A recent Kaspersky survey entitled “Cybersecurity in the workplace: Employee knowledge and behaviour”, showed that 39% of professionals in the Middle East, Turkiye and Africa (META) region, consider cybersecurity rules in their company to be excessive or not fully appropriate.

While 7% noted that their organisations do not have cybersecurity rules or that they are not aware of them. These results show a disconnect between corporate cybersecurity policies and employee commitment to these rules, underscoring the risks associated with shadow IT and unmanaged device usage in the workplace.

Shadow IT is defined as the use of unauthorised software, devices, or services without IT oversight, and it has evolved into a critical business risk. While often driven by employee productivity needs, it creates blind spots for IT departments.

The rise of hybrid work environments, increased reliance on cloud-based tools and the spread of AI tools have accelerated this trend. Without robust cybersecurity management and oversight, organisations face heightened exposure to ransomware attacks, data leaks, and regulatory penalties.

19% of survey respondents in the META region said there are no policies regarding the use of non-corporate devices in their company. 35% of employees admitted that they can use their own devices to access business information, provided they have some type of cybersecurity protection, even consumer-grade software.

On the positive side, 21% said they can use their own device, but these must first pass more stringent corporate IT security checks; while 25% of respondents indicated that only devices provided by the IT function can be used for work purposes.

The situation is significantly better with permissions for employees to install software on corporate devices without IT department’s approval. 50% reported that only IT specialists in their company are allowed to install software, while in 31% of organisations only top management or designated users can do so. 11% of employees can install software that is approved by the IT team. However, 8% of respondents said that all users can install any software they need without IT agreement in their organisation.

At the same time 21% of professionals surveyed acknowledged that within the past year they installed software on their work devices without IT supervision. That highlights a persistent shadow IT challenge that continues to expose organisations to security vulnerabilities, compliance risks, and data breaches.

“Shadow IT is now a mainstream operational risk. When one in five employees installs software without IT oversight, it signals a policy gap. Many organisations already have security policies in place, but employee perception must also be considered.

Organisations should move beyond restrictive controls and instead implement intelligent, user-centric cybersecurity strategies that combine strategies that integrate technology with employee awareness and responsible use,” said Toufic Derbass, Managing Director for the META region at Kaspersky.

Microsoft is facing a £1.7 billion ($2.3 billion) class action lawsuit in the United Kingdom over allegations that it abused its dominant market position in cloud computing.

Microsoft

The case, filed before the Competition Appeal Tribunal, was brought by Maria Luisa Stasi on behalf of about 59,000 British businesses and organisations. It alleges that Microsoft unfairly imposed higher costs on customers running its Windows Server software on rival cloud platforms.

Stasi said the company’s practices have had a significant financial impact on both public and private sector organisations over several years.

In allowing the case to proceed, the tribunal ruled that it has a “reasonable prospect of success.” The judges noted that Microsoft is alleged to have abused its dominance in the paid server operating system market to undermine competition in the cloud services space.

If the claim succeeds, compensation for affected organisations is estimated to range between £1.7 billion and £2.1 billion.

Microsoft has rejected the allegations and confirmed it will appeal the ruling. A company spokesperson said the decision does not represent a final judgment on the claims and that it disputes the substance of the case.

The lawsuit comes as regulators in the UK and the European Union intensify scrutiny of Microsoft’s cloud business practices. UK authorities are currently assessing whether the company should be designated as having “strategic market status,” a move that would subject it to stricter competition rules.

According to the global report by Kaspersky Security Services ‘Anatomy of a Cyber World’, the government sector has emerged as the most targeted sector for the second consecutive year, accounting for 19% of all high-severity incidents in 2025.

The industrial sector closely followed at 17%, while the IT sector rose to third place with 15%, displacing finance from the top three targeted industries.

The ‘Anatomy of a Cyber World’ is a comprehensive global report drawing on incident statistics from Kaspersky Managed Detection and Response, Kaspersky Incident Response, Kaspersky Compromise Assessment and Kaspersky SOC Consulting.

This report sheds light on the most prevalent attacker tactics, techniques and tools, as well as the characteristics of detected incidents and their distribution across regions and industry sectors.

Building on these findings, the report reveals that government bodies continued to be the most targeted sector in 2025. A deeper examination of the root causes of attacks within this sector uncovers that Advanced Persistent Threats (APTs) were the most common, accounting for 33,3% of incidents.

This trend highlights the increasing sophistication of adversaries who persistently evolve their tactics to bypass automated protection. Additionally, 18,9% of government organisations experienced social engineering attacks, underscoring that employees remain a critical entry point for cyber threats.

This dual vulnerability, from both advanced persistent attackers and social engineering campaigns, underscores the need to strengthen not only technology but also organisational resilience.

Implementing measures such as role-based access control and limiting privileges can significantly reduce the impact of compromised accounts, particularly in large, distributed government environments.

The industrial sector presents a different but equally concerning profile. Threats in industrial environments are distributed with striking uniformity: APT-driven incidents constitute 17,8%, malware 14,9% and social engineering 13,9%.

This pattern suggests that industrial organisations attract a broad range of adversaries with different capabilities and objectives, rather than being primarily targeted by a single type of threat actor. Notably, confirmed cyber exercises like red teaming accounts for 22,8% of incidents in the sector, the highest share among the top three industries, reflecting growing investment in proactive security validation among industrial organisations.

In contrast, the IT sector shows a markedly different pattern. With 41% of incidents attributed to human-driven APT attacks, the highest rate across all sectors, IT organisations are clearly a priority target for sophisticated threat actors seeking to exploit trusted relationships and scale their impact through supply chains.

APT traces, which are artifacts from previous advanced persistent threat activity, were identified in an additional 17% of cases, while social engineering accounted for 11%. In contrast, red teaming represents only 9% of IT incidents, suggesting that proactive security testing remains underutilised relative to the sector’s actual threat exposure.

Interestingly, the finance sector was displaced from the top three targeted industries. According to the report, red teaming in this sector accounts for 36,1% of incidents, reflecting a mature, compliance-driven approach to proactive defence, while confirmed APT activity remains comparatively low at 11,5%.

This pattern indicates that sustained investment in security assessment can effectively enhance a company’s ability to identify vulnerabilities early, avoiding costly breaches and reducing the risk of significant damage to reputation and operations.

“Government, industrial and IT organisations consistently attract sophisticated adversaries because of the strategic value of what they hold, operate and connect to geopolitical intelligence, critical infrastructure and global supply chains respectively. The 2025 data confirms that these attacks are not opportunistic: they are targeted and often aimed at establishing persistent access.

Each of these sectors needs to operate on the assumption that determined attackers will find a way in, and focus their defences on early detection, rapid containment and minimising the window of exposure. So, proactive threat hunting, continuous monitoring and regular compromise assessments are no longer optional for organisations of any size across these industries,” comments Sergey Soldatov, Head of Security Operations at Kaspersky.