Fifteen Years of Exposure: What Supermarket Refrigeration Attacks Reveal About Industrial Cybersecurity
Key Takeaways Cyberattacks against supermarket refrigeration systems across Europe in October and November 2026 demonstrate how the compromise of internet-connected operational technology (OT) can result in physical disruption and significant financial losses. Internet-exposed industrial control systems are not a new problem. Research published in 2011 and the subsequent Project SHINE initiative identified widespread exposure of industrial equipment more than a decade ago. Removing direct internet exposure through firewalls and secure remote access is an important mitigation, but does not eliminate the underlying security risks. The December 2025 attacks against Polish…
Cybersecurity Trends 2027: Risks Reshaping Security
Key Takeaways AI will expand security exposure through speed, scale, data access, and automated action. Its use requires clear operating boundaries. Connected technologies will extend enterprise exposure through IoT, IIoT, OT, edge systems, cellular modems, and supplier-managed access. Critical infrastructure security will be measured through continuity, safety, recovery time, and the ability to maintain trusted operations. Offensive security will test whether controls perform across realistic attack paths, detection events, response decisions, and recovery actions. Supply chain risk will require evidence across software, hardware, firmware, data, cloud services, and specialist providers….
Vendor Risk Assessment Template: Free Guide
“A vendor risk assessment should help organizations identify where third-party access, technology, and dependencies could introduce meaningful security exposure.” – IOActive Security Team Vendors may have security policies in place, but those policies do not always show how much risk their access and technology create for your organization. A useful assessment looks beyond the policy document to the attack paths a compromised vendor could open. Use this vendor risk assessment template free of charge to establish scope, test evidence quality, and determine when a vendor relationship warrants technical validation. This…
Below the Threshold: Why Britain’s Smallest Power Generators Face a Four-Year Cyber Security Gap
Key Takeaways A small-scale gas generator was taken offline for four days in July 2026. The UK Government confirmed the incident but has not formally attributed it. [1] Under the Network and Information Systems Regulations 2018, electricity generation is captured only at 2GW cumulative capacity, and the threshold expressly excludes generators that are not connected to a transmission system. [2] On 5 August 2026 the Department for Energy Security and Net Zero and Ofgem confirmed that baseline cyber resilience requirements for all Ofgem licensees will be built on…
Cyber Risk Management Strategies for Enterprises
“The most effective cyber risk management strategies prioritize business impact alongside technical risk.” – IOActive Security Team The strongest cyber risk management strategies begin with a business question. Which failures could stop a critical business service, harm people, cut revenue, or damage trust? A list of flaws cannot answer that question. Leaders need to see how weaknesses combine, which services they threaten, and what action will cut the risk. This framework focuses on five decisions: Link technical risk to business impact. Test real attack paths through offensive security assessments. Treat…
Signal Messenger Security: A Research Case Study
Signal Messenger is widely recognized for protecting private communications, but secure messaging depends on controls beyond encryption. This Signal Messenger security case study examines how IOActive tested Signal Desktop’s Windows screen-capture protection and what the results reveal about evaluating application controls against realistic attacker capabilities. Signal Messenger Security: At a glance ProblemSignal Desktop’s Windows content-protection feature prevents the application window from appearing in screenshots and screen recordings. However, the control relies on the assumption that only Signal’s own process will change the…
From 30 Systems to Over 100: What CISA’s Revised Water Sector Figures Reveal About the OT Detection Gap
Key Takeaways CISA has revised the scale of the July 2026 water sector campaign from the roughly 30 systems described by federal law enforcement at the time to more than 100 internet-exposed systems across at least 12 US states [1] [3]. The revised figure originated with CISA’s own observation, published on 21 August 2026 in exposure reduction guidance, rather than with incident reports submitted by the affected utilities [1] [3]. CISA has warned that the cellular modems involved may have been installed by operators, vendors or…
Secure Product Development Lifecycle Requirements
A final penetration test can miss a design choice that gives attackers an easy path later. An open debug port, a weak update process, or an unknown dependency can affect the whole product. For CISOs, CTOs, and product security leaders, secure product development lifecycle requirements define what to protect, which controls to build, how to test for vulnerabilities, and who owns each security decision. In practice, these requirements span six connected areas: security goals, threat modeling, hardware and firmware controls, component records, release checks, and postmarket response. Together, they answer…
Cyber Risk Management Strategies: Six Ways to Align Security With Business Priorities
Recent IOActive research on 2026 attack trends points to a recurring problem: attackers target systems that companies rely on the most, but watch the least, including operational technology (OT), firmware supply chains, and AI-enabled development. That raises a difficult question for security leaders: Which risks deserve investment first? The answer is not always the vulnerability with the highest technical severity. A useful cyber risk management strategy links technical risk to business impact, tests whether attack paths are realistic, and directs funding toward the risks most likely…
One Exposure, Many Actors: What the NCSC’s OT Alert Adds to the AA26-097A Picture
Key Takeaways On 27 August 2026, the NCSC published an Alert warning of increased targeting of operational technology (OT) systems across multiple sectors globally, including in the UK, carried out by a range of threat actors and resulting in some limited real-world disruption [1]. The Alert is deliberately unattributed. It should not be read as an extension of joint advisory AA26-097A, which attributes a separate and well-documented PLC exploitation campaign to Iranian-affiliated actors [2]. Three separate bodies of reporting published between April and August 2026, covering Iranian-affiliated PLC…