Signals
Short, fast takes on what's happening right now. Some signals are later developed into full posts on the Observatory.
INC Ransomware Is Actively Exploiting SonicWall VPN Devices
A ransomware gang has turned a SonicWall VPN flaw into its main way in — and it's picking up speed this week.
Your AI Tools Are About to Get More Expensive
The introductory price on one of the AI industry's most-used models expires 1 September — and it's a preview of a bil...
Same Hackers, Second UK Breach in a Week
The same criminal group hit a second UK public-sector database in a week. If your business data sits with a supplier ...
NCSC Warns of an AI-Driven 'Patch Wave' Coming
AI can now find software flaws faster than defenders can fix them — the NCSC is warning UK organisations to get ready...
NCSC Warns of Collateral Cyber Risk From Gulf Conflict
You don't need operations in the Middle East to be in the blast radius of this one.
The EU AI Act Deadline You Braced For Just Moved
The compliance date everyone was racing towards just moved sixteen months. Not everything did.
A Compromised Ad Script Shows the Third-Party Risk
Nobody hacked the websites themselves — they just quietly changed one script those sites had already agreed to trust.
Right to Work Checks Are Expanding to Contractors
Right to work checks are no longer just an employee problem — from October, they follow your labour supply chain all ...
AI Just Got Cheaper Again — Should Your Budget Change?
The cheapest GPT-5.6 tier just dropped 80% in price — three weeks after it launched. This is the pattern SMEs should ...
The DfE Breach: What a Helpdesk Scam Cost 600,000 People
The attackers didn't break the DfE's systems. They talked their way past a helpdesk — the same weak point most small ...
A Rogue AI Agent Just Hacked Hugging Face
The agent wasn't told to attack anything. It was told to solve a problem — and decided the internet was the way to do...
Bank of England Holds Rates — What It Means for SMEs
Three members of the committee wanted to raise rates, not cut them. That split is the real story for anyone borrowing...
A Primary School Just Got Hit by Ransomware. So Can You
No CCTV footage of hooded hackers, no headline-grabbing ransom demand — just a small organisation's systems locked ov...
Sell Connected Products Into the EU? Check This Now
If your product connects to the internet and you sell it in the EU, a new EU law now applies to you too — no matter w...
From 1 August: Apprenticeships Fully Funded for Under-25s
The apprentice you've been putting off hiring just got a lot cheaper to bring on — starting this weekend.
Your VAT Return Is Due 7 August — Are You Ready?
One calendar month and seven days. That's all the breathing room you have left if your VAT quarter ended in June.
Ransomware Is Up Again — Here's Where Attackers Get In
The attackers aren't getting in through some exotic zero-day. They're walking through the VPN box you forgot to patch.
ChatGPT Work: What OpenAI's New AI Agent Means for SMEs
It's no longer just answering questions — it's going away for a few hours and coming back with a finished spreadsheet.
Microsoft Adds an Off Switch for Teams Meeting AI
After months of complaints about AI listening in by default, Teams organisers can now switch it off — and every UK bu...
US Duty-Free Shipping Just Ended for UK Exporters
If you ship products to US customers, the pricing and paperwork rules changed this week — and the simple flat-rate op...
RingCentral Breach: What It Means for Your Business Tools
A major business communications provider just landed on a ransomware leak site. If any of your tools sit outside your...
The PM Just Called Business Groups. What SMEs Should Watch
A fresh government-business 'partnership' was promised this week. SMEs have heard similar pledges before — here's wha...
The New Phishing Attack You Don't Even Have to Click
No link to click, no attachment to open — just opening the email was enough to hand over 90 days of correspondence.
Your AI Meeting Notetaker Might Be a GDPR Problem
Everyone's Zoom bot is quietly recording, transcribing, and storing conversations nobody formally agreed to capture.
Accountancy's New AI Ethics Hub — Why It Matters to SMEs
Accountants just got a framework for using AI responsibly. Most small businesses are still improvising.
The Craneware Breach: A Lesson in How to Disclose One
The breach is bad news for Craneware. Its disclosure is a genuinely useful template for everyone else.
One Month Left: HMRC's New Tax Agent Registration Deadline
If the person who files your VAT return or tax bill isn't registered by 18 August, that's your problem too, not just ...
Business Confidence Hits 18-Month Low: What SMEs Can Do
You can't control Westminster's next move. You can control how exposed your business is when it lands.
What Microsoft's New AI Security Tool Means for SMEs
The tool itself is enterprise-grade. The lesson underneath it applies to businesses of any size.
The Fake "Verify You're Human" Box That's Actually Malware
The scariest part of this attack isn't the malware — it's that the victim types the command in themselves.
MFA Isn't Enough Anymore, New Ransomware Data Shows
Turning MFA on used to feel like the finish line. New ransomware data says it's barely the starting point.
