Cyber Security and Resilience Regulation

Summary

The UK’s Cyber Security and Resilience Bill turns cybersecurity from guidance into a legal obligation. It brings 24-hour incident notification, supply chain accountability, and fines of up to £17 million or 4% of global turnover. In this webinar, Zero Networks’ Pieter Wigleven and Albert Estevez explain what the bill requires, why compliance is an architecture problem before it’s a process problem, and how microsegmentation limits the blast radius of ransomware.

Key takeaways

• Guidance becomes obligation. The bill gives regulators more scope, more power, and a clear enforcement mandate, and extends accountability into the supply chain. Secondary legislation means requirements can change quickly, so compliance is no longer a one-time checkbox.
• The reporting clock is tight by design. Initial notification is due within 24 hours and a full report within 72. Teams need to know their blast radius before an incident, not start mapping dependencies after one.
• The fines are real. The higher band reaches £17 million or 4% of global turnover, whichever is higher. The lower band reaches £10 million or 2%.
• The NCSC’s Cyber Assessment Framework points to containment. Its objectives are to protect against attacks and to minimize their impact, which means constraining what an attacker can do once inside. Detection and response alone can’t keep pace when breakout takes 27 seconds.
• Close privileged ports by default. RDP, SMB, RPC, and WinRM appear in most enterprise threat activity. Zero Networks closes them by default and opens them only through just-in-time MFA, and BreachMap shows your blast radius before and after.

Speakers: Pieter Wigleven, Director of Customer Engineering, Zero Networks · Albert Estevez, Field CTO EMEA, Zero Networks 

Moderator: Hello, everyone, and welcome to today’s webinar, Cybersecurity and Uptime Becomes a Legal Obligation. For some quick housekeeping, please note that all attendees are in listen-only mode. We encourage you to interact with us in the Q&A or chat window on the right side of your screen. We hope to have enough time at the end of our thirty-minute session to answer any questions, but if for some reason we don’t, we, of course, will get back to you offline after the event. And with that, we’ll hand it over to our speakers.

Pieter Wigleven: Alright. Welcome, everyone. Welcome to Cybersecurity and Resilience Regulation: Uptime Becomes a Legal Obligation. So today, I’m here with my good old friend, Albert. Albert, may I ask you to introduce yourself real quick?

Albert Estevez: Hi. Yeah. Sure. Uh, thank you for being here. I’m Albert. I was working twenty-five years in the cybersecurity industry. And for the last two years, I have the pleasure to be the field CTO, uh, for EMEA for Zero Networks.

Pieter Wigleven: Fantastic. And I’m Pieter. I’m a director of customer engineering. I joined this organization about three and a half years ago, and before that, I was with Microsoft for fifteen years. And it’s a pleasure to today talk about this very important change that a lot of people are, uh, facing right now. So let’s start with a very important poll question, and I’m super curious about your thoughts. So regarding the Cyber Security and Resilience Bill, what is your level of awareness? So we’ll give you a couple of seconds to vote, maybe ten or fifteen seconds. We have a lot of content to go through, so I’ll just wait for a little while before we proceed. I see the votes rolling in. Alright. Fantastic. We’ll proceed for now, but make sure you continue to keep voting if you would like.

Why is the UK replacing the NIS regulations?

Pieter Wigleven: So let’s talk about this first. So how we got here. Now, you can see, uh, the threats — or at least you can read that threats have outpaced the first regulatory response. What this means — the key point here is that the original NIS regulations, they were really designed for a different threat environment. So in, back in 2018, you can see there was a first response, uh, and — but since then, the threat, or the threat landscape, has accelerated faster than any regulation has evolved. And in 2020 and 2022, we have reviews, and they showed the gap, because many essential service operators, they didn’t really implement any meaningful, uh, cybersecurity policies, or updated their security posture compared to 2018. But, obviously, attackers, they, uh, evolved. They became faster, more disruptive, um, operationally more disruptive. So they’re much more focused on systems that were running critical infrastructure, and we can see this is innovating, or becoming even faster, as we go. Uh, some people even say that things, or attacks, will be happening at machine speed, so we have to do something about this. And that’s also why the statistics that you can see at the bottom do really matter, because attack outbreaks can now happen in seconds, and not days, or, you know, weeks or months. Uh, it will become faster and faster. And we still see that, even up to this point, that there’s some basic, let’s say, hygiene which has not been taken care of.

Why do privileged protocols matter so much?

