Category: Blogs & Videos

Cyber-attacks aren’t a dramatic, once‑in‑a‑lifetime set of events, these days they are part of routine operations and they hit organisations of every size. In 2025 we saw this play out clearly when Jaguar Land Rover, Co‑Op and Marks & Spencer (M&S) all found themselves dealing with serious incidents. It was a blunt reminder that no brand is too established or too well resourced to avoid being caught out.

When something like this happens, the technical response is only half the story. The other half, and often the part that decides whether customers stay calm or start losing trust, is how the company communicates. Clear and honest updates can stop a difficult situation from turning into a reputational mess.

That’s what crisis communications is about: being upfront, cutting through confusion and helping people understand what’s going on without adding to the panic.

In 2025, M&S showed what it looks like when a company takes that responsibility seriously. In this article we review what M&S did well, lessons other organisations can learn from M&S’s response to their cyber-attack, and provide practical, actionable steps for businesses who want to make sure they have the right incident response and communication plans in place should they be attacked.

A Quick Introduction to Crisis Communications

So let’s get started. First of all, what is Crisis Communications and why are they so important in an incident response process?

Crisis communications are the structured approach organisations use to communicate during unexpected, high‑pressure events, anything from a data breach to a product recall to a global pandemic. The goal is simple: protect people, protect trust, and protect the business.

Why does it matter so much today?

• Cyber-attacks are increasing in scale and impact. 2025 was more evidence of the notoriety of cyber risk increasing, with attacks deeply affecting economic stability and business continuity.
• Customers expect transparency. Silence or vague statements erode trust faster than the breach itself.
• Regulators are watching. Poor communication can lead to reputational damage and regulatory scrutiny.
• Social media accelerates everything. Misinformation spreads instantly if organisations don’t fill the information vacuum.

Done well, crisis communications can turn a chaotic situation into a moment of leadership. Done poorly, it can turn a technical incident into a reputational disaster.

What Happened: The 2025 Marks & Spencer Cyber Attack

In April 2025, Marks & Spencer disclosed a major cyber-attack that severely disrupted its operations. The incident was identified as a ransomware breach which forced the retailer to shut down automated ordering and stock systems, leading to empty shelves and significant operational strain.

The impact was substantial:

• Online sales were brought to a standstill
• Food shelves were left bare
• The financial hit was enormous
• Disruption lasted for months

Despite the severity of the incident, M&S managed to maintain customer trust and protect its brand reputation. And that wasn’t luck, it was through communication.

How M&S Communicated During the Crisis

While the technical details of the attack were complex, M&S’s communication strategy was refreshingly simple: be honest, be visible, and be human.

They Communicated Early and Openly

M&S didn’t wait for rumours to spread or for customers to notice empty shelves. They disclosed the attack promptly, explaining the nature of the disruption and its expected duration.

This early transparency helped:

• Set expectations
• Reduce speculation
• Demonstrate accountability
• Build trust during uncertainty

In a world where many organisations still try to “keep things quiet,” M&S chose clarity over concealment.

They Provided Regular, Timely Updates

Throughout the incident, M&S issued ongoing updates to investors, customers, and the media. Timely updates prevented:

• Confusion
• Misinformation
• Customer frustration

And importantly, they showed that M&S was in control, even if at times the situation itself wasn’t.

They Used Clear, Accessible Language

M&S avoided technical jargon and focused on what customers needed to know:

• What happened
• How it affected them
• What the company was doing about it
• When things would return to normal

This is especially important in cyber incidents, where overly technical explanations can alienate or confuse audiences.

They Demonstrated Leadership Visibility

M&S’s CEO played a prominent role in communications, offering reassurance and outlining recovery plans. His public statements emphasised both transparency and determination, including the company’s intention to use the disruption as an opportunity to accelerate technology transformation

Leadership visibility signals:

• Accountability
• Confidence
• Stability

And it reassures customers that the organisation is taking the incident seriously.

They Maintained a Customer‑Centric Tone

Even while dealing with operational chaos, M&S kept the focus on customer experience. Their messaging acknowledged the inconvenience, explained the impact on stock and online services, and reassured customers that restoring normal service was the top priority.

This empathetic tone helped mitigate the psychological impact of the attack, particularly the anxiety customers feel when their favourite retailer experiences a breach.

Lessons Other Businesses Can Learn from M&S

The M&S incident offers valuable lessons for organisations of all sizes, not just retail giants.

