One works in construction, the other finance – would they see eye to eye on Britain’s security, the royals and net zero?
Carey, 66, London
Occupation Logistics manager on a construction site
Continue reading...
© Photograph: Christian Sinibaldi/The Guardian
© Photograph: Christian Sinibaldi/The Guardian
© Photograph: Christian Sinibaldi/The Guardian
An English teacher and a personal trainer disagreed on emissions targets, but how did they fare on public spending and defence?
• Want to meet someone from across the divide? Click here to find out how
Edward, 38, Bristol
Occupation English teacher at a secondary school
Continue reading...
© Photograph: David Levene/The Guardian
© Photograph: David Levene/The Guardian
© Photograph: David Levene/The Guardian
From commanding the catwalks to acting as plus-ones for their famous parents, celebrity kids are bang on trend
Knee-length skirts and bras worn as tops were two of the main takeaways from fashion month, which wrapped up this week. But the biggest trend had nothing to do with clothing. From New York and London to Milan and Paris, the shows were the ultimate proof of a nepo baby takeover.
John Travolta’s daughter, Ella Bleu, 26, made her Paris catwalk debut at Miu Miu. Apple Martin, 22, the daughter of Chris Martin and Gwyneth Paltrow, walked the Chloé show.
Continue reading...
© Photograph: Kristy Sparow/Getty Images
© Photograph: Kristy Sparow/Getty Images
© Photograph: Kristy Sparow/Getty Images
Sales at one UK retailer are up 200%, thanks in part to young people rejecting the informal look adopted by their middle-aged bosses
Name: Ties.
Age: Originated in the early 17th century.
Continue reading...
© Photograph: Randy Faris/Getty Images
© Photograph: Randy Faris/Getty Images
© Photograph: Randy Faris/Getty Images
Benedict Jones spent years working for McAfee and Sophos. While doing threat research at Sophos, he spotted a problem in mobile threat defence that nobody had actually fixed. He’s now CEO and founder of Trustd Mobile, and the story of how he got there says more about MSP buying decisions than most vendor pitches ever […]
The post Innovation wins. Why smaller beats bigger appeared first on Heimdal Security Blog.
© Dongyan Xu
I’ve spent enough time around AI adoption now to notice a pattern. Ask a business how AI is going for them and the honest answer is, lately, “we’ve got Copilot, and it’s not great.” That gap between the hype and the reality is exactly where Samantha North operates. Sam runs an AI transformation agency, helping […]
The post AI adoption that pays off is built around keeping humans in the driver’s seat appeared first on Heimdal Security Blog.
It’s tempting for MSPs to write off event sponsorship in education as a waste of money. You sponsor an event, hand out flyers, follow up with an email, and hear nothing back. Rick Cowell says you’re judging it on the wrong timescale. Rick spent 20 years as a school network manager, and he founded the […]
The post The Planting Seeds philosophy. Selling into schools takes years, not quarters appeared first on Heimdal Security Blog.
© Vahid Salemi/Associated Press
Before dawn on 10 July 2024, one ransomware attack took down ten schools inside the same multi-academy trust at once. Every control that eventually stopped it was something the Department for Education’s own cyber security standard already asked for, well before the attack. That’s a case DfE has published on its own Cyber Security Hub, […]
The post What the DfE’s cyber security update means for multi-academy trusts appeared first on Heimdal Security Blog.
As enterprises race to bolt AI onto every business process, security leaders are being forced to answer a harder question than "should we adopt it" — it's "who's accountable when it goes wrong." To unpack this, The Cyber Express sat down with Harsha Reddy, Head of Information Security at Veterinary Emergency Group (VEG).
With nearly two decades in security leadership — including senior roles at Lixil and American Standard before joining VEG — Harsha brings a practitioner's view of where AI is genuinely changing the CISO's job, and where it's mostly just hype and shadow adoption.
Harsha pushes back on the narrative that AI will hollow out security teams, pointing to Gartner research showing that while most fields are projected to lose jobs to AI, cybersecurity is expected to gain them. In his view, the technology is mainly absorbing the "toil" — log review, alert triage, evidence gathering — that keeps analysts from actually defending.
“It's the analyst who refuses to use AI that will get replaced by an analyst who uses it,” he says.
