Cybersecurity & Cyber Risk Quantification

AI Security

October 5, 2026

When the Adversary Is Running the AI Agents

Frequency rises directly, and the second effect hides inside the containment assumption in a severity estimate.

Cyber Risk Quantification

October 4, 2026

When Two Cyber Risk Models Disagree on the Same Company

Asking which model is right produces an argument. Two free checks resolve most apparent disputes.

Agentic AI

October 4, 2026

The AI Agent That Was Never Registered Anywhere

A registry counts compliance with a registration step rather than the number of agents that exist.

AI Regulations & Compliance

October 4, 2026

The AI Incident Reporting Duty Nobody Can Date

Two readings of the text point in different directions, and no authority has resolved which is right.

Cyber Risk Quantification

October 3, 2026

Cyber Loss in Rail and Signalling

Signalling fails into a stop, so the safety design is the attack surface for the financial loss.

AI Security

October 3, 2026

Reading AI Use From the Browser When the Network Sees Nothing

Three facts decide whether an AI exposure is reportable, and the network holds none of them.

Cyber Risk Quantification

October 2, 2026

The Cyber Risk Inputs That Move the Answer Most

The dominant inputs differ depending on which output the decision rests on.

AI Governance

October 2, 2026

Reconciling an AI Risk Estimate Against What Truly Happened

A single loss cannot falsify a distribution and zero losses prove nothing. The inputs are what can be reconciled.

Cyber Risk Quantification

October 1, 2026

Cyber Loss When the Stolen Asset Is a Trained Model

The organization still holds the model, so the loss is the end of exclusivity rather than a destroyed asset.

AI Regulations & Compliance

October 1, 2026

The AI Marking Deadline That Applies Only to Systems Already Running

The transition went to the installed base while new systems comply immediately, and it covers marking alone.

Cyber Risk Quantification

September 30, 2026

The Cyber Loss Where the Stolen Records Belong to Other Companies

Notification law is keyed to personal data, so the exposure runs through contracts rather than statute.

AI Security

September 30, 2026

Which AI Signals Carry a Finding and Which Only Size It

Every source in a rule is constitutive, corroborative or descriptive. The test is what you lose without it.

Cyber Risk Quantification

September 29, 2026

The Cyber Outage That Ends Before the Recovery Does

The outage ends well before the recovery does, and the second clock is set by constraints that ignore effort.

AI Regulations & Compliance

September 29, 2026

Crossing 750 Employees Triples an AI Act Penalty

The penalty calculation inverts at the boundary, from the higher of two figures to the lower.

Agentic AI

September 29, 2026

AI Agents Were Never Outside the Definition

The existing definitions already cover agents. Autonomy sits inside the definition rather than outside it.

Cyber Risk Quantification

September 28, 2026

Cyber Loss When the Company Is Someone Else's Fourth Party

The contract caps what a provider owes and says nothing about what it loses.

AI Regulations & Compliance

September 28, 2026

The AI Act Duty That Applies Regardless of Risk Tier

It applies to any AI system regardless of tier, and enforcement began while the high-risk regime moved to 2027.

AI Governance

September 28, 2026

Underwriting an AI Agent

Absent loss history is a pricing problem the market solved. Correlation across a shared model is not.

Cyber Regulations & Compliance

September 27, 2026

The Cybersecurity Directive That Reached Ten Times More Entities

The classification moved from the regulator to the entity, so nobody writes to tell you.

AI Governance

September 27, 2026

AI Review of Privileged Material and the Waiver Question

Two federal courts, two answers. One submission can waive privilege while leaving work product intact.

AI Governance

September 27, 2026

An AI Risk Figure That Updates Without a Reassessment

Frequency is observable and magnitude is not, so a half-updating figure makes its own movement unreadable.

Cyber GRC

September 26, 2026

The Cyber Dependency a Register of Information Forces Into the Open

The register joins provider to service to function, which is a join nobody held whole before.

AI Governance

September 26, 2026

AI Governance When the Data Subject Is a Minor

Consent is usually the wrong lawful basis here. What differs is that the subject cannot exercise their own rights.

Cyber Risk Quantification

September 25, 2026

Cyber Loss When the Product Is a Clinical Trial

Data whose integrity cannot be demonstrated is unusable even where nothing was altered.

AI Regulations & Compliance

September 25, 2026

Fine-Tuning Is Not What Reclassifies an AI Deployer

Fine-tuning rarely reclassifies a deployer. Defining a high-risk purpose does it with no compute at all.

AI Regulations & Compliