Category: News, Awards and Industry Recognition

Featuring Glen Williams, Cyberfort CEO

---

The world’s cyber battlefield is evolving — and the defenders are still adjusting their footing

In the first quarter of 2025, Kenya’s national cyber-intelligence centre detected an unprecedented 2.5 billion threat events — a figure that dwarfs even the region’s previous highs and reflects a new era of cyber risk. This explosive surge, confirmed by the Communications Authority of Kenya, represents more than a 200 percent increase on the prior quarter, with system vulnerability scans and automated attack traffic leading the rise. Far from being an isolated case, Kenya’s experience is a lens through which to view a rapidly shifting global threat environment.

What distinguishes this moment is the role of artificial intelligence — not as a future risk, but as a present and multiplying force on both sides of the cyber-arms race. Automation, generative-AI tooling, and adaptive attack strategies have compressed the traditional gap between initial compromise and major incident from weeks to mere days, sometimes hours. In practice, this means that what once took criminal groups months to plan and execute can now be launched and scaled almost instantly, making national borders nearly irrelevant.

As Camden Woollven, Group Head of AI Product Marketing at GRC International Group, observes: “What’s happening in Kenya is happening everywhere. Attack volume has exploded, not because there are more hackers, but because AI has made it easy to scale. You don’t need a team anymore. You just need a decent prompt.”

These patterns are not unique to Kenya. From Singapore’s financial sector to critical infrastructure in São Paulo, security teams are reporting similar surges, with AI-driven attacks accelerating the pace, scale, and sophistication of threat activity worldwide. The stakes are rising not only for those on the digital front lines in Nairobi, but for every organisation operating in a globally connected, AI-enabled economy.

The new offence

The dramatic acceleration in attack speed has become one of the defining features of the AI era in cybersecurity. Globally, the “dwell time” — the window between an attacker’s initial access and the deployment of a major payload like ransomware — has fallen from an average of sixty days just a few years ago to less than four days in 2024, according to leading incident response studies. In some documented cases, attackers are able to move from entry to lateral movement across an organisation’s network in under an hour, compressing the window for detection and response to near real time.

“Generative AI has put cybercrime on steroids,” says Glen Williams, CEO of Cyberfort. “What used to take hours now takes minutes. Phishing emails are no longer riddled with spelling errors, they’re polished, persuasive, and chillingly not only accurate, but aligned to the recipient. Deepfakes aren’t science fiction anymore; they’re being used today to bypass voice verifications and deceive finance teams. We’re seeing AI-written malware that rewrites itself in real time to stay ahead of traditional defences. The barriers to entry for cybercrime have collapsed. The result? An arms race where attackers are sprinting – and too many defenders are still tying their laces.”

Central to this shift is the proliferation of generative AI tools and automated “playbooks” that can generate phishing campaigns, malware variants, and social engineering scripts on demand. Malicious actors are increasingly leveraging AI-powered platforms to craft deepfake lures — voice, video, and even interactive chatbots — which make traditional employee awareness and technical filters far less effective.

As Kevin Curran, IEEE senior member and professor of cybersecurity at Ulster University, explains: “The rise of generative AI has opened new vectors for cyberattacks, fraud and social engineering. Given the pace of AI development, attack methods have also evolved – making it a lot harder for traditional security measures to detect and mitigate threats. Polymorphic malware, for example, can now rewrite its own code to evade detection, slipping past conventional scanners unnoticed. In addition, AI’s ability to produce convincing text, code and even synthetic identities is streamlining phishing campaigns, automating malware creation and helping attackers scan networks for vulnerabilities.”

These synthetic identities are emblematic of the growing sophistication of fraud tactics being employed by malicious actors. “We’re now seeing synthetic identities that are entirely AI-generated – right down to fake biometric data – being used to pass onboarding and Know Your Customer (KYC) checks,” says Doriel Abrahams, principal technologist at Forter. “It’s not just about a stolen ID anymore; attackers are creating convincing digital personas from scratch. These aren’t one-off attempts either. They’re often part of coordinated fraud rings using generative AI to spin up large volumes of believable, seemingly legitimate users.”

Business email compromise (BEC) and targeted scams have also moved into a new league, blending deepfakes and automation at scale. Sergei Serdyuk, VP of Product Management at NAKIVO, highlights how the rise of “dark” LLMs is reshaping attacker tactics: “We’re seeing AI models like FraudGPT and WormGPT being actively used on the dark web to generate highly personalised, believable phishing emails, code for new malware, and instructions for exploiting vulnerabilities. These tools let attackers fine-tune their messaging and adapt in real time, making each scam more convincing than the last.”

And, as Jeff Sims, Senior Data Scientist at Infoblox, points out in a recent case, these capabilities are not just theoretical: “One of the most striking examples they’ve tracked involves a threat actor known as Reckless Rabbit. This group has been targeting Japanese-speaking users with fake investment schemes that incorporate AI-generated deepfake videos of public figures like Elon Musk and Masayoshi Son. These videos are embedded directly into fraudulent websites designed to mimic legitimate news outlets such as Yomiuri Shimbun. This campaign marks a shift from traditional text-based scams to immersive, multimedia deception. It’s a clear example of how generative AI is being weaponised to enhance the credibility and emotional impact of social engineering attacks.”

For businesses and institutions worldwide, the practical result is a daily environment where both the volume and effectiveness of digital attacks are rising — and traditional defences are no longer enough.

Read the article on Business Quarter here: https://businessquarter.substack.com/p/ais-global-cyber-arms-race?r=5lu7lt&triedRedirect=true

By Glen Williams, Cyberfort CEO

---

Just as the C-suite are familiarising themselves with this year’s cyber threats, it seems a bigger risk is looming on the cyber security agenda. A deeply concerning disconnect has emerged between cyber security board responsibilities and cybercrime reality that could lead to sub-standard cyber defences, successful data breaches, and worse.

Cyber threat levels remain high. In fact, the recent UK Government Cyber Security breaches 2025 report reveals that 43% of businesses and three in ten charities reported having experienced any kind of cyber security breach or attack in the last 12 months. With the stakes typically higher for SMEs with lower resources than their larger peers, the real question is: are CEOs and board directors truly aware of their cyber security responsibilities?