Here are the key takeaways.

Transparency Builds Trust -Customers don’t expect perfection, but they do expect honesty. Being upfront about what happened and what you’re doing to fix it is always better than silence.

• Speed Matters –The first 24–48 hours of a cyber incident are critical. Quick communication prevents rumours and demonstrates control.
• Consistency Is Key – Regular updates – even if the update is “we’re still working on it” keep stakeholders reassured.
• Leadership Should Be Visible – A calm, confident leader can steady the ship and reinforce trust.
• Empathy Goes a Long Way – Cyber-attacks are stressful for customers too. Acknowledging their concerns helps maintain loyalty.
• Preparation Makes Everything Easier – M&S’s ability to communicate effectively didn’t happen by accident. It happened because they had plans, processes, and trained people.

Cyber‑Focused Advice for Businesses Preparing for Attacks

If the Marks & Spencer incident taught us anything, it’s that crisis communications doesn’t exist in a vacuum. It’s tightly woven into cyber readiness, technical resilience, and the ability to make decisions quickly under pressure. Here’s how organisations can strengthen their cyber posture and their communication capability at the same time.

Build a Real‑World Incident Response Plan

Not a theoretical document. Not a dusty PDF. A plan people can actually use at 2am when the ransomware alarm goes off.

It should include:

• Clear roles and responsibilities
• Playbooks for the most likely attack types
• A rapid approval process for communications
• A single source of truth for updates

A good plan removes panic and replaces it with muscle memory.

Know Your Crown Jewels

You can’t protect everything equally. Identify:

• Your most critical systems
• Your most sensitive data
• Your highest‑risk suppliers

This helps you prioritise both your technical response and your communications when something goes wrong.

Train Your People (Not Just IT)

Cyber incidents are cross‑functional events. Everyone needs to know:

• How to report suspicious activity
• What to say, and what not to say
• How to route media or customer enquiries
• How to avoid spreading unverified information

For example, Tabletop exercises are a great way to expose gaps and build confidence. At Cyberfort we recommend Incident Response plans are tested on annual basis as a minimum. The crisis simulation exercises undertaken should provide common attack scenarios tailored to your organisations specific sector so you can see where the communication, process and response gaps are in real time before an incident happens.

Prepare Customer‑Friendly Messaging in Advance

When an incident hits, you won’t have time to wordsmith. Pre‑prepare:

• Holding statements
• FAQs
• Internal updates
• Regulator‑ready notifications

Keep them simple, human, and jargon‑free.

Establish a Crisis Communications “Battle Rhythm”

Decide in advance:

• How often you’ll issue updates
• Who approves messaging
• Which channels you’ll use
• How you’ll coordinate with technical teams

This rhythm keeps everyone aligned and prevents misinformation from filling the silence.

Strengthen Your Technical Foundations

Good crisis communications are easier when your cyber basics are solid. Prioritise:

• Access Controls
• Regular patching
• Network segmentation
• Tested offline backups
• Endpoint detection and response
• Supplier risk assessments
• Regular security reviews by a specialist MSSP

These controls reduce the blast radius, and the communication chaos.

Build a Culture of Early Reporting

The sooner you know something’s wrong; the sooner you can contain it. Encourage:

• Zero‑blame reporting
• Quick escalation
• Transparency across teams

Culture is one of the most underrated cyber controls.

Final Thoughts – Communicating Through Chaos

Cyber-attacks are stressful, disruptive, and often expensive. But they don’t have to destroy trust. Marks & Spencer’s 2025 cyber incident showed that even in the face of major operational and financial disruption, strong crisis communications can protect a brand’s reputation and maintain customer loyalty.

By being transparent, timely, empathetic, and consistent, M&S turned a difficult situation into an opportunity to demonstrate leadership and resilience.

And the good news? Any business, large or small, can do the same with a bit of preparation.

Crisis communications aren’t about perfection. It’s about being human, being honest, and being ready.

As the saying goes ‘fail to prepare, prepare to fail’. At Cyberfort we believe ‘now’ is the time for organisations to start making sure they have the right tested incident response plans and crisis communications strategies in place. In today’s threat landscape it’s no longer ‘if’ you will get attacked it’s ‘when’. Those organisations who dedicate the right amount of time and effort to be prepared against cyber-attacks will find themselves with the ability to be more resilient and bounce back with minimal reputational damage.

