--- title: "AI Insider Threat 2026 - Thales Data Threat | Firevault" description: "The 2026 Thales Data Threat Report surveyed 3,100+ security professionals across 20 countries. Its findings, from AI as insider threat to 97% of organisations…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/ai-insider-threat-2026-thales-data-threat-report#webpage", "url": "https://fire-vault.com/news/ai-insider-threat-2026-thales-data-threat-report", "name": "AI Insider Threat 2026 - Thales Data Threat", "description": "The 2026 Thales Data Threat Report surveyed 3,100+ security professionals across 20 countries. Its findings, from AI as insider threat to 97% of organisations…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/a0337295-7e47-444d-b5b7-856a3439695c/og-thales-2026-2x.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/ai-insider-threat-2026-thales-data-threat-report#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/ai-insider-threat-2026-thales-data-threat-report#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "AI Is the New Insider Threat: 2026 Thales Report", "item": "https://fire-vault.com/news/ai-insider-threat-2026-thales-data-threat-report" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "AI Is the New Insider Threat: 2026 Thales Report", "description": "The 2026 Thales Data Threat Report surveyed 3,100+ security professionals across 20 countries. Its findings, from AI as insider threat to 97% of organisations harmed by deepfakes, reveal why offline secure storage is no longer optional.", "url": "https://fire-vault.com/news/ai-insider-threat-2026-thales-data-threat-report", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/a0337295-7e47-444d-b5b7-856a3439695c/og-thales-2026-2x.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/a0337295-7e47-444d-b5b7-856a3439695c/og-thales-2026-2x.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/a0337295-7e47-444d-b5b7-856a3439695c/og-thales-2026-2x.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/__l5e/assets-v1/a0337295-7e47-444d-b5b7-856a3439695c/og-thales-2026-2x.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-02-25T12:00:00+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/ai-insider-threat-2026-thales-data-threat-report" }, "inLanguage": "en-GB", "articleSection": "Insight", "wordCount": 1704, "keywords": "Insight, data breach, cyber security, offline secure storage, data protection, physical air gap, Thales Data Threat Report 2026, AI insider threat, agentic AI security, cloud data breach, harvest now decrypt later, data sovereignty UK, post-quantum cryptography, deepfake attack, secrets management DevOps, NIS2 compliance, CISO strategy, ransomware resilience", "articleBody": "Updated February 2026 | Estimated read time: 12 minutes | Published by Firevault The 2026 Thales Data Threat Report, conducted by S&P Global Market Intelligence 451 Research and based on responses from over 3,100 security professionals across 20 countries, delivers a sobering assessment of enterprise data security in the age of AI agents. Its central thesis: AI is no longer just a tool. It is beco", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview 1\. AI Security Spending Is Surgi…2\. The Pace of AI Change Is the …3\. Human Error Remains the Leadi…4\. Cloud Data Remains Dangerousl…5\. The C-Suite Has a Dangerous B…6\. Quantum Computing Is No Longe…7\. Data Sovereignty Is Being Res…8\. Secrets Management Is the Top…9\. 97% of Organisations Have Suf…What This Means for UK Organisat…SourceMore Resources [Knowledge Vault](/learn/knowledge)/ [Insight](/learn/knowledge?filter=insight) Insight · 25 February 2026 # AI Is the New Insider Threat: 2026 Thales Report The 2026 Thales Data Threat Report surveyed 3,100+ security professionals across 20 countries. Its findings, from AI as insider threat to 97% of organisations harmed by deepfakes, reveal why offline secure storage is no longer optional. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 9 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fai-insider-threat-2026-thales-data-threat-report)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fai-insider-threat-2026-thales-data-threat-report&text=AI%20Is%20the%20New%20Insider%20Threat%3A%202026%20Thales%20Report%0A%0AThe%202026%20Thales%20Data%20Threat%20Report%20surveyed%203%2C100%2B%20security%20professionals%20across%2020%20countries.%20Its%20findings%2C%20from%20AI%20as%20insider%20threat%20to%2097%25%20of%20organisations%20harmed%20by%20deepfakes%2C%20reveal%20why%20offline%20secure%20storage%20is%20no%20longer%20optional.