On adoption, Reddy points to a 2024 Microsoft-LinkedIn survey in which most executives called AI critical to their business, yet a majority had no formal plan and most had employees already bringing in their own tools. That gap, he argues, is why so many organizations are now dealing with AI-related data leaks. "Many organizations started onboarding AI like software when they should be onboarding it like staff." His fix isn't more restrictions — blocking AI just pushes it into the shadows — but guardrails, an internal AI enablement committee, and measuring actual business value instead of token consumption.
The conversation also digs into deepfake-driven fraud, why training employees to spot deepfakes is “a losing bet” at machine speed, and how he decides when to greenlight a new AI tool versus telling a business unit “not yet.”
The conversation closes with our newly introduced rapid-fire round "Express Shots" — Claude vs. ChatGPT, passkeys vs. passwords, and Reddy's prediction for the biggest cybersecurity threat of 2030.
Most of the cyber incidents landing on our desks these days start with someone believing a lie. It’s not a brilliant piece of code that causes most breaches. A convincing email, a confident phone call, and a fake sense of urgency can make people hand over exactly what the attacker needs. Last week I talked […]
The post The risk awareness radar. A superpower every MSP needs to train appeared first on Heimdal Security Blog.
“Make everyone one percent better and it compounds across the team.” That’s the line Joe Head wrote about his own job and when I read it back to him, he didn’t hesitate. “That is 100% the objective,” he said. Joe runs AI adoption for an 80-person team as the only AI automation specialist in the […]
The post Tools Change. Teach People How to Keep Up appeared first on Heimdal Security Blog.
Strip away the geopolitics, the hacktivist noise, and the espionage headlines, and one number from the first half of 2026 stands out above everything else: 1,721. That's how many ransomware attacks hit organizations in the United States between January and June, according to new research from Cyble Research and Intelligence Labs (CRIL). It's not just the highest total of any country tracked in the report — it's more than the next nine most-targeted countries combined.
Canada, in second place worldwide, recorded 179 attacks. Germany logged 155. The United Kingdom, 138. Add up the rest of the global top 10 — France, Italy, Spain, Thailand, India and Brazil — and the total still falls more than 600 attacks short of the U.S. figure alone. Out of 3,836 ransomware attacks CRIL tracked worldwide this half, roughly 45% landed on American soil.
Widen the lens slightly and the picture holds. North America as a whole recorded 1,981 ransomware attacks in H1 2026 — more than half of every ransomware incident Cyble observed globally — alongside 35 data breach and leak incidents and 9 initial access sale listings. The report describes the region as home to "a mature, persistently active RaaS ecosystem operating at high volume across a wide range of industries and geographies."
Two ransomware-as-a-service operators did much of the damage. Qilin, the single most prolific gang worldwide, claimed 370 of those North American attacks on its own — nearly 19% of the regional total. Akira followed with 268, and INC Ransom added another 164. Together, Qilin and Akira alone accounted for more than half of all recorded ransomware activity across the region, a level of concentration that points to a small number of highly organized affiliate networks doing the bulk of the damage rather than a diffuse swarm of opportunists.
Professional Services bore the brunt of North American ransomware activity, with INC Ransom showing a marked preference for law firms and other high-value services with sensitive client data. Construction, Manufacturing and Healthcare followed close behind.
One operator, AiLock, stood out for a coordinated wave of victim disclosures that all landed on the same day — March 3 — a pattern consistent with a mass-exploitation campaign rather than isolated intrusions. LockBit, despite years of law enforcement pressure and takedown attempts, kept up a steady tempo against public-sector and educational targets throughout the period, showcasing how difficult the group has been to fully dismantle.
On the data breach side, Technology and financial services (BFSI) were the most frequently targeted sectors in North America, together accounting for roughly 43% of incidents — a reflection of how much intellectual property and monetizable personal data those industries hold.
Notably, Agriculture & Livestock emerged as a significant target for initial access brokers, accounting for a third of all access listings tied to the region. Cyble flags this as a sign of "growing risk in the food supply chain," an area that has historically drawn less attention from ransomware operators than finance or healthcare.