Pieter Wigleven: If you look at a few of these statistics — so first of all, you can see that, uh, thirty-nine percent of the UK CNI organizations reported an incident in the past year. So that’s a lot. Um, and this scares me the most: twenty-seven seconds. Twenty-seven seconds was the fastest attacker breakout time observed in 2025. And especially now, with all of the AI — and we’ve all read about Mythos and all the other things coming towards us — it’s very likely that we’ll see more of these very low numbers in terms of speed of attackers. Now, this one is dear to my heart. If you look at the 71% — so the enterprise threat activity flows, they’re the vast majority of attacks, sooner or later, will use some of the privileged protocols: RDP, SMB, RPC, WinRM. Now, I told you during my introduction that I worked for Microsoft for fifteen years. Out of the fifteen years, I was based in Redmond, the headquarters, for five years, sitting in the team that owns the RDP protocol, Remote Desktop Protocol. And at one point, I had one customer ask me, “RDP, does that stand for ransomware deployment protocol?” Now, clearly, they were joking, um, but I understand why people think about this, because it’s just one of the protocols that, as soon as an attacker compromised one asset — which is inevitable, we all know that — they’re first trying to port scan, try to abuse one of these common privileged ports. So you can see some more statistics, some more information on this slide, but this is super, super important. So the existing requirements have not, in a reliable way, prevented disruption. Um, so we have to do something about this. We really have to be better at defending. Right?

What changes when guidance becomes obligation?

Pieter Wigleven: Now, this slide is all about the shift from guidance to obligation. So the bill is not just asking organizations to take things more seriously, to take cybersecurity more seriously, but it gives regulators more scope, more power, and, but also a clear enforcement mandate. And I personally think that one of the biggest changes is that it’s not just organizations themselves, but it now extends into the supply chain. We all know the examples of why organizations are being breached or being attacked. Uh, while, you know, their in-house security is pretty good, but they don’t really take the security vendors, or their suppliers, into account. Um, so that is something that you also have to think about right now. Um, the other part is enforcement. So, higher penalties, expanding information-gathering powers. All of this becomes more and more and more important, uh, something we all have to consider.

What does the 24-hour reporting clock require?

Pieter Wigleven: The 24/72 reporting clock. Very interesting. So now the clock, it starts ticking when the incident occurs, not just when you notice it. So this reporting window is, is tight by design. Uh, an initial notification of twenty-four hours, and a full report within seventy-two hours. So, you know, legally, the official — uh, I think the official, um, frame notes that the, uh, to run the awareness of the incident, but the operational challenge starts way sooner. And, like, if you look at this in practice, it’s not just if you or your team can fill in the form within twenty-four hours. It is truly to being able to answer what happened. So how do you know which shifts, systems are affected? How do you know which services are at risk? And do you know how far your tech can move? And this is truly why this is an architecture problem, uh, and before it’s even a process problem. If you only start mapping dependencies when you’ve had an incident, that is too late. The clock is already against you. So you have to understand the blast radius before an incident occurs. And one way to do this is by truly understanding, first of all, visibility in the organization: knowing which assets are communicating with each other, segmenting specific pieces, and understanding that if a particular asset is breached, what the blast radius could be, where can an attacker move to. That is something you should be able to understand today, before an incident occurs.

How does the bill connect to the NCSC Cyber Assessment Framework?

Pieter Wigleven: Now, this slide really connects the bill to the, the NCSC Cyber Assessment Framework. So “appropriate and appropriate measures” — that sounds very broad, but in practice, it gets translated into measurable controls and outcomes. So there’s two CAF objectives that truly matter here. First, protecting against a cyberattack. So just reducing the likelihood that a compromised, uh, attack succeeds or spreads. And second, minimizing the impact of such an incident. So limiting what a successful compromise can affect, because we all know it’s gonna happen. It’s inevitable. Let’s accept it. Let’s just make sure that it’s contained in some way. And these are not just separate ideas. They point in the same direction, which is all about constraining what an attack can do once they are inside. And this is truly where identity and access control, in a resilient network design, they become central. If any compromised asset can reach most of the network, then an organization is truly relying on detection and speed — sorry, detection and response speed — which we all know is not gonna be successful. Remember that statistic about an x percent, uh, sorry, an x seconds, that it only takes for an attacker to spread. So with just — if you look at the classic framework, prevent, detect, and respond, just investing in detection and respond is not gonna be successful in the future. We all really have to focus more on prevention. With that, I’m gonna hand it over to my friend, Albert.

What are the fines under the Cyber Security and Resilience Bill?

