Cyber Pulse: Ian Matthews, StratoLabs

Our Cyber Pulse blogs highlight member voices on cyber security. Join this conversation with Ian Matthews, Founder and CEO at StratoLabs.

What is your cyber security background?

Over twenty years. I founded WMC Global in 2006 to monitor mobile billing fraud and messaging compliance for mobile network operators and brands. As more fraud moved onto mobile, our work moved with it into threat intelligence and mobile messaging fraud detection and disruption. We worked with US and UK mobile network operators, banks and regulators, and sold the business to private equity in 2025. I launched StratoLabs in Edinburgh to advise organisations where telecoms, cyber and AI meet.

The Current Landscape

What is one cyber security challenge or trend you are currently seeing in your sector?

Mobile messaging fraud has become an industry. Phishing-as-a-service operators now sell low-skill criminals ready-made bank and parcel impersonation sites, mobile message delivery infrastructure and victim dashboards. AI hasn’t only invented new attacks. It has also made the existing ones cheaper, faster and more convincing. Meanwhile the channels are fragmenting. Traffic is moving from SMS to RCS, iMessage and encrypted messaging apps, and much of it is now outside the network-level filtering mobile network operators have relied on for years.

How is this challenge specifically affecting your organisation or clients?

The organisation that initially sees the attack is rarely the one that pays for it. A mobile network operator may see the malicious message, a bank absorbs the loss, and a brand takes the reputational damage. In the UK, mandatory APP fraud reimbursement has put that cost directly on banks and payment providers. Smaller organisations face the same attacks as large ones with a fraction of the security budget. Privacy rules on both sides of the Atlantic make it hard for mobile network operators and banks to share the data that would connect the dots.

Response & Lessons Learned

How are you or your team responding to this challenge?

Through partnerships. StratoLabs exchanges threat intelligence with cybersecurity companies and technology platforms so that signals seen in one place protect users in another. We advise organisations on mobile messaging fraud strategy. We also help international security companies, including Scottish and UK firms, enter the US market.

What is one insight or best practice you have learned that others could benefit from?

Map who sees the threat against who carries the loss. Most fraud programmes are built around one organisation’s own telemetry. The attacks that cause the most damage cross the boundaries between mobile network operators, banks, platforms and brands. Build relationships with the other parties in that chain before an incident, not during one.

Looking Ahead

What emerging threat, technology or trend should organisations be paying attention to over the next 6–12 months?

Three things. First, RCS adoption, which removes some of the in-network inspection that has historically caught fraud at scale. Second, on-device scam filtering from Apple and Google. It protects individual users well, but it restricts default controls to two companies whose primary focus is not security. Third, agentic AI running full scam conversations, from the first message through to the payment request, without a human operator.

Quick Fire

Favourite cyber tool right now: Scamnetic, as scam protection shifts towards on-device controls. (I sit on Scamnetic’s Board of Advisors.)

Someone in the industry to follow: Wil Klusovsky, for his practical, business-first take on cyber decisions.

One word that describes the current state of cyber security: Constrained