Company
References and suppliers
The organisations we cite in our papers, who they are and what they do, and the podcasts we listen to.
A mention here is not an endorsement. CyberCQR is independent: we do not resell products or take commission from any supplier, so we name vendors only where their research, products or incidents are relevant. Details checked 25 October 2026.
UK government, regulators and law enforcement · Standards bodies and international agencies · Research, threat intelligence and industry data · Technology platforms · Identity and access management · Security product vendors · Security services and consultancies · AI developers · Podcasts we listen to
UK government, regulators and law enforcement
Association of British Insurers (ABI)
The trade body for UK insurers. Publishes industry data, including what insurers pay out on cyber claims.
Cyber Monitoring Centre (CMC)
An independent UK not-for-profit. Categorises major cyber events affecting the UK by severity and estimates their financial impact.
Department for Science, Innovation and Technology (DSIT)
The UK government department responsible for cyber security policy. Publishes the Cyber Security Breaches Survey and the Cyber Governance Code of Practice, and leads cyber legislation.
Financial Conduct Authority (FCA)
The conduct regulator for UK financial services firms. Sets operational resilience and incident reporting expectations for the firms it regulates.
IASME
A UK company appointed by the NCSC as the Cyber Essentials delivery partner. Runs the Cyber Essentials scheme and its network of certification bodies, and the public certificate search.
Information Commissioner's Office (ICO)
The UK's independent regulator for data protection. Enforces UK GDPR and the Data Protection Act 2018, receives personal data breach reports and issues fines.
National Crime Agency (NCA)
The UK's national law enforcement agency for serious and organised crime. Leads UK action against major cyber crime groups, including ransomware operators.
National Cyber Security Centre (NCSC)
The UK's technical authority for cyber security, part of GCHQ. Publishes guidance (including the Cyber Essentials scheme and board toolkit), handles nationally significant incidents and assures incident response and exercising firms.
Office of Financial Sanctions Implementation (OFSI)
Part of HM Treasury. Enforces UK financial sanctions, including where a ransom might be paid to a sanctioned group.
Prudential Regulation Authority (PRA), Bank of England
The prudential regulator of UK banks, insurers and major investment firms. Sets operational resilience and outsourcing rules, and runs threat-led testing programmes with the Bank of England.
Report Fraud
The national reporting service for fraud and cyber crime, run by the City of London Police. Takes reports of cyber crime from organisations and the public. It replaced Action Fraud.
Solicitors Regulation Authority (SRA)
The regulator of solicitors and law firms in England and Wales. Sets the standards firms must meet, including on protecting client information and money.
Standards bodies and international agencies
Center for Internet Security (CIS)
A US not-for-profit organisation. Publishes the CIS Critical Security Controls and the CIS Benchmarks for securely configuring systems.
Cloud Security Alliance (CSA)
A not-for-profit industry body. Publishes cloud security guidance and the Cloud Controls Matrix.
Cybersecurity and Infrastructure Security Agency (CISA)
The US federal agency for cyber and infrastructure security. Publishes advisories and the Known Exploited Vulnerabilities catalogue, a widely used list of flaws being attacked in practice.
European Union Agency for Cybersecurity (ENISA)
The EU's cyber security agency. Publishes threat landscape reports and supports EU laws such as NIS2.
FIDO Alliance
An industry association of technology companies. Develops the standards behind passkeys and security keys, the main forms of phishing-resistant sign-in.
International Organization for Standardization (ISO)
The international standards body, working with the IEC on information security. Publishes ISO/IEC 27001, the information security management standard, and related standards.
ISACA
A professional association for IT governance, audit and security. Publishes the COBIT framework and runs professional certifications.
MITRE
A US not-for-profit that runs federally funded research centres. Maintains MITRE ATT&CK, the public catalogue of attacker techniques, and ATLAS for attacks on AI systems.
National Institute of Standards and Technology (NIST)
A US government agency within the Department of Commerce. Publishes the Cybersecurity Framework (CSF 2.0), the SP 800 series, digital identity guidelines and the post-quantum cryptography standards.
