Recent incidents such as the Manchester Airports Group breach have highlighted an uncomfortable reality for businesses: attackers don't always target the systems organisations are most focused on protecting.

While headlines often focus on the number of records exposed or the operational impact of a cyber attack, the route into an organisation is frequently through less scrutinised systems such as guest Wi-Fi networks, booking platforms, third-party suppliers, external APIs and customer-facing applications. The Manchester Airport incident serves as a reminder that cyber resilience is no longer just about protecting core infrastructure, but understanding the wider attack surface surrounding it.

At the same time, search demand shows UK businesses are actively seeking guidance on both cyber threats and defensive measures, with "network security" generating around 2,300 UK searches per month, while "phishing attack" attracts around 1,300 monthly searches and "ransomware attack" a further 1,100 searches. Interest in preventative security measures is also growing, with terms such as "zero trust security" and "network security solutions" generating hundreds of monthly searches from organisations looking to strengthen their defences.

Yet despite increasing awareness, many organisations remain focused on protecting their core systems while overlooking the entry points cyber criminals increasingly target.

According to Bradley Collis, Cyber Security Expert at Planet IT, part of TalkTalk Business:

"The breach at Manchester Airports Group underscores a critical reality for enterprise IT teams: attackers are actively bypassing hardened core systems to exploit secondary customer touchpoints like guest Wi-Fi, booking portals, and vendor APIs."

While many cyber security discussions focus on malware, ransomware or phishing, the bigger risk is often the collection of systems sitting around the edge of an organisation's infrastructure.

What The Manchester Airport Breach Can Teach Businesses#

The Manchester Airports Group breach wasn't notable solely because of the volume of records exposed. It also demonstrated the importance of effectively separating public-facing systems from critical infrastructure.

As Bradley Collis explains:

The lesson extends far beyond airports.

Businesses cannot always prevent attacks from occurring, but they can limit the damage those attacks cause. Effective network segmentation, tighter control over third-party access and stronger oversight of customer-facing systems can all help prevent a localised security incident from becoming a company-wide crisis.

For organisations reviewing their cyber security posture, the key question is no longer whether core systems are protected.

It's whether an attacker could move from an overlooked peripheral system into the rest of the business.

Cyber Security Search Trends: What UK Businesses Are Researching#

Key UK Search Volumes#

• Network security – 2,300 monthly searches

• Phishing attack – 1,300 monthly searches

• Ransomware attack – 1,100 monthly searches

• Zero trust security – 700 monthly searches

• Network security solutions – 600 monthly searches

• What is zero trust security? – 600 monthly searches

Combined, these six cyber security topics generate more than 6,600 searches per month in the UK, highlighting sustained concern around both cyber attacks and cyber defence.

Could an Attacker Move From a Peripheral System Into Your Core Environment?#

Before looking at specific vulnerabilities, businesses should ask themselves one simple question:

If a threat actor compromised your guest network or a third-party marketing integration today, could they move laterally into your core production environment?

The Hidden Attack Surface Audit below highlights seven commonly overlooked areas that may warrant closer inspection.

The Hidden Attack Surface Audit#

1. Guest Wi-Fi Networks#

Public and guest networks often receive less scrutiny than internal corporate systems.

With interest in Zero Trust security continuing to grow, organisations are increasingly recognising the need to treat guest networks as entirely separate environments rather than extensions of their corporate network.

Bradley Collis recommends:

"Public guest Wi-Fi and customer-facing booking portals must be strictly segregated from internal corporate networks. The MAG incident proves that architectural boundaries work. Employing a Zero-Trust architecture ensures that even if a secondary touchpoint is compromised, attackers cannot move laterally into sensitive databases or business-critical IT infrastructure."

Audit checklist#

✅ Guest and internal networks are separated

✅ Access between networks is restricted

✅ Zero Trust principles are applied

2. Network Threat Monitoring#

Many organisations monitor endpoints but have limited visibility across wider network activity.

