October 2026 was rough

October 2026 brought a concentrated wave of disclosed vulnerabilities, active ransomware campaigns and confirmed breaches across Europe and beyond. Healthcare networks, public-sector platforms and industrial control systems were all hit at points during the month, and the pattern across incidents was familiar: organisations that had treated preparedness as a background concern found themselves exposed when attackers found the gaps that preparation would have closed.

The month's events underlined several trends that have been building through 2026. Ransomware groups continued to demonstrate patience and precision, spending weeks or months inside networks before triggering encryption, maximising leverage and limiting the window for defensive response. Vulnerabilities in widely-deployed edge devices and remote-access tools were actively weaponised, often within days of public disclosure, outpacing patching cycles that many organisations still run on a monthly or quarterly schedule. And the volume of publicly disclosed incidents, driven in part by Europe's NIS2 reporting obligations, made the scale of the problem harder to ignore than it has been in previous years.

What stood out in October was not simply the number of incidents but the degree to which many of them were foreseeable. Known unpatched vulnerabilities. Privileged accounts without multi-factor authentication. No tested incident response plan. These are not novel failure modes; they appear in almost every post-incident review and have done for years. October did not introduce new attack classes. It handed adversaries another month in which the basics had not been done.

Preparedness is the word that matters here, and it is worth being precise about what it means. It is not the same as compliance. Having a policy document, passing an audit or deploying a security product is not the same as knowing what your highest-risk assets are, knowing how quickly you can detect and contain a compromise, and having rehearsed what happens when your on-call engineer receives the alert at two in the morning. The organisations that weathered October's incidents with the least damage were, by and large, those that had already answered those questions before the month began.

Posture is the other concept that keeps coming up in October's aftermath. Posture, in cybersecurity terms, describes the aggregate of your controls, your visibility and your readiness as it actually stands at any given moment: not how it looks on paper, but how it performs under pressure. A strong posture is not achieved once and held. It degrades. Staff change. Systems are added. Patches get missed. Configurations drift. Keeping posture strong means treating it as a continuous operational concern rather than a periodic exercise, and measuring it against realistic threat scenarios rather than a static checklist.

The practical takeaways from October are not complicated, but they do require honesty about where things actually stand. Know your attack surface, including the systems and credentials you have forgotten about. Prioritise patching on internet-facing and privileged systems, particularly when a critical vulnerability is disclosed publicly. Test your detections, not just your defences. Have a documented, rehearsed incident response plan and ensure the people who need to execute it have read it recently. Understand your obligations under NIS2 or whichever framework applies to your organisation, because incident reporting windows are short and the first time you should not be reading the requirements is during an active incident.

October 2026 was a rough month. November is an opportunity to respond to it seriously.