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fai-insider-threat-2026-thales-data-threat-report)[](mailto:?subject=AI%20Is%20the%20New%20Insider%20Threat%3A%202026%20Thales%20Report&body=The%202026%20Thales%20Data%20Threat%20Report%20surveyed%203%2C100%2B%20security%20professionals%20across%2020%20countries.%20Its%20findings%2C%20from%20AI%20as%20insider%20threat%20to%2097%25%20of%20organisations%20harmed%20by%20deepfakes%2C%20reveal%20why%20offline%20secure%20storage%20is%20no%20longer%20optional.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fai-insider-threat-2026-thales-data-threat-report) ![A heavy steel vault door slightly ajar in a dimly lit industrial corridor with blue-hour lighting and subtle magenta accents, representing physical data isolation and offline secure storage](/__l5e/assets-v1/a0337295-7e47-444d-b5b7-856a3439695c/og-thales-2026-2x.jpg) A heavy steel vault door slightly ajar in a dimly lit industrial corridor with blue-hour lighting and subtle magenta accents, representing physical data isolation and offline secure storage Why it matters ## What this means for organisations holding critical data The 2026 Thales Data Threat Report surveyed 3,100+ security professionals across 20 countries. Its findings, from AI as insider threat to 97% of organisations harmed by deepfakes, reveal why offline secure storage is no longer optional. In this analysis 1. 01 [1\. AI Security Spending Is Surgi…](#section-0) 2. 02 [2\. The Pace of AI Change Is the …](#section-1) 3. 03 [3\. Human Error Remains the Leadi…](#section-2) 4. 04 [4\. Cloud Data Remains Dangerousl…](#section-3) 5. 05 [5\. The C-Suite Has a Dangerous B…](#section-4) 6. 06 [6\. Quantum Computing Is No Longe…](#section-5) **On this page**[1\. AI Security Spending Is Surgi…](#section-0)[2\. The Pace of AI Change Is the …](#section-1)[3\. Human Error Remains the Leadi…](#section-2)[4\. Cloud Data Remains Dangerousl…](#section-3)[5\. The C-Suite Has a Dangerous B…](#section-4)[6\. Quantum Computing Is No Longe…](#section-5)[7\. Data Sovereignty Is Being Res…](#section-6)[8\. Secrets Management Is the Top…](#section-7)[9\. 97% of Organisations Have Suf…](#section-8)[What This Means for UK Organisat…](#section-9) **Updated February 2026** | Estimated read time: 12 minutes | Published by Firevault The 2026 Thales Data Threat Report, conducted by S&P Global Market Intelligence 451 Research and based on responses from over 3,100 security professionals across 20 countries, delivers a sobering assessment of enterprise data security in the age of AI agents. Its central thesis: **AI is no longer just a tool. It is becoming a new [insider threat](/control-for-insider-threat)**. For organisations that rely on cloud-first infrastructure and handle sensitive data, this report is essential reading. Here, we distil the most critical findings, explain what they mean for UK enterprises, and outline how [offline secure storage](/solutions/root-cause) addresses the exact vulnerabilities Thales identifies. ## 1\. AI Security Spending Is Surging, But Still Underfunded Thirty per cent of organisations now have a **dedicated budget for AI security**, up 50% year-on-year from 20%. Yet more than half (53%) are still funding AI security from their existing security budgets, treating it as an add-on rather than a discipline in its own right. The report makes clear why this matters: **61% of organisations say their AI applications are being actively targeted by attackers**, with sensitive data being the primary objective. AI security spending now ranks second-highest in priority behind only cloud security. > **Firevault view:** Budgets allocated to AI security overwhelmingly focus on access controls, monitoring, and encryption, all software-based. None of these controls protect data that has already been exfiltrated or encrypted by ransomware. [Offline secure storage](/solutions/root-cause) removes the data from the attack surface entirely, addressing the gap that software security cannot. ## 2\. The Pace of AI Change Is the Number One Risk When asked about their greatest AI-related security concern, **70% of respondents cited the rate of change within AI ecosystems**. The rapid integration of agentic tools, autonomous AI agents that can access, process, and act on organisational data, is outpacing security teams' ability to establish controls. The report notes that agentic applications like Claude Code and Cursor are already in production use, fusing previously separate data sources and blurring sovereignty boundaries. A third of enterprises (34%) report embedded AI agents are already in use, with 73% expecting deployment within 12 months. The implication is stark: **only 34% of organisations have complete knowledge of where their data is stored**, and only 39% can classify all their data. If security teams cannot find and