Contents

• New advice: AI-enabled security risks

• JCSC is official(!)

• Heightened risk of phishing attacks

• Upcoming events

• Cybersecurity in the news

  • Privilege escalation vulnerability found in CrowdS …

• Jobs in Cyber

  • Senior Information Security Consultant: Zensec

• Tool of the Month

Dear reader,

There’s a back-to-school feeling in the air and we’re looking forward to this autumn across both Islands. Here in Jersey, we saw the first parts of the Cyber Security (Jersey) Law come into effect on 1 September. While some of the provisions are simply formalising what we already do, others add much-needed clarity on our role and responsibilities. Remember, the parts of the Law relating to Operators of Essential Services (OES) will come into effect on 1 December. So if you are classified as an OES, the countdown is on.

Over in Guernsey, work continues on our office fit-out and we hope to be ready to welcome Islanders in-person in the coming weeks. We’ve also met with key stakeholders in Guernsey, including with pan-island organisations such as telecoms and utilities, to understand more about the areas of concern and how GCSC can add value. If you did attend those events, thank you for your time. We held similar meetings in Jersey not long after JCSC was formed, and they have been the foundation for many valuable relationships.

We’re also looking forward to October which is - as you know - Cyber Security Awareness Month. We’ll be delivering talks to organisations in Jersey, and running Cyber Simulation Events in Guernsey (see more below). We’ll also be attending the Channel Islands Cyber Security Conference on Friday 16 October. We’ll be sharing more information about the programme for October shortly, so keep your eyes peeled.

Until next time,

New advice: AI-enabled security risks

With the capabilities of agentic AI evolving at an exponential rate, progress in this area moves quickly, and clarity can sometimes be lost. Back in August, our Head of Cyber Defence, Paul Dutot, explored how frontier models are speeding up both threat detection and exploit. He also outlined the mechanisms and implications of the Hugging Face incident.

(Since this article was published, OpenAI have also shared their analysis on the Hugging Face incident, including lessons learned.)

JCSC is official(!)

On the 1 September, JCSC quietly passed an important milestone: the first parts of the Cyber Security (Jersey) Law 2026 came into effect. The parts that came into effect last week are those that set out how JCSC is managed and governed. This includes:

• Setting out the responsibilities of JCSC and its Director

• Requiring the Director to act independently of Ministers, and requiring JCSC to operate independent IT networks

• Allowing JCSC to create Technical Advisory Councils (TAC) to provide cyber security expertise

• Requiring JCSC to publish an annual report and accounts, and a 3-year strategic plan

• Designating JCSC as the SPOC for Jersey

• Empowering JCSC to adopt standards, and set out guidance

The parts of the Law that set out requirements for Operators of Essential Services (OES) will come into effect on 1 December 2026. Find out more by visiting the Cyber Law information hub.

Heightened risk of phishing attacks

After a spate of phishing emails targeting local businesses, we’ve been warning Islanders to be aware of a heightened risk of attacks. Once one organisation has been compromised, malicious actors can use compromised data to launch secondary attacks.

We put together a plain English guide that members of the public can use to identify the tell-tale signs of a phishing attack, and how they can protect themselves.

Upcoming events

Guernsey Cyber Simulation Events
Wednesday 14 October

We’re partnering with Soteria Communications to run several Cyber Simulation events for organisations in Guernsey on Wednesday 14 October. As with previous events, these simulations will give organisations a chance to experience a real-time event, and plan their response.

All events are free to attend, and will be run confidentially. Book your free place today:

• For All Organisations: 9am - 12pm

• For Financial Services: 1pm - 4pm

We’ll also run an event for providers of Critical National Infrastructure (CNI). To book onto this event, email [email protected].

Channel Islands Cyber Security Conference
Friday 16 October

Booking for the 2026 Channel Islands Cyber Security Conference is open. We’ll be attending and speaking at the conference, which will bring together practitioners from the Channel Islands, UK, and beyond.

Speakers for the day will include:

• Peter Job of Intergence and Dave Mareels of Sophos

• Rob Shapland, Director of Cyonic Cyber and ethical hacker

• Andy Compton, CEO of Cortida Ltd

Places at the conference are always in demand, so book your ticket today.

Cybersecurity in the news

AI agents provide feedback after attack

A human actor has carried out a successful ransomware attack using agentic AI agents. The agents also considerately (!) left their target an audit on all their security failings.

Privilege escalation vulnerability found in CrowdStrike

Researcher ChaoticEclipse has released a proof of concept exploit for CrowdStrike’s Falcon sensor. So far, so usual. But given the widespread disruption caused by a CrowdStrike outage in 2024, it’s clear that small vulnerabilities like this could have wide-ranging effects.

Jobs in Cyber

Are you recruiting for a cyber role locally? Tell us at [email protected] and we’ll share your job listing with the community.

Senior Information Security Consultant: Zensec

Zensec is looking for an Information Security Consultant to assist in providing virtual CISO (vCISO) and information security consultancy services to organisations across the Channel Islands.

Tool of the Month

Each month, we provide a round up of tools that our team have found useful, and which could be useful to cyber security professionals. If you’ve found a helpful tool you’d like to share, please email us and we’ll include it in a future newsletter.

Did you know? JCSC can also check potentially malicious files for you in our sandbox, but please let us know before sending them over.