Cyber Brief: Ransomware Surge, Insider Risk and AI Governance

Today's brief highlights the operational realities behind three persistent security challenges: the continued surge in ransomware activity, the enduring risk posed by trusted insiders, and the governance questions raised by AI development practices. Alongside these, the UK government has reinforced its position on cyber resilience and AI regulation, marking the 10th anniversary of the National Cyber Security Centre with a reminder that threat actors are adapting faster than many defences.

Q3 2026 sets new record for ransomware attacks

Infosecurity Magazine reports that Q3 2026 saw 2,627 claimed ransomware attacks, the highest quarterly total on record according to research published by Comparitech. The data shows significant increases across critical sectors including finance, technology, education and healthcare. The figures reflect publicly claimed attacks tracked via ransomware leak sites, meaning the true scale of ransomware activity is likely higher when unreported incidents and organisations that pay ransoms quietly are included. The research underscores that ransomware remains a high-volume, industrialised threat affecting organisations of all sizes and sectors.

For UK businesses, this trend reinforces that ransomware is not slowing down and continues to evolve in both scale and targeting sophistication. The increase in attacks against finance, technology and healthcare sectors is particularly relevant given the operational and regulatory pressures these industries face. Ransomware groups are refining their targeting, focusing on organisations where downtime, data loss or reputational damage creates the strongest incentive to pay. The volume of attacks also suggests that initial access methods, whether through phishing, credential compromise or unpatched vulnerabilities, remain effective at scale.

Why it matters

For UK businesses, this is a prompt to review whether your organisation has tested its ransomware response plan recently, confirmed that backups are isolated and recoverable, and ensured that privileged access is monitored and protected. The sustained volume of attacks means preparedness and resilience matter more than assuming you will not be targeted.

Source: Infosecurity Magazine

Former engineer sentenced for insider extortion plot against industrial firm

SecurityWeek reports that a former core infrastructure engineer has been sentenced to prison following an insider cyber extortion plot against an industrial firm. The individual deleted administrator accounts, reset hundreds of passwords across the company's systems, and demanded 20 bitcoin to restore access and spare the organisation's servers. The case highlights the significant damage that can be caused when a trusted insider with privileged access decides to act maliciously. The engineer's access to critical infrastructure and administrative credentials allowed them to cause widespread disruption quickly, demonstrating how insider threats can bypass many perimeter security controls.

For many organisations, this case serves as a reminder that insider risk is not limited to accidental data loss or negligence. Deliberate malicious activity by current or former employees with privileged access can cause immediate operational harm, particularly when offboarding processes, access reviews or monitoring of administrative actions are not robust. The extortion element also reflects a broader trend where insiders, familiar with an organisation's vulnerabilities and response capabilities, may attempt to exploit that knowledge for financial gain. The speed and scope of the disruption in this case underline how quickly an insider with the right access can move from trusted employee to serious threat.

Why it matters

This is a prompt to review whether your organisation has clear processes for revoking access immediately upon an employee's departure, monitors privileged account activity for unusual behaviour, and maintains offline or immutable backups that cannot be deleted by a single administrator. Insider risk management is as much about governance and oversight as it is about technical controls.

Source: SecurityWeek

OpenAI fires three safety researchers in dispute over AI risks

SecurityWeek reports that OpenAI has dismissed three safety researchers following a dispute over AI risks and the handling of sensitive information. The company stated that the researchers violated clear policies on handling sensitive information, though the dismissals have raised questions about internal tensions over how AI safety concerns are managed and communicated. The incident comes at a time when AI governance, transparency and safety practices are under increasing scrutiny from regulators, researchers and the public. The departure of safety-focused staff from a leading AI developer highlights the organisational and cultural challenges involved in balancing rapid AI development with responsible risk management.

For UK organisations deploying or integrating AI systems, this development underscores the importance of understanding the governance practices and safety commitments of the AI vendors and platforms they rely on. If internal safety teams at major AI developers are experiencing friction over risk disclosure and policy enforcement, it raises questions about how those risks are being communicated externally and whether organisations using these systems have sufficient visibility into potential safety or security concerns. The incident also reflects broader industry tensions around AI transparency, whistleblowing and the extent to which commercial pressures may influence safety decisions.

Why it matters

For many organisations, this is a prompt to review whether your AI procurement and vendor management processes include questions about safety governance, transparency commitments and how risks are disclosed. Understanding the internal culture and safety practices of AI providers is becoming as important as understanding their technical capabilities.

Source: SecurityWeek

King warns malicious online actors are evolving tactics

BBC News reports that the King has warned that malicious online actors are evolving their tactics, speaking of threats to the international order in a letter marking the 10th anniversary of the National Cyber Security Centre. The message reinforces the UK government's continued focus on cyber resilience and the need for organisations to adapt their defences in response to changing threat actor behaviour. The NCSC has played a central role in supporting UK organisations over the past decade, providing guidance, threat intelligence and incident response support across public and private sectors. The anniversary message highlights that while progress has been made, the threat landscape continues to develop in complexity and scale.

For UK businesses, the statement serves as a reminder that cyber security is not a static challenge. Threat actors, whether state-sponsored groups, organised criminals or opportunistic attackers, are continuously refining their methods, targeting and techniques. The reference to threats to the international order also reflects the increasing intersection between cyber security, geopolitics and national resilience. Organisations operating in critical sectors, supply chains or internationally connected environments should recognise that their security posture contributes to broader national resilience and that support and guidance from the NCSC and other UK authorities remains available.

Why it matters

This is a prompt to review whether your organisation is actively engaging with NCSC guidance, subscribing to threat intelligence updates and ensuring that your security strategy reflects the evolving threat landscape rather than relying on static controls implemented years ago. Cyber resilience requires ongoing attention and adaptation.

Source: BBC News

Today's Key Actions

• Review whether your ransomware response plan has been tested in the last 12 months, confirm that backups are isolated and recoverable, and ensure privileged access is monitored and protected.
• Check that your offboarding processes revoke access immediately upon an employee's departure, that privileged account activity is monitored for unusual behaviour, and that critical systems cannot be deleted or disabled by a single administrator.
• Review whether your AI procurement and vendor management processes include questions about safety governance, transparency commitments and how risks are disclosed by AI providers.
• Ensure your organisation is actively engaging with NCSC guidance, subscribing to threat intelligence updates and reviewing whether your security strategy reflects the current threat landscape.
• Confirm that ownership of these areas is clearly assigned across the organisation, with regular review cycles and escalation paths in place.

Secarma Insight

The stories today reflect three enduring truths about mature security practice: resilience comes from preparation before incidents happen, insider risk requires governance as much as technology, and understanding the practices of the vendors and platforms you depend on is part of your own risk management. The sustained volume of ransomware, the operational harm caused by a single malicious insider, and the governance questions raised by AI development all point to the same underlying principle: security is not a one-time implementation but an ongoing discipline built on clear ownership, regular review and the confidence to ask difficult questions. Organisations that approach these challenges with calm, structured attention rather than reactive urgency tend to be better prepared when incidents occur.