Business & Technology
Cyber Essentials update raises bar on visibility gaps
ThreatAware has warned organisations to close cybersecurity visibility gaps ahead of changes to the UK’s Cyber Essentials scheme. The updated version introduces stricter checks for certification.
The revised standard adds two automatic failure conditions and raises the bar for proving that key controls are in place across full IT environments. The five technical controls at the heart of Cyber Essentials remain unchanged, but the assessment process will place greater weight on whether those controls are consistently enforced in practice.
Under the changes, any cloud service that supports multi-factor authentication must have it enabled. A single account without MFA would trigger an automatic failure.
Another change shortens the window for fixing critical and high-risk vulnerabilities. Organisations will need to remediate those issues within 14 days across endpoints, applications and network infrastructure.
Scrutiny during assessments is also set to increase. If sample testing identifies failures, organisations will need to fix the same issues across the whole environment before they can be reassessed.
Stricter checks
IASME has published the update, which is backed by the National Cyber Security Centre. For many UK organisations, Cyber Essentials certification remains a basic requirement for working with government departments and parts of the wider supply chain, and it is often linked to cyber insurance conditions.
That makes the practical effect of the revised rules significant for companies that rely on certification to win or retain contracts. The changes shift the focus from written policy to proof that controls are active across all users, devices and systems.
Common weak points include misconfigured conditional access policies, unmanaged or guest accounts, devices outside patching windows, and unsanctioned software-as-a-service use. Under the updated framework, any one of those gaps could be enough to prevent certification.
Jon Tamplin, Head of Cybersecurity at ThreatAware, said: “These updates reinforce a fundamental cornerstone of cybersecurity: when organisations get the basics right, they prevent the vast majority of attacks. And it starts with one essential principle – visibility.
“Visibility isn’t a nice-to-have; it’s the foundation of effective security. Think about this from the attacker’s perspective: they’re looking for the easiest path. A high-risk account where MFA isn’t enforced can quickly lead to a compromised device.”
Proof required
The emphasis on evidence reflects a broader trend in cyber compliance, with auditors and certification bodies increasingly wanting to see operational controls rather than policy statements. In practice, that means security teams must be able to account for every relevant device and user account, including those outside standard management processes.
For larger organisations, that can be difficult when estates include a mix of on-premises systems, cloud applications, third-party tools and temporary accounts. Guest users, shadow IT and assets outside central management often create the blind spots that compliance frameworks are now trying to eliminate.
Tamplin said: “If security leaders can’t identify where these gaps are, they’re effectively working with one hand tied behind their back. Teams are doing their best, but it only takes one device without the right security controls to expose an entire network.
“If you can’t see every device and every account, you can’t prove the controls are working. Under v3.3, proof is exactly what’s required, and it only takes one device outside the patch window or one account without MFA enforced to fail an assessment.
“The message behind the Cyber Essentials updates is simple: get the fundamentals right. Those fundamentals haven’t changed, but expectations have. Organisations should not only have core controls in place, from patching to EDR and MFA, but also be able to prove they are applying them across every account and every device, all the time, to meet the ‘Five Controls’.”
The revised requirements apply immediately to new certification accounts created under the updated scheme, while organisations with existing accounts have a six-month transition period to certify under the previous standard. That phased approach gives some businesses extra time, but it also creates a near-term decision for organisations that need certification for procurement, supplier assurance or insurance purposes.
ThreatAware, founded in 2018, works with more than 100 organisations across the UK, US and Canada.
Business & Technology
Sound Devices unveils Astral Mini Plus wireless pack
SOFIAH NICHOLE SALIVIO
News Editor
Sound Devices has introduced the Astral Mini Plus wireless transmitter pack as part of its Astral Wireless range.
Aimed at touring, live theatre and fixed-installation work, the device keeps the compact form factor of earlier Astral transmitters while adding longer battery life, a wider tuning range and water resistance.
Astral Mini Plus offers more than eight hours of battery life and a tuning range of 169-1525 MHz. It also carries an IP67 water-resistance rating, meaning it is designed to withstand dust and temporary immersion.
Alongside the hardware launch, Sound Devices has updated the broader Astral Wireless line with V8.30 firmware. The update adds SoundBase integration to AstralComm and introduces routing changes across the range.
According to Sound Devices, the SoundBase link is intended to give audio engineers a more direct way to monitor and adjust wireless devices during RF coordination. Functions include changing frequencies, renaming transmitters and keeping key operating information visible.
Broader range
The release expands a portfolio that Sound Devices markets to sound professionals working in film, television, live events, houses of worship and education. The company designs, assembles and supports its products from its headquarters in Reedsburg, Wisconsin, and offices in Madison, Wisconsin, and Rickmansworth, UK.