This is particularly important given the continuing demand for information around network security, which generates more monthly UK searches than any other topic analysed.

According to Bradley Collis:

"Cybercriminals frequently use leaked data to test credential-stuffing attacks across other corporate platforms. Maintaining 24/7 network threat monitoring and automated anomaly detection allows IT teams to spot unusual outbound traffic spikes, lateral movement, or unauthorized login attempts before a wider breach occurs."

Audit checklist#

✅ Continuous network monitoring in place

✅ Suspicious outbound traffic investigated

✅ Lateral movement detection capabilities enabled

3. Third-Party Access & Vendor Relationships#

Modern organisations rely on an increasingly complex ecosystem of partners, suppliers and software providers.

Every additional supplier connection, software integration or outsourced service potentially expands an organisation's attack surface.

Bradley Collis warns:

"Modern enterprises rely heavily on interconnected third-party platforms for Wi-Fi logins, reservations, and customer management. Organizations must regularly audit external API permissions and vendor access points to close potential supply-chain security gaps that attackers could exploit."

Audit checklist#

✅ Vendor permissions reviewed regularly

✅ Dormant accounts removed

✅ Third-party access minimised

4. External APIs#

APIs underpin everything from customer portals to SaaS applications and booking systems.

Yet they often receive far less scrutiny than core infrastructure despite exposing organisations to significant risk if poorly configured.

Growing interest in network security solutions and Zero Trust frameworks suggests businesses are increasingly aware that security boundaries now extend beyond traditional networks.

Audit checklist#

✅ API permissions reviewed quarterly

✅ Legacy integrations removed

✅ Sensitive data access monitored

5. Email & DNS Security#

Following major breaches, attackers frequently launch phishing campaigns and register imitation domains.

With "phishing attack" generating approximately 1,300 searches per month in the UK, email security remains one of the most visible and persistent concerns facing organisations.

Bradley Collis advises:

"In the hours following a leak, bad actors rapidly register lookalike domains to spoof trusted brands. IT teams should immediately tighten email security filters, enforce strict DMARC/SPF validation, and update DNS filtering rules to block newly registered domain names mimicking affected organisations."

Audit checklist#

✅ SPF configured

✅ DMARC enabled

✅ DKIM implemented

✅ DNS filtering policies reviewed

6. Lookalike Domains#

Attackers increasingly exploit trusted brands through domain spoofing.

Following public breaches, these domains are frequently used to distribute phishing emails, credential theft campaigns and malicious links.

✅ Brand monitoring in place

✅ Suspicious domains tracked

✅ Domain impersonation risks reviewed

7. Employee Awareness#

Even strong technical controls can be undermined through successful phishing or smishing campaigns.

Bradley Collis notes:

"Because 8.7 million leaked records contain personal emails and phone numbers, many of those affected will be corporate employees on company devices. Businesses should issue an immediate warning reminding staff to scrutinize unsolicited SMS messages (smishing) and emails claiming to offer parking refunds, booking confirmations, or urgent account updates."

✅ Regular cyber awareness training

✅ Phishing reporting process in place

✅ Employees understand social engineering risks

The Biggest Risk Could Be The Systems You Rarely Think About#

Search behaviour suggests businesses remain heavily focused on headline threats such as phishing attacks, ransomware attacks and network security. However, incidents such as the Manchester Airports Group breach highlight a less obvious reality: attackers increasingly look for weaknesses around the edges of an organisation's infrastructure rather than attempting to breach the most heavily protected systems.

As Bradley Collis explains:

The most resilient organisations aren't simply protecting their core infrastructure. They're reviewing the guest networks, third-party connections, APIs and supplier relationships that make up their wider attack surface.

Because in today's threat landscape, attackers aren't always trying to break through the front door.

They're looking for the side entrance nobody remembered to lock.

Check out our Security Services here.