Cyberfort’s own customer research has highlighted that many UK businesses consider a Cyber Essentials Plus (CE+) certification sufficient to keep their organization secure and fulfil board requirements. In today’s dangerous cyber threatscape, where high-profile breaches have paralysed a business for several months, their views couldn’t be further from reality.

Beyond ignorance, it’s worth checking first if lagging in their responsibilities could be down to other underlying reasons.

Trending cybersecurity detachment at board level

The above Cyber Security Breaches Report also highlights that boards are reducing their specialist cyber security representation. Board level responsibility for cyber security at company director level has dropped 11% (from 38% to 27%) in the past four years. But with 72% of businesses responding to the survey stating that cyber security is a high priority, there is clearly a gap between board representation and cyber security reality.

From our customer interactions, we know there is often a disconnect between board level and the IT department in terms of cyber security responsibility understanding. This is likely the reason for the low average CISO tenure, estimated at 18–26 months according to the CISO Workforce and Headcount 2023 Report from Cybersecurity Ventures.

There is clear evidence of the need for information security representation at board level. Research by the World Economic Forum shows that organizations with strong executive involvement in cyber security are 400% more likely to repel or rapidly recover from attacks.

The CE+ certification’s limitations

One of the most glaring gaps in the belief that CE+ is enough to keep an organization secure is that it does not include a section on one of the most important tools for cyber survival: real-time threat detection and response. CE+ was never designed to protect organizations against advanced persistent threats (APTs), targeted attacks, or evolving techniques used by criminal groups.

While CE+ covers patch management, access control, malware protection, secure configuration, and boundary firewalls, it does not address critical areas such as:

Real-time threat detection and response

CE+ does not require the use of Security Operations Centres (SOC), Security Information and Event Management (SIEM) platforms, or Endpoint Detection and Response (EDR). These are the most effective ways to stop a breach in its tracks.

Phishing and social engineering resilience
According to the UK Information Commissioner’s Office (ICO), over 80% of successful cyber incidents begin with phishing, yet CE+ has no requirements around simulated phishing or awareness training beyond general advice. This is the only way of outsmarting social engineering attacks, where emails are highly personalised and appear to come from a known person.

Cloud and hybrid environment protection
CE+ still assumes a traditional network perimeter, ignoring many risks associated with modern SaaS, IaaS, and BYOD environments. The complexities of growing ecosystems are allowing vulnerabilities to grow.

Business continuity and incident response planning
Remarkably, there is no requirement under CE+ to prove you can recover from a ransomware attack or data breach. Planning for the worst is essential to fully understand potential risk.

Third-party and supply chain risk
As seen in the infamous SolarWinds breach, attackers often exploit vendors or contractors to access their targets. CE+ does not assess or govern these relationships, so it’s up to each business to connect with suppliers to discuss cyber defence policies and practices.

Costs and consequences of gaps in protection

If executive teams don’t go beyond CE+, they are taking serious risks. Relying solely on CE+ gives the entire business ecosystem a false sense of security, with huge consequences if a breach is successful.

Regulatory and legal exposure is a key consequence of a cyber breach, with hefty fines payable for non-compliance. The average ICO fine for a serious cyber incident in the UK was £153,722 in 2024, according to URM Consulting.

Secondly, the industry is calling for it. Insurers are tightening their requirements, with some major underwriters requiring evidence of 24/7 monitoring and incident response plans to maintain coverage. It’s also fast becoming a business requirement, with large clients demanding ISO 27001 or sector-specific certifications such as NHS DSPT or PCI-DSS to continue partnerships. Lacking parity with a prospect on cyber security diligence could be a deal-breaker.

The sheer scale of the risks of reputational and financial damage can’t be ignored. Businesses don’t always bounce back. In fact, Hiscox’s 2024 Cyber Readiness Report reveals that 47% of organizations struggled to attract new customers following a cyber attack.

The impact on business operations can be extensive, with far-reaching consequences. In 2024, the average ransomware incident led to 21–24 days of downtime and cost $2.73 million, according to NinjaOne.

Reasons for board directors to take action

Cyber risk is not something that directors can delegate accountability for, particularly when investors, customers, and regulators all expect board-level ownership of cyber resilience.

The c-suite must take action. As directors, they have legal duties under the Companies Act and UK GDPR. Ignorance is no longer a shield.

Threat actors are evolving faster than defences. The time to act is before a breach, not after. Cyber resilience is now a competitive differentiator, and clients, partners, and investors expect it.

The four key actions that business leaders must take

After understanding all this, there are four key actions directors must take to ensure their organizations start on the right path to becoming secure, resilient, and compliant:

1. Commission an independent cyber risk assessment that goes beyond Cyber Essentials Plus.
2. Invest in detection and response capabilities – whether in-house or outsourced
3. Adopt a recognised security framework such as the NCSC’s Cyber Assessment Framework, NIST CSF, or ISO 27001
4. Ensure board-level oversight of cyber risk through regular briefings, KPIs, and executive ownership.

CE+ onwards and upwards

Business leaders must embrace Cyber Essentials Plus as the beginning of a journey in cyber protection, not a goal. Wherever a business is in terms of cyber security maturity, there are always improvements to make. But by acting now, business directors can secure the business, protect stakeholder trust, safeguard customers and employees, and meet their obligations in an increasingly hostile threat landscape.

Read the article on Resilience Forward here: https://resilienceforward.com/cyber-essentials-plus-is-not-enough-uk-board-directors-must-take-action-for-holistic-cyber-protection/

By Glen Williams, Cyberfort CEO

---

With cybersecurity being a priority in every boardroom, SME business leaders are particularly pressurised, with lower budgets than their larger counterparts. Threat levels are high, with as many as 43% of businesses and three in ten charities experiencing some kind of cyber security breach or attack in the last 12 months.

Beyond resources, there could also be another key barrier to SMEs taking adequate cybersecurity action. It seems friction amongst leadership is creating a divide in business with lack of a CISO or cybersecurity representative at board level being common. This cavalier approach may leave companies wide open to successful breaches.

In fact, the UK Government Cyber Security breaches 2025 report reveals that board level responsibility for cyber security at company director level has decreased from 38% to 27% over the last four years. Despite almost three quarters (72%) of business respondents seeing cyber security as a ‘high priority’ it indicates a clear disconnect between the board responsibilities required and cyber security reality that puts the entire business at risk.

