https://garzoncybersolutions.com/insights.html Threat briefings and market analysis from Garzon Cyber Solutions. Cyber security incidents, regulatory change and what both mean commercially for organisations operating in the UK, the EU and the Americas. en-gb Garzon Cyber Solutions jonathan@garzoncybersolutions.com (Jonathan Garzon) jonathan@garzoncybersolutions.com (Jonathan Garzon) Fri, 09 Oct 2026 05:27:01 +0000 Fri, 09 Oct 2026 09:00:00 +0100 GCS RSS generator https://garzoncybersolutions.com/gcs_threat_briefing_pushchannel/ https://garzoncybersolutions.com/gcs_threat_briefing_pushchannel/ On 6 October 2026 ASOS customers received a push notification from the official ASOS app announcing the company had been hacked. The app was not broken into. ASOS has confirmed an unauthorised party obtained an employee account's log in credentials by impersonating a trusted contact, then used them to reach third party platforms the retailer uses to communicate with customers. The exposure sits in the customer engagement layer, which holds the customer record, the behavioural history that makes phishing convert and the authenticated right to publish under the brand, usually behind a single login procured on a marketing budget. Fri, 09 Oct 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_validcerts/ https://garzoncybersolutions.com/gcs_threat_briefing_validcerts/ On 6 October 2026 Google disclosed domain hijacks in the .gh, .sl and .as country-code namespaces. Attackers compromised the third-party registries, rewrote authoritative DNS and obtained publicly trusted HTTPS certificates for names they did not own. Google says its own systems were not compromised and that it has no reason to believe the issuing certificate authorities did anything wrong. Every stage of the failure sat outside the organisations named on the certificates, which is what makes this a governance problem rather than a patching one: the incident window is the hijack plus the validation reuse period, and the rules permit that to run to two hundred days. Thu, 08 Oct 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_fixversion/ https://garzoncybersolutions.com/gcs_threat_briefing_fixversion/ Dell published DSA-2026-448 on 1 October for Container Storage Modules: thirteen proprietary flaws, six critical, two at CVSS 10.0 for missing authentication sitting in front of storage administrator credentials. The Workarounds and Mitigations section reads None. The harder problem is the table underneath. Affected is given as versions prior to 1.17.0 and the fix as 1.18.0 or later, one listed flaw is recorded against 1.18.0 itself, and the critical entries cite component versions rather than the release. The question of whether you are exposed cannot be answered from the advisory, which makes this an inventory problem before it is a patching one. Mon, 05 Oct 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_startupsme_certificates/ https://garzoncybersolutions.com/gcs_startupsme_certificates/ A founder asked to produce a security certificate usually asks which one is best. It is the wrong question. Cyber Essentials, ISO 27001 and a SOC 2 report are not three grades of the same qualification: they are three instruments of market access, each accepted by a different kind of buyer, and the right one is decided by where the next four quarters of revenue sits. Some 24% of UK businesses report controls in all five Cyber Essentials areas while only 5% hold the certificate. That gap is proof, not security, and the companies inside it are losing bids on paperwork. Fri, 02 Oct 2026 09:00:00 +0100 Start-ups and SMEs Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_fortimailibe/ https://garzoncybersolutions.com/gcs_threat_briefing_fortimailibe/ Fortinet disclosed CVE-2026-104286 in FortiMail on 1 October, an unauthenticated arbitrary file write at CVSS 9.8, reported to be exploited in the wild. CISA catalogued it the same day with a remediation date of 4 October. The fixed builds are labelled upcoming in the advisory and have not shipped, and the 7.2 branch gets no in branch fix at all. With nothing to install, the vendor's first suggested workaround is to disable the encryption feature regulated firms use to send confidential mail to clients. That is a governance decision about which obligation to suspend, not a patch window. The published indicator set points at the appliance's own logging. Fri, 02 Oct 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_startupsme_insurance_renewal/ https://garzoncybersolutions.com/gcs_startupsme_insurance_renewal/ Few companies of fifty people commission a security audit. Almost all of them buy insurance, and the renewal has quietly become the audit they did not commission. The proposal form now asks for named controls and documentary evidence, and the answers set the premium, the exclusions and, after a loss, whether the cover answers. UK insurers paid £197m in cyber claims in 2024, up 230% on the year before, with malware and ransomware at 51% of claims. Prepare