For more information about Cyberfort Incident Response and Cyber Security Consultancy services contact us at [email protected] and one of our experts will be in touch.

Introduction

Secure by Design (SbD) was launched in July 2023 and its already transforming the way government departments and the MOD are implementing security. Perhaps one of the biggest changes to UK Cyber Security processes in the last 15 years, Secure by Design aims to ensure all of your systems, processes and data are secure from concept to its launch and then throughout its full lifecycle.

Before we delve deeper into the blog, it’s important to note that MOD Secure by Design and Governmental Secure by design are different. Despite having the same name, the same premise and the same objectives, their execution, delivery and assurance processes are different. They have different principles, different timelines and different maturity levels, with at present MOD Secure by Design being almost fully introduced into MOD programmes and projects. UK Government Secure by design is following suit and is ready to secure projects and systems with its 10 principles.  This article will be looking at the first and most transformative principle, Principle 1: Create responsibility for Cyber Risk.

For the first time, strategic leaders and leadership throughout projects/programmes will be empowered to be responsible and accountable for Cyber Security risk.  Some of these positions will have never encountered Cyber Security before. But by spreading the risk ownership and the understanding across the business/program/project, these projects/programmes will be able to deliver far more secure products and processes, with a far greater security lifespan.

Addressing the elephant in the room – businesses have never been the biggest lovers of major change. To understand these large scale governmental Secure by Design changes it’s important to know why these changes are being implemented, and to understand the benefits of Secure by Design.

Unlocking the Benefits of Secure by Design Principle 1 – Create responsibility for Cyber Risk

A key benefit of Secure by Design is how it affects leadership. Leaders at every level are decision makers and greater understanding of Cyber Security and its risks will ensure that leaders make better decisions.  By implementing Secure by Design principles leaders are able to make informed decisions, and better decisions will be made when leaders understand cyber risks. This empowerment towards leadership is not just at the executive level, it cascades down, resulting in leaders at all levels having an understanding of cyber risk and ensuring it is understood and mitigated. This creates a much more comprehensive risk understanding and security controls that are better informed, and therefore far more fitting.

Too often there is a disconnect between executive leadership and the technical teams responsible for securing systems. This gap can result in poorly informed decision-making, lack of investment, and incorrect prioritisation of risk mitigation. By clearly assigning cyber security responsibilities to stakeholders, such as CEOs, COO’s as well as Chief Risk Officers and Board Members, organisations ensure that cyber risk is treated alongside financial, legal, and operational risks.

Another major benefit of Secure by Design is that it aims to stop Cyber Security work being siloed, or existing in isolation. Cyber Security attackers will normally attack a wide surface, not just the security function, and so security needs to be in the forefront of everyone’s minds. By empowering security to staff throughout the business, rather than just the security team it not only spreads awareness but deepens the security scrutiny and allows security to be looked at from subject matter experts, potentially highlighting weaknesses that a cyber security team member would not be able to see.

A case study of where specific expertise has been siloed can be seen within NASA in the 1970’s, specifically during the challenger builds. Engineering teams identified that the ‘O rings’, a component of the lower rockets could fail, which could in turn lead to the entire failure of the launch. This severe risk was not fully understood by senior stakeholders’, and their findings were siloed within the rocket engineering team, unable to get their extreme risk findings correctly communicated or mitigated. This tragically led to the destruction of Challenger on launch and the loss of her entire crew.

By having all teams empowered to not just understand security risks but have influence over them gives the opportunity for projects and programmes to be more secure. Most organisations already do this for safety, and so security will now be no different.

The key challenges organisations must overcome

Of course, as with any organisational change there are challenges. The largest challenge so far observed in the Secure by Design rollout is leaders who are newly empowered to be responsible or accountable for cyber security being unwilling or unable to fully immerse themselves into the new role.

Many leaders face busy days, heavy workloads and hold a lot of responsibility already. With the changes being made some are being informed that they must take on more responsibility in an area they may be unfamiliar with. They may not welcome the changes and therefore will not commit to them as intended. A potential sign of this may be them trying to delegate this responsibility to another team member or someone within their team, pushing work deadlines back indefinitely or openly stating that they are going to refuse to partake. This unfortunately will mean that the delegation of security accountability at all levels will not be being implemented correctly, and that person is not only creating risk but a risk themselves.