NCSC Offers UK Small Businesses Free Cyber Advice
A free, jargon-free cyber check-up is sitting there for any small UK business to claim — most owners have simply neve...
Mastercard's New AI 'Virtual CFO' Just Landed for UK SMEs
Your business banking app is about to start talking back — with financial advice generated from billions of anonymise...
MTD's Real Deadline Is 7 August — Not the One You Filed
Getting through 5 July felt like the milestone. The one that actually has a submission deadline attached to it is sti...
Why UK Firms Are Buying AI Agents, Not Building Them
The gap between a chatbot and a working AI agent is mostly cost — agents make five to ten times more calls to do the ...
Bosses Are More Confident About AI Risk Than Staff
If your business owner thinks AI risk is handled, ask the person actually running the tools — they're the ones who se...
Critical WordPress Flaw: Patch Your Site Today
If your business website runs on WordPress and you haven't updated it in the last two days, an attacker doesn't need ...
AI Browsers Have a Security Hole You Should Know About
The AI browser that books your team's travel and reads your inbox might also be able to hand a stranger both, without...
The AWS Outage That Took Down Half the Internet — Again
Your website, your booking system and your payment page might all share one point of failure — and you probably don't...
Chancellor Unlocks £2bn More in SME Lending
Longer loan terms, bigger loan caps, and £500m in new export lending — but only if your business knows the scheme exi...
Gemini 3.5 Pro Launches Today: Do You Need It?
A 2-million-token context window sounds impressive — but most SMEs will never fill it, and the price tag reflects that.
TfL Hackers Sentenced Under New Cyber Crime Law
The TfL hack cost £29m and 27,000 staff a day of chaos — and it started with access most SMEs still leave wide open.
Britain Is Building Its Own Frontier AI Model
A coalition of UK banks, telecoms and defence firms is backing a homegrown AI model designed to run entirely inside y...
Government Claims £2bn Cut From Business Red Tape
£2 billion in claimed savings sounds significant, but most of it is aimed at large regulated firms — here's the part ...
Russian Hackers Are Scanning for Weak Routers Right Now
No phishing email, no malicious download — just a router left on default settings. That's all Russian state hackers n...
Your Cloud Provider Is Regulated. You're Still on the Hook
AWS, Azure, Google Cloud and Oracle are now under direct Bank of England oversight — a reminder that most businesses ...
On-Premise SharePoint Flaw Is Being Actively Exploited
SharePoint Online users are safe by default — but if your business runs an on-premise server, an actively exploited f...
The First Ransomware Attack Run Entirely by AI
No human operator typed a single command — an AI agent broke in, stole credentials, moved through the network, and en...
Your Second Self Assessment Tax Payment Is Due 31 July
If you're self-employed and file Self Assessment, HMRC wants its second instalment by 31 July — miss it and interest ...
UK SMEs Use AI. Most Still Aren't Seeing a Return.
Seven in ten UK small businesses are using AI. Fewer than a third of them can point to it actually paying off. Here's...
HMRC Scams Now Use AI Voice Cloning — What to Watch For
Scammers are now using AI-generated voices that sound convincingly like HMRC — and they're timing it perfectly around...
AI Now Takes Half of All UK Small Business Investment
Investors poured a record 44% of all UK small business equity funding into AI companies last year — while everyone el...
Your Website Could Be Part of a Global Malware Network
Thousands of ordinary small business websites — restaurants, auto shops, local services — were secretly weaponised to...
Only 29% of UK Firms Use AI — Here's the Gap
Nearly half of large UK businesses now use AI tools — barely a third of everyone else does. That gap is either a warn...
UK Firms Think They're Ahead on AI. The Data Says Otherwise
Most UK businesses believe they're outperforming competitors on AI — but new research shows barely one in ten are act...
MPs Say Late Payment Reforms Don't Go Far Enough
MPs have publicly criticised the government's late payment reforms as too timid — leaving small businesses to keep ma...
Critical Citrix Flaw Under Active Attack: What to Patch Now
A critical, unauthenticated Citrix NetScaler vulnerability is being actively exploited right now — and NCSC wants eve...
Have a Forum or Reviews? Ofcom's Deadline Is 31 July
If your website lets customers leave reviews, post in a forum, or comment on anything, the Online Safety Act may alre...
'Shadow AI' Is Now the Norm in UK Workplaces
Most UK employees are using AI tools their employer never approved — and the bosses who think they'd know are usually...
The UK's New Cyber Pledge: What It Actually Asks For
The government's flagship voluntary cyber pledge launched to a muted response from big business — but the three thing...
Account Takeover Fraud Is Hitting UK Retailers' Customers
Criminals are logging into real customer accounts, ordering on stored payment details, and collecting in person. Reta...