classify valuable data, AI agents will likely find ways to access it with unpredictable results. > "The rapid integration of agentic AI tools is outpacing security teams' ability to establish controls.", 2026 Thales Data Threat Report ## 3\. Human Error Remains the Leading Cause of Breaches For all the focus on sophisticated nation-state attackers (cited as a top-three concern by 63% of respondents), the data tells a different story about what actually causes breaches: - **28%: Misconfiguration or [human error](/threats/human-error)** (leading cause) - 21%: Exploitation of known vulnerabilities - 14%: Zero-day or previously unknown vulnerabilities - 12%: Failure to use MFA for privileged accounts - 10%: Compromise of identity or access controls This paradox, fearing nation-state actors while being breached by human mistakes, is compounded by security tool sprawl. The average organisation uses **seven data protection tools**, with 77% running five or more. This complexity directly increases the likelihood of human error. > **Firevault view:** Tool sprawl and operational complexity are unsolvable problems in purely software-defined environments. [Physical isolation eliminates the configuration surface area entirely](/solutions/root-cause). There are no credentials to misconfigure, no access policies to forget, no cloud consoles to leave exposed. The vault is either connected or it is not. ### Root Causes of Data Breaches (2026) Source: 2026 Thales Data Threat Report, S&P Global 451 Research ## 4\. Cloud Data Remains Dangerously Exposed For the third consecutive year, cloud-based assets are the **top three attack targets**: - 35%: Cloud storage - 34%: Cloud-delivered applications (SaaS) - 32%: Cloud management infrastructure The average organisation now uses **2.26 IaaS cloud providers** and **89 SaaS applications**. Despite this sprawl, only about **half of sensitive cloud data is encrypted**, and 53% of organisations let cloud providers control their encryption keys for more than half of their applications. Credential theft is the **leading attack technique against cloud infrastructure**, cited by 67% of respondents. This is followed by third-party vulnerabilities (61%) and malware injection (54%), which has risen in the rankings due to software supply chain attacks. > **Firevault view:** Encryption is necessary but insufficient when the keys are controlled by the cloud provider, when credentials can be stolen, and when only half the data is encrypted in the first place. [Offline vaults hold data outside any cloud provider's infrastructure](/solutions/by-risk), making credential theft irrelevant and supply chain attacks impossible against the stored data. ### Top Cloud Attack Targets - Cloud Storage - SaaS Applications - Cloud Management Source: 2026 Thales Data Threat Report ## 5\. The C-Suite Has a Dangerous Blind Spot One of the report's most striking findings is the disconnect between leadership perception and operational reality. **78% of C-suite executives reported no breach history**, compared with just 57% of IT and security practitioners in the same organisations. For cloud breaches specifically, 62% of executives reported no history, versus 54% of the broader survey population. This means security budgets and board-level risk assessments are likely based on incomplete information. > "78% of C-suite executives reported no breach history, compared with just 57% of IT and security practitioners in the same organisations." This perception gap directly leads to underinvestment in resilience measures. > **Firevault view:** This perception gap is dangerous because it leads to underinvestment in last-resort protections. When leadership believes breaches are not happening, resilience measures like offline backup and air-gapped storage are deprioritised. **The organisations that survive breaches are those that [plan for them](/solutions/boardrooms)**, regardless of whether leadership acknowledges the risk. ### C-Suite vs Practitioner: Breach Perception Gap - Report No Breach - Report No Cloud Breach Source: 2026 Thales Data Threat Report ## 6\. Quantum Computing Is No Longer Theoretical The report reveals that quantum risk concerns have matured significantly. The top-cited quantum risk, selected by **61% of respondents**, is **harvest now, decrypt later (HNDL)**: the practice of capturing encrypted data today to decrypt it when quantum computers become capable. While 59% of organisations are prototyping post-quantum cryptographic (PQC) algorithms, and 32% have identified or started experimenting with quantum computing projects, the transition timeline remains uncertain. The Certification Authority Browser Forum is already requiring TLS