can take many forms. It may be indistinguishable from a human user carrying out a task, or it might look like one visitor carrying many Users. This removes the ability for the Site to recognize, serve, and hold accountable the user or users behind the Agent, and causes the Site to face the costs when something goes wrong.

Mend.io now has verified defender access at both Anthropic’s Cyber Verification Program and OpenAI Daybreak Blue. Here is what that changes for our security research.

October’s central risk was speed. Attackers exploited systems before the fixes existed, and AI agents ran intrusions in hours, not weeks. Below is the month in visuals. Every figure comes from Foresiet’s Global Threat Intelligence Report: October 2026, which separates confirmed facts from criminal claims.

For Charity Fraud Awareness Week (2-6 November), The Cyber Helpline teamed up with the Fraud Advisory Panel to create a practical helpsheet on protecting your devices and accounts. Whatever devices you use and however you connect, there are simple steps you can take to protect your accounts and devices and stay safe online.