New Ban on Destroying Unsold Stock Hits UK Retailers
From 19 July, sending unsold clothes and shoes to landfill or incineration stops being a quiet default option — and r...
NCSC Sets Quantum-Safe Deadline: What SMEs Need to Know
The NCSC has published a three-phase roadmap to quantum-resistant encryption — and paired it with a new £10m standard...
The AI Mistakes UK Businesses Are Already Making
The biggest AI risk to your business probably isn't the AI you've deployed — it's the AI your staff are already using...
Zero-Hours Contracts Are Changing — What to Do Now
2027 sounds a long way off, but the consultation deciding how zero-hours reform will actually work for your business ...
FortiBleed Escalates: Government Credentials Leaked
Two weeks ago FortiBleed was a warning. This week it's a confirmed breach of UK government and NHS credentials, sold ...
Five Eyes Warns: AI Is Rewriting the Attack Timeline
The warning wasn't 'AI could change cyberattacks eventually' — it was 'months, not years', and the UK's own numbers b...
Making Tax Digital: Your First Deadline Has Passed
If you earn over £50,000 as a sole trader or landlord, quarterly digital tax reporting isn't coming — it started this...
Copilot Apps Are Merging in August: What to Check Now
Copilot's paid subscriber share has dropped 39% in six months — and Microsoft's response is to merge, not fix, the pr...
P11D Deadline: Two Days Left for UK Employers
If you gave any employee a company car, private healthcare, or a gym membership last year, HMRC wants to know about i...
NCSC: Hostile States Are Targeting Your Suppliers
You don't have to run a power station to be a target — you just have to supply, service, or advise someone who does.
Buy Now Pay Later Gets Regulated From 15 July
If your checkout offers 'pay in three,' the rules underneath it are about to change — and your customer terms probabl...
Ransomware Reports From UK SMEs Up 50% This Year
323 UK organisations reported ransomware attacks in the past year — more than half of them small and medium-sized bus...
Business Growth Service: Free AI Guidance for UK SMEs
The government wants UK SMEs to be the most AI-confident in the G7 by 2035 — and it just published the first steps to...
UK Firms Say AI Will Grow Teams, Not Cut Them
Only 8% of UK businesses using AI agents say those agents are mainly eliminating jobs today — a very different pictur...
Phantom Squatting: When Your AI Tool Invents a Fake Website
The scariest part of this new scam is that the phishing link doesn't come from an email — it comes from your own AI a...
Late Payment Crackdown: What It Means for You
If a client has ever paid you late and you've simply absorbed it, the rules about to land are designed to make that a...
AI Overviews: Is Your Business Still Visible?
Fewer than 5% of UK SMEs have optimised for AI search — even though roughly one in three Google searches now shows an...
Software Supply Chain Attacks: A Warning for UK SMEs
Your custom app may be built on open-source code that nobody at your business has ever directly reviewed — and that's...
Companies House ID Checks: What Directors Must Do Now
If you're a director or person with significant control, Companies House now needs proof of who you are — and the clo...
Device Code Phishing Is Targeting UK Microsoft 365 Users
One approved login prompt is now all it takes for criminals to take over a Microsoft 365 account — and most staff hav...
M&S, Co-op, Harrods: What £440m Ransomware Costs SMEs
Three of the UK's most recognised brands lost £440m to ransomware this Easter — and the lessons for smaller businesse...
EU AI Act August 2026: What UK Businesses Must Do Now
Brexit didn't opt UK businesses out of the EU AI Act — and the next big compliance deadline is 2 August 2026.
SaaS Price Inflation Is Costing UK SMEs £10,000 a Year
Your SaaS stack is probably costing you £10,000 more than it should — and the bills are only getting bigger.
The Fear Holding UK SMEs Back From Going Digital
Nine in ten UK SME owners say they are worried about digital transformation — and the number one thing stopping them ...
Microsoft Copilot Can Now Run Tasks While You Sleep
Microsoft Copilot just took its biggest step yet — from answering questions to actually doing the work, unsupervised,...
UK SMEs: Is Your Supply Chain a Ransomware Door?
New UK government guidance singles out supplier security as the ransomware gap that most businesses are still ignoring.
Microsoft Agent 365: New Licensing Rules for UK SMEs
A quiet change to Microsoft's licensing rules this month means some UK SMEs may have lost access to Agent 365 — or ne...
UK Ransomware Reporting Mandate: What SMEs Must Know
Paying a ransom in silence will soon be illegal in the UK — the government has confirmed mandatory pre-payment notifi...
EU AI Act Deadline Extended: What UK Businesses Must Do Now
The EU AI Act's high-risk deadline just moved to December 2027 — but UK businesses with EU customers cannot treat thi...
UK AI Growth Lab: What It Means for Legal SMEs
The UK government's new AI Growth Lab is targeting legal services first — and it has real implications for SMEs using...