The best way to remedy this so far has been to educate these leaders in the importance of the security work and the new responsibility they hold, and to ensure that their workload is balanced well enough that they can correctly adapt to the changes.

Final Thoughts

The first principle of Secure by Design sets the tone for the entire framework: security begins with leadership. When executives take ownership of cyber risk, they signal its importance throughout the organisation. They unlock the necessary resources, drive cultural change, and support the technical teams in making security a core part of every decision, and creating programmes, systems and projects that are secure, by their design.

As cyber threats continue to evolve in scale and sophistication, especially with AI and quantum threats on the horizon, creating clear responsibility for cyber security risk is not just good practice, it’s now an essential pillar of resilience.

How Cyberfort can help?

At Cyberfort we specialise in helping organisations understand their comprehensive cyber risk landscape and put the best governance in place. We ensure cyber security and resilience is built into systems, processes and policies from the start of a product or service lifecycle. This enables organisations to align security with business objectives, existing systems, and industry regulations consistently.

Our teams are experienced in aligning business strategy with Secure by Design principles, starting with clear responsibility at the top. If you’re ready to take a proactive approach to cyber resilience, contact us at [email protected] or visit our website here.

Secure by Design sets a framework of Principles for the delivery of digital capability with cyber security and risk management at the core. This blog article explores how continual assurance measures: Vulnerability Management and Security Controls Testing ensure that delivery Principles including Principle 5: Build in Detect and Respond Security and Principle 7: Minimise the Attack Surface continue to be effective through-life by implementing Principle 9: Embed Continuous Assurance.

Vulnerability Management is a critical component of ongoing security assurance, providing risk owners with continuous evidence that the system’s security controls and capabilities are functioning as intended. This assurance spans the full lifecycle of a system from development to deployment and into ongoing operation.

Security Controls Testing verifies that security controls and capabilities continue to function as intended, especially after deployment and during system operation. Combined, they support the application of Secure by Design, building a resilient security posture.

Key Benefits of Vulnerability Management and Controls Testing

Secure by Design principles embedded into the development process, ensures that activities and controls such as threat modelling, secure coding, continuous testing, access controls, encryption and monitoring have validation mechanisms in place. In the next section of this article, we explore what the key principles are for vulnerability management and controls testing, highlighting the key benefits organisations can realise by adopting a Secure by Design approach.

Risk Mitigation and Management
Principle 5; emphasises proactively embedding detection and response mechanisms into systems and services during design and development, and not as an afterthought. This foundation allows vulnerability management to be more proactive, focusing on preventing vulnerabilities rather than just reacting to them. These Secure by Design controls serve as baselines, enabling automated detection of deviations or misconfigurations.

Ongoing vulnerability management supported by controls testing ensures that risk mitigation continues to be effective. Vulnerability identification, assessment and remediation provides risk owners the evidence that continuous monitoring validates that controls remain effective against evolving threats.

By documenting vulnerability trends, patch cycles, and remediation effectiveness, organisations can demonstrate compliance with internal security standards and regulatory requirements.

Security Controls Testing confirms that identified security controls remain effective in mitigating risks over time. This provides evidence that risk management remains effective, giving confidence that security posture across the system’s lifecycle remains.

Sustaining an excellent security posture after deployment is crucial, as systems can become vulnerable due to configuration drift, outdated software, or new threat vectors. Continuous validation through testing identifies where changes may have occurred and provides opportunity to resolve them, realising several benefits:

• Security measures continue to deliver protection as intended.
• Controls are not bypassed or degraded over time.
• The service continues to mitigate known and emerging risks.

Verifying operational effectiveness of controls post-deployment, ensure that updates, patches, or changes have not compromised system security and that security policies are applied and enforced. This helps to identify deviations from approved baselines or misconfigurations and prevents drift from security standards that can introduce new vulnerabilities.

Tracking Progress and Maturity
Ongoing vulnerability management and through-life controls testing helps track how effectively the implementation of Secure by Design principles are across the organisation including:

• Trends, gaps, and analysis of recurring issues can help to refine the secure development lifecycle and ensure continuous improvement.
• Metrics from vulnerability management such as time to patch, frequency of critical vulnerabilities, or compliance with baseline configurations support strategic objectives.
• Track maturity in Secure by Design adoption.
• Identify gaps in implementation or effectiveness.
• Adapt and improve processes to close those gaps, aligning with continuous improvement.