While security professionals are fluent in technical jargon or threat models, their business leader peers talk about bottom-line impact, and board-level implications. The effect on strategy is that critical security concerns may be downplayed, misunderstood or, at worst, ignored.  This means keeping up with the latest strategies to counter threats is essential.

The risk of cybersecurity complacency at board level

With more CISOs stepping away from the boardroom, and in an increasingly active and intelligent cyber threatscape featuring ransomware and highly targeted social engineering attacks, it’s likely that their board director peers aren’t qualified to step up to the ownership of cyber security responsibilities.

AI-driven threats are introducing new challenges for the development of overall corporate security policy. AI requires a different approach to cyber security than the traditional cyber security methods employed. Security policies will need to be reviewed and revised on a regular basis, to ensure the safe and responsible use of AI within an organisation to protect its biggest assets – data and people.

Added to this, Cyberfort’s own customer research has revealed a concerning complacency – that many businesses consider a Cyber Essentials Plus (CE+) certification sufficient to keep their organisation secure and fulfil board requirements. With high profile breaches continuing to dominate the media agenda, this is a high-risk strategy.

Limitations of CE+

The cybersecurity needs of today’s business have superseded the Government-backed certification scheme launched in 2014, Cyber Essentials Plus (CE+), which was recommended as the minimum standard of cyber security for organisations. Although CE+ covers basic areas which might previously have been sufficient to counter cyber risks – patch management, access control, malware protection, secure configuration, and boundary firewalls – it lacks information on real-time threat detection and response, which is an essential tool for the earliest threat detection.

CE+ wasn’t designed to protect organisations against advanced persistent threats (APTs), targeted attacks, or any evolving techniques by criminal groups, which are so prevalent today. According to the UK Information Commissioner’s Office (ICO), over 80% of successful cyber incidents begin with phishing, yet CE+ has no requirements around simulated phishing or awareness training beyond general advice.

Costs and consequences of gaps in protection

There are some serious risks for SMEs investing in and relying on CE+ alone. To start with, there are hefty fines payable for non-compliance, with the average ICO fine for a serious cyber incident in the UK being £153,722 in 2024.

Insurers are also upping their demands, with some underwriters insisting on evidence of 24/7 monitoring and incident response plans to stay covered. Business partnerships are also becoming dependent on a company’s cybersecurity posture, with rising expectations of ISO 27001 or sector- specific certifications such as NHS DSPT or PCI-DSS compliance.

With significant risks and responsibilities to protect a business’ data and people, it is essential to have information security representation at board level. Research by the World Economic Forum shows that those organisations that have strong executive involvement in cybersecurity are 400% more likely to repel or rapidly recover from an attack.

The consequences of a breach in terms of reputational and financial damage can’t be ignored. Hiscox’s 2024 Cyber Readiness Report reveals that almost half (47%) of organisations struggled to attract new customers following a successful cyber attack. The costs and recovery time can also be extensive. In 2024, the average ransomware incident led to 21-24 days of downtime and cost $2.73 million, according to NinjaOne.

Five ways to elevate cybersecurity protection

In taking the following cybersecurity measures, SMEs will have the best chance of being protected in the event of a cyber attack:

Real-time threat detection and response – The use of Security Operations Centres (SOC), Security Information Event Management (SIEM) platforms, and Endpoint Detection and Response (EDR) are the most effective ways to counter a cyber attack.

• Phishing and social engineering resilience – This is the only way of outsmarting social engineering attacks where emails are highly personalised and look like they are coming from a known person.
• Cloud and hybrid environment protection – CE+ still assumes a traditional network perimeter, ignoring many risks associated with modern SaaS, IaaS, and BYOD environments. The complexities of growing ecosystems are allowing vulnerabilities to grow.
• Business continuity and incident response planning – Almost unbelievably, there is no requirement under CE+ to prove you can recover from a ransomware attack or data breach. Inclident response planning is the only way to fully understand potential risk.
• Third-party and supply chain risk – Attackers often access their targets through exploiting third party vendors or contractors. As CE+ does not assess or govern these relationships, it’s up to each business to engage with their supply chain to fully understand risk levels.

Key steps that cyber security leaders must take

To ensure a cohesive and effective cybersecurity strategy that can counter today’s cyber threats and stay compliant, information security decision-makers must take four key actions:

1. Ensure board-level oversight of cyber risk through regular briefings, KPIs, and executive ownership
2. Commission an independent cyber risk assessment that goes beyond Cyber Essentials+
3. Invest in detection and response capabilities – whether in-house or outsourced
4. Adopt a recognised security framework such as the NCSC’s Cyber Assessment Framework, NIST Cyber Security Framework(CSF) 2.0, or ISO 27001

Ensuring strategies align to today’s cyber threats

With AI introducing a new complexity to cybersecurity threats, business leaders must keep up with the latest tactics, such as advanced detection capabilities, to identify threats as they arise. This means going beyond CE+ and adopting new tools and measures aligned to their risk levels.

While CE+ is a strong starting point for SMEs, it’s not enough. Business directors and cyber security teams must unite to elevate their security approach and defend what’s theirs in an increasingly hostile threat landscape.

Read the article on SME Today here: https://www.smetoday.co.uk/technology/why-its-essential-smes-boost-security-measures-beyond-cyber-essentials/

Featuring Glen Williams, Cyberfort CEO

---

Boards across the UK — and indeed the world — are under pressure to evolve for the digital age. But who’s leading the change?

There was a time when technology was treated as a support function — something for the CIO to handle, outside the boardroom and out of scope for most non-executives. That time has passed.

Digital transformation, cybersecurity, and artificial intelligence now sit squarely in the path of corporate strategy, and boards are being challenged to adapt. Investors, regulators, and risk committees are asking whether boards truly understand the technologies shaping their businesses — and whether they are capable of overseeing them responsibly.

Yet recent data paints a stark picture. Fewer than 15% of large UK companies identify a named board member or committee responsible for cyber oversight. Only 3% of new FTSE 350 non-executive director (NED) appointments in 2022 came from a cybersecurity background. And in a global Deloitte survey, just 14% of boards reported that AI appears on every meeting agenda.