OWASP Foundation
An open, not-for-profit community focused on software security. Publishes the OWASP Top 10 lists, including the Top 10 for large language model applications.
PCI Security Standards Council
A body founded by the major payment card brands. Publishes PCI DSS, the security standard for organisations that handle card payments.
Research, threat intelligence and industry data
Black Kite
A third-party cyber risk company. Rates the security of suppliers from outside, and publishes an annual ransomware report based on criminal leak sites.
BlackFog
A security company with offices in the US and the UK (London and Belfast). Sells software that stops data being taken off devices, and publishes quarterly and annual ransomware reports.
Forrester
A research and advisory firm. Publishes analyst research, and first described the Zero Trust security model in 2010.
Gartner
A research and advisory firm. Publishes analyst research on technology markets, including security, and surveys of security leaders.
IBM
A US technology and consulting company. It owns HashiCorp. Publishes the annual Cost of a Data Breach report, with UK findings, and sells security products and services.
Panaseer
A London-founded security company. Measures whether security controls are working across an organisation, and publishes research on security leaders.
Recorded Future
A threat intelligence company, owned by Mastercard since December 2024. Collects and analyses information on threat groups, malware and vulnerabilities for security teams and governments.
SecurityMetrics
A US company and PCI Qualified Security Assessor. Assesses organisations against PCI DSS and publishes practical guidance on the self-assessment questionnaires.
Vectra AI
A security company. Sells threat detection for networks and cloud services, and publishes research on security operations teams.
Verizon
A US telecommunications company. Publishes the annual Data Breach Investigations Report (DBIR), one of the most cited sources on how breaches happen.
Technology platforms
Amazon Web Services (AWS)
Amazon's cloud computing business. Provides cloud infrastructure and security services, and sets the shared responsibility model for its customers.
Apple
A US technology company. Makes iPhone, iPad and Mac, and is one of the main providers of passkeys alongside Google and Microsoft.
Cisco
A US networking company. Sells networking and security products, including Duo for multi-factor authentication. It owns Splunk, whose platform is widely used for security monitoring.
Cloudflare
A US internet infrastructure company. Runs a global network that protects websites from attack and provides Zero Trust remote access.
A US technology company, part of Alphabet. Runs Google Workspace and Google Cloud. It owns Mandiant (incident response and threat intelligence) and Wiz (cloud security, acquired 2026).
Microsoft
A US technology company. Runs Microsoft 365 and Azure, and sells security products including Entra ID, Defender, Intune, Purview and Sentinel. Many UK firms already own more of these than they use.
Identity and access management
BeyondTrust
A US security company. Sells privileged access management and secure remote support.
CyberArk
An identity security company, now part of Palo Alto Networks. Sells privileged access management: vaulting, controlling and recording the use of administrator accounts.
Duo Security
Part of Cisco since 2018. Multi-factor authentication and device trust checks, widely used to add MFA to VPNs and older applications.
JumpCloud
A US company aimed at small and mid-sized organisations. A cloud directory with single sign-on, MFA and device management in one service.
Keeper Security
A US security company. Password management and privileged access management for businesses and individuals.
Microsoft Entra
Microsoft's family of identity products. Entra ID was called Azure Active Directory until 2023. Sign-in, single sign-on, MFA, Conditional Access and identity governance for Microsoft 365, Azure and other applications.
Okta
A US identity company. Provides single sign-on and identity management for workforce and customer accounts.
One Identity
An identity security company, part of Quest Software. Identity governance, privileged access management and Active Directory management.
Ping Identity
A US identity company, owned by Thoma Bravo, which merged it with ForgeRock in 2023. Single sign-on, MFA and identity management for workforce and customer accounts, often in large or hybrid estates.
SailPoint
A US identity security company, listed on Nasdaq again since 2025. Identity governance: who has access to what, joiner-mover-leaver processes and access reviews.
Saviynt
A US identity security company. Cloud-based identity governance and administration, including access reviews and privileged access.
Yubico
A Swedish company, listed on Nasdaq Stockholm. Makes YubiKey hardware security keys, used for phishing-resistant sign-in and passkeys.
