18 years of data. One avoidable breach.

In April 2025, the UK's Legal Aid Agency got hit by a cyberattack.

By May, the full scale became clear. Attackers had accessed personal data of legal aid applicants going back to 2007. Names, addresses, dates of birth, National Insurance numbers, criminal histories, financial records, employment status. Over 2 million records.

Here's what makes this particularly uncomfortable: the Law Society had been warning about the LAA's outdated IT systems since at least 2023. The vulnerabilities weren't a surprise. The breach was attributed to longstanding weaknesses in aging infrastructure that the Ministry of Justice had repeatedly failed to address.

The systems were known to be at risk. The investment to fix them never came. And when attackers showed up, 18 years of sensitive data was sitting there waiting.

This isn't a technology failure. It's a security management failure.

Every organization has security gaps. Legacy systems. Underfunded infrastructure. Known vulnerabilities that haven't been remediated yet.

The difference between organizations that get breached and organizations that don't isn't whether those gaps exist. It's whether security leadership has the authority, the frameworks, and the credibility to get them fixed before attackers find them.

The LAA's security team almost certainly knew the systems were vulnerable. But knowing about a risk and having the organizational power to address it are two different things entirely.

Getting leadership to invest in security remediation requires more than pointing at a vulnerability. It requires translating technical risk into business language that boards and ministers understand. It requires building governance frameworks that force risk decisions to be made explicitly, not ignored by default. It requires the kind of security program management that turns "we know this is a problem" into "we fixed this before it became a crisis."

That's exactly what CISM is designed to build.

CISM focuses on security management: how to design programs that catch and address risks before they become breaches, how to communicate risk in ways that drive action at the leadership level, and how to build governance structures that don't let known vulnerabilities sit unaddressed for years.

And professionally? The LAA breach resulted in parliamentary scrutiny, regulatory investigation, and lasting reputational damage. The security leaders who can prevent these situations are the ones organizations are willing to pay for. The ones who can't are the ones explaining to parliamentary committees why 18 years of sensitive data got stolen.

Our next CISM Bootcamp runs June 22-25. Four days covering everything ISACA tests. You also get full access to the CISM MasterClass if you'd prefer to study at your own pace.

Learn more about the CISM Bootcamp

P.S. Prefer to study on your own schedule? Our CISM MasterClass covers the same material with full flexibility.

Best,
The DestCert Team