SearchPressSubscribe

P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

Press & MediaTaking media enquiriesCambridge, United Kingdom

Cyber security and AI expertise for news and current affairs

Parminder Kumar Sharma (P.K. Sharma) is a cyber security leader who comments on cyber incidents and ransomware, cyber warfare, security operations, AI security and governance, and the AI models and hardware behind the news. He combines 16 years of hands-on delivery in IT and security with evidence-led analysis of cyber and AI developments, published on this site.

Media enquiries for Parminder Kumar Sharma

press@pk-sharma.com

All requests by email, broadcast included. Add a number if you would like a call back. Written comment is usually possible the same working day. Phone, video, studio and live interviews by arrangement.

Email a request
  • Written commentBy email, attributable
  • PhoneBackground or on the record
  • Video callRecorded or live
  • StudioRadio and television
  • Live broadcastBy arrangement

For comment

Subjects, and the questions behind them

Six areas, each with the kind of question a reporter brings on deadline. Comment is given on the record or as background, as the story needs.

  • Cyber incidents and ransomware

    Breaches, ransomware and outages, read from the organisation's own statements and the regulator's record.

    • What does an organisation's first statement actually tell us, and what does it leave out?
    • A ransomware group claims a victim: what can be checked, and what is only the group's word?
    • Should a victim pay, and what do the UK's rules on ransom payments say?
    • What usually happens in the first 72 hours, and what can still be unknown weeks later?

  • Cyber warfare and state threats

    State-linked hacking, attacks on infrastructure, and how attribution is made.

    • Who is behind a state-linked attack, and how much of the attribution rests on one company's report?
    • What would an attack on power, water or hospitals actually look like, and how likely is it?
    • What do sanctions, indictments and takedowns against hacking groups really change?

  • Security operations and vulnerabilities

    Exploited flaws, patch cycles and what defenders should do this week.

    • A vendor says a flaw is exploited or critical: what does that mean for an ordinary organisation this week?
    • Why do patch counts and deadlines from different bodies disagree?
    • What separates a scan or a honeypot hit from an actual compromise?

  • AI security and governance

    AI systems as a target and a tool, and the rules that apply to them in the UK.

    • Prompt injection, AI agents with too much access, and stolen AI credentials, explained without jargon.
    • What does a company's AI safety claim measure, and what does it not?
    • What UK rules apply to AI systems today, and where do they stop?

  • AI models and computing hardware

    New AI models and the chips they run on: processors, graphics cards and NPUs.

    • A new AI model tops a benchmark: what was measured, and what did each task cost?
    • Processors, graphics cards and NPUs: what does a new chip launch change for buyers and businesses?
    • Can an AI model run on a laptop or a phone, and what hardware does it really need?

  • Cyber security leadership and accountability

    Boards, suppliers and data protection duties, from someone who has carried them.

    • What should a board ask after an incident at a supplier?
    • When a regulator acts, what did it find, and what did it not decide?
    • How do data protection duties apply when staff use unapproved tools?
    • What does good evidence look like when a company says it is secure?

Selected analysis

Briefings that went back to the document

Chosen for this page and checked again against their primary sources on 17 October 2026.

  1. Cyber incidents and ransomware
    Q3's record 2,627 ransomware attacks: 247 confirmed by the victim, 2,380 only claimed

    Set Comparitech's record quarter against its own page: 2,627 attacks counted, 247 confirmed by the victim, and 2,380 only claimed.

  2. Cyber incidents and ransomware
    Legal Aid Agency's stated data start moved from 2010 to 1978: about 250,000 pre-2007 records, no count of people

    Traced the agency's own notices: the stated start of the stolen data moved from 2010 to 1978, with about 250,000 pre-2007 records and still no count of people.

  3. Cyber warfare and state threats
    Fake AI committee, borrowed names: all three sender addresses Proofpoint lists are consumer webmail

    Read Proofpoint's report on TA419, a group it calls China-aligned, which invited US AI policy experts to a fictitious committee: every listed sender address is consumer webmail.