The new transmitter arrives as wireless audio suppliers continue to adapt products to shifting spectrum conditions and varied venue requirements. In that context, tuning flexibility and software control have become more prominent selling points for manufacturers serving touring crews, theatre operators and systems integrators.
Sound Devices said the new model was designed to improve usability and shorten setup times. It said the updated firmware is intended to simplify operation across the Astral range by giving engineers more flexible routing options.
Matt Anderson, Chief Executive Officer at Sound Devices, commented on the launch and the software update.
“Astral Wireless is the most full-featured wireless toolkit on the market, designed to meet the ever-changing needs of a rapidly evolving RF landscape,” said Matt Anderson, Chief Executive Officer at Sound Devices.
“The launch of Astral Mini Plus, along with continued firmware development and deeper software integrations, reflects our commitment to this constant evolution and our desire to provide high-quality solutions that reflect the day-to-day realities of the most demanding RF professionals,” Anderson said.
The launch reflects a wider trend in professional audio towards combining hardware improvements with deeper software integration.
As productions become more complex and spectrum management challenges increase, manufacturers are placing greater emphasis on tools that simplify wireless coordination and device monitoring. The addition of SoundBase integration is expected to appeal to engineers managing large-scale deployments where visibility and control are critical. Extended battery life and expanded tuning capabilities may also help reduce operational interruptions in demanding live and broadcast environments.
With the latest hardware and firmware updates, Sound Devices is continuing to position Astral Wireless as a comprehensive platform for professional RF applications.
Business & Technology
US fast food chain set to open its first UK restaurant
Louisiana-born chicken brand Raising Cane’s is setting up shop on Coventry Street in the heart of London, between Piccadilly Circus and Leicester Square.
Although no official opening date has been announced, branded hoardings have now appeared at the site, signalling that the long-awaited launch is edging closer.
The chain, loved by celebrities including Snoop Dogg, Post Malone and Halle Berry, opened its first store in 1996, and as it approaches 30 years in business, is coming to the UK for the first time.
US fast food chain Raising Cane’s set to open its first UK restaurant
The chain has already developed a UK-focused menu featuring both take-out and dine-in meal options, as well as customisable chicken finger combos.
Unlike many competitors, Raising Cane’s keeps its menu simple, offering chicken fingers, crinkle-cut fries, coleslaw, Texas toast, and its signature Cane’s Sauce.
The sauce, described by fans as “next level,” is a particular point of excitement among British diners, who have shared their enthusiasm online.
One food lover wrote: “Omg I absolutely love Raising Cane’s.”
Another said: “Had this in Vegas.
“It was so good.
“Definitely on a par with Slim Chickens imo.”
A third added: “The sauce is next level.
“I will travel just for that.”
The company is reportedly exploring additional central London locations, including Oxford Circus, Paddington, South Bank, and The Strand, as well as potential drive-thru sites across Greater London.
The London restaurant will be the starting point for the brand’s wider European rollout.
US fast food chain rivalling McDonald’s coming back to UK after 17 years
Raising Cane’s is the latest in a wave of US fast-food brands expanding into the UK market.
Recent arrivals include Popeyes, while Dave’s Hot Chicken and Chick-fil-A have also announced UK expansion plans.
Chili’s Grill & Bar is also looking to come back to the UK after more than 15 years, with hopes of eventually opening more than 100 restaurants across the country.
The chain originally arrived in Britain during the 1990s and operated restaurants in places including Cambridge, Reading and London’s Canary Wharf, but by 2009, every UK branch had closed.
Now, the company is making a fresh attempt at cracking the UK market, aiming to open a flagship restaurant within the next 12 to 18 months before it aims to roll out more sites, reports Need To Know.
Industry insiders say they believe the chain could open between 85 and 100 restaurants if successful, with potential locations including London, Manchester, Birmingham, Leeds, Glasgow, and Liverpool.
The Tex-Mex chain is well-known in the US for its burgers, ribs, fajitas, and margaritas.
What US restaurant or fast food chain would you most like to see come to the UK?
Business & Technology
UK firms struggle to map supply chain cyber threats
More than eight in 10 UK cyber security and third-party risk professionals say their organisation experienced at least one supply chain cyber incident in the past year, highlighting continued gaps in supplier oversight and incident response.
Risk Ledger‘s research Every Link Matters: The State of Supply Chain Security 2026 – UK Edition found 82.4% of respondents recorded at least one supply chain incident in the previous 12 months. Almost half, at 47.2%, reported two or more. The findings suggest supply chain cyber risk remains a persistent issue for organisations across sectors, despite stronger regulatory scrutiny of operational resilience and supplier dependencies.
Risk levels
The survey of 500 UK cyber security and third-party risk management professionals found 86% ranked supply chain cyber incidents among their top three concerns for 2026.
The data also shows a gap between concern and readiness. Only 6% of respondents said they could accurately map exposure across their supplier ecosystem in under four hours after a major supply chain cyber incident. Another 45% said it would take between four and 24 hours.
More than a quarter said it would take one to three business days. A further 23% said it would take more than a week and require manual outreach to suppliers.
Those delays can limit an organisation’s ability to respond when a supplier is compromised. Teams need to know which business services, systems and processes may be exposed. They also need to understand whether risk extends deeper into the supply chain.
Slow checks
Supplier due diligence remains slow. Only 38% of respondents said their organisation could complete security due diligence for a new supplier within two weeks.
Another 34.6% said the process took three weeks or more. Within that group, 12% said it took more than one month.
Risk Ledger’s analysis points to a structural weakness in many third-party risk management processes. They often remain manual and focused on bilateral assessment between one customer and one supplier. Many still rely on bespoke questionnaires and periodic reviews.
That approach can create duplicated work for suppliers. It can also leave customers relying on information that may not reflect current security controls.
Visibility gap
Visibility beyond direct suppliers remains uneven.
Some 30% of respondents said they had full visibility into the entire chain of subcontractors contributing to important business functions. Just over half, at 50.2%, said they had high visibility into all direct subcontractors of critical third parties.
A further 16% reported only partial visibility into some fourth parties of their critical suppliers. Only 3% said they had no visibility beyond direct critical third parties.
The findings come as regulators in the UK and EU put greater emphasis on operational resilience, concentration risk and the mapping of digital dependencies. This includes closer scrutiny of subcontractors and deeper-tier relationships that support critical or important services.
“Identifying systemic risks is really important. However in most cases, only industry-level associations have enough combined resources and adequate information sharing guardrails in place to efficiently identify actual systemic risks, agree actions and, with the help of regulators, influence large players in the supply chain,” said Yohann Le Grand, Senior Security & Resilience GRC Manager, Lloyds Wealth.
Network mapping
Risk Ledger sets out a model it calls Active Supply Chain Security. It is based on standardised assessments, continuous monitoring, network visibility, collective defence and faster incident response.
The survey suggests organisations are open to more collaborative approaches. Some 42% of respondents said their organisation would be very supportive of an industry-wide model in which supplier intelligence and assurance data are shared with peers. A further 50.2% said they would be somewhat supportive.
Risk Ledger also examined three groups using its platform: 26 government organisations, 25 local authorities and 30 financial institutions.
Across the government group, the platform identified 3,240 direct third parties and 5,886 additional dependencies across shared nth parties. It also identified 1,264 potential concentration risks, including 820 at third-party level.
Of those third-party concentration risks, 224 were rated critical. Risk Ledger said this means an incident at one supplier would be likely to disrupt essential services at multiple public sector organisations.
“Risk Ledger’s Network Visualisation Tool has enabled us to efficiently identify critical risks across our supply chain, helping us address potential concentration risks before they escalate,” said Chris Phillips, Third-Party Compliance and Assurance Lead, Home Office Cyber Security (HOCS) | Governance, Risk and Compliance (GRC).
Sector exposure
The local authority group had 1,004 direct third parties and 7,659 additional dependencies across shared nth parties. Risk Ledger identified 1,240 potential concentration risks, including 364 at third-party level. Of those, 99 were rated critical.
The financial services group had 2,780 direct third parties and 6,529 additional dependencies. The platform identified 1,322 potential concentration risks, including 727 at third-party level. Of those, 288 were rated critical.
The analysis also found control weaknesses among some critical concentration risks. In the financial services group, 120 suppliers classified as critical third-party concentration risks did not have Cyber Essentials certification. Two were not using Multi-Factor Authentication to secure remote access to their network or cloud environments. Ten did not regularly test or rehearse Business Continuity and Disaster Recovery plans.
“A big challenge with third-party risk management comes down to how corporations and other organisations tackle peer-to-peer communication from within their respective siloes. We (as customers of common suppliers) need to get better at working with each other and trusting what our peers are doing. Using feedback as a form of intelligence about shared interests would allow companies to focus more time on fixing the things we really care about,” said Jay Vinda, Global CISO and Cyber Risk Engineering Lead, Mosaic Insurance.
Read full report here.
-
Crime & Safety4 weeks agoWhat happens to Halifax customers if Lloyds makes changes?
-
Crime & Safety4 weeks agoFlock of clay birds set to take flight in special exhibition
-
Oxford News4 weeks agoActor steps down from major role in new Harry Potter series
-
Crime & Safety4 weeks agoOxfordshire bridge closure comes as management ‘weaknesses’ found
-
Oxford News4 weeks agoNHS fracture service helps support extra 1,000 patients
-
Oxford News4 weeks agoHenley pub once owned by Russell Brand reopens after 6 years
-
Crime & Safety4 weeks agoFriends of the Ridgeway appoint Matthew Barber as president
-
UK News4 weeks agoThe race to replace Starmer is on – but he still faces a momentous choice
