Enterprise connected devices now underpin physical security, operational technology and digital infrastructure across UK organisations. This briefing examines how government policy from DSIT aligns with technical guidance from NCSC, NPSA and NACE, highlighting overlaps, tensions and practical implications for DFIR teams responsible for investigation, resilience and evidence preservation across increasingly converged cyber-physical environments within modern enterprise security and incident response.

Attackers are cutting response windows: Unit 42 cites cases reaching data exfiltration in 72 minutes. Figure Technology Solutions confirmed a breach tied to leaked user records, while Meriden, Connecticut reported ransomware disruption. Mandiant warned of active exploitation of a Dell RecoverPoint for VMs zero-day, and the UK ICO prevailed in the DSG Retail appeal, sharpening expectations for “appropriate security” practice.

In the last 48 hours, breaches and recoveries hit healthcare and retail, while investigators disrupted fraud marketplaces and laundering services. Major incidents affected oil logistics and UK government systems. Active exploitation warnings targeted React2Shell and SonicWall SMA, alongside new CISA ICS advisories. Policy and standards moved on UK cyber legislation, EU CRA reporting, and NIST’s Cyber AI profile this week.