For years, boards approached cyber risk as a technical or compliance issue — a matter for the IT function. That’s now shifting. “It is no longer just about reactively putting firewalls in place or ticking boxes for compliance,” said Glen Williams, CEO of Cyberfort. “The conversation has evolved to focus on proactive resilience — especially as AI has started to shape both the threat landscape and the potential solutions.”

This shift has revealed significant capability gaps. According to Spencer Stuart’s UK Board Index 2024, digital transformation experience is now one of the top three criteria in NED recruitment briefs — yet the talent pool remains limited. Heidrick & Struggles notes a growing demand for directors with operational tech expertise, rather than just plc credentials.

Williams is seeing that trend first-hand. “Boards want people who can challenge assumptions, ask the right questions of their executive teams, and provide insight when critical tech-related decisions are on the table,” he said. That includes directors with experience in cybersecurity, data governance, and cloud infrastructure — but also those with backgrounds in inclusive innovation and change leadership.

James Lei, COO at Sparrow, confirmed that boards are increasingly open to non-traditional candidates. “Non-executive director appointments increasingly prioritise candidates with strong backgrounds in technology, data science, and cyber governance,” he said. “Boards are becoming more open to recruiting beyond traditional public company executives, welcoming leaders from tech firms and startups who bring fresh perspectives and agility.”

Still, the pace of change has been uneven. “Some boards are fluid and adaptable,” said Ciaran Bollard, CEO of the Corporate Governance Institute. “Others are very prone to groupthink and traditionalism, and so will not actively seek to branch out into experience from tech or startups.”

Changing the game

One consequence of this shifting landscape is a redefinition of what it means to be “board ready.” Technical literacy, once a desirable add-on, is increasingly seen as a prerequisite. According to Odgers Berndtson, there has been a 60% rise in mandates for digital or cyber-risk NEDs across FTSE 350 and large private companies.

That change isn’t limited to new appointments. Many boards are investing in upskilling for existing members. The National Cyber Security Centre now offers a free governance training package for board use, while the Institute of Directors and CGIUKI have launched dedicated AI bootcamps. Major consultancies such as PwC and KPMG are also running board-focused modules on AI assurance and quantum-resilient cyber controls.

“Forward-thinking boards are doing both,” said Williams. “Upskilling existing board members is essential but so is bringing in fresh expertise that accelerates that learning and brings a different lens to the table.”

Bollard agrees that board learning and succession planning are central to bridging the capability gap. “Board committees are a very important aspect of ensuring expertise in particular areas like Risk and AI,” he said.

Despite growing awareness, many boards still struggle to manage digital risk at the right level. “Too many boards are still structured around models that were built for a different era,” said Williams. “AI in particular is not just a technological issue but presents a governance challenge that cuts across every committee — from audit to risk to strategy.”

Failure to adapt can have real-world consequences. When TSB suffered a catastrophic IT migration failure in 2018, an independent review found that the board lacked deep integration experience and relied too heavily on executive assurances. In 2023, Capita was hit with a ransomware breach that cost £25 million — and faced scrutiny for lacking a dedicated cyber-risk director. At the British Library, a cyberattack led to months of disruption after vulnerabilities in ageing infrastructure were left unaddressed.

The risk environment is growing more complex. “Cybersecurity is a dynamic industry where new threat vectors are appearing faster than ever,” said Sam Thornton, COO of Bridewell. “A continuous improvement and upskilling programme should be an ongoing requirement for individuals operating in the sector.”

That means rethinking oversight structures, too. Some boards are responding by establishing dedicated digital or risk committees. Tesco now operates a Technology & Data Committee at board level, chaired by an independent NED with a CIO background. NatWest recently elevated its Chief Digital & Data Officer to the main board. Rolls-Royce appointed a former Microsoft UK CEO to a newly created digital oversight role, folding cyber risk into its Safety and Sustainability Committee.

What boards should do next

For boards still catching up, several practical steps can help close the risk-readiness gap:

• Conduct a digital skills audit of the board and its committees to identify critical shortfalls in oversight capacity.
• Establish a formal responsibility for cyber, AI, or digital risk within an existing committee — or create a dedicated subcommittee.
• Allocate recurring agenda time to technology risk, not just in response to incidents but as part of strategic oversight.
• Invest in independent board training, such as the NCSC’s Cyber Governance Toolkit or specialist AI literacy sessions.
• Engage with external advisors or digital non-executives who can provide challenge and independent perspective on technology investments and risk.

Each of these actions supports a more resilient, responsive board — one capable of meeting today’s risks and preparing for tomorrow’s.

What next-gen boards look like

These are not isolated moves — they point to a broader shift in what effective governance will require. Progressive boards are moving beyond token appointments and one-off workshops. They are rethinking structure, culture, and competence.

“Boards that embrace continuous learning, diverse thinking, and cross-functional collaboration will be much better placed to thrive in this new complexity,” said Williams.

Thornton notes that investor scrutiny is also playing a role. “Cyber budgets are coming under increased pressure and therefore the discussions around cyber risk are becoming more common place in the boardroom,” he said. That pressure, he suggests, is driving organisations to mature faster in their risk assessments and board-level readiness.

According to John Young, Principal Consultant at TSG Training, the most resilient boards are those that strike a balance. “Balancing these approaches helps boards maintain continuity while injecting the knowledge needed to navigate rapidly evolving digital landscapes,” he said.

Mehdi Paryavi, Chairman of the International Data Center Authority, takes a wider view. “Boards must be highly aware of risk management in creating and maintaining their data and digital assets,” he said. “Cybercrime and cyberterrorism today is not just about potential financial loss, but the real existential threat these attacks pose to all organizations.”

The challenge for UK boards is no longer awareness; it’s action. The technological landscape is evolving faster than most governance models were designed to handle. That makes structure, training, recruitment, and cultural adaptation all the more urgent.

“If the board cannot adapt,” said Bollard, “then its structure is not fit for purpose: plain and simple.”

For those willing to evolve, the opportunity is clear: to build boards not only fit for today, but ready for whatever comes next.

Read the article on Business Quarter here: https://businessquarter.substack.com/p/boardroom-skills-for-the-next-economy

Featuring Rob Vann, Cyberfort Chief Security Officer

---

What is malware as a service (MaaS), why is it so popular with adversaries, and what can businesses do to protect themselves from this growing threat?

