A security researcher has recently disclosed flaws affecting Microsoft's passkey implementations across Entra ID and Windows 11. If successfully exploited, these weaknesses could have allowed attackers to gain unauthorised access to accounts using techniques traditionally associated with password-based attacks. Further technical details are expected to be presented at the upcoming Black Hat USA 2026 conference. While this may seem concerning, phishing-resistant authenticatio

Microsoft has announced a major shift towards phishing-resistant authentication, with native SMS and voice authentication being retired from Microsoft Entra ID on 1 February 2027. This reflects the industry's move towards stronger authentication methods that are more resistant to phishing, credential theft, and social engineering. For organisations still relying on SMS and voice-based authentication, now is the time to start planning your transition: Identify users still usi

A simple but often overlooked cybersecurity habit is signing out of applications you're no longer using and periodically clearing your browser cookies. This is because many modern attacks don't focus on stealing your password. Instead, they attempt to abuse an existing signed-in session, allowing access without needing your credentials. This is commonly known as session hijacking. While this habit won't prevent the attack, it can help limit the impact. The fewer applications

In this next topic in the cybersecurity awareness series, we look at cyber hygiene: the small, regular habits that help keep your personal and work digital life more secure. Quick takeaway Section Key message What it is Cyber hygiene is the routine care of your digital assets, including accounts, devices, apps, and information. Why it matters Small gaps, such as weak authentication or outdated software, combine to create easy opportunities for attackers. What to do Strengthen

Cybersecurity can feel complex. There are many tools, systems, and controls designed to protect information, devices, and people. But one of the most important lines of defence is also one of the most familiar: you, the user. Security training and attack simulations help, but the real goal is awareness. When people understand common risks and build safe everyday habits, they help protect both their workplace and their personal digital lives. That is why we have started this c

Despite widespread Multi-Factor Authentication (MFA) adoption, identity-based attacks continue to succeed. The reason is that many authentication methods still rely on mechanisms attackers can bypass. Phishing-resistant authentication addresses this and should now be a top priority for organisations. Quick Takeaways Authentication remains a primary attack path: Attackers target passwords, login prompts, and active sessions because they provide a direct route into business sy

Today’s security landscape looks very different from the one traditional firewalls were originally built for. Users are no longer always in the office. Devices move between networks. Applications are delivered through SaaS. Workloads run in public cloud platforms. Many business systems are now accessed directly over the internet rather than through a private corporate network. In this world, the firewall is no longer the natural centre of gravity for security. That does not m

OpenAI recently confirmed that two employee devices in its corporate environment were impacted as part of the TanStack npm supply chain attack. According to OpenAI, the security breach involved activity consistent with malware behaviour, including unauthorised access and credential-focused exfiltration activity in a limited subset of internal source code repositories accessible to the impacted employees. Importantly, OpenAI stated that it found no evidence that user data was

A recently disclosed security vulnerability affecting cPanel and WHM (CVE‑2026‑41940) is currently under active exploitation. Given that cPanel powers a significant portion of global websites, this critical vulnerability presents a significant risk to organisations and businesses that rely on cPanel‑based hosting. If your organisation uses cPanel or WHM, here’s what you need to know — and the steps you should take to protect your environment. What You Should Do Immediately Re