Despite mounting threats and high incident rates, organizations in the UK’s critical national infrastructure (CNI) sector display an alarming overconfidence in their cybersecurity defenses. According to Bridewell’s latest Cyber Security in Critical National Infrastructure Organizations report, confidence that critical systems are protected from cyber threats has grown steadily since 2025, despite 95% of respondents admitting they suffered a breach within the past year. Organizations Overestimate Cyber Defenses This overconfidence is most obvious when it comes to risk assessments: 90% of respondents were confident that their organization’s current cyber risk assessment approach reflected their cyber risk posture, but only 25% are…
Josh Breaker Rolfe
Josh Breaker Rolfe
Josh is a Content writer at Bora. He graduated with a degree in Journalism in 2021 and has a background in cybersecurity PR. He's written on a wide range of topics, from AI to Zero Trust, and is particularly interested in the impacts of cybersecurity on the wider economy.
2025 is set to be a massive year for MSPs, the latest MSP Horizons 2025 Report from N-able suggests. Fuelled by robust cybersecurity investments, AI-driven automation, and a surge in M&A activity, the industry is poised for significant growth, with new revenue opportunities abounding. A Market on the Upswing The report reveals that global managed IT services are currently valued at an impressive $525 billion, with managed services revenue growing by just 11% from 2023. Understandably, optimism is rife among the MSP community, with 59% of respondents expecting over 20% revenue growth in 2025 and 49% anticipating similar growth, specifically…
A global effort led by Fortra, Microsoft’s Digital Crimes Unit (DCU), and the Health Information Sharing and Analysis Center (ISAC) has reduced access to weaponized versions of the powerful hacking tool Cobalt Strike by 80%. Dramatic Reduction in Dwell Time The initiative, which focused on dismantling the distribution and use of unauthorized, legacy copies of Cobalt Strike and compromised Microsoft software, slashed the average “dwell time” – the period between initial detection and takedown of malicious activity – to less than one week in the United States and less than two weeks worldwide. Operation MORPHEUS In July 2024, Operation MORPHEUS,…
Broadcom has issued a security alert warning VMware customers about three zero-day vulnerabilities attackers are actively exploiting in the wild. The flaws – CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 – impact VMware ESX products, including VMware ESXi, vSphere, Workstation, Fusion, Cloud Foundation, and Telco Cloud Platform. The VMware Nightmare: What You Need to Know Broadcom’s advisory states that CVE-2025-22224, the most severe of the three with a CVSS score of 9.3, is a critical VMCI heap overflow vulnerability impacting VMware ESXI and Workstation. Attackers with local administrative privileges on a virtual machine (VM) can exploit this vulnerability to execute code as the…
Cybercriminals are more sophisticated than ever, a new report from CrowdStrike reveals. Breakout times are falling, social engineering is becoming more common and effective, and cyber espionage – particularly that originating in China – is growing increasingly aggressive. “Our latest research demonstrates that adversaries are becoming more efficient, focused, and business-like in their approach — in many ways, more like the enterprise organizations they prey upon. That’s why our team of security analysts, experts, and authors chose ‘the enterprising adversary’ as the theme for this year’s CrowdStrike Global Threat Report,” said George Kurtz, CrowdStrike CEO and Founder. Cyberattacks Are Faster…
AI-driven automation and real-time transaction monitoring are the top priorities for organizations seeking to combat fraud, the 2025 Digital Fraud Outlook report published by SEON has revealed. Fraud Budgets Grow, But ROI is Complicated According to the report, 85% of organizations have increased their fraud prevention over the past year, 88% are actively expanding their fraud teams, and 88% spend over 3% of their revenue on fraud prevention. However, SEON warns that organizations must invest strategically to maximize ROI, and existing ROI calculation methodologies may be flawed. The report highlights that 33% of organizations measure ROI based on reduced fraud…
Cybersecurity information sharing is a crucial element of a strong security culture, and organizations should actively facilitate and encourage it to reduce human risk, a new report from KnowBe4 argues. Called “Cybersecurity Information Sharing as an Element of Sustainable Security Cultured,” the report was authored by Dr Martin Kraemer, Security Awareness Advocate at KnowBe4, and Dr William Seymour, a Lecturer in Cybersecurity at King’s College London. It examines how people consume and share cybersecurity information to understand the role that workplace training plays in fostering information sharing among colleagues. Why Information Sharing Matters While arguments advocating for cybersecurity awareness training…
Cybersecurity researchers at VulnCheck have exposed internal conversations between members of the Black Basta ransomware group, revealing rare insights into the groups’ tactics and actionable advice for cybersecurity defenders. The key takeaway? Black Basta generally prioritizes known weaknesses. Extensive Use of Known Vulnerabilities The report reveals that Black Basta referenced 62 unique security flaws (CVEs) in their internal discussions, 85.5% of which were already being exploited in the wild. Obviously, these are concerning figures, but they have a major silver lining: organizations can take relatively simple steps to protect themselves, by reviewing the CVE list and applying patches immediately. Rapid…
Eighty-six percent of commercial codebases contain vulnerabilities, with 81% harboring high-or-critical-risk vulnerabilities, new research from Black Duck has revealed. The 2025 Open Source Security and Risk Analysis (OSSRA) report drives home the massive risk posed by outdated and unmonitored open-source components. It reveals that the average number of open-source files in applications has tripled over the past four years, surging from 5300 in 2020 to over 16000 in 2024. “The 2025 OSSRA report underscores a critical and ongoing challenge for organizations: managing the security and compliance risks inherent in open source software,” said Jason Schmitt, CEO of Black Duck. “As…
Vast numbers of misconfigured Access Management Systems (AMS) across the globe are exposed to the public Internet, researchers from Internet Index Search Solution provider Modat have revealed. The vulnerabilities, which span a wide range of industries—including critical sectors like construction, healthcare, oil, and government—have exposed hundreds of thousands of sensitive employee records, including personal identification details, biometric data, and even work schedules. Routine Assessment Reveals Global Security Crisis In early 2025, the Modat research team embarked on what they thought would be a routine investigation. Using the Modat Magnify tool, they scanned the global security landscape and unearthed something disconcerting:…