  4. Security operations and vulnerabilities
    Microsoft's October Patch Tuesday has seven totals, 1,407 to 1,417, and one exploited CVE, not three zero-days

    Parsed Microsoft's full release data: one exploited CVE, not three zero-days, and seven published totals from different counting rules. Microsoft's own count has since moved to 1,453.

  5. AI security and governance
    UK Cyber Bill: AI appears 0 times in the text; 0 of 47 amendments on the 13 October list are the Government's

    Counted the Lords text of the Cyber Security and Resilience Bill: AI appears 0 times, and none of the 47 report amendments listed on 13 October is the Government's.

  6. AI models and computing hardware
    Qualcomm's two new flagships share one spec sheet, and the memory clock that binds on-device AI has not moved

    Read both Qualcomm product briefs line by line: no NPU throughput, no memory bus width, no largest model size, and the same 5,300 MHz memory clock as before.

  7. Cyber security leadership and accountability
    ICO: about 500 Met accounts on Auror, 179 people uploaded, no DPIA, and a control gap it dates to May 2018

    Read the regulator's 48-page notice in full: about 500 accounts, 179 people's details uploaded, no impact assessment, and a control failure it dates to May 2018.

Latest from the Briefing

Updates as new briefings are published

Every briefing is in the Briefing, newest first.

Method

How the work is produced

The same five steps on every briefing, shown here on one real case.

Worked example: the ICO’s notice to the Met, dated 23 September 2026

01 of 05

The coverage

A news report on 15 October 2026 summarises an ICO action against the Met.

News report, 15 October 2026

  • The ICO has reprimanded the Met and issued an enforcement notice over officers’ use of a retail crime platform.
  • About 500 accounts, data on 179 people, no impact assessment.
  • Officers used the platform for more than 18 months without triggering an alert. Held for checking.

02 of 05

The source, read in full

The regulator's own notice: 48 pages, dated 23 September 2026.

48 of 48 pages

The reprimand and enforcement notice, read in full, with its two listing pages and the news release.

Notice, 23 SepReport, 15 Oct

22 days between them (derived)

03 of 05

The figures, recomputed

Counts split as the notice gives them; intervals worked out and marked derived.

179 people whose data was uploaded, as the notice splits them

Name only
128
With date of birth
49
And home address
2

3,043 days of the control failure the notice dates from 25 May 2018 (derived)

May 2018Sep 2026

Auror use, March 2023 to 26 September 2024: about 18 months, about 18 per cent of the span (derived)

04 of 05

What it does not establish

The questions a reader would ask next, and the record's silence on them.

Stated

  • The Met’s data team: 59 of the 179 were arrested, charged, convicted or circulated as wanted
  • No data protection impact assessment before or during the period
  • No monetary penalty issued

Not stated

  • How the 59 split into arrested, charged, convicted or wanted
  • Anything about the other 120 people (derived)
  • Any harm to a person, beyond harm that was likely
  • Why there was no fine
  • The coverage's line on 18 months without an alert: not in the visible text, where paragraphs 80 to 82 are partly blacked out

05 of 05

On the record

Published with every source linked. Later changes are dated and logged.

Briefing, 15 October 2026

ICO: about 500 Met accounts on Auror, 179 people uploaded, no DPIA, and a control gap it dates to May 2018

Sources linked in the text: the notice, both listing pages, the news release, the legislation it relies on and the guidance it quotes. The coverage is read as secondary.

Read the briefing

If a fact changes, a dated section goes at the top of the article.

Anything already published that turns out wrong is marked as a correction.

Every change is listed in one public log.

Briefings on this site are drafted with the help of AI tools, then checked against primary sources: regulators’ notices, advisories, court filings and official data. Figures are recomputed and marked “derived” where they are not printed in the source. Claims are attributed to whoever made them, and what the record does not establish is stated.

