Blog

TL;DR If you are mid-patch right now, here is where your vendors stand. Within a day of the PHP2Shell fixes, five vendors we work with had published guidance or protections: Cloudflare, AWS, Microsoft, Check Point and Tenable. We found nothing PHP2Shell-specific yet...

TL;DR PHP2Shell is the name for two serious flaws in PHP (CVE-2026-109618 and CVE-2026-109619) that let an attacker run code on a web server without logging in. Fixes came out on 21 October 2026 and attacks have already been reported. The NCSC says to consider taking...

REGISTER HERE TL;DR Your people are already using GenAI. Microsoft research found 71% of UK employees have used unapproved consumer AI tools at work, and the NCSC's briefing on shadow AI.says plainly that you cannot manage what you do not know. Blanket blocking tends...

TL;DR On 15 March 2027 the maximum validity of public TLS certificates falls to 100 days, then 47 days in 2029. There are four realistic responses: standardise on a leading certificate authority, add a CA-neutral management platform, do nothing and renew by hand, or...

TL;DR Most teams buy automated vulnerability scanning to satisfy an auditor, and Tenable does that well: scheduled scans, configuration audits and evidence for frameworks such as Cyber Essentials Plus, where a high or critical vulnerability older than 14 days can fail...

TL;DR Maximum TLS certificate validity is falling in scheduled steps: 398 days, then 200 days (live since 15 March 2026), 100 days from 15 March 2027, and 47 days from 15 March 2029. Renewals per certificate rise from about one a year to nearly eight, and the schedule...

TL;DR The cyber security skills shortage is structural, not cyclical. ISC2 put the global workforce gap at 4.8 million professionals in 2024, a 19% year-on-year increase, and in the UK, DSIT's 2025 labour market reportshows 49% of businesses have a basic cyber...

TL;DR New NCSC New Zealand research (published ahead of Cyber Smart Week, 5–11 October 2026) found 43% of SMEs now believe they're vulnerable to a cyber attack, up from 34% a year ago, rising to 59% among businesses with 20 to 49 staff, the group also most likely to...

TL;DR The average SOC processes around 11,000 alerts a day, but only about 22 per analyst genuinely warrant investigation. Nearly half of all alerts are false positives, and over 40% go entirely uninvestigated. This isn't a minor inconvenience, it's the direct driver...

TL;DR True 24/7 SOC coverage needs 8 to 12 analysts across shifts, not the 2 to 3 headcount most mid-market budgets assume, pushing fully-loaded in-house cost into seven figures a year. Managed SOC services typically run 30 to 50% less, in the region of $60,000 to...

TL;DR SIEM isn't dying, legacy SIEM as passive log storage is. What's replacing it is AI-powered security intelligence that's converging with XDR and SOAR into a single platform, not a separate product you buy instead of a SIEM. Microsoft, CrowdStrike and Palo Alto...

TL;DR A NOC (Network Operations Centre) exists to keep the network up, monitoring performance, availability and infrastructure health. A SOC (Security Operations Centre) exists to keep the network safe, monitoring for threats, detecting intrusions and responding to...

TL;DR We've added ConnectProtect to our partner stack. It's a Managed XDR platform backed by three global SOCs (UK, South Africa, Philippines), ingesting data from hundreds of security tools and applying AI-driven analytics to cut alert noise down to what actually...

TL;DR Ransomware victims hit a record high in 2025, and weekly attacks per organisation reached 1,968, up 18% year on year and nearly 70% since 2023, according to Check Point's 14th annual Cyber Security Report, drawing on its own global telemetry and Check Point...

TL;DR ITogether is now listed on G-Cloud 15 [HERE], the Digital Marketplace framework run by the newly renamed Government Commercial Agency (formerly Crown Commercial Service), with 125 services live across three lots. The listing spans our full partner stack,...

TL;DR ISO 27001 certification doesn't mean an organisation is risk-free, it means risk is identified, treated and continually reviewed within a defined appetite. Ask for the Statement of Applicability and scope statement, not just the certificate PDF. Every valid ISO...

TL;DR We've added Object First to our partner stack. Its Ootbi (out of the box immutability) appliance is a purpose-built backup target with what it calls Absolute Immutability, a Zero Access architecture where nobody, including an admin with valid credentials, can...

TL;DR We've started sending some prospects an unsolicited “Attack Surface Snapshot”, built entirely from public information, as a conversation starter rather than a data sheet. A handful of CISOs have told us it feels like using AI to embarrass people into a sales...