Aston Villa Football Club

The Organisation

Aston Villa Football Club is a Premier League club in the English Premier League, established in 1874. As one of the Premier League's historic clubs with significant success over the years, Aston Villa is currently enjoying strong performance both in the league and in the Europa League.

• Relatively small IT and security team managing rapid organisational growth
• Extensive infrastructure including a historic stadium with complex technology requirements
• Microsoft technology stack requiring enterprise-level cybersecurity capabilities
• Subjected to UK/EMEA compliance regulations, including GDPR
• Participating in Premier League's Section K technology standards and security baseline requirements

The Challenge

Football clubs have long been considered high-value targets for threat actors given the type of confidential data they hold, such as athlete transfer news and contract details, sensitive information about athletes and coaching staff, and Personally Identifiable Information (PII) about their employees and fans. The Aston Villa Football Club is no different.

Unlike traditional businesses with linear growth trajectories, football clubs experience rapid, compressed timelines with constant change. The club's rapid expansion brought an influx of new staff, additional infrastructure, and evolving business operations, all without a dedicated cybersecurity function in place.

So, as Aston Villa experienced significant growth on and off the pitch, their cybersecurity challenges also increased.

"The challenge isn’t just trying to keep up with making sure that systems and accounts are secure. We also need to make sure the technology that we're implementing is also fit for purpose. But things move so quickly, it's incredibly difficult to keep up with that," Carl Maycock, Head of IT at Aston Villa, explains.

After conducting an initial NIST Cybersecurity Framework assessment, Aston Villa identified significant gaps in their security posture. While they had various technical tools in place, it became clear that they needed additional guidance and support for:

• 24/7 security monitoring and threat detection capabilities
• Specialised technical understanding of the cyber threat landscape
• A cohesive cybersecurity strategy aligned with industry frameworks
• The ability to respond quickly to emerging threats
• Expert-level guidance to implement and maintain comprehensive security controls

In addition, the threat landscape was particularly concerning for a high-profile organisation like Aston Villa for two primary reasons.

First, data breaches are always of concern since any leaked data can compromise business operations as well as football matches. However, there is an added layer of complexity with football clubs; the leaked data contains confidential information about the athletes, which may offer a competitive advantage to anyone who can access it.

Second, threat actors are creating increasingly sophisticated malware and ransomware that targets the club’s employees, so having 24/7 threat detection and response capabilities that stop attackers in their tracks is critical—especially for an organisation who doesn’t have the resources to run an internal Security Operations Centre (SOC).

“Even though we are a Premier League club, the reality is that we just don't have the resources to be able to run an internal SOC. So, our ability to monitor and react to cyber threats 24/7 is limited,” Carl says. “We need that ability and the only way to do that is to engage a third-party provider so we can actively monitor and respond to the various different threats.”

With match-day operations being time-critical, with a stadium full of fans and live broadcasters, any security incident could have devastating consequences for the club's reputation and operations.

“If you've lost all your data or the data has been leaked, you can never bring it back in again,” Carl states. “And the same thing with your people's accounts or data that they've been locked out of at that point, the business can't operate. Those are the two big things I think really scare me in terms of my day-to-day and the things that I always try to keep as a focal point moving forward.”

As part of their compliance with the Premier League's Section K technology standards, Aston Villa also needed to provide extensive connectivity for media, broadcasters, and other third parties on match days, creating hundreds of potential entry points that required careful, comprehensive monitoring and security controls:

“We have lots of third-parties that come in and plug unknown random equipment into the network, which you don't have a lot of control over a lot of the time. We've seen rogue access points that are advertising fake wireless networks and we've seen them wander around the ground because you can pick them up from our wireless environment.”

However, the club's small IT team was stretched thin, managing everything from networking and servers to cloud services and match-day operations. So, when it came time to address cybersecurity gaps, Aston Villa faced a critical decision: hire expensive cybersecurity specialists or find a trusted partner who could provide enterprise-level security expertise.

Given these challenges, Aston Villa needed a strategic partner who provided 24/7 threat detection and response capabilities with round-the-clock security monitoring and offered enterprise-level cybersecurity expertise at a fraction of the cost of building an in-house security operations team.