Everything on this site is published under P.K. Sharma’s name, and he is responsible for it. Corrections and updates are dated on the article and listed in the corrections log.

How to cite

Parminder Kumar Sharma, [briefing title], pk-sharma.com, [date of publication].

Name in print. Parminder Kumar Sharma on first mention, then P.K. Sharma.

Background

Relevant experience

16 years of delivery, from a diagnostic imaging centre to a global security operations provider. Employers are not named, as on the About page.

  1. Aug 2024 to present

    Head of IT, Security & Compliance

    UK tools and equipment business

    Single point of accountability for information security, IT operations and digital risk; technical lead for an AI product programme.

  2. Jul 2020 to Jul 2024

    Vice President of Information Technology

    Global managed security services provider

    Security service delivery to more than 500 client organisations; grew the security operations team from 6 to 18; led ransomware response, forensics and recovery decisions.

  3. Apr 2024 to Mar 2025

    Cyber Threat Intelligence Team Lead

    Cyber Security Forum Initiative, volunteer appointment

    Led a volunteer intelligence team producing analytical reporting for senior leadership.

  4. Sep 2010 to Apr 2018

    IT and PACS Administrator, Clinical Imaging Systems Lead

    Diagnostic imaging provider, Punjab, India

    Sole technical authority for clinical imaging systems: PACS, DICOM, RIS and HIS.

Credentials

  • ISACA AAISMAdvanced in AI Security Management
  • ISO/IEC 42001 Lead AuditorAI management systems
  • ISO/IEC 27001 Lead AuditorInformation security management systems
  • CISMCertified Information Security Manager
  • CCISOCertified Chief Information Security Officer

Policy and standards work

  • ISACA UK Advocacy Task Force, 2026

    Appointed member, contributing to ISACA's UK policy and advocacy positions.

  • DSIT and ISACA roundtables, 2026

    Contributor to a DSIT-convened government and industry roundtable on the UK cyber governance code of practice, and to an ISACA and BCS roundtable on UK NIS regulatory reform.

  • ISACA AAISM Quality Assurance Review Team, 2026

    Reviewing the Advanced in AI Security Management certification, the credential itself.

Press kit

Biographies to copy

Free to use for editorial coverage. Please keep the credentials as written.

Short

54 words

Parminder Kumar Sharma (P.K. Sharma) is a UK-based cyber security leader with 16 years in IT and security delivery, from incident response and security operations to AI security and governance. He holds ISACA's AAISM and CISM and EC-Council's CCISO, and is an ISO/IEC 42001 and 27001 Lead Auditor. He publishes evidence-led analysis at pk-sharma.com.

Extended

184 words

Parminder Kumar Sharma (P.K. Sharma) is a cyber security leader whose career runs from clinical imaging systems in India, through security operations at a global managed security provider, to AI security and governance in the UK. As its Vice President of IT he led security service delivery to more than 500 client organisations, grew the security operations team from 6 to 18 analysts and engineers, including 24/7 detection and response, and led ransomware response and recovery decisions. He is now Head of IT, Security and Compliance at a UK business, and technical lead for its AI product programme. He holds ISACA's Advanced in AI Security Management and CISM credentials and EC-Council's CCISO, is a Lead Auditor for ISO/IEC 42001 and 27001, and sits on ISACA's UK Advocacy Task Force. He comments on ransomware and cyber incidents, cyber warfare, AI security and governance, and the AI models and hardware behind the news. On pk-sharma.com he publishes briefings that go back to primary sources: regulators' notices, vendor advisories, court filings and government data. Figures are recomputed, claims are attributed, and corrections are dated on the page.

Photograph. A press photograph is available on request by email, free to use for editorial coverage with credit.

On deadline? Send the question.

Email is the fastest route, including for broadcast bookings. Include your outlet, your deadline, the format you need, and a number if you would like a call back. Written comment is usually possible the same working day. Phone, video, studio and live interviews by arrangement.

press@pk-sharma.com

Email a request