Thomas Bain

NCC Group experts featured in ZDNet on AI-driven cyber risk in 2026 Experts from across our business shared their thoughts in this new ZDNet article on ten ways AI could intensify cyber risk in 2026. The article with contributions from David Brauchler III, Natalie Walker, Floris Dankaart-Chang, Nigel G., Mark Frost and Gary Cannon® explores everything from escalating AI‑enabled attacks and pressure on security teams to the expanding skills gap, increased physical threats and the shift towards systemic‑level breaches. Thanks all for sharing your insights Read the full coverage in ZDNet: https://lnkd.in/gavfpwsd ZDNET

17

Inside the Email Compromise Playbook: Trends, IOCs, and Configuration Risks webinar by Health-ISAC Champion, Pondurance on Tuesday, April 7th at 1 PM ET. Register Here- https://lnkd.in/ehAX75UG Business Email Compromise (BEC) remains one of the most persistent and financially damaging attack types affecting healthcare organizations, from small clinics to larger hospital networks. Unlike malware-driven campaigns, modern BEC attacks often rely on credential theft, inbox manipulation, and misconfigurations that evade baseline security controls. This webinar examines how BEC tactics continue to evolve (but remain persistent), with a focus on real-world incident patterns observed. Attendees will gain insight into current threat actor behaviors, emerging indicators of compromise (IOCs), and the email configuration gaps that take part in the overall impact. Led by two Digital Forensics and Incident Response (DFIR) experts actively engaged in ongoing forensic investigations, this session provides a behind-the-scenes perspective on how incidents are detected, investigated, and contained. Participants will see what it looks like from the responder’s viewpoint — from analyzing audit logs and mailbox rules to tracing token abuse and identifying persistence mechanisms. #BusinessEmailCompromise #IncidentResponse #RansomwarePrevention

16

Threat intelligence for #OT environments requires some specialization. Read this article on Claroty Nexus by George Hulme to learn more. Great expert commentary here: https://hubs.li/Q03Dl2QG0

1

I spend a lot of time with manufacturers and product teams who aren’t questioning whether they must comply with the Cyber Resilience Act (CRA) they’re stuck on the how. The CRA is clear on the obligations, but in practice the hard part is interpretation: software distributed online, products that depend on cloud back-ends, continuous updates, open-source components, product families, legacy models… This is exactly what the European Commission is trying to address now. The Commission is preparing a Communication (a guidance document) to explain how the CRA should be applied in real situations and to support a consistent approach across the EU. It’s not a new Regulation and it’s not “binding law” in itself but it matters because it clarifies how key provisions are expected to be understood and implemented in practice. https://lnkd.in/etm43Utx What I like in this draft is that it turns the CRA into practical “rules of the road”, especially on: • Software scope & “placing on the market” (including iterative releases) • What counts as the “product” when hardware depends on apps/drivers/software delivered separately • Open-source (FOSS): when it’s out of scope vs when it becomes a commercial activity, and the steward concept • Updates vs “substantial modifications”: focus on risk/attack surface/intended purpose, not release size • Support period: 5 years is a minimum, and how this works with versioned software/upgrade paths • Cloud / remote processing: what’s part of the product vs general IT infrastructure • Risk assessment & due diligence: manufacturers keep responsibility, including for third-party components The draft is open for feedback for a limited period, and comments are expected in a structured template (so they can consolidate input). If you build products that will fall under CRA, this is a very good moment to stress-test your assumptions and flag the parts that are unclear, unrealistic, or could lead to unintended consequences. I’m sharing the draft guidance here because, from what I see, the companies that will move fastest are the ones that turn these interpretations into concrete internal rules: scope mapping, update governance, support period policy, OSS governance, and evidence-ready documentation.

32

New Apono Report Reveals 98% of Cybersecurity Leaders Are Slowing Agentic AI Adoption Due to Insufficient Security Controls https://ow.ly/qeip50Ymkf8 #TechnologyNews #AI #TechNews #CIOCommunity #CIOLeadership #CIOInfluence #TechLeadership #ITStrategy #FutureOfIT #TechTrends

2