Advanced attack capabilities are becoming accessible to almost anyone as adversaries offer platforms that can be used by cybercriminals with little expertise. A prime example of this is malware as a service (MaaS), an out-of-the-box solution similar to software as a service (SaaS) that allows even low skilled criminals to access tools to carry out sophisticated cyberattacks.

Over the last year, MaaS has been growing in popularity. Research shows there was a distinct surge in separate malware campaigns delivering the same payload in 2024, suggesting hackers are increasingly procuring tools from MaaS platforms.

Recent Darktrace research found the MaaS model was responsible for 57% of all cyber threats detected in the second half of 2024, up 17% from the first half of the year. Meanwhile, a report from WatchGuard reported an “astronomical surge” in malware threats in the third quarter of 2024, surpassing 420,000 – a 300% increase on the previous quarter’s figures and the largest quarterly rise it has ever observed.

So, what exactly is MaaS, why is it so popular with adversaries and what can businesses do to protect themselves against this growing threat?

MaaS – a subscription-based model

Much like SaaS, MaaS offers a subscription-based model. This sees technically skilled developers rent out malware to other cyber criminals, who use it for malicious purposes.

MaaS offers advanced capabilities to those lacking the technical expertise to develop the tools themselves, says Boris Cipot, senior security engineer at Black Duck. “This accessibility has driven rapid growth in the MaaS market, and it continues to expand at a significant pace.”

Because attackers no longer need to develop their own malware, the barriers to entry are much lower, says Nathaniel Jones, VP, security and AI strategy at Darktrace. “Criminals can operate attacks almost like a legitimate business, processing payments and creating subscription-based or one-off payment models.”

Like legitimate services, tools on offer also receive regular updates, incorporating plugins that exploit newly-discovered vulnerabilities.

MaaS offerings are extensive and can be “highly sophisticated and structured”, says Ian Porteous, regional director of security engineering and UK&I at Check Point Software. “Many include marketplace portals on the dark web, user-friendly interfaces for managing malware campaigns – and even technical support services.”

Another benefit of MaaS to cybercriminals is the anonymity it provides, with attackers able to use the malicious tools within the platform without revealing their identity or even operating under a specific name or group.

“Payments are often made via cryptocurrency, and with profit sharing, bonuses, promotions and other partner or associate benefits further confusing the financial transaction flows,” explains Rob Vann, CSO at Cyberfort.

It is also available relatively cheaply, depending on the package. Basic malware kits can typically be rented for around £80 ($108) to £400 ($543) per month, with more complex packages costing thousands. “Despite crackdowns, MaaS persists due to anonymized transactions on dark web marketplaces and evolving tactics that exploit weaker defences in vulnerable industries,” says Kevin Curran, IEEE senior member and professor of cybersecurity at Ulster university.

AI-enhanced MaaS

The growth of MaaS is a concern on its own. But experts warn malware kits are getting better at what they do due to technology such as AI. This is enabling attackers to create “adaptive malware that can evade traditional security measures”, says Matt Riley, data protection and information security officer at Sharp UK and Europe.

For example, AI tools could generate payloads designed to fool antivirus and machine learning-based detection models, disguising true intent by masquerading as legitimate code, says Vann.

Porteous points to OpenAI’s February 2025 report. “This highlights how North Korean-affiliated actors have used ChatGPT to research cyber intrusion techniques, develop PowerShell scripts for automation, and debug code for remote desktop protocol attacks. Given these findings, it is highly likely that MaaS operators are leveraging AI in similar ways.”

One of the most immediate impacts of AI on cyber crime is its ability to generate more convincing phishing attacks, says Porteous. “Generative AI can create highly personalized phishing emails that lack the grammatical errors and other red flags that security professionals have traditionally relied on to detect scams. MaaS platforms can integrate AI-powered tools to automate and scale these phishing campaigns with unprecedented efficiency.”

In the future, AI could be used for marketing and sales, too. Although there is no real evidence of this yet, there are indications that marketplaces are starting to utilize AI to drive interactions between the most lucrative vendors and partners, says Vann. “We expect to see the use of AI to build and leverage strong MaaS platforms, establish reputations for payments, and select partner relationships, special offers and other promotions to continue to drive financial performance in this area of cybercrime.”

What should businesses do about MaaS?

MaaS is being used more widely than ever before and it’s easy to see why. With this in mind, businesses should ensure they are in a solid position to defend against attacks utilising the criminal model.

It starts with good cyber hygiene. Make sure you do the basics well, says Vann. “Ensure that you aren’t the softest target, enforce multi factor authentication (MFA) and make sure security tooling is up to date and functioning correctly.”

Meanwhile, train employees with real world examples of deepfakes, AI-crafted phishing emails and other advanced techniques, he advises.

Layered cybersecurity strategies are “crucial”, adds Curran. “Advanced endpoint protection with AI is key to stopping smart malware. If a system does become compromised, network segmentation can limit the spread.”

Email filtering solutions should be in place and a zero trust security model will ensure no user or device is automatically trusted, say Curran. Investing in cyber threat intelligence and “a solid incident response plan” will help organizations to detect and mitigate threats faster, Curran adds.

At the same time, Curran emphasizes the importance of regularly backing up critical data offline. “This will ensure a swift and seamless recovery when – not if – an organization is attacked. This can even avoid the need to pay a ransom when critical systems are required back online quickly.”

Regularly updating and patching software to close vulnerabilities is “another vital step”, says Riley. “Cybercriminals often exploit outdated systems, and without these updates, even the most sophisticated defences can be bypassed.”

Read the article on IT Pro here: https://www.itpro.com/security/malware/malware-as-a-service-explained-what-it-is-and-why-businesses-should-take-note

Featuring Glen Williams, Cyberfort CEO

---

The twist being that our rundown is based entirely on the views of 12 partner leaders

In a year in which cyber-attacks have begun piercing our daily lives, what have been the most potent and memorable incidents?

Who better to ask than a dozen leaders of MSSPs, consultancies and IT partners working on the front line of cybersecurity day in day out?

Whether it be the empty shelves and eyewatering losses at Marks & Spencer, or the tragic news last week of a patient death linked to an NHS attack, cybersecurity is now never far from the headlines.

At a government level, all eyes are now on cyber – cyber spending is a key component of new NATO plans to raise defence spending to 5% of GDP, while Australia this month introduced mandatory reporting of ransomware payments.

