Cyber threats looming in 2025

This year Cyber Essentials celebrated  it’s 10th birthday and the scheme has never been more important writes assessor Tyson McGuirk.

Notably, 2024 has seen Artificial Intelligence continue to dominate the headlines, and not without good reason.

The speed with which this new technology has developed can make it hard to keep up! AI can now be used to craft phishing emails, adopting the correct cadence and tone for emails that scammers have struggled to replicate in the past.

The Government’s cyber security breaches report, published in April, adds fuel to this, reporting that phishing is to blame for 84% of attacks on businesses.

The turbulent global political climate comes with risks to UK businesses, with the NCSC listing Russia, Iran, China and DPRK as significant threat actors in their annual review of 2024.

And there is no greater reminder of cyber security threats than the vulnerability revealed recently around the multifactor authentication for Microsoft products.

This vulnerability essentially involved a brute force method in guessing the multifactor authentication code – each session via Microsoft typically allows 10 attempts. However, it was found these attempts could be made simultaneously and with the app codes being valid for three minutes the chance of correctly guessing the MFA code is relatively high.

Looking forward to 2025, the critical importance of businesses maintaining and actively pursuing a healthy approach to cyber security is starker than ever.

Schemes such as Cyber Essentials are vital given the availability of information to low-skilled attackers through freedom of information via AI and social media. This means there are more low-skilled attackers than ever before – who can still cause significant damage if your company is not sufficiently protected and following good cyber hygiene.

In summary, the year ahead for the cyber security space is likely to be a turbulent and unpredictable one, therefore it is important to stay vigilant and stay ready to adapt to new cyber security threats.