Albert Estevez: Sure. Thank you. So let’s talk about the fines. You know? All this new build is, is, uh, is — it makes you taking this very seriously, you know, because the, the amount of money that you can be charged if you don’t take actions, you know, uh, at the right time, they can be a lot. So they are two different bands, you know, depending on how hard is the, the, the thing that you were not in comply. Like, for example, if you fail to report an incident, or if you fail to comply with national security directions, or maybe you wouldn’t click in security duties, you know, the, the band for the fines, it could go to up to 17 millions pounds, or the 4% of your, you know, your global turn— turnover, which is a lot. So whatever is higher, you know. And then, depending if you, you move in the lower band, you know, of the, of the fines, uh, it could be up to 10,000,000, or 2% of your global turnover. So this is one of the reasons that they are forcing you to take, you know, very serious this, you know, this new law, because the, the amount of money that you can be charged, it’s, it’s a lot.

Why is compliance no longer a checkbox?

Albert Estevez: So this is very similar to what is going on in Europe, you know, with NIS2. So we, we, we move from something that you, you wanted to be in compliant once, and now it’s something that you need to keep evolving over the time to be sure that you are secure. You control your infrastructure, your latest, last, and now even you need to understand who is your supply chain. You know? So you need to be sure that you go above your infrastructure, your control, and understand your third parties that they are communicating with you, the service providers that they are providing you, you know, services. So everything needs to be really under control for you to be accountable if something happens. Okay. So right now, everything is, is consulted in the, in the, in the House of Commons. Yeah. Uh, right now, uh, this is something that is going to change. So what we need to be clear is, whatever it becomes the law now, you know, uh, we need to be sure that in the coming months, now the government will have a secondary legislation that will not require, you know, to go to the, the common, uh, the large, the common or the commons — sorry. The, the large common. I’m not really used to that. And which means that the legislation can change and adapt constantly, you know, depending on which actions, or how things, or threats are happening to the country. So this could be adapted, you know, very dynamically. So that means that if you are not prepared, and you don’t have agility in how you are really apply— applying the security measures in your infrastructure, uh, you will suffer, and you will always be late. So, again, so this new act will force you to really adapt your infrastructure. Your security needs to be more proactive, more dynamic. Because, again, whatever the law will say now is going to change probably in the near future. So this is not a, a thing that you will have a checkbox that say, yeah, I’m right now secure, I’m in, in compliance with the law, you know, and that’s it, and I forget about it. Because if it changes in six months, you will need to adapt, you know, what are you doing, how you are doing it. So it’s really important that we keep this end in, in mind.

How far could an attacker spread in your network?

Albert Estevez: So then let’s talk about how it, how it looks your infrastructure, how it looks your, your security. Right? So we all know that we will be breached at some point, so we need to embrace this. Right? So we need to be sure that we always have a mind that understands that we are going to be compromised at some point. So what we need to understand is how a machine, or host, or an asset compromising my infrastructure, how it can spread from that machine to the rest of the unit network. So if you have a flat network, this — the answer is, is one host compromised, 100% of the network compromised. So this is the, one of the most common scenario that we found, you know, out there, uh, sadly, in many, many prospects. For, because, for many reasons, they were evolving flat networks over the time.

Pieter Wigleven: Mhmm.

Albert Estevez: You know, the network never was, uh, the, the business goal. So usually, you have a business that you need to satisfy a need for somebody else, and then the network is just, uh, something useful that you have, but not something that really realize your entire business. Right? So you — this is what the, the first thing is: understanding your radius blast. So if we can move to the, the, the next slide.

How does BreachMap show your blast radius?

Albert Estevez: So we need something to help you to understand, you know, how the radius blast in your infrastructure looks like. So we, we wanted to help, you know, the UK companies out there to have an easy button, so they can download, uh, a utility that we just developed. It’s available in our website. We will provide the links. So, in an easy, for a practical exercise, you can download this, run it internally in your network. Now I will show you who it looks like, but what it’s going to do is, it’s going to take a view of the entire network with some credentials that you can provide. Like, if somebody was, you know, compromising your host and stealing your credentials, then we try to help you understand how far we can go with those credentials, and then try to show you, in a very appealing and visual way, you know, how much permissivity, or trust, if you want to call it, is already inside your, your infrastructure. Okay? So what I’m going to do right now is, uh, let me allow to share my screen. Pieter, you can stop sharing. Just — I will try to bring this very cool tool. My laptop has to show me available windows. Yep. Here we are. Cool.

