The Cybersecurity Visibility Gap: What You Can't See Can Still Hurt You

Key takeaways

• Nearly 43% of UK businesses identified a cyber breach or attack in the past 12 months, yet only 11% have used or invested in threat intelligence to see attacks coming.

• Vulnerability exploitation, not stolen credentials, is now the leading way attackers break in, and it happens fast: the median time from disclosure to exploitation has fallen to around five days.

• Brand impersonation is concentrated but relentless. Microsoft was the most-impersonated brand in Q2 2026, targeted by attackers in 23% of all brand phishing attempts in Q2 2026, with the top five brands making up more than half of all cases tracked.

• Supply chain blind spots are widespread: only 15% of UK businesses formally review the cyber risk posed by their immediate suppliers, and just 6% look at their wider supply chain.

• External threat intelligence turns invisible risk into actionable warning, closing the gap between what internal tools can see and what attackers are already doing.

Most security budgets are still built around a simple assumption that the threat is inside the network or trying to get in through the front door. Firewalls, endpoint detection, and access controls are all designed to watch that boundary closely. However, a growing share of the damage against organisations starts somewhere the internal stack was never built to look outside it.

Leaked credentials sitting in a criminal marketplace. A domain one character away from your own, quietly harvesting customer logins. A forum post naming your organisation as a target. None of this trips an internal alert, because none of it happens on your network. By the time it does reach your infrastructure, the reconnaissance is already finished.

Why the perimeter no longer marks the edge of your risk

The idea of a security perimeter made more sense when most systems, staff, and data lived inside a defined network boundary. That boundary has been dissolving for years, pushed outward by cloud services, remote work, and sprawling supplier relationships. What has not kept pace is visibility. Internal tools remain excellent at watching internal systems. They are structurally unable to see what happens on a criminal forum, a paste site, or a domain registrar three steps removed from the corporate network.

The UK government's own data illustrates the scale of the problem. Just over four in ten UK businesses (43%) identified a cyber breach or attack in the last 12 months, which is equivalent to roughly 612,000 organisations nationwide. Yet when the same survey asked what organisations actually do to identify risk before it lands, threat intelligence came bottom of the list: only 11% of businesses said they had used or invested in it, well behind more familiar measures like security monitoring tools (32%) or basic risk assessments (30%). Most organisations are still oriented almost entirely toward detecting what has already reached them, not what is being prepared against them.

The threats that live outside your network

A useful way to think about the visibility gap is to separate it into the categories of activity that internal tools cannot reach.

Leaked and stolen credentials. A working username and password remains one of the most reliable ways into an organisation, and the volume in circulation keeps climbing. Specialist researchers now track billions of stolen credential records recaptured from infostealer malware and combo-list dumps each year, many of them tied to corporate accounts their owners have no idea are exposed. None of that exposure is visible from inside the network it eventually threatens.

Brand impersonation and typosquatted domains. Attackers do not need to breach an organisation directly if they can convincingly impersonate it instead. Check Point Research's Q2 2026 brand phishing tracking found that Microsoft was the single most impersonated brand, appearing in 23% of all brand phishing attempts. It was also found that the top five impersonated brands together accounted for more than half of everything tracked that quarter. Lookalike domains registered against a brand pass email authentication cleanly because they are not forging anything, they are simply new domains sending mail as themselves. A perfectly configured DMARC policy has no opinion on a domain it does not own.

Dark web discussions and threat actor activity. Attackers plan and coordinate in places security teams do not routinely monitor: closed forums, encrypted chat channels, and marketplaces trading in access and stolen data. Named organisations, upcoming campaigns, and freshly compromised datasets often surface there well before they surface anywhere else.

Vulnerabilities being discussed or exploited. The gap between a vulnerability becoming public and attackers actively using it has been collapsing. Recent analysis tied to the Verizon Data Breach Investigations Report found vulnerability exploitation overtook stolen credentials as the leading way attackers gain initial access for the first time in the report's history, which is now present in 31% of breaches. Separately, researchers at VulnCheck found the median time from a vulnerability's public disclosure to active exploitation had fallen from 120 days to around 80 days in the first half of 2026, with roughly one in four vulnerabilities exploited within 24 hours of disclosure. Knowing a vulnerability affecting your stack is already being discussed or weaponised, before a patch cycle even begins, is the definition of visibility an internal scanner cannot provide on its own.

Supply chains widen the gap further

External exposure is not limited to an organisation's own infrastructure. Suppliers, partners, and vendors extend the attack surface well beyond anything a company directly controls, yet formal oversight of that risk remains thin. The 2025/2026 Cyber Security Breaches Survey found only 15% of UK businesses formally reviewed the cyber risk posed by their immediate suppliers, and just 6% extended that review to their wider supply chain. A vendor's exposed credentials or compromised systems can become an organisation's problem long before anything shows up on its own network.

Closing the gap

None of this means internal security tooling has failed. It means it was never designed to answer the question that matters most for early warning: what is happening to this organisation outside its own walls. Answering that requires visibility built specifically for the external landscape, continuous monitoring of credential leaks, domain infrastructure, dark web and closed-source discussion, and vulnerability chatter relevant to a specific organisation's footprint.

This is the space external threat intelligence occupies. Rather than waiting for an external threat to cross into internal territory, it surfaces the warning signs while they are still outside the perimeter. This gives security teams the chance to act before an incident, rather than respond after one. CYJAX focuses on exactly this layer, tracking the external indicators that internal tools structurally cannot see and turning them into intelligence organisations can act on.