Reinforcing Secure by Design Through-Life
Vulnerability management is central to the success of other Principles, supporting the measures adopted by validating that they remain effective or providing opportunity for improvement. It covers the ‘Detect’ part of ’Detect and Respond Security.’  and involves continuously:

• Identifying known weaknesses (e.g., unpatched software, misconfigurations).
• Assessing the risk and severity of those vulnerabilities.
• Prioritising and remediating based on impact.
• Monitoring for signs of exploitation.
• Testing to confirm resolution of vulnerabilities and that they do not reappear.

Integrating Vulnerability Management with other through-life assurance and operational measures ensures a more robust security management programme. These include:

• Controls Testing: Regular testing validates that security controls (like patch management, access controls, logging) are effective in mitigating vulnerabilities and risks.
• Logging, Monitoring & Alerting: Vulnerability scanners, SIEM tools, and endpoint detection systems provide real-time visibility into potential threats exploiting known weaknesses.
• Incident Detection & Response: When a vulnerability is exploited, fast detection and coordinated response limit damage and prevent recurrence.
• Continuous Iteration: Threat landscapes evolve, so vulnerability management must be a continuous process, not a one-time event.

Having minimised the attack surface (Principle 7) during the design and build of the capability, Vulnerability Management and Controls Testing helps to identify new attack vectors and validate that the capability can remain resistant.

Continuously scanning for and identifying known security weaknesses across systems, applications, and networks – detects vulnerabilities early.
• Unnecessary or outdated services/components can be disabled or removed.
• Exposed ports, APIs, or services can be secured. This reduces the number of potential entry points, shrinking the attack surface.

Vulnerabilities are prioritised based on severity, exploitability, and asset criticality:
• Issues are prioritised, preventing adversaries from targeting easily exploitable paths.
• Unused or low-utility components that present elevated risk can be removed or replaced.

Vulnerability management often uncovers over-privileged accounts or services, or components running with unnecessary permissions.
• Controls Testing identifies if gaps exist and then by remediating these findings, organisations can enforce the principle of Least Privilege and Minimised Functionality.
• These improvements ensure that only essential capabilities are exposed.

Vulnerability data informs threat models.
• Helps understand real-world attack vectors and the likelihood of compromise.
• Supports asset and risk management in focusing mitigation efforts where they matter most.

Ongoing vulnerability assessments ensure newly introduced components do not expand the attack surface unnecessarily. Supported by Controls testing, this validates that updates, patches, and configuration changes have not inadvertently reintroduced risk.

Vulnerability management is not just a technical function it is a continuous, evidence-based assurance process. When integrated within Secure by Design practices, it provides risk owners with confidence that security measures are both present and effective, supports the detection and resolution of implementation gaps, and helps ensure that systems remain resilient throughout their operational life.

Understanding the key challenges

Vulnerability management plays a crucial role in upholding Principle 5 and Principle 7, which emphasises the need for integrated capabilities to detect, respond to, and recover from security incidents. Principle 7 advocates reducing the number of exploitable points in a system, but in practice, achieving this while managing vulnerabilities is complex. Consequently, aligning vulnerability management practices with this principle comes with several challenges:

Visibility Gaps & Poorly Defined Ownership and Responsibilities:

• Challenge: Incomplete asset inventories, and unmonitored/unscanned systems make it hard to detect vulnerabilities across the full attack surface. The lack of clarity over who owns which assets or components with users/developers unknowingly increase the attack surface.
• Impact: Undetected vulnerabilities in these “blind spots” if exploited, hinder both detection and timely response. This leads to gaps in vulnerability remediation, attack surface monitoring, misconfigurations, unsafe code practices, and ignored security guidance.

Integrating DR Tools with Complex and Dynamic IT Environments:

• Challenge: Modern infrastructures (cloud, containers, microservices) changing rapidly and the lack of integration between vulnerability scanners and SIEM (Security Information and Event Management) and/or EDR (Endpoint Detection & Response) platforms.
• Impact: The constant changes make it hard to maintain an up-to-date view of the attack surface and it also limits the ability to correlate vulnerabilities with active threats or incidents, reducing effectiveness in prioritising or automating responses

Prioritisation of Risks & Patch Management Delays:

• Challenge: Security teams may struggle to prioritise which vulnerabilities require immediate attention due to limited context (e.g., threat intelligence, exploitability, asset criticality). Once they have decided on a priority, patching can cause downtime or affect business operations, leading to delays.
• Impact: Prolongs vulnerability exposure, especially in high-risk systems. Time and resources may be wasted on low-risk issues, while critical threats remain unaddressed.

