Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A public body has no revenue to lose, no share price to move and no insurance market pricing it the way one prices a manufacturer. It faces the same regulatory pressure to quantify cyber exposure as anyone else, and the standard model's central input does not exist. ‍ Substituting the loss categories is the easy half and it is where most guidance stops. The harder question is what the resulting figure is for, because the decisions a private company makes with it are mostly unavailable. ‍

For years, our security team has run pentests against business-critical applications across industries, and one pattern stands out. The vulnerabilities that are the most difficult to remediate are business logic vulnerabilities: IDOR, broken access control, privilege escalation, and multi-step workflow abuse. These are the kind of vulnerabilities pentest experts find by noticing a broken assumption behind one API call and chasing it until the full exploit path becomes clear.

Due diligence in a merger or acquisition is, by design, exhaustive. It brings a level of scrutiny that touches almost every part of a business. From financial audits and legal reviews to commercial assessments, buyers work hard to make sure nothing important gets missed. And yet there’s one area that continues to catch organisations off guard, even in the most professionally run due diligence processes: The cost of a data breach has never been higher. Digital estates have never been more complex.

NIS2 and GDPR cannot be merged into one legal obligation, but much of the compliance work behind them can be consolidated. Organisations can use one control framework, shared asset and risk information, common supplier assessments and a single incident record while maintaining separate legal registers and notification workflows. The key is to consolidate evidence and operational processes — not the obligations themselves.

The MSP landscape is evolving. Customers increasingly expect more than technology management, they want trusted partners who can help them understand, reduce, and manage cybersecurity risk. WatchGuard's upcoming “Provider to Advisor: The MSP Shift Toward Risk Leadership” webinar explores exactly this opportunity.

Security teams already know employees use generative AI. The harder problem is buying the right platform before unsanctioned apps move sensitive data outside your visibility and control. UpGuard research found 81% of employees and 88% of security leaders use unapproved AI tools, and 45% of workers find a workaround when their employer blocks an app. That last number should shape your buying criteria more than the first two. Demand doesn't disappear when you block it. It moves somewhere you can't see.

In January 2024, Craig Raw, the developer of the real Sparrow Wallet, a Bitcoin wallet app, warned that a fake version of his app was live on the Apple App Store. He reported it repeatedly, but the listing stayed up. By August 2025, three people had lost a combined $1.8 million to it: Jalen Delgado (about $120,000 in May 2025), James Ramirez (about $875,000 in July 2025), and Christopher Ellis (about $840,000 in August 2025). All three are now suing Apple. The complaint, Ramirez, et al. v.

Leaked credentials now reach public sources faster than any security team can review them by hand. GitGuardian Public Secrets Monitoring runs agents over every public incident and returns a comprehensive verdict.

Some of the most dangerous vulnerabilities in modern web apps are the default features left switched on where they were never meant to be reachable. The first entry in our Findings from the AP series looks at an exposed actuator endpoint. On paper, this finding started the same way most do: an HTTP endpoint returned a 200. Nothing about that response looks unusual by itself. It’s the kind of line that gets logged, categorized, and moved past in most automated scans.

CVE-2026-67281 is an unauthenticated file read vulnerability in WebFig, the web-based management interface in MikroTik RouterOS. A newly allocated session on the /jsproxy path retains a stale, uninitialized principal pointer that WebFig then uses for file authorization decisions. The vulnerability carries a CVSS v4.0 base score of 8.7 (High). A CVSS v3.1 base score has not been assigned in the CVE record at the time of writing.