ISMS.online

As breaches become part of everyday business, how has the conversation evolved and what do recent incidents reveal about good — and poor — incident response? Even as little as five years ago, a company that suffered a breach would come under intense scrutiny, including months of review into how and why the attack had hit — especially if sensitive data was exposed.

All good things come to those who wait. At the time of writing, the Cyber Security and Resilience Bill (CSRB) was awaiting its committee stage in the Lords, at the beginning of September. The hope is that it will become law this year, after many delays. It promises to widen the group of in-scope organisations, strengthen incident response requirements, and introduce new baseline security expectations, among other things. But perhaps more interesting is what comes next.

The headlines from the 2026 edition of Cost of a Data Breach made for interesting reading, but does it actually demonstrate a better perspective of the state of resilience amongst cyber professionals? In the 21st edition of the Cost of a Data Breach Report, the global average cost of a data breach was $4.99 million, a significant increase from $4.44 million in 2025.

The White House isn’t losing any time preparing for the onslaught of zero-day vulnerabilities that frontier AI tools are expected to surface. On June 2nd, President Trump signed Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security. It’s an attempt to bring together AI vendors and critical national infrastructure (CNI) operators in a bug-busting partnership.

Multiple cyber-attacks against critical infrastructure highlight a need for resilience, operational risk and governance, rather than just technical security. Critical national infrastructure (CNI) is under attack in the US and UK. In late August, it emerged that a British power plant had been hit and shut down for four days after Iranian adversaries launched an unprecedented cyber-attack.

Skip to content Phishing for Trouble – The IO Podcast returns for Series 2 Phishing for Trouble – The IO Podcast returns for Series 2 Based on independent research with 251 senior UK cybersecurity professionals, this report explores how organisations assess certification credibility, compliance automation and regulatory readiness.

The Copilot SearchLeak vulnerability chain shows how any AI assistant can evolve from a productivity feature into a new path into data that inherits the user’s reach. What lessons can security and compliance leaders learn? In June, researchers at Varonis Threat Labs unveiled a critical vulnerability chain in Microsoft 365 Copilot Enterprise dubbed “SearchLeak”.

Last month, attackers used a stolen credential to hack competitive intelligence SaaS provider Klue. But the seeds of the attack apparently started four years earlier. Klue executives said that in 2022, the Vancouver-based company issued a credential to an unnamed third party for a limited pilot. An investigation by Crowdstrike later revealed the credential to be a GitHub Personal Access Token (PAT), which enables developers to access software development repositories.

From deepfake-enabled phishing to AI-driven malware, attackers are evolving faster than ever. At the same time, new regulations like the EU AI Act are redefining how organisations must manage and govern AI responsibly. Join experts from ISMS.online and TechForce Cyber for an insight-packed session exploring how to build true cyber resilience in the age of AI.

As the risk of being hit grows, how well an organisation governs its data determines the blast radius of an attack and how quickly care can continue. How can this be done? Ransomware attacks are continuing to hit the healthcare sector, with potentially devastating consequences that can go on for months after the incident. In February 2026, University of Mississippi Medical Center was forced to close all clinics after suffering a ransomware attack.