Okay. So what you can see here — so this is a report generated after the tool runs. So the, the run is a very simple CLI command, which you can provide some credentials, and then it will do all the discovery for you from the point of view of the machine that you are running. Okay? So that means that, if you have credentials that they are valid in, for, for example, your Active Directory or your Linux servers, it will try to spread and then investigate which opens are, which ports are open from this machine. It will try to investigate with other machines they are in the infrastructure, and it will try to move from one machine to the other to build this, this map. So what you can see here is like a mesh. So this is one of the environments that we were analyzing, you know, and you can see that all the machines, they default — they can communicate with everybody. K? So this is giving us the visibility on how many, you know, privileged services we, we found already open, like SSH, SMB, RDP, WinRM. We classify them as critical, because this is the main vector for ransomware, or, or attackers, or your administrators, that you can put altogether in the same bucket, you know, because they have the same mission, which is move between machines to take, you know, administrative tasks — one with a good purpose, others with probably a bad purpose. But at the end of the day, they use the same, the same channels of communication. Right? This is why it’s really hard to, to find companies that they really are protecting themselves to close those ports, because usually those ports are in need, you know, for the administrators. So that’s the reason it’s easy to find these ports open in any network that we, we, we, we land. And this is what the, the attackers on the malware knows it, expects it, and have used it. Okay?

So in this case, what I’m going to do is, I’m going to select who are my crown jewels, okay, just to put, you know, the, the focus on them, to understand who can communicate directly or indirectly, you know, by pivoting to another machine, to see how many attack paths they are, you know, available to reach out from any point of my network to my credentials that, supposedly, is the piece that I want to protect in my, in my infrastructure. K? In this case, I put my, my Active Directory. So as you can see, this is flagged. You know? So mostly, every machine in this infrastructure has visibility of the 445 and the WinRM ports, or the COM and WinRM. So which means that, potentially, you know, any of those machines can automatically communicate with, uh, my asset, my crown jewel in BAM. So now what I’m going to do is, in the, in the event that Zero Networks were deployed, and we were already, uh, learned and generated all the security policies to really close inside a bubble every single asset in your infrastructure — so all this privileged access, it should be closed, or restrict from some specific sources, not for everybody in your network. So what I’m going to do is, I’m going to enable this with Zero Networks. And as you can see right now, you know, all the mesh of communications that they were supposed to be allowed between a lot of your machines, that will make all these paths available, you know, to reach out my crown jewels — so, so right now, they are very restricted to the minimum, you know, of the servers that typically require to get some of those ports inside. But for the rest of the network, all those ports are, they are, they will be closed, or even protected by just-in-time MFA, you know, at the network layer, which is really relevant, just to be sure that not privileged access is open to anybody, you know, twenty-four seven, which is what the Zero Networks, uh, does pretty full. Cool? I think that by just doing that, I will stop sharing this, then I will share back. Here we are.

How did Istituto Nazionale dei Tumori reduce its attack surface?

Albert Estevez: Okay. So after what I explained — so let me give you an example of what really looks like a ready environment. Okay? So this is one of the, our customers. So it’s the Istituto Nazionale dei Tumori. It’s a, it’s a leading European healthcare organization, but they have the mandate, and they are under a lot of, you know, regulations, and they are under the mandate to really improve their, their security posture, reduce the, you know, the opening ports, uh, reduce the attack surface that they have in your infrastructure. So they decided, you know, for our solution, just because — yeah. So just to mention, for the ones that you don’t know what Zero Networks does: so we have a really comprehensive microsegmentation approach. Why? Because, usually, we are, uh, agentless approach, so we don’t need to deploy any agents anywhere. So we automatically understand and classify all your environment. So we really, you know, are gonna classify: this is a Windows machine, this is an Active Directory, you have an NGINX server, uh, or even you have, you know, offensive tools installed in this machine. So all this information is our context to be used to automate the process to generate the security policies, with a man in the loop, which means that we generate, based on what we learned for thirty, sixty, ninety days. It translates into security policies that a human can read and understand. Okay? Because they are based on all this tagging that we generated. That tagging means sometimes grouping, and the grouping is understandable and is easy to follow for a human. And we are not suggesting thousands of security policies. What we do is, we, we suggest a really small set of policies that they are based on dynamic blocks, like dynamic groups, the source of destination, which makes really easy for a human to really validate and adopt those security policies. So our solution provides as well end-to-end visibility between clients and servers. So we automatically correlate both logs generated from the client and the server standpoint to generate an individual activity, which brings you a really rich set of, you know, uh, information and context, like source process, or user, source application, destination application, destination user, destination process. You know, all this information altogether is very valuable.

