Beyond AI, cybersecurity challenges continue to evolve. Effective vulnerability management requires more than just CVSS scores, and supply chain attacks highlight the need for greater scrutiny of third-party providers. Meanwhile, advancements in quantum computing could reshape encryption and cloud security.

As we navigate 2025, understanding these trends will be key to staying ahead in an increasingly complex digital landscape.

AI is everywhere but does it need to be?

There’s been something of a stampede by vendors to add AI functionality into products.  It seems almost every product now has a Copilot or similar feature claiming to make life easier.  Understanding how beneficial this is to users is unclear at present.  When evaluating new products, KedronUK does cast a critical eye over the “datasheet benefits” and how they many actually work in the real world.

AI and ML does suit some applications very well though.  Surfacing performance or security detections (events / alerts) in large amoun’ts of data, such as raw network traffic in NDR tools or logs in a SIEM solution, is a great use case.

AI isn’t just all good though

I’m sure every IT professional has seen a terrible attempt at a phishing e-mail, either offering them money lost in a foreign bank account or one claiming to be from a senior colleague asking them to help with an urgent action.  Easy access to AI tools will make these harder to spot as they mimic the writing style or even voices of colleagues.  Alongside appropriate security tools, user awareness will be very important in helping combat this threat.

Managing the use of AI platforms will also continue to challenge organisations from a GRC perspective.  The leaking of sensitive data could occur thanks to careless but well-intentioned use of AI to help with productivity.

Look beyond just the vulnerability

Vulnerability scanners are a common and essential part of any IT’s team tooling.  Finding and addressing vulnerabilities early is important in maintaining a good secure posture.  However, just considering a CVSS score in isolation may not deliver the best results.  Leveraging additional data sources such as the CISA KEV catalogue can provide extra context to help prioritise remediation work.  As an example, a CVE with a score of 9.8 would, at first glance, look to need immediately addressing.  However, it may not be actively exploited.  Thus, a CVE with a lower score (eg 6.5) which is being commonly exploited should be addressed first.

Incorporating vulnerabilities (with all import context) and other signals can provide a much wider and more complete view of your attack surface.

Trusted Partners

The December 2024 attack on the US Department of the Treasury used BeyondTrust’s remote support tools to gain access to the Department’s infrastructure.  Supply chain attacks are nothing new though – the SolarWinds Sunburst and Supernova attacks date back to 2020/21.  Whilst SaaS (or other XaaS) still has many benefits, it can be extremely difficult to audit and build trust in a provider.  Major SaaS providers will continue to be a ripe target for nation state attackers.  This may encourage organisations to move back to self-hosted solutions, especially critical parts of the infrastructure such as ZTNA.

This topic doesn’t just cover technology service providers though.  With the change of government in the USA and their “unsettling” statements on subjects such as security, borders and tariffs, both private business and public sector users may start to reconsider the implications of hosting applications and storing data in cloud platforms owned by US technology companies such as Microsoft and Google.  Could unexpected policy announcements have sudden legal implications for data sovereignty and local compliance regulations?

The World of Quantum

For large enterprises, interest in quantum computing will continue to grow as they research and plan how the new age will impact their operations.  The applications of aspects quantum computing, such as Quantum Random Number Generation gives financial businesses the chance to improve the accuracy and speed of simulations.   QRNG also offers a truly random source of random numbers to provide an ideal basis for encryption keys.  Entropy as a Service offers a way to benefit for cloud applications and IoT devices to benefit from QRNG.

For more information please get in touch!

In our increasingly digital world, cyber-attacks pose a significant threat to both individuals and organisations. Understanding these threats and learning how to protect yourself is essential. This blog post will delve into some of the most common cyber-attacks, providing detailed insights and practical prevention tips.

1. Phishing Attacks

Phishing attacks are deceptive attempts to obtain sensitive information such as usernames, passwords, and credit card details. These attacks often come in the form of emails, text messages, or websites that mimic legitimate communications from trusted sources.

How it works:

• The attacker sends a message that appears to be from a reputable entity, such as a bank, telecommunications, cloud provider, courier / postal service or other well-known company.
• The message contains a link or attachment that prompts the victim to enter personal information such as logon credentials or download malware.

Prevention Tips:

• Verify the Source: Always check the senders email address and look for signs of spoofing. If unsure, contact the organisation directly using a known, legitimate contact method.
• Think Before You Click/React: Hover over the links to see where they lead before clicking. Be cautious with unexpected attachments, even from known contacts. Services like Microsoft 365 and Google Workspace can place additional warnings into external e-mails to help users spot phishing attempts which try to make out they are internal from a colleague.
• Use Security Services/Software: Implement email filters and anti-phishing tools to detect and block malicious messages. Alongside the standard security controls provided by email providers, third party vendors such as Heimdal offer additional layers of security.
• Education: Regularly train employees on how to recognise and respond to phishing attempts. Simulated phishing attacks can be occasionally run to ensure user awareness is checked and maintained.