certificate lifetimes to be shortened to 47 days by 2029, forcing automation upgrades. > **Firevault view:** HNDL attacks target data in transit and at rest in connected environments. **Data stored offline in a Firevault vault cannot be harvested** because it is not on any network. For crown-jewel data, including [intellectual property](/oss-for-intellectual-property), legal records, and trade secrets, [offline storage](/solutions/root-cause) is the only guaranteed protection against future decryption capabilities. ## 7\. Data Sovereignty Is Being Reshaped by AI Agents The report highlights how agentic AI is eroding sovereignty boundaries. When AI tools fuse data from multiple sources, including code repositories, cloud resources, and CRM systems, the lines of data residency and operational independence blur. Almost half of respondents (45%) cited portability as the primary driver of their sovereignty initiative, and **54% are refactoring applications to better segment or isolate data**. Thirty-six per cent believe cryptographic protections are sufficient for sovereignty, but the report warns this is only the first level. Operational sovereignty requires that all personnel involved are citizens of the jurisdiction, and software sovereignty means data can be removed from any application and ported to a new one. > **Firevault view:** **Physical [data sovereignty](/why-oss/control) is the strongest form of sovereignty**. When data is stored in an offline vault in a known UK location, there is no ambiguity about jurisdiction, no risk of cross-border data flows, and no dependency on a cloud provider's compliance posture. This is particularly relevant for organisations subject to [NIS2](https://www.gov.uk/government/collections/nis-directive-and-nis-regulations-2018), [SRA, or FCA requirements](/solutions/risk-compliance). ## 8\. Secrets Management Is the Top DevOps Security Challenge The report identifies **secrets management as the number one security challenge in DevOps**, ranked first by the largest share of respondents across all listed categories. Yet spending on DevSecOps and secrets management tools ranked **lowest among all 17 technology categories** surveyed. This creates a dangerous gap: the thing developers struggle with most is the thing organisations invest in least. As agentic coding tools like Claude Code and Cursor gain adoption, the volume of secrets, including API keys, tokens, and certificates, will only increase. > "The thing developers struggle with most is the thing organisations invest in least." This disconnect between risk and investment is a recurring theme throughout the 2026 report. ## 9\. 97% of Organisations Have Suffered AI-Generated Misinformation Harm Perhaps the most universally concerning statistic: **97% of all respondents reported some form of organisational harm from AI-generated false information**. This includes deepfake business email compromise, trademark abuse, harm to key personnel, reputational damage, and hiring fraud. Fifty-nine per cent have experienced deepfake attacks, and 48% have suffered reputational damage from AI-generated misinformation. AI-generated misinformation and deepfakes showed the second-highest attack increase across all categories. > **Firevault view:** When AI-generated deepfakes can impersonate executives and trigger fraudulent data transfers, the integrity of authentication chains becomes critical. Physical verification through [offline secure storage](/solutions/ciso) provides an authentication layer that cannot be spoofed, cloned, or bypassed by generative AI. ### AI and Quantum Threat Landscape Source: 2026 Thales Data Threat Report, S&P Global 451 Research ## What This Means for UK Organisations The 2026 Thales Data Threat Report paints a picture of an enterprise security landscape that is **outpaced by the technology it is trying to protect**. The key themes, including AI as insider threat, cloud exposure, human error, quantum risk, and sovereignty erosion, all point to a common conclusion: **Software-only security is necessary but no longer sufficient for protecting an organisation's most critical data.