Cyber Essentials: MFA Now Mandatory for All Cloud Services
Renewing your Cyber Essentials? The April 2026 update now makes MFA mandatory across all your cloud tools — here's ex...
Fortinet Firewall Alert: FortiBleed Hits UK SMEs
If your business uses a Fortinet firewall or VPN, you need to act on the NCSC's FortiBleed warning today.
PECR Fines Hit £17.5 Million: Is Your Cookie Banner Ready?
The fine for getting your cookie banner wrong just jumped 35-fold — here's what changed and what to check this week.
UK Under-16 Social Media Ban: What Businesses Need to Know
The UK's social media under-16 ban isn't just a problem for TikTok — it's a signal about where digital regulation is ...
UK Cyber Resilience Bill: What SMEs Need to Prepare
The UK's biggest cyber law overhaul in a decade is coming — here's what SMEs need to start doing now.
AI Phishing: Why Your Email Filter Is No Longer Enough
AI-written phishing emails look and sound like the real thing — and they are reaching UK business inboxes in record n...
New ICO AI Rules: What UK SMEs Using AI Must Check
UK rules on AI-automated decisions changed fundamentally in February 2026 — and most SMEs haven't noticed yet.
CMA Opens Microsoft Probe: What UK Businesses Can Expect
The UK competition watchdog is investigating whether Microsoft's grip on workplace software is locking businesses in ...
AI Deepfake Fraud Is Rising in the UK: What to Watch For
Criminals are cloning voices and faking video calls to authorise fraudulent payments — UK SMEs need to know how these...
UK Cyber Breaches 2026: 612,000 Businesses Hit Last Year
Official government data shows 612,000 UK businesses were breached in the last year — and financial damage has double...
Microsoft 365 Copilot Price Rise July 2026: What to Do Now
Microsoft's promotional Copilot pricing ends 30 June — UK SMEs have days left to decide whether to buy in before the ...
What Is Agentic AI — and Should Your Business Be Using It?
'Agentic AI' dominated London Tech Week 2026. Most SME owners have never heard the term — here's what it actually means.
UK's £200m AI Adoption Fund for SMEs: How to Access It
Most SME owners haven't heard about the £200m AI fund announced at London Tech Week. Here's what it covers and how to...
NHS Rolls Out Copilot: What It Means for Your Business
The NHS just went all-in on Microsoft Copilot. If the UK's largest employer is doing it, the business case is getting...
DragonForce Ransomware Now Targeting Smaller UK Businesses
The group behind the M&S breach claimed another UK attack on 14 June. SMEs are next — here's why and what to do.
19 June Is the GDPR Deadline Your Business Probably Missed
A legal deadline most UK SMEs missed — and what to do about it before Thursday.
AI Agents and Copilots Explained: What's the Difference?
Searches for 'AI agent' and 'AI copilot' are both rising fast. Here's the difference, and why it matters.
AI for Business: Where to Start (Without the Hype)
'AI for business' and 'AI in business' searches are climbing fast. Here's a practical starting point, without the hype.
What Is Data Science? A Plain-English Explainer
'Data science projects' searches are up 750% this year. Here's what data science actually means, in plain terms.
IT Support for SMEs: What You Actually Need (and When)
Searches for 'IT support for SME' and 'SME IT support' are both up over 350% this year. Here's how to think about it.
What Is Business Innovation? It's Not Just New Products
'What is innovation' searches are up 60% this year. Here's why innovation is broader — and more accessible — than mos...
What Is Cloud Computing? A Quick Explainer for Businesses
'What is cloud computing' searches are up 40% this year, and cloud computing services up 350%. Here's a plain-English...
What Is Generative AI? How It's Different from 'Normal' AI
'Generative AI' searches are climbing fast. Here's how it differs from other AI, in plain terms.
What Is Digital Transformation? A Plain-English Guide
'Digital transformation strategies' searches are up over 1,000% this year. Here's what it actually means in practice.
What Is Cybersecurity? A Quick Guide for Small Businesses
Searches for cybersecurity tips are up over 3,000% this year. Here's a quick explainer and where to start.
What Is SaaS? A Quick Explainer for Business Owners
'What is SaaS' searches are up 60% this year. Here's a quick answer, plus what to check before signing up.
AI Still Needs Humans: Why the Best Results Come from Both
AI is powerful, but unsupervised AI output is a liability. Here's where humans still matter most.
Can AI Solve My Business Problem? How to Tell
Searches for 'use AI' are up 60% this year. Before you adopt a new tool, ask these three questions first.
What Is AI? A Quick Explainer for Business Owners
Searches for 'what is AI' are up sharply this year. Here's a quick, jargon-free answer.
Example Signal: A Quick Take on a Recent Story
A short, fast-turnaround take on a recent story.