2. Ransomware & Malware 

Ransomware is a type of malware that encrypts a victims files to prevent access and demands a ransom for the decryption key. Attackers may also exfiltrate the data and threaten to publicly release sensitive business information if a ransom is not paid. This attack can cripple businesses, plus cause significant financial losses and reputational damage.

How It Works: 

• Ransomware typically spreads through phishing emails, malicious ads, or by exploiting vulnerabilities in software. Once executed, it encrypts files and displays a ransom note demanding payment, often in cryptocurrency. It will also try to move laterally across a network to maximise the disruption.

Prevention Tips: 

• Regular Backups: Again, maintain regular backups of critical data and ensure they are stored offline or in a secure cloud environment. Immutable backups can protect critical restore points from ransomware. Backup procedures need to be tested on a regular basis to ensure they are working as expected – do not just trust log reports!
• Install Antivirus / EDR Software: Ensure you have reliable antivirus and anti-malware software installed and regularly updated. That said, the recent CrowdStrike outage has shown regular updated can be a double-edge sword!
• Patch Vulnerabilities: Keep your software and systems updated to protect against exploits. A vulnerability scanner / solution such as Qualys. Tenable Nessus or Rapid7 InsightVM can help automate this process to avoid blind-spots when dealing with a large IT estate. Any vulnerabilities with a CVE score of 9 or more should generally be treated as a priority and either be patched or mitigated.
• Network Segmentation: Segment your network to limit the spread of ransomware and contain potential damage. Zero Trust Network Access (ZTNA) solutions like Appgate can ensure users only have access to the applications they need, restricting the ability of ransomware to move laterally to other devices on the network.
• Consider Fire-Break Solutions: Ransomware containment solutions such as BullWall RC can provide a last line of defence against encryption. These solutions aim to stop a ransomware attack as quickly as possible, isolating or shutting down the infected PC(s) to minimise the impact of the attack.
• Examine your full supply chain and technology stack: A number of enterprises impacted by the ransomware groups which targeted the MOVEit vulnerabilities were actually affected due to the use of MOVEit by their payroll / HR software provider (TechCrunch).

3. EOS/EOL and Unpatched Network Equipment

Patching operating systems and applications is a regular task for most businesses, with tools such as Heimdal Patch & Asset Management used to automate much of the repetitive work. However, it is also critically important to update network equipment, especially routers and firewalls which are internet facing.

Research published this week by Vedere Labs, the cybersecurity research arm of our partner Forescout, identified 14 new security vulnerabilities in 24 models of the popular DrayTek Vigor network routers/firewalls. Around 785,000 impacted devices have been identified globally, with 20% of these considered to be End of Life (EOL) and 43% End of Support (EOS).

Thankfully, DrayTek have provided firmware updates for EOS/EOL routers.

How It Works: 

• Attackers use automated tools such as Shodan to scan the Internet for exposed devices with out-of-date firmware.
• One located, attackers will have scripts ready to exploit the security bugs.
• The attackers may use the device launch DDoS attacks as part of a botnet, intercept traffic or penetrate the private network behind the firewall/router to deploy ransomware.

Prevention Tips:

• Patch Firmware: Where possible, subscribe to vendor email notifications to automatically receive alerts for new firmware release. More importantly, arrange appropriate maintenance windows to install the updates, especially where they contain security fixes.
• Replace End of Life (EOL) Equipment: Critical network infrastructure which is EOS/EOL and thus unsupported should be replaced. Even though the equipment may continue to work fine without support by the vendor, the lack of updates means rushing to replace a device when an exploit is found and widely abused. Not all vendors will product patches for old equipment like DrayTek!
• Remove or secure public management access: Although convenient for remote support, exposing router, firewall or other management interfaces directly to the Internet should be avoided wherever possible. The DrayTek research found over 704,00 devices with the management UI exposed to the Internet.

Conclusion

Understanding these common cyber-attacks and implementing robust security measures can significantly reduce your risk. Stay informed, stay vigilant, and prioritize cybersecurity to protect yourself and your organisation from these pervasive threats.

As an independent specialist consultancy working with leading cyber-security vendors, KedronUK can assist enterprises in addressing gaps within their security tooling from EOL device management through to ransomware containment solutions.

For more information on our full product portfolio, please contact us, or email our sales team at sales@kedronuk.com.