** The report's recommendations, including better data classification, reduced tool complexity, stronger encryption, and proactive security leadership, are all valid. But they operate within the connected environment. They do not address what happens when that environment is compromised. [Firevault exists precisely for that scenario](/solutions/root-cause). [Offline secure storage](/offline-secure-storage) provides: - **Zero attack surface:** No credentials to steal, no APIs to exploit, no misconfigurations to discover - **Quantum-proof protection:** Data that is not on a network cannot be harvested for future decryption - **True data sovereignty:** Physical location, physical access, verifiable chain of custody - **Resilience against AI agents:** Autonomous systems cannot access data that is physically disconnected - **Human error immunity:** No cloud consoles to misconfigure, no encryption keys to mismanage > "The most secure data is the data that cannot be reached." This is the principle Firevault has built its entire platform around, and the 2026 Thales Data Threat Report confirms it. ## Source _2026 Thales Data Threat Report_, conducted by S&P Global Market Intelligence 451 Research. Based on 3,120 respondents across 20 countries. Published February 2026. [Read the full report](https://cpl.thalesgroup.com/data-threat-report). About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Access decided by you, not assumed by the network Control by Firevault removes standing pathways and replaces them with connection windows you approve, so stolen credentials and compromised suppliers have nothing standing to abuse. [Get started](/get-started)[Talk to the team](/demo) **No standing access**Paths exist only when you open them **Verification**Identity confirmed before any connection is made **Containment**A compromised account cannot reach what is disconnected **Control**Every window and closure is under your command Related Reading ## You may also find these useful [ ![Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/manchester-airports-group-data-breach-2026.jpg) Insight ### Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed Manchester Airports Group has confirmed that criminal hackers accessed the data of about 8.7 million customers across Manchester, East Midlands and London Stansted. Most of it came from free terminal WiFi sign-ups and from car parking, lounge and fast-track bookings. 27 Aug 2026 5 min ](/news/manchester-airports-group-data-breach-87-million-customers-2026)[ ![T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there.](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/tmobile-power-pull-salt-typhoon-2026.jpg) Insight ### T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there. T-Mobile's security chief ended months of failed software remediation by driving to the data centre, clearing ID, finding the cabinet and physically pulling the power supply from the compromised hardware. Disconnection was the right control. Firevault Control is designed to take the same action in under six milliseconds. 27 Aug 2026 7 min ](/news/tmobile-severs-network-cable-salt-typhoon-hackers-2026)[ ![Beacon breach: 1,500 charities exposed and an HIV charity's health data stolen](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/george-house-trust-beacon-charity-data-breach-2026.jpg) Insight ### Beacon breach: 1,500 charities exposed and an HIV charity's health data stolen People supported by a Manchester HIV charity have been told sensitive health information may have been stolen after a breach at Beacon, the shared database platform used by more than a thousand UK charities. One supplier, one connected database, national exposure. 26 Aug 2026 3 min ](/news/beacon-charity-database-breach-hiv-charity-health-data-2026)[ ![Iran-linked hackers shut down a UK power plant for four days](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg) Insight ### Iran-linked hackers shut down a UK power plant for four days A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK power generation. The grid held. The control layer did not. 23 Aug 2026 4 min ](/news/iran-linked-hackers-uk-power-plant-shutdown-2026)[ ![GTA 6 leaks: a nightmare or a blip for the biggest video game of the year?](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/gta6-leaks-rockstar-2026.jpg) Insight ### GTA 6 leaks: a nightmare or a blip for the biggest video game of the year? Unreleased Grand Theft Auto 6 footage has appeared online ahead of Rockstar's official preview, and Take-Two is now in court seeking the identities behind the accounts sharing it. The game will still sell. The material that leaked can never be unseen. 22 Aug 2026 3 min ](/news/gta-6-leaks-rockstar-development-footage-2026)[ ![Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/nine-pbs-archives-cloud-vendor-shutdown-2026.jpg) Insight ### Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed A public broadcaster lost access to fifty terabytes of archival footage, spanning seventy years of regional history, when its cloud storage supplier suddenly went out of business. The files are still trapped in a Denver data centre. 18 Aug 2026 4 min ](/news/nine-pbs-archives-cloud-vendor-shutdown-2026) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)