Outdated Vulnerability Data and Integrating Legacy & Complex System Updates:

• Challenge: Modification, update or decommissioning of older systems often results in significant cost or disruption. Careful consideration must be taken when updating components (e.g., third-party libraries, firmware, OS) as these can break existing functionality or introduce new vulnerabilities. And relying on outdated vulnerability databases or incomplete scanning (e.g., failing to detect zero-days or misconfigurations) does not help. Legacy systems may not have been developed with SbD principles in mind and can have undocumented vulnerabilities.
• Impact: These systems increase the attack surface and may have un-patchable vulnerabilities. They can introduce weaknesses or incompatibilities in otherwise secure environments. This weakens the ability to proactively detect or prepare for exploitation attempts. It also becomes difficult to ensure that security controls still function post-update.

Organisational Silos:

• Challenge: Vulnerability management is often handled by separate teams from incident response or threat detection.
• Impact: Creates communication gaps, slows coordinated response, and leads to disjointed security workflows.

How a specialist Cyber Security Provider can help organisations to address these challenges

To help organisations overcome these challenges organisations who do not have the in-house skills, expertise or knowledge should engage with a specialist cyber security services provider. A reputable cyber security services provider should have a track record of and be able to deliver holistic and managed cyber security services which keeps people, data, systems, and technology infrastructure secure, resilient, and compliant. For example, at Cyberfort  we provide National Cyber Security Centre assured Consultancy services that leverage our technology, hosting, and Security Operations capabilities to Identify and protect against cyber-attacks, detect and respond to security incidents.

Our Managed services provide vulnerability management that integrates with threat detection capabilities, connecting scanners with SIEM and/or EDR platforms for better context and automation.

• We use Risk-Based Prioritisation, leveraging common risk and severity scoring methods such as CVSS, asset values, exploit availability, and threat intelligence to prioritise vulnerabilities.
• We implement continuous monitoring as a shift from periodic scanning to continuous assessment and detection.
• We break down silos and encourage cross-team collaboration between vulnerability management, SOC, and IT operations.

Additionally, we reinforce the continuous monitoring regimes through proactive and reactive controls testing. Reactively done in response to risk or incident resolution, providing assurance that controls are in place and effective. Proactively testing controls baselines can be crucial for either identifying controls weaknesses which lead to risks or mitigating issues before they become risks in the future by validating controls are effective. Whilst vulnerability management tends to focus on the technology landscape, controls testing can consider validation of the people, process, and procedural controls.

Reactive testing from external audits has included the review of Joiners, Movers, Leavers (JML) processes, to identify issues within the Leavers part of the current JML process that is in place that were resulting in unrevoked accounts.

Proactive controls testing conducted as a gap analysis against expected policy implementations to ensure that conformance by the business and those supporting the business in functions. An example of this validated that contractors with permission to craft and modify code held the correct vetting status, as per the businesses vetting policy set in place by the CISO.

Final Thoughts

Vulnerability management in the context of security assurance across the system lifecycle is challenging because it demands continuous effort, adaptation, and validation. It can however be effective in minimising the attack surface when integrated with asset discovery, risk analysis, and threat modelling. Organisations can increase the security return on investment and comply with the security principle of “necessary and sufficient” using only what’s required to deliver a secure, functional service.

Security Controls Testing within the ‘Secure by Design’ lifecycle ensures that security controls operate effectively throughout the system lifecycle, not just at deployment of a system going live. When integrated correctly into a Secure by Design security programme, it delivers continuous assurance to risk owners by validating the ongoing mitigation of risks, enabling timely detection of failures, and reinforcing organisational security posture, while also proactively identifying and closing gaps before risks arise.

While Secure by Design embeds security into every stage of the system lifecycle, ensuring that it continues to perform as intended, requires more than simply good initial design. These through-life concepts and Principles, delivered effectively can allow organisations to respond to the changing threat landscape, minimising the impact of systems becoming vulnerable, but this requires effective threat intelligence and resources to maintain the services.

For more information about Cyberfort Secure by Design consultancy services and how we can help your organisation to become secure, resilient and compliant contact us at [email protected].