In 30 seconds
- BeyondTrust Remote Support is in CISA's crosshairs. A critical vulnerability in remote support tooling that sits in one of the most trusted positions in any environment. Remote support platforms are designed to bypass normal access controls, which makes them an ideal target. If your organisation or a third party uses BeyondTrust Remote Support, this needs immediate attention.
- Ivanti Connect Secure is being actively exploited again. CISA issued an alert on 13 October for CVE-2025-22457, a critical vulnerability in a widely deployed VPN and remote access gateway. Exploitation is confirmed, not theoretical. If your organisation uses Ivanti for remote connectivity, this is an immediate priority.
- Free awareness events from local cyber security centres. Both the GCSC and JCSC are running free events and resources during Cyber Security Awareness Month. A low-effort way to prompt internal conversations and demonstrate proactive awareness activity.
Why it matters
BeyondTrust Remote Support — high-trust tooling, high-value target
Remote support tools are built to do exactly what an attacker wants to do — access systems remotely with elevated privileges. When a vulnerability appears in that kind of tooling, the risk is not abstract. It is a direct, fast route to the most sensitive parts of your environment.
What makes this particularly sharp is the trust model. Remote support platforms are often whitelisted through firewalls, excluded from endpoint detection, and granted broad access by design. A compromise here does not look like an intrusion — it looks like normal operations. That is what makes it dangerous.
For regulated firms, the supply chain angle matters too. Even if you do not run BeyondTrust internally, your managed service provider or IT support partner might. The question is not just "do we use this?" — it is "does anyone with access to our environment use this?"
Ivanti Connect Secure — another edge device, another active exploit
Ivanti keeps appearing in these briefs for a reason. Edge devices like Connect Secure are the front door to your network, and attackers know that patching cycles for infrastructure appliances tend to lag behind endpoint updates. This vulnerability is not theoretical — it is being exploited now, which means the window between disclosure and compromise is already closing.
For regulated firms in the Channel Islands, the question is straightforward: do you know whether Ivanti Connect Secure is in your environment, and has the patch been applied? If the answer to either is "I'm not sure", that is your action for today.
This is the same pattern we keep seeing — Fortinet, SonicWall, now Ivanti again. The edge is where attackers are concentrating effort because it is where organisations are slowest to respond.
Channel Islands cyber security centres — free events and practical awareness
This is not a threat story, but it is worth flagging. The local cyber security centres do good work, and October is when they concentrate their public-facing activity. If you have been meaning to run an internal awareness session, refresh your phishing training, or simply get your team thinking about cyber security, this is a low-effort way to start.
For compliance teams in regulated firms, pointing staff toward these free resources is an easy win — it demonstrates proactive awareness activity without additional cost or procurement.
Questions to ask your team this week
- 1.Do we or any of our third-party providers use BeyondTrust Remote Support, and has the patch been applied against the CISA advisory?
- 2.Do we have visibility of what remote support tools are active in our environment, and are they included in our vulnerability management and patching scope?
- 3.Do we use Ivanti Connect Secure, and is it on the current supported version with the patch for CVE-2025-22457 applied?
- 4.Are our edge devices included in vulnerability scanning, or do they sit outside the normal patching cycle?
One thing to do this week
Ask your IT team or service provider to confirm whether BeyondTrust Remote Support and Ivanti Connect Secure are in use — either internally or by any third party with access to your systems. If either is present, verify the patch status against the CISA advisories and treat them as priority remediations. If you are not sure what remote support and VPN tools are running in your environment, that is the bigger conversation to have. Then share the GCSC or JCSC events page with your team as a prompt to have the awareness conversation internally.