Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

One of the most common questions organisations ask when planning a security assessment is how long a penetration test will take. The answer depends heavily on scope, but there is also an important distinction between the time spent actively testing and the overall project timeline. When buyers ask how long a penetration test takes, they may be referring to several different stages.

A firewall can be considered a digital shield that helps protect your network from unwanted or potentially harmful traffic. It lies between a trusted network and external connections, such as the internet, where it checks network traffic against predefined security rules. Based on those rules, it decides which connections to allow and which to block.

Water and wastewater operators make decisions every day that affect service reliability and public safety. Cybersecurity needs to fit that responsibility: helping teams understand exposure, protect critical systems, and respond without creating unnecessary operational disruption.

The future of policing depends on more than changing force structures or investing in AI. It depends on making data work across boundaries. Policing is being asked to change at pace.

The rules of cyber defense have shifted. Threat actors are increasingly using advanced automation to accelerate reconnaissance, evade static signatures, and orchestrate rapid intrusions across critical infrastructure, software supply chains, and insider pathways. This has created a critical velocity gap: when adversaries compress attack timelines from days to minutes and defenders rely on manual triage across fragmented legacy tools, the defense falls behind.

A driver’s license tells you who someone is and that they passed a driving test, not whether they’ll drive responsibly in the future. The same is true for bots: verifying who operates it creates accountability, but trust depends on what it does next. A known bot can still ignore website preferences, overwhelm origins, or evade controls. It’s not always malicious — often it’s just a misconfiguration or a bug.

Since 11 September 2026, an actively exploited flaw in your app starts a 24-hour reporting clock under the EU's Cyber Resilience Act. That's expensive if you don't know what's running, and an edge if you do. For most companies, an app is a channel. For a mobile-first company, it is the business: the bank branch, the checkout counter, the boarding gate, the clinic waiting room. Until this year, however, the law mostly treated it like a channel.

In part one of this NIS2 series, we examined why vendor questionnaires fall short and how third-party breaches impact downstream organizations across Europe. But what happens after a supplier containment phase ends? The long-term danger lies in how attackers leverage exfiltrated supplier data to launch hyper-targeted social engineering attacks against an organization’s employees. A supply chain incident does not end when a service provider detects, contains, or recovers from an attack.

A phishing campaign is targeting YouTubers with phony sponsorship offers, according to researchers at ESET. The emails are personalized to each target, making specific references to their channels, and are designed to trick users into granting access to their Google accounts. “One such recent campaign impersonates Hollyland, a legitimate manufacturer of wireless transmission and audiovisual equipment,” ESET says.