Security product vendors
Carbon Black
Endpoint security products, now part of Broadcom alongside Symantec. Endpoint detection and response and application control. Broadcom acquired it with VMware in 2023.
CrowdStrike
A US security company. Sells endpoint detection and response (EDR), threat intelligence and incident response. A faulty update in July 2024 crashed about 8.5 million Windows devices.
Drata
A US compliance software company. Automates evidence collection and monitoring for frameworks such as ISO 27001 and SOC 2.
HashiCorp
Infrastructure software, owned by IBM since 2025. Makes Vault, used to store and control secrets such as passwords, keys and certificates, and Terraform.
Ivanti
A US IT software company. Sells device management and remote access products. Flaws in its VPN products have been widely exploited.
Jamf
A US device management company. Manages and secures Apple devices for organisations.
Mimecast
An email security company founded in the UK. Sells email security, archiving and awareness training.
Palo Alto Networks
A US security company. It completed its acquisition of CyberArk in 2026. Sells firewalls, secure remote access, cloud security and security operations products.
Proofpoint
A US email security company. Sells email protection, security awareness training and data loss prevention.
Qualys
A US security company. Sells cloud-based vulnerability management and compliance scanning.
SentinelOne
A US security company. Sells endpoint detection and response and security operations products.
SolarWinds
A US IT management software company. Sells network and IT monitoring software. Its build system was compromised in 2020 to deliver a backdoor to customers, a landmark supply chain attack.
Sophos
A UK-founded security company, headquartered in Abingdon, Oxfordshire. It acquired Secureworks in 2025. Sells endpoint and firewall products and managed detection and response, and publishes ransomware research.
Tenable
A US security company. Sells vulnerability management and exposure management products.
ThreatLocker
A US security company based in Florida. Application allowlisting and ringfencing: only approved software can run, and it can reach only what it needs.
Tripwire
A security product line owned by Fortra since 2022. File integrity monitoring and secure configuration management: spotting unexpected changes to systems.
Zscaler
A US security company. Sells cloud-delivered secure internet and private application access, often used to replace VPNs.
Security services and consultancies
AmberWolf
A UK offensive security consultancy and CREST member. Penetration testing and threat-led red teaming, including CBEST and STAR-FS testing for financial services.
Arctic Wolf
A US security services company. Provides managed detection and response, with a security operations team monitoring customers' systems around the clock.
NCC Group
A UK cyber security services company, listed on the London Stock Exchange. It agreed in January 2026 to sell its Escode software escrow business. Penetration testing, incident response, managed detection and security consulting.
QinetiQ
A UK defence and security technology company, listed on the London Stock Exchange. Defence research, testing and engineering, including cyber security work for government and defence.
Red Goat Cyber Security
A cyber resilience consultancy based in Bristol, founded in 2017 by Lisa Forte. Cyber crisis exercises and simulations, social engineering training, insider threat programmes and executive briefings.
AI developers
Anthropic
A US AI company. Develops the Claude models, and publishes research and threat intelligence on how AI is misused.
Podcasts we listen to
Cybercrime Investigations
A podcast by Geoff White, an investigative journalist. Goes behind the scenes of cyber crime stories: the twists, dead ends and surprises investigators meet along the way.
CyberWire Daily
A daily podcast from N2K CyberWire. A daily briefing on cyber security news, with interviews with researchers and industry figures.
Darknet Diaries
A podcast by Jack Rhysider. Long-form true stories from the dark side of the internet: hackers, breaches, cyber crime and espionage.
Google DeepMind: The Podcast
Google DeepMind's podcast, presented by Hannah Fry. Conversations with researchers about how AI is built, where it is heading and the questions it raises.
Hacked
A podcast hosted by Jordan Bloemen and Scott Francis Winder. Stories about hacking, internet scams, AI and security, told for a general audience.
Smashing Security
A weekly podcast hosted by Graham Cluley and Carole Theriault. Light-hearted discussion of the week's cyber security and privacy news.
The AI Fix
A weekly podcast hosted by Graham Cluley and Mark Stockley. AI news, with an eye on its risks, failures and security implications.