the evidence file once and it serves the insurer, the enterprise buyer and the certification assessor alike. Wed, 30 Sep 2026 09:00:00 +0100 Start-ups and SMEs Jonathan Garzon https://garzoncybersolutions.com/gcs_talent_briefing_assuranceline/ https://garzoncybersolutions.com/gcs_talent_briefing_assuranceline/ Most people entering cyber security search on job titles, and the titles do not describe the work. DSIT's analysis of UK core cyber postings placed during 2024 names auditing as a required skill in 19% of adverts, yet security or IT auditor accounts for just 3% of titled postings. The governance work is advertised under titles that never name it, and the pay follows the title rather than the requirement. This briefing sets out the Assurance Line, a four-part test of Gate, Signature, Scarcity and Transfer that a practitioner can score any role against, held or offered. Thu, 24 Sep 2026 09:00:00 +0100 GCS Talent Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_identifiedentrypoint/ https://garzoncybersolutions.com/gcs_threat_briefing_identifiedentrypoint/ ENISA published its Threat Landscape 2026 on 22 September, analysing 8,257 incidents recorded across 2025. The figure being quoted is 73%, the share of recorded events involving essential and important entities under NIS2. The one nobody is quoting sits seven pages earlier. Unauthorised access was 39.5% of recorded activity, and ENISA could identify an intrusion vector in only 5.2% of it, around 2% of the dataset. An organisation that cannot establish an entry point cannot tell a regulator what was affected, tell a customer whether their data moved, or make a clean insurance claim. Thu, 24 Sep 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_regulatory_briefing_stillunderinvestigation/ https://garzoncybersolutions.com/gcs_regulatory_briefing_stillunderinvestigation/ Sweden's data protection authority fined Miljodata 1.8 million kronor on 22 September over the August 2025 breach, under Article 32(1). The more useful part of the decision sits beside it. Reviews of two municipalities and one region have been open since November 2025, and IMY says they focus particularly on what those bodies themselves put into the supplier's system: which categories of data, and about which people. Protected identities, long-departed employees and children. Wed, 23 Sep 2026 09:00:00 +0100 GCS Regulatory Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_talent_briefing_noticeperiod/ https://garzoncybersolutions.com/gcs_talent_briefing_noticeperiod/ Just 34% of security professionals plan to stay with their current employer, and the factor most closely tied to how they feel about the job is not salary. It is whether they believe the organisation treats security as a priority. UK boards say it is: 72% of businesses call cyber a high priority, yet only 31% have a named board owner. We set out the commercial exposure of a security departure and the Priority Test: Access, Allocation, Advancement and Attribution. Tue, 22 Sep 2026 09:00:00 +0100 GCS Talent Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_regulatory_briefing_nobodyattacked/ https://garzoncybersolutions.com/gcs_regulatory_briefing_nobodyattacked/ Ireland's Data Protection Commission fined Google Ireland Limited 403 million euros on 21 September, the fourth largest penalty it has issued. There was no breach, no intruder and no stolen record. The findings fall under four headings: lawfulness and fairness, accountability, transparency and retention. One turned purely on evidence, because Google could not demonstrate compliance. The regulator took about six years and seven months to establish the case and has allowed six months to fix it. It is understood Google may appeal elements of the decision. Tue, 22 Sep 2026 09:00:00 +0100 GCS Regulatory Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_startupsme_first_security_hire/ https://garzoncybersolutions.com/gcs_startupsme_first_security_hire/ Most growing companies hire a senior security leader the moment a buyer asks who is accountable. Our view is that the hire should be the third decision rather than the first. Managed foundations and fractional leadership come first, certification second, and the permanent owner last, recruited into a working system. With 49% of UK businesses reporting a basic cyber skills gap and the median advertised Head of Information Security salary down 20% on a year earlier, the autumn 2026 labour market makes that sequence unusually rewarding. Tue, 22 Sep 2026 09:00:00 +0100 Start-ups and SMEs Jonathan Garzon https://garzoncybersolutions.com/gcs_talent_briefing_evidenceladder/ https://garzoncybersolutions.com/gcs_talent_briefing_evidenceladder/ Some 81% of UK core cyber job postings set a bachelor's degree as the minimum, and 63% ask for two to six years of experience. Asked directly what they would accept in an early-career hire, 90% of hiring managers said prior IT work alone would do, 89% said an entry-level certification alone, and only 81% said a