Monday, 27 July 2026

US and Iran hold fire for a second consecutive day as Muscat channel works toward an interim deal

Neither the United States nor Iran launched strikes for a second straight day, and a senior Iranian official told Reuters that Tehran will hold its fire for as long as Washington maintains the pause — the clearest reciprocal signal since the June ceasefire framework collapsed. Diplomatic efforts now centre on an interim arrangement to replace the broken memorandum, negotiated through Oman. For security planners the correct read is narrow: this is a pause with a stated condition attached, not a settlement, and the condition can be voided by a single Houthi launch, a maritime incident or a proxy action neither capital fully controls. Organisations that raised travel-risk postures, rerouted shipping or activated duty-of-care protocols for Gulf-exposed staff during the strike campaign should hold those postures through at least one full negotiation cycle rather than unwinding on the first quiet weekend. The cheapest mistake available this week is prematurely declaring normality; the second cheapest is failing to use the lull to restock, rotate and re-brief the people who have been operating at elevated readiness for a month.

Mission Support's advisory and intelligence team helps organisations decide when to hold, adjust or unwind elevated security postures as a conflict de-escalates.

Hormuz endgame turns on tolls: Iran wants mandatory fees, Oman floats a Malacca-style voluntary model

The unresolved core of the interim negotiations is whether vessels transiting the Strait of Hormuz will pay for the privilege. Tehran is pressing for mandatory navigation fees under a new strait-administration regime; Oman — designated under the June memorandum to define future maritime services with other littoral states — opposes compulsory tolls and is reportedly exploring models closer to the voluntary contributions used in the Strait of Malacca or Türkiye's Bosphorus transit charges. The commercial consequences of each variant differ enormously: a mandatory-fee regime forces every charterer, insurer and trading house into direct financial relationships with entities that may remain sanctioned, while a voluntary scheme mostly re-prices risk premiums. Organisations with Gulf supply-chain exposure should model both outcomes now — including the compliance question of whether paying a mandatory Iranian transit fee is even lawful under existing sanctions regimes — rather than waiting for the negotiated answer. Whatever emerges from Muscat will set a precedent every other chokepoint state in the world is watching closely.

Interpol and Europol renew cybercrime cooperation as identity-based attacks overtake software flaws

Interpol and Europol have renewed their cooperation agreement and set new joint operational priorities for combating cybercrime — an institutional signal that lands alongside a telling shift in the underlying threat data: recent European analysis shows identity-based attacks, led by compromised credentials and phishing, have overtaken software vulnerabilities as the most common root cause of ransomware incidents. That inversion matters for how organisations spend their next security euro. Patch discipline remains necessary, but the dominant entry path now runs through people and credentials — stolen passwords, session tokens, MFA fatigue and increasingly convincing social engineering — which means identity governance, phishing-resistant authentication and staff awareness deliver more risk reduction per euro than another perimeter appliance. For Dutch organisations the practical checklist is short: inventory which systems still accept password-only access, close dormant accounts with standing privileges, and rehearse the credential-compromise scenario with the same seriousness as the malware one. The attacker who logs in looks like an employee until the moment the damage is done.

Mission Support's cyber security services help organisations harden identity, access and awareness — the entry paths attackers now use most.

"Unmanned where possible": the Dutch Defence Strategy's pivot to drones, AI and cyber reshapes the national security market

The Defence Strategy published at the end of June — its guiding principle "unmanned where possible, manned where necessary" — is now translating into concrete programmes: within five years unmanned systems are expected to account for more than half of operational capability, backed by roughly €20 billion in additional spending by 2035 and a software-first drone-ecosystem partnership with Dutch industry. The second-order effect is a structural demand signal across the civilian security sector. Every new drone, AI and cyber programme widens the circle of Dutch companies holding defence-relevant information, and hostile intelligence services have spent 2026 demonstrating — through documented sabotage, insider recruitment and reconnaissance cases across Europe — that this supply chain is actively targeted. Firms entering defence work for the first time inherit obligations most have never operated under: personnel screening beyond the standard VOG, contractor and visitor discipline at development sites, counter-surveillance awareness for programme staff, and technical assurance of the rooms where designs are discussed. The strategy also normalises counter-drone thinking far beyond the military: airports, ports, events and corporate campuses will increasingly be expected to have an answer to the unmanned threat they now share.

Mission Support's TSCM services provide sweep and technical-assurance programmes for organisations entering defence and government supply chains.

Heat week ahead: peaks near 36°C on Wednesday put outdoor security operations under heat protocols

The Netherlands enters a sustained hot spell this week, with temperatures climbing toward peaks near 36°C on Wednesday — arriving precisely as WorldPride fills Amsterdam's streets with two weeks of outdoor programming. For security operations, heat is an operational load factor, not a comfort issue. Static guarding posts, event stewarding, crowd management and canine teams all degrade measurably in sustained heat: vigilance drops, rotation cycles shorten, PPE and ballistic vests raise core temperature faster, and medical incidents in crowds multiply — which in turn consumes the same response capacity that security incidents would need. Organisations running outdoor posts this week should shorten rotations, harden hydration and shade logistics, brief supervisors on heat-illness recognition, and pre-agree with event medical services where the handover line runs between a medical response and a security one. Control rooms should also expect the classic hot-weather incident profile — more alcohol, more altercations, more medical calls, thinner tempers in queues — and staff accordingly. The forecast is public; an unprepared roster on Wednesday is a planning failure, not bad luck.

Mission Support's training and resilience programmes prepare security teams for degraded operating conditions — heat protocols included.