So at the end of the day, uh, the operational outcome for this customer is not just visibility, uh, control of third party, you know, uh, companies that they are, uh, landing in their, in their network to provide, you know, managed security services. But we reduce the, the amount of work, you know, that human requires to fully manage and deploy a solution like this to, uh, mostly, uh, one full-time employee only. And by the deploying our solution, they really closed all the gaps related with privileged access, because now they are all closed behind, uh, just-in-time MFA, which is makes, you know, them really secure. And even we had to force their insurer, you know, their company that was providing insurance, cybersecurity policies, or insurance for this company — because now these companies are in much better state than the ones that they are expected to find. So they had to really low, you know, the premiums that they were paying, because, you know, uh, they invest in a tool that reduces the, the chances to be compromised. Uh, so it’s fair to pay less, you know, for the insurance.

How do you build a cyber resilience architecture?

Albert Estevez: So we, we move to the next one that I control. Cool. So building a cybersecurity, uh, resilience architecture, uh, is something that we, we help companies to do by, by default. K? So by closing by default all the ports — so don’t open what is not needed. Just, just in time, you know, to provide temporary access when something is really required for your administrators. So try to, by default, bound the radius blast. So be sure that when someone hits inside one of your assets, you know, it’s really hard to move from that asset to different ones. And then keep all this information documented and auditable. So our solution tracks every single change — who was making the change, when was making the change — so you have always a track of everything that happens, you know, in your, in your infrastructure.

So if we build these in layers — you know, because security is not just a single layer. There are different layers involved in, in, in security. So let’s try to build a containment architecture, you know, not just a single control that you place here and there, north, south, east, west. So if you build your infrastructure in different layers, then we can cover different dimensions of the, of the security. Like, we have microsegmentation on the network level. As I mentioned, this will, you know, isolate every single machine, like if they were acting or running in a single VLAN. So we’re trying to isolate every single machine with the rest, you know, and we’re, we only allow what needs to happen, you know, and only when it’s needed, not twenty-four seven, as usually you have today, uh, in your security policies probably deployed in your network devices. So then we have another layer, or dimension, which is identity. You know, try to apply least privilege access. So try to reduce, uh, how many places your users can move. Uh, identify your service account. Make sure that those service account can only log in, you know, uh, in a specific service, and doing a specific net loans. So try to reduce, by default, that your service account, they can do RDP or interactive sessions, unless there is a need for that. And if you want to allow that, then, you know, use just-in-time access to really provide the access when it’s really required. Then reduce and remove all the privileged access. So all those ports that we say that malware is going to utilize, or have a lack to decide your network, will try to move around your infrastructure by using RDP, or ransomware deployment protocol, as I like to hear from Pieter. You know, Secure Shell, WinRM — all those protocols, close them by default. Only open when you see that, through a just-in-time MFA, you know, which is, um, attempted by Zero Networks. This is one of the most powerful, you know, keys, uh, or solutions that we, we provide for all of our customers. Then keep monitoring, you know, the entire traffic in your infrastructure. Correlate all the information between client servers to understand who is doing what all the time. This is the visibility layer. And then at the end, you know, have this, um, deterministic engine that will classify, contextualize all your assets, and generate security policies automatically, you know, for you, at scale. And this is the only way that we can really — and for at least for our platform, it doesn’t matter if we are protecting five assets or 100,000 assets, just because our engine is built for scaling, you know, uh, to the infinite, I would say, or beyond. I think it was like here. Cool.

What can you do today?

Albert Estevez: Then three things that you can do today to start. So the first one is just download and run the, the BreachMap. Run it in your infrastructure, get visibility, understand your, your radius blast. Okay? The second thing that you could do is, we can provide you, like, a couple of, um, uh, reports that we were, uh, generating for you. So we were analyzing more than three trillions of data from our customers to really understand, you know, where the bad things are happening, what usually — which ports you, we found that they are compromised. So you can get and put under the, uh, you know, your point of view, to really understand what steps you should be doing to, to really secure your infrastructure. Well, and then you can request a conversation with your sales rep for Zero Networks, uh, to — if you want to walk the, the path to restrict access inside your infrastructure, make your network more resilient. Um, this is the information that you can get from our team, you, you know: the Lateral Movement Experience Report that I was talking about, and the CISO guide for business impact analysis for cyber resilience. I think that you found this webinar interesting. You — we’re providing, and we built a lot of tools and information for you. So, hopefully, you get something from the meeting today. Pieter, any last words?

Pieter Wigleven: Nope. Thanks a lot, everyone, for attending, and, uh, hopefully, we’ll talk again soon.

Albert Estevez: Thank you.