Weekly Roundup · Week of 14 to 20 September 2026
The week in business IT & comms
Two counts set the week. Openreach totted up the copper phone lines left in ten big cities and found around 600,000 still to move, with Bristol at 8.99 per cent and London at 12.92. The government published its Cyber Essentials figures and they hit a record 61,430 certificates, against a private sector it puts at roughly 5.7 million small and medium businesses. Both counts point the same way: the deadlines and the standards keep moving, and most firms have not moved with them.
- 01The Switch-Off
Openreach names the cities with the most analogue phone lines left to switch
Openreach published a league table on 17 September covering ten of the UK's largest cities and the areas around them. Liverpool leads with 6.35 per cent of legacy lines still to convert. London trails on 12.92 per cent, or 235,934 lines. Bristol sits at 8.99 per cent with 43,775 lines to go. Nationally Openreach estimates around 1.5 million lines are still running on the old copper phone network, including around 350,000 business premises.
Read the full story - 02Cyber Security
Cyber Essentials had a record year and still reaches about one per cent of UK small businesses
Government figures updated on 16 September show 61,430 Cyber Essentials certificates awarded in the year to June 2026, 46,245 at CE level and 15,185 at CE Plus. Infosecurity Magazine put that at a 20 per cent rise on the year before and reported that nearly three quarters of the total were recertifications rather than new organisations. The government estimates there are around 5.7 million SMEs in the UK.
Read the full story - 03Microsoft & Cloud
Microsoft shipped out of band fixes after its record patch broke Remote Desktop
Microsoft released cumulative updates on 14 September, KB5129195 for Windows 11 24H2 and 25H2 and KB5129235 for Windows Server 2025, to fix Remote Desktop Services problems caused by the 8 September security release. Infosecurity Magazine reported on 15 September that Microsoft had by then issued six emergency patches tied to September's Patch Tuesday. A separate known issue can break the trust relationship between a domain joined PC and Active Directory.
Read the full story - 04Cyber Security
Hiscox puts the average cyber incident at 52,000 dollars, and UK firms were the most likely to be hit
The Hiscox Cyber Readiness Report 2026, published on 15 September and based on a survey of 6,800 security decision makers across the UK, Europe and the US, found 29 per cent of organisations globally suffered at least one successful attack in the past 12 months. UK firms were the most likely to be hit at 38 per cent, against 20 per cent in the US. The average incident cost around 52,000 dollars and the global average downtime was 32.8 hours.
- 05Cyber Security
Four clients out of more than 800 met their own ransomware recovery target
Incident response firm Fenix24 published its first State of Recoverability report on 15 September, drawn from more than 500 ransomware recoveries. Only four of more than 800 clients, 0.5 per cent, came close to their own 24 to 48 hour recovery targets, and then only for partial operations. It found 94 per cent had tied their backup systems to the same Active Directory the attacker seized, and 99.2 per cent arrived with no documented identity recovery plan.
- 06Telephony & VoIP
Telecoms providers get official guidance on sharing fraud data with each other
Comms Council UK published data sharing guidance on 16 September, produced with support from the Home Office, Ofcom and the Information Commissioner's Office, aimed at telephone enabled fraud. It sets out what kinds of data sharing are lawful and what frameworks support it. One case study describes cross industry analysis of network data identifying an SMS blaster used to mass send fraudulent texts, leading to an arrest, conviction and sentencing. In another, telecoms provider data was shared with financial institutions to identify potential business victims of fraud.
- 07Connectivity & Broadband
Subsidised gigabit build passed 46,300 more premises, and 9 per cent of them were commercial
Building Digital UK published its April to June 2026 progress report, covered by ISPreview on 17 September. BDUK interventions reached 46,300 premises in the quarter, 90 per cent of them rural, taking the cumulative total to 1,462,910 since the programmes began. Of the premises passed in the quarter, 91 per cent were residential and 9 per cent, 3,980 premises, were commercial. ISPreview notes that over 91 per cent of UK premises can already reach a gigabit capable network.
What we’re watching
The switch off work is the one with a clock on it. Openreach's notes to editors say the WLR basic rental price rises by a further 40 per cent on 1 October 2026, taking legacy line rental to double what it was, so anything still sitting on a WLR line costs more in under a fortnight. On the Microsoft side, two known issues are still open on the September updates: Credential Guard protected machine accounts losing their secure channel with Active Directory, which Microsoft says it plans to resolve in a future Windows update, and USB Audio Class 1.0 devices failing with error Code 10, which matters if your staff run a softphone through a USB headset. The Cyber Essentials data set is published a quarter at a time, so the next figures will cover July to September 2026.
#WEARECOBALT
Got a question this raises?
If anything here makes you wonder where your business stands, ask us. We'll give you a straight answer for your setup, with no obligation.