Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Fraud against rail operators extends well beyond fare dodging. CYJAX breaks down how compensation scheme abuse, insider fraud and Telegram marketplaces for discounted tickets are combining to create a persistent revenue threat across the UK rail sector.

Domain Monitor's detection engine has been rebuilt to catch impersonation domains that keyword matching was never built to find. This release covers the new evidence-based matching engine, per-keyword Low, Medium and High thresholds, and what's coming next as the improvements roll out in stages. Domain Monitor's detection engine has been rebuilt from the ground up.

From a ransomware-as-a-service group that can move from initial access to full encryption in under four hours, to a China-linked affiliate that has quietly pivoted to its own encryptor, these two threat actors show how mature the ransomware ecosystem has become. CYJAX breaks down what each group does, why they matter, and what security teams should know.

UK fintech is one of the country's fastest-growing sectors, but its reliance on APIs, partnerships, and real-time data makes it a prime target for cybercriminals. This blog explores why fintechs are so exposed, what the latest UK data reveals about breach costs and supply chain risk, and how cyber threat intelligence helps firms grow securely.

The UK's compliance environment is shifting fast as organisations move to the cloud and accelerate digital transformation. This guide breaks down the core cybersecurity laws and regulations UK organisations need to know, from data protection statutes to sector-specific frameworks, and what recent government data reveals about the threat landscape driving them.

WhatsApp has begun rolling out usernames, letting people connect without sharing their phone number. The feature adds privacy for individual users but opens fresh territory for impersonation, lookalike accounts, and smishing, particularly as usernames are reserved on a country-by-country basis.

The insurance sector faces mounting pressure from both commercial growth and a persistent, evolving cyber threat landscape. This blog examines why insurers remain key targets, where their security gaps lie, and how cyber threat intelligence helps close the gap between ambition and resilience.

The NHS, MoD, and Metropolitan Police have each built deep operational dependency on Palantir through contracts largely awarded without competitive tender. Parliament has called it "an unacceptable point of weakness," Sadiq Khan blocked a £50 million Met Police deal, and the pattern keeps repeating: enter below scrutiny thresholds, build dependency, make exit expensive.

Rail networks sit at the intersection of critical national infrastructure and daily public life, making them a persistent target for protest, industrial action, infrastructure crime and, in parts of Europe, suspected sabotage tied to geopolitical tensions. This analysis from CYJAX sets out the physical threat picture in the UK alongside that of the wider continent.

The final part of CYJAX's rail cybersecurity series sets out a practical, five-step roadmap for building a rail-specific threat intelligence capability, covering regulation, coverage, and where to start regardless of maturity.