The initial access market itself was strikingly concentrated: two sellers, tracked under the handles "redpin" and "xpl0itrs," accounted for nearly all listings targeting North American organizations. Threat actors also continued to lean on known and zero-day vulnerabilities in widely deployed enterprise platforms — including products from Ivanti and Palo Alto Networks — as their preferred way into corporate networks.
North America wasn't spared the hacktivism wave sweeping the rest of the world either. Collectives including SOLDADOS DIGITALES – UNIÓN AMERICANA and LYSTIC TEAM #ID drove roughly 56 data leak or dump posts and touched about 360 unique domains across the region, with Government, Technology, financial services and telecommunications entities most frequently in the crosshairs.
Cyble's broader findings suggest many groups marketing themselves as ideologically driven hacktivists are, in practice, running side businesses in stolen data brokerage and DDoS-for-hire services — a blurring of motive that complicates how defenders triage the threat.
The scale of the U.S. numbers doesn't necessarily mean American companies have weaker defenses than their global peers — the concentration also reflects the sheer size and digital density of the U.S. economy, and its outsized share of the high-value targets ransomware affiliates chase. But the data does argue for a shift in posture.
Cyble's broader recommendations — treating data exfiltration, not just encryption, as the primary risk; prioritizing patches for the recurring vendor list; and monitoring initial access markets as a leading indicator rather than an afterthought — apply nowhere more urgently than in a country absorbing this much of the world's ransomware volume on its own.
Your client is no longer just buying your security advice. They’re auditing whether you live by it. That was a clear message from my exclusive interview with Heather MacDonald Alford, an MSP finance specialist and owner of Counting Creators. Heather’s exactly the kind of customer MSPs should be paying attention to. She’s informed, commercially minded, and willing to challenge vendors to […]
The post Cyber-Aware Customers Are Raising the Bar for MSPs and Other Vendors appeared first on Heimdal Security Blog.
MSPs spend too much time talking to other MSPs and not enough time talking to the people they’re supposed to serve. That’s Paul Croker’s view of some of the channel’s biggest growth problems. While most industry events bring technology professionals together, they rarely put them in the same room as the business leaders making […]
The post Breaking the MSP Echo Chamber: The Power of Community appeared first on Heimdal Security Blog.
Cybersecurity failures now happen beyond the OSI stack. Faulty governance, the human factor, and AI tools create new attack surfaces. After seven years working across cybersecurity, cloud infrastructure, and Zero Trust architecture, Jayal Yadav explains how we got here and what organizations still get wrong. “The original seven layers of the OSI model still matter. […]
The post The OSI Model and Its Two Missing Layers appeared first on Heimdal Security Blog.
Key findings US executives are more than four times as confident as their own practitioners that AI risk is under control, 29% to 7%. The UK gap runs the same direction, 18% to 11%. The board’s view and the team’s view aren’t the same view. ChatGPT sits in 7 in 10 IT estates and Microsoft […]
The post The State of AI Risk Management in 2026 appeared first on Heimdal Security Blog.
COPENHAGEN, DENMARK, 12 May 2026 — Heimdal’s managed SOC processes three million alerts a month. In the year ahead, fewer than 500 of those, less than 0.02%, are expected to need a human analyst. That’s the forecast from Heimdal founder Morten Kjaersgaard, based on the trajectory of AI Wingman SOC as it absorbs the bulk […]
The post AI Will Absorb 99.98% of SOC Triage Within a Year, as 79% of IT teams brace for AI-driven workload shift appeared first on Heimdal Security Blog.
Although Cyber Security is often seen as technical and maybe even dull, it has many similarities to our day-to-day life. In this blog I call out one of the most important – You Only Know What You’ve Got When Its Gone. Let me start by putting this statement into context in the current chapter of […]
The post You Only Know What You’ve Got When Its Gone appeared first on Heimdal Security Blog.
We’ve had four cases associated with OpenClaw in the last few weeks. This is what one MSP this told me. Not a researcher or a vendor trying to sell me a solution, but somebody that’s already dealing with the consequences, whilst most boards are still deciding whether to pay attention or not For those who […]
The post OpenClaw Incidents Show Why AI Adoption Pressure Puts Companies at Risk appeared first on Heimdal Security Blog.
Login