But what are the most signficant cyber-attacks of 2025 so far, and what implications does each have for how channel partners position their services?

Panel

Glen chose to speak about the Legal Aid Agency Attack

When: April

What happened?

The government initially became aware of a cyber-attack on the Legal Aid Agency’s online digital services on 23 April.

But on 16 May, it discovered the attack “was much more extensive than originally understood” and that the group behind it had accessed “a large amount of information relating to legal aid applicants”.

Three of our 12 panellists ranked this cyber-attack among the year’s most significant in the form of Chorus MD Nicola Saner, Cyberfort CEO Glen Williams and CyXcel Co-founder and COO Jano Bermudes.

“Investigations by the NCSC and NCA are ongoing, raising serious concerns about data privacy,” Williams said of his reasoning.

“Still early days for this one, but it’s eye catching due to the impact on the legal system in general, the scale of data stolen and the amount of time this may take to resolve,” Saner said when asked to justify her decision.

Channel takeaway

While investigations are ongoing, Saner claimed the cybersecurity industry can already glean some potential lessons from the cyber-attack.

“The implication for cybersecurity (again maybe not fully understood yet) seems to be a timely reminder about the risks of old and unpatched systems, a lesson well understood but again one which many organisations (especially in challenging financial times) struggle to deal with,” she said.

Read the full article on IT Channel Oxygen and find out what other panel members chose as their most significant cyber attack of 2025: https://itchanneloxygen.com/14-most-significant-cyber-attacks-of-2025-so-far-with-a-twist/11/

Featuring Glen Williams, Cyberfort CEO

---

Mergers and acquisitions are a big deal for SMEs. It can change the whole outlook of a small company. But when is the right time to make changes? Four experts share their viewpoints, starting with Paul DeMott, Chief Technology Officer of Helium SEO.

For M&A decisions the most significant indicator to proceed with the purchase is achieving faster outcomes compared to maintaining maximum control and strategically creating internal solutions becomes too slow.

Speed takes precedence for me since I normally choose to build rather than acquire. Within my software engineering discipline writing code and mastering the entire stack remains an internalised perspective. At Helium SEO rapid expansion reaches a point where the best internal team cannot fulfil both growth goals and market requirement changes. Acquisitions become the ideal solution in such cases.

The acquisition of a development agency specialising in marketing automation tools happened at Helium recently. Our company had intended to build its own platform enhancement capabilities from scratch. We had drawn an initial design which then moved into scoping before kicking off our first development sprints. A few months showed that the necessary feature set could not materialise without reallocating resources from our core projects. The sales team held onto opportunities which needed those particular features our development had not yet completed.

We conducted external investigations until we located a small agile team implementing the identical solution we needed for our problem. The solutions and organisational values between the two businesses were compatible. We integrated the acquired services rapidly which allowed us to provide new solutions to our clients in just weeks. We completed the deal which reduced our project schedule by nine months. The goal extended beyond acquiring new technology because we needed faster project completion combined with reduced delays.

We conducted external investigations until we located a small agile team implementing the identical solution we needed for our problem. The solutions and organisational values between the two businesses were compatible. We integrated the acquired services rapidly which allowed us to provide new solutions to our clients in just weeks. We completed the deal which reduced our project schedule by nine months. The goal extended beyond acquiring new technology because we needed faster project completion combined with reduced delays.

George Holmes, Managing Director, Aurora Capital:

Mergers and acquisitions can be a fast route to growth, opening new markets or bringing in fresh talent and capabilities. However, they’re never a one-size-fits-all solution. Deciding whether to build or buy comes down to what makes the most sense for your business, what you can afford and how much risk you’re comfortable taking.

Acquisition tends to make sense when time is a limiting factor. If you’re trying to break into a new sector or geography, or quickly gain skills and capabilities your business lacks, buying an established company can be more efficient than building those things from scratch. 

The same applies to acquiring customer bases or intellectual property, both of which can take years to build naturally. But these benefits only materialise when the acquisition is planned, properly financed and followed by a well-managed integration process. Rushed deals are rarely successful.

Building organically can be the better route if your business has the time, cash flow and internal talent to scale sustainably. It gives more control over culture, brand identity and operational structure. For small businesses in particular, building is typically more financially manageable, avoiding the need for external debt or investor dilution. However, it may also mean slower progress or missed opportunities if competitors are moving faster through acquisition.

In reality, the decision often comes down to financial readiness. An acquisition typically requires serious upfront capital, strong cash flow forecasts and contingency planning. Many SMEs underestimate the capital needed after an acquisition for things like onboarding staff, upgrading systems or supporting customer transition.

That’s why access to finance is so important when considering M&A. We always advise businesses to have their house in order before they embark on an acquisition. It’s important that you ensure financials are up-to-date, identify any funding gaps and explore a full range of finance options, from traditional lenders to alternative providers which understand acquisition funding.

Another important consideration when weighing up buy vs build is market timing. In a volatile economic environment, valuations may be lower, but so too is appetite for risk. If interest rates are high or borrowing is expensive, it may be a sensible time to focus on organic growth. Conversely, if the business is in a strong financial position and a strategic opportunity presents itself, holding back could mean missing out.

As with so many big business decisions, there is an element of risk involved. Ultimately, whether you buy or build, what matters is having a clear plan and managing your finances carefully. Acquisitions can be a fast track to growth, but only if you have the right funding, strong leadership and a clear integration plan. Growth is essential, but it only happens when it’s stable and manageable.

Glen Williams, CEO, Cyberfort:

Mergers and acquisitions (M&A) are strategic moves that organisations undertake to enhance their market position, expand their capabilities or achieve growth. In the technology sector, mergers can be particularly impactful due to the rapid pace of innovation and the competitive landscape. If successful they can result in accelerated growth, improved financial performance and the opportunity to expand further into existing markets and access to opportunities in new target markets. However, if they do not achieve the expected results, organisations which adopt this strategy could find themselves facing integration issues, regulatory hurdles which can take time to resolve and dilution of focus on the core business if things do not go to plan.