degree alone. The academic qualification the adverts insist on finished last of the three. The Evidence Ladder sets out where a practitioner should actually spend their effort: Stated, Shown, Tested, Vouched. Thu, 17 Sep 2026 09:00:00 +0100 GCS Talent Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_startupsme_security_questionnaire/ https://garzoncybersolutions.com/gcs_startupsme_security_questionnaire/ The commercial terms are agreed and the legal review is complete. Then a security questionnaire arrives from a function the founder has never dealt with, and the close moves a quarter. What an enterprise security review actually asks a smaller supplier for, why it has become more demanding in 2026 through PPN 014, DORA and the Cyber Security and Resilience Bill, and six decisions a fifty-person company can take before the next one arrives. Large buyers are twice as likely to run a supplier review process as the small companies answering it, and that gap is where the deal slips. Wed, 16 Sep 2026 09:00:00 +0100 Start-ups and SMEs Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_deadlineaugust/ https://garzoncybersolutions.com/gcs_threat_briefing_deadlineaugust/ This week CISA warned that ransomware gangs have joined the attacks on a VMware vCenter flaw, CVE-2026-59310, that Broadcom patched on 29 July. The federal deadline to apply it was 21 August. Root on vCenter is root on the console that runs the whole virtual estate. Ransomware arriving seven weeks after the fix is a signal about the defenders, not the attackers: enough unpatched, internet-facing control planes remain to make it worthwhile. A passed deadline is not a closed risk, and patching does not evict an intruder already inside. Wed, 16 Sep 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_regulatory_briefing_tsacode/ https://garzoncybersolutions.com/gcs_regulatory_briefing_tsacode/ Version 1.1 of the Telecommunications Security Code of Practice landed on 14 July 2026. Its explanatory memorandum says the law has not changed, and that there is no significant impact on businesses outside Tier 1 and Tier 2. The first is true. The second describes the document rather than the market: privileged access, API and patching guidance all reach suppliers through contracts, and the 2028 deadline is a procurement date for anyone selling into a large operator. Wed, 16 Sep 2026 09:00:00 +0100 GCS Regulatory Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_regulatory_briefing_nineregulators/ https://garzoncybersolutions.com/gcs_regulatory_briefing_nineregulators/ The EU AI Act's enforcement powers applied on 2 August 2026, with penalties reaching 35 million euros or 7% of worldwide turnover. Member states were meant to designate the authorities by August 2025. On the most recent public count nine of twenty-seven had done so and six had designated nothing at all. The gap is not grace. Every member state has already designated the authorities that police fundamental rights, so waiting for the market surveillance authority is waiting for the wrong regulator. Tue, 15 Sep 2026 09:00:00 +0100 GCS Regulatory Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_arrive/ https://garzoncybersolutions.com/gcs_threat_briefing_arrive/ A crafted email gives an unauthenticated attacker root on the Cisco Secure Email Gateway built to inspect it. Nobody opens anything and nothing is clicked. Cisco reported active exploitation before the advisory existed, there is no workaround, and every physical and virtual appliance is affected regardless of configuration. CISA listed it as exploited the same day. The device that reads every inbound message in clear text is also the one that can erase the evidence it was compromised. Tue, 15 Sep 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_regulatory_briefing_frontierrules/ https://garzoncybersolutions.com/gcs_regulatory_briefing_frontierrules/ On 14 September OpenAI told a committee of MPs and peers that the UK should legislate now for the handful of firms building frontier models, including itself, while sparing smaller companies. The carve out is not the relief it sounds like. Every harm the committee named is a deployer harm, governed by law that already applies, and frontier obligations propagate outwards as contract clauses and questionnaire lines long before they arrive as legislation. Mon, 14 Sep 2026 09:00:00 +0100 GCS Regulatory Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_fakerequest/ https://garzoncybersolutions.com/gcs_threat_briefing_fakerequest/ Revolut released customers' identity documents, verification selfies, IBANs and full transaction histories to a fraudster who emailed from a genuine government agency domain. Nothing was hacked. The message passed domain authentication because it really did come from that domain, and the lawful request team released the files. Almost every organisation that holds customer data has the same channel and almost none of them monitors it. Mon, 14 Sep 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon