BeStreamWise has published research on the use of work phones for illegal streaming in the UK. It found that 68% of people who stream content illegally use a company smartphone for that activity.

The findings highlight a workplace cybersecurity issue linked to unofficial streaming sites and apps. Among illegal streamers aged 18 to 24, 71% said they had used a work smartphone to access sport, films or television from unofficial sources, compared with 62% of those aged 45 to 54.

More than half of illegal streamers using work smartphones, 56%, said their device had been infected with malware in the past 12 months. That compares with a national average of 18%, according to the research.

Some respondents also reported repeated problems. More than a quarter, 27%, said they had experienced malware infections multiple times during the past year.

Phishing was another risk highlighted in the study. One in five illegal streamers who use work devices, 20%, said they had received phishing attempts involving requests for passwords and account login data, compared with 8% of illegal streamers overall.

The survey also suggested that awareness of those risks remains low among some workers. Only 34% of respondents who use work devices for illegal streaming said they knew illegal streaming sites can infect devices with malware, compared with 42% of the public overall.

BeStreamWise is backed by government bodies and media and sports organisations including the Premier League, BBC, ITV, Sky and FACT. It describes itself as a cross-industry initiative focused on raising awareness of the risks linked to illegal streaming.

Business exposure

The figures add to a broader picture of cyber threats facing employers. Government data cited alongside the study shows phishing attacks are the most common type of cyber breach reported by UK businesses, affecting 38% of companies.

The same official figures put the average cost of a significant cyber attack at £195,000 for each affected business. That gives fresh relevance to employee behaviour on corporate devices, particularly when those devices are used to access unauthorised services outside normal company controls.

Illegal streaming has often been treated as a consumer issue linked to broadcasting rights and lost subscription revenue. The new data reframes it by focusing on the risks to company systems, internal networks and commercial information when workers use employer-issued phones to visit unofficial services.

Younger workers appeared more likely than older groups to use work devices in this way, though the practice was not limited to one age bracket. The gap between respondents aged 18 to 24 and those aged 45 to 54 was narrower than might be expected, suggesting the behaviour is spread across the workforce rather than confined to the youngest employees.

That pattern may complicate any response from employers. Companies that rely on staff policies alone may struggle if workers do not associate illegal streaming with cyber risk, especially when the activity takes place on smartphones that move in and out of corporate environments more easily than office-based desktop systems.

Expert warning

The research was accompanied by comment from independent cybersecurity expert James Bore.

“These findings will be a huge concern for business leaders looking to keep their networks and data safe. Illegal streaming sites and apps sit outside the security checks that legitimate platforms go through, so the risk of encountering malware is much higher. Installing unauthorised software on work devices carries the same risks as on personal devices, particularly if companies do not have up-to-date antivirus software installed. Malware can be an entry point into company networks where sensitive commercial and financial information is stored,” said James Bore, Independent Cybersecurity Expert.

The research was based on a survey of 2,000 people in the UK. Its central finding is that a large share of people who already access pirated content are doing so on employer-provided smartphones, creating a route by which malware and phishing attacks can reach business systems.

For employers, the issue goes beyond viewing habits to basic cyber hygiene. The data suggests that personal choices made on work devices can expose wider company infrastructure to threats that begin with a film, match or television stream.

JOSEPH GABRIEL LAGONSIN

News Editor

Phoenix Software has announced that two employees have achieved Broadcom VCF Knight status, Broadcom’s highest recognition for partner professionals.

Infrastructure Practise Lead Richard Worth and Senior Technical Consultant Robert Dent both received the Broadcom VCF Knight – Storage certification, recognising expertise in VMware Cloud Foundation-related storage.

The achievement strengthens Phoenix’s position within Broadcom’s partner network, where it holds UK Pinnacle and Expert Advantage status. It also reflects continued investment by the York-based business in technical staff with specialist VMware expertise.

Broadcom’s Knight programme identifies partner specialists with experience in the architecture, design, implementation and support of Broadcom technologies. In this case, the focus was on VMware Cloud Foundation and related storage work.

The process involves several stages rather than a single exam. Candidates must pass multiple advanced technical tests, submit evidence of customer designs, deliver a live technical demonstration to a Broadcom sponsor, and then undergo nomination and review by a Broadcom panel.

The certification typically takes several months to complete and requires periodic renewal, making it a relatively rare qualification within the VMware and Broadcom partner ecosystem.

Worth has worked in IT for more than 25 years, including nine at Phoenix, where he leads the infrastructure practice. His background spans networking, storage and virtualisation, all closely tied to the technologies covered by VMware Cloud Foundation.

Dent has worked with VMware technologies for more than 20 years, beginning during an early IT apprenticeship and later implementing virtualisation environments at the University of Hull. His experience also includes servers, storage, NetApp and vSAN, and he gained his first VMware certification while working at the university.

Technical route

The certifications come as many customers reassess their VMware environments following Broadcom’s acquisition of the software business. That has increased scrutiny on partners able to demonstrate deep product knowledge and delivery experience.

Both men completed the same rigorous process to secure the designation, which Phoenix described as evidence of its ability to support organisations running complex virtualised infrastructure.

Worth said: “The difference with the Knight programme is that it recognises not just what you know, but what you’ve actually delivered. It reflects real-world experience – designing, implementing, and solving problems for customers. For me, VCF brings together everything we do across networking, storage, and virtualisation into one cohesive platform.”

Dent linked the certification to customer expectations around complex infrastructure projects.

Dent said: “This is one of the highest standards a consultant can achieve. It’s exactly the level of expertise customers expect when they’re investing in complex platforms like VMware Cloud Foundation. For me, it’s also about continuing to learn and building environments where the wider team can develop their skills.”

Phoenix operates across software licensing, hardware, software asset management and managed IT services, and has been in the market for more than 30 years. It works with public and private sector customers on IT strategy, infrastructure design, deployment and software management.

The latest certifications suggest the company is seeking to deepen specialist skills in core infrastructure areas as customers continue to assess how they manage virtualisation, storage and networking in consolidated cloud environments.

Restore Information Management has warned that connected building systems are becoming a cyber security risk for organisations, with many businesses failing to secure operational technology such as building management systems, access control and CCTV.

The warning comes as attackers expand their focus beyond traditional IT to target the technology that supports day-to-day building operations. These systems are increasingly internet-connected, remotely managed and linked to cloud services, widening the number of potential entry points for attackers.

Official figures underline the scale of the issue. The latest UK Government Cyber Security Breaches Survey found that 43% of UK businesses experienced a cyber security breach or attack in the past 12 months.

David Robinson, Head of Cybersecurity at Restore Information Management, said many organisations have basic weaknesses across their operational technology environments, particularly default settings and poor access controls.

“Many building systems still rely on default credentials straight out of the box. If these credentials aren’t changed, cyber criminals can gain access to critical systems with relative ease. As today’s digital building systems become increasingly connected, remotely managed and cloud-based, they are evolving faster than many organisations can secure them. Without the right controls, attackers could disrupt critical building systems, disable physical security measures or use them as a route into the wider corporate network,” Robinson said.

Attack surface

Robinson said one of the main steps organisations should take is to establish a full inventory of connected building systems, including building management systems, access control platforms, CCTV networks and environmental controls.

In practice, that means knowing what equipment is connected to the network, who is responsible for managing it and how users, contractors and suppliers can access it. Security teams often have a clearer view of laptops, servers and business applications than of operational technology embedded in buildings, creating a gap that can persist for years.

He also highlighted the risk posed by shared and default credentials. Manufacturer-set passwords remain common across a range of connected systems, and shared accounts can make it difficult to trace activity or remove access when a staff member or contractor leaves.

Restore urged organisations to replace default credentials as soon as systems are deployed, remove shared logins and ensure each employee or contractor has an individual account. That allows access to be monitored and withdrawn when required.

Remote access

Another area of concern is remote access for suppliers and maintenance providers. Building systems often rely on outside specialists for configuration, support and servicing, but these links can remain open long after a project has ended.

Robinson said access should be formally approved, reviewed regularly and removed once work is complete or contracts expire. Dormant contractor accounts, he added, should not remain active.

The issue has become more pressing as facilities technology has become easier to access from outside a site. Remote management can help operators maintain systems across multiple buildings, but it also creates another route that needs oversight from both facilities and cyber security teams.

Network separation

Restore also called for stronger segmentation between operational technology and corporate IT environments. Separating building systems from wider business networks can limit the damage if one part of the estate is compromised.

This matters because attackers who gain access to a connected operational system may try to move laterally into more sensitive parts of the organisation. Segmenting networks can make that movement harder and reduce the impact of a breach.

Security and facilities teams should work together to review legacy environments and identify where older systems can be better isolated. In many organisations, building technology has evolved in stages over a long period, leaving a mix of old and new equipment with varying security controls.

Strategic priority

Robinson’s final point was that operational technology should no longer sit outside mainstream cyber planning. He argued that connected building systems need to be included in an organisation’s wider security strategy, with regular reviews, staff awareness and stronger security design at the point of deployment.

That view reflects a broader shift in cyber risk management as physical infrastructure becomes more digital. Systems once treated mainly as facilities assets are now part of an organisation’s connected estate and can affect both physical security and business continuity if disrupted.

Restore Information Management is one of the UK’s larger information management providers and says it works with more than 6,000 clients, including more than 80% of NHS trusts. “Cyber security is no longer confined to servers and laptops. As buildings become smarter, the systems that control them require the same level of protection as every other critical asset,” Robinson said.