From my experience in the technology sector the approach to mergers involves four key steps:

1. Strategic planning – Companies must identify their long-term goals and how a merger aligns with these goals

2. Target identification – Finding the right company to merge with is crucial. This involves thorough research and due diligence

3. Integration planning – Post-merger integration is critical to realising the benefits of the merger

4. Ongoing cultural integration – Once the merger plan has been implemented, you then need to continuously monitor that a ‘one company culture’ has been adopted

For technology businesses, deciding whether to buy (acquire) or build (develop internally) is a pivotal decision that can significantly impact their growth trajectory. Here are some considerations to help determine the right approach:

When to Buy

1. Speed to market – Acquiring an existing company can be faster than developing new technology from scratch

2. Access to expertise – Buying a company can provide immediate access to specialised knowledge and skills that may be difficult to develop internally

3. Market position – Acquisitions can help quickly enhance market position by eliminating competitors or gaining access to established customer bases

4. Risk mitigation – Developing new technology internally can be risky and uncertain. Acquiring a company with proven technology can reduce development risks and provide a more predictable path to success

When to build

1. Control and customisation – Building technology internally allows for greater control over the development process and customisation to meet specific business needs

2. Cost considerations – While acquisitions can be expensive, building internally might be more cost-effective in the long run

3. Cultural fit – Integrating an acquired company can be challenging due to differences in corporate culture. Building internally avoids these integration issues

4. Innovation and IP – Developing technology internally can foster innovation and result in proprietary intellectual property that provides a competitive advantage

The decision to buy or build in the technology sector depends on various factors, including strategic goals, market conditions, available resources and risk tolerance. Companies must carefully evaluate their options, considering both the immediate and long-term implications of their choice.

Tracie Crites, Chief Marketing Officer, HEAVY Equipment Appraisal:

Over the years, I’ve worked with businesses of all sizes, guiding them through strategic decisions, including mergers and acquisitions (M&A). The decision of whether to buy or build is a critical one for any SME, and it all comes down to timing, resources and long-term goals. For small to medium enterprises, understanding when to pursue an acquisition versus building from the ground up can make a huge difference in scalability, market positioning and cost-effectiveness.

When exactly should one make their purchase? Business acquisition provides the best solution for speedy expansion together with brand dominance and technologies which internal development takes too much time. When you want to penetrate a new market swiftly you can save time and money by acquiring an established firm that already has customers and distribution channels in place. Businesses acquire businesses to enter new markets according to a recent Deloitte study with 64% of companies making business acquisitions for this purpose. By purchasing intellectual property (IP) or skilled personnel, businesses can quickly get ahead of competitors without waiting through years of organic expansion.

The development process of original products through sustained R&D efforts and appropriate market timing becomes a superior choice for lasting growth when your business demonstrates financial capabilities to support both initiatives. Your organisation maintains better control of the development process when you build your solutions from within while achieving enhanced team cultural alignment. Building your own solution proves to be the optimal choice for companies that innovate within secluded markets. Build your own solution because it offers strong versatility for companies with adaptive capabilities.

Smoothing transitions is a major obstacle which companies face with acquisitions. The majority of company acquisitions results in failures because organisations implement substandard integration strategies that lead to culture mismatch problems, leadership transition issues and technology compatibility problems. Companies need to evaluate how well new acquisitions match their future needs in addition to acquiring immediate market position and technological advantages.

Small and medium enterprises find success through combining internal growth along with strategic acquisitions. Build capabilities at your core before exploring acquisitions to solve value chain gaps and capture new markets and accelerate operational growth. Your competitive advantage will benefit from an acquisition when your industry demands rapid evolution or when you need cutting-edge technology.

Businesses need to base their acquisition or development decisions on their strategic requirements along with market demands and resource constraints and long-term valuable impact. Devote sufficient time to evaluate each option carefully before you assess how they match up with your business’s future plans.

Read the article on Intelligent SME Tech here: https://www.intelligentsme.tech/2025/06/06/editors-question-whats-your-approach-to-mergers-and-acquisitions-when-is-the-right-time-to-buy-vs-build/

By Rob Vann, Chief Solutions officer at Cyberfort

26^th May 2025

AI and cybersecurity are now intrinsically linked in the transportation sector. AI systems must be protected like any other critical asset and used defensively to enhance cyber resilience. Whether safeguarding autonomous vehicles, securing logistics chains, implementing zero-trust frameworks, or preparing for new regulations, the message is clear: cybersecurity is not optional in the age of AI-powered transport. Organisations that embrace this reality will not only avoid the devastating impact of cyberattacks but will also gain a competitive edge by building systems that are secure, intelligent, and resilient by design.

Vulnerability Assessment of Autonomous Vehicles 

Autonomous vehicles (AVs) are among the most high-profile applications of AI. These systems rely on complex sensor arrays, deep learning models, and edge computing to make split-second driving decisions. Ironically, this life-saving mitigation of human error through enabling support and autonomy also introduces novel vulnerabilities, requiring different and iterated defensive approaches and techniques to be intertwined with the traditional “do the basics well” approach.

Before we even consider sophisticated attacks, AVs interacting with our physical world face a number of environmental and malicious risks. For example, an attacker physically interfering with road signs on a new road could create subtle manipulations of sensors where GPS data is not available to confirm an upcoming hazard through other systems. Autonomous parcel delivery systems regularly “fall” off kerbs and ironically must be “rescued” by kind-hearted human passersby. This is especially a challenge within the UK, where environments such as kerb heights and pavement widths are often many years old and hence do not have the consistency of more modern planned town layouts in the US.

Laws and environmental changes mean that AVs must be trained, consider, understand, and respond to the actual geographies that they are currently operating in.

Furthermore, in a simple system, “falling back” to a baseline operating level is often an option. When you lose GPS, you follow the signs; when an assisted vehicle is operating in heavily adverse weather conditions, the system notifies the driver it is no longer steering, braking, or accelerating, and the driver resumes control. In a truly autonomous transportation system, these failsafe’s must be carefully considered to encompass all possible outcomes safely and effectively.

The transition to fully autonomous vehicles is another area for consideration. As drivers, we are taught to avoid confrontation; if people are tailgating us, we let them pass and drop back. However, as the percentage of autonomous vehicles increases, inconsiderate or dangerous drivers may “force” AVs to take evasive action, which then creates a chain reaction across the AVs surrounding it.

Beyond these “simple” potential challenges (which must be understood, predicted, tested, and mitigated), there’s also the risk of remote code execution to manipulate AVs’ driving behaviours. If a malicious actor gains access to over-the-air update systems, navigation modules, or vehicle-to-infrastructure (V2I) communication channels, they could cause significant disruptions.

