Expert commentary: ‘Black October’ and the importance of cyber resilience

Following a particularly busy October for the cyber security industry, the term ‘Black October’ has emerged to describe a month marked by significant vulnerabilities, high-profile incidents and sustained pressure on security teams.

Matt Hull, VP of Cyber Intelligence and Response at NCC Group, reflects on whether the label accurately represents the current threat landscape, why organisations should avoid unnecessary fear and panic, and what October’s activity tells us about the growing importance of resilience, from understanding technology dependencies and responding quickly to emerging threats, to protecting the people on the frontline of incident response.

"There's been an awful lot going on in cyber security this October, there's no denying that. We've seen some significant vulnerabilities, high-profile incidents and plenty of activity that's kept security teams on their toes. It's certainly been a busy month, although I'm not sure giving it a name like 'Black October' really helps us understand what's happening or what we should be doing about it. "That said, I'm not convinced we're seeing some unprecedented escalation in cyber risk. We need to be careful about how we interpret what's happening. There's a big difference between a vulnerability being discovered, someone attempting to exploit it and an organisation actually being compromised. A busy month of headlines doesn't necessarily mean attackers are suddenly becoming more successful. "A lot of what we've seen this month comes back to things we've been talking about in cyber security for years. We're increasingly reliant on complex technology, software and third parties, often without fully appreciating how dependent we are on them. When something goes wrong with a technology that's used by thousands of organisations, the potential consequences can be significant. That's hardly a new problem, although the scale of our reliance on these technologies makes it increasingly difficult to manage. "One area I do think we need to keep a close eye on is speed. The time between discovering a vulnerability and someone finding a way to exploit it can be incredibly short. AI has the potential to accelerate parts of that process, although we need to be careful about attributing everything we're seeing to AI. Attackers have been very good at exploiting opportunities long before generative AI came along. "If there's one lesson to take from October, it's the importance of resilience. Organisations need to understand where they're exposed and be able to do something about it. That means knowing what technology you're using, understanding your dependencies and having the ability to spot and respond to suspicious activity. Patching is obviously important, but attackers don't necessarily wait politely for us to get our systems updated. "There's also a human element to resilience that I think we sometimes overlook. As I recently highlighted to the BBC, resilience depends on people as much as technology. When incidents like these happen, security teams can find themselves working incredibly long hours, often under enormous pressure. We need to make sure we're looking after those people, sharing the workload and giving them the opportunity to rest and recover. There's little point having brilliant technology and well-rehearsed incident response plans if the people responsible for delivering them are completely exhausted. Looking after our teams is every bit as important as looking after our systems. "And will October be the last particularly busy month in cyber security? I very much doubt it. There will be more vulnerabilities, more breaches and more incidents that put security teams under pressure. Some months will inevitably be busier than others, and I suspect we'll see plenty more like this one. "We need to take these incidents seriously and learn from them, but we also need to keep a sense of perspective. There's enough to worry about in cybersecurity without unnecessarily adding to the fear and panic. A lot of the advice remains the same as it has been for years: understand your risks, get the basics right, look after your people and make sure you're in a position to respond when something does go wrong."

Matt Hull is Vice President of Cyber Intelligence and Response at NCC Group, leading the global Cyber Response and Intelligence (CRI) capability.

A former Detective Constable specialising in cybercrime, Matt brings deep operational experience across investigation, response, and intelligence-led operations. He leads multidisciplinary teams supporting organisations through complex incidents, advanced threat activity, and the development of mature detection and response capabilities.

Matt is recognised across the industry for his authenticity and clear communication, speaking at major conferences and featuring in media including BBC News, the Financial Times and Channel 4’s Hunted. He also serves as Chair of the Threat Intelligence Focus Group and sits on the CREST International Council.