Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

IT leaders tell me the same story repeatedly. They’ve built large, sometimes expensive, security stacks, but they don’t trust them. Dozens of tools are running across the estate: separate agents, standalone scanners, multiple SIEMs, and identity providers layered on top of Microsoft’s native stack. Despite this, gaps remain. When you peel back these stacks, we often find redundant technology performing overlapping functions but not integrating well.

Microsoft E5 can be an excellent security investment, but without targeted configuration, integration, and continual threat alignment, its value remains untapped. Over the years, building out custom SOC, MDR, and MXDR services has shown us how to move from licenced capability to reduced response times, cleaner telemetry, and security teams who trust the picture in front of them.

That was the message from major UK retailers like Marks & Spencer and the Co-op during recent Parliamentary hearings on cyber resilience. Their stories weren’t hypothetical, they were recovering from real-world incidents involving identity compromise, supply chain breaches, and operational disruption that cost hundreds of millions of pounds. The lesson is clear. Prevention is necessary, but it is no longer enough.

From the passing Telegraph and Guardian coverage to orchestrated BBC and NCSC collaboration, the British media is repeatedly spotlighting Scattered Spider as 2025’s stimulant to jolt organisations into action. While this coverage has dislodged two blatant misconceptions, it has propagated several more subtle ones.

Executive leadership teams aren’t the only ones keenly aware that a merger or acquisition marks a vulnerable period. Attackers understand that times of change open fresh opportunities—not just to exploit transitional challenges in ERP systems or payroll but to actively capitalise on new financial realities – from manipulating stock prices via reputation damage to zeroing in on a target’s hypothetically more lucrative ransomware payout.

JUMPSEC have detected and tracked a new phishing attack campaign targeting numerous industrial sector organisations, predominately in engineering, construction, and energy sectors in the UK and US, where threat actors have consistently used a common and identifiable AITM (Adversary in the Middle) phishing kit throughout March 2025. At-risk organisations should take steps to reduce the risk of compromise as the infrastructure detailed below continues to be leveraged by threat actors.