To safeguard autonomous vehicles, a layered security approach is essential. This includes AI robustness testing, where models are trained and tested against adversarial inputs across all geographies, systems, and environments they may interact with. Code signing and secure bootloaders ensure that only authenticated software is installed or run. Real-time anomaly detection uses AI to monitor vehicle behaviour for anomalies such as unexpected lane changes, deviations from logistics routes, loss of centralised connectivity, or communication spikes. Additionally, isolating safety-critical systems by separating AI decision-making from infotainment, customer announcements, and other third-party applications limits exposure and enhances security.

Ultimately, cybersecurity for AVs must be treated as a primary secure-by-design requirement, not an afterthought.

Securing AI-Powered Supply Chains 

Supply chain attacks span all areas of technology, from compromising core code in autonomous vehicles to transport-specific workflows. Modern logistics networks rely heavily on AI for forecasting, routing, inventory management, and robotic automation, creating extended attack surfaces and inconsistent security postures. AI models trained on sensitive data can be targeted for model inversion attacks, leading to compromised decision-making that reroutes shipments, delays deliveries, or triggers fraudulent inventory movements. Attackers may exploit IoT endpoints, such as connected sensors in logistics warehouses, to deploy ransomware or other malicious agents.

Defensive strategies for AI-powered supply chains include understanding the vast and sprawling nature of supply chains, where small businesses often manufacture critical components but lack enterprise-level defences. End-to-end encryption ensures all data in transit is secure. Federated learning distributes AI training across multiple devices, decentralising data to reduce exposure and improve privacy.

Continuous model monitoring by both human and AI systems helps identify data drift, unforeseen use cases, and malicious inference. Threat intelligence sharing among logistics partners enhances detection of supply chain-wide threats. Cybersecurity in supply chains is now a boardroom priority that impacts physical operations.

Zero-Trust Architecture for Connected Transport 

In zero-trust, no device, user, or system is inherently trusted—even if it’s inside the network. Instead, access is granted based on continuous verification of identity, device posture, and contextual risk. With vehicles, roadside infrastructure, and control centres all becoming interconnected, the need for a zero-trust approach in transportation is critical. Traditional perimeter-based security models are no longer sufficient, as the perimeter is constantly shifting, difficult to secure, and hard to monitor and respond to.

Zero Trust is a concept that is often discussed but rarely fully implemented. Critical components for transportation systems include micro-segmentation, which involves dividing networks and systems into separate zones to reduce lateral movement in case of a breach and mitigate the risk of single incidents spreading to impact the entire ecosystem. Identity-centric controls, such as multi-factor authentication (MFA), least-privilege access, and identity governance, are essential. Behavioural analytics play a key role in Zero Trust by using AI to identify deviations in access patterns or operational behaviour.

Policy automation, driven by AI, dynamically adapts access controls based on real-time risk assessments, ensuring a robust and responsive security posture. In transportation, we should remember that a Zero Trust Approach doesn’t just improve a system’s defensive posture, it boosts operational resilience and improves performance by containing incidents as early as possible, before they spread across complex transport ecosystems.

Regulatory Horizons

As the transportation industry evolves, so too does its regulatory landscape. Governments and international bodies are responding with updated mandates around cybersecurity, AI ethics, and data privacy. Within a global supply chain supporting the development and rollout of AVs, the platforms and systems are often common, but regulatory frameworks, legal requirements, areas of responsibility, and regulatory fines are more often territory or country-driven. These include privacy, security, design, and safety, and care should be taken to consider the systems’ likely and possible use areas rather than defaulting to primary sold markets.

Examples of regulation include UN Regulation No. 155 (Cybersecurity Management System), which now applies to all new vehicle types sold in many countries and mandates robust cybersecurity risk management for automakers. The EU’s NIS2 Directive expands security obligations for operators of essential services, including transportation. In the UK, the Automated Vehicles Act sets a legal framework for self-driving vehicles and their use within the UK, projected to be in use on public roads from 2026. In the US, the National Highway Traffic Safety Administration (NHTSA) has proposed a voluntary program and is expected to introduce AI-specific safety standards for autonomous driving systems.

Organisations can stay ahead of compliance by conducting comprehensive cybersecurity maturity assessments, implementing AI compliance standards and ethics frameworks to ensure fairness and explainability, and participating in public-private collaboration initiatives to stay informed on evolving threats and best practices. Regulatory alignment isn’t just about avoiding penalties; it builds trust with customers and stakeholders to enable maximum leverage and minimum exposure in a high-risk, high-reward industry.

Real-World Examples

AI driven ransomware attack on logistics company
Recent incidents underscore the importance of robust cybersecurity measures in transportation. These include the disruption of AVs, targeting of customer information and safety systems, and logistics system.

Autonomous Vehicle Confusion
Autonomous vehicle confusion has been demonstrated through two intriguing proofs of concept. Firstly, researchers have shown that Tesla’s AI vision system can be deceived using adversarial examples on the road, such as fake lane markings or speed limit signs. This underscores the necessity for robust sensor fusion and constant validation of model outputs to ensure safety and reliability.

Secondly, an experiment conducted by one of Cyberfort’s own resources involved adding a 60mph speed sign to the rear window of a car. On private land, a semi-autonomous vehicle was driven past the parked car. This experiment was repeated with three different vehicles, and it was observed that two of the vehicles quickly accelerated to address the perceived speed limit change from 5mph to 60mph, while the third vehicle remained unaffected. These results were consistently replicated, highlighting potential vulnerabilities in autonomous vehicle systems and the importance of continuous improvement in AI robustness and sensor accuracy. These findings illustrate the critical need for ongoing advancements in autonomous vehicle technology to mitigate risks and enhance the reliability of AI-driven systems on the road.

Key Lessons
To ensure robust cyber resilience, it’s crucial to adopt a holistic security approach that encompasses everything from physical sensors to cloud-based analytics platforms. Defensive AI technologies, such as behavioural analytics, anomaly detection, and automated response systems, play a vital role in identifying and containing threats in real time. However, the growing threat of offensive AI, which attackers use for reconnaissance, phishing personalisation, and identifying zero-day vulnerabilities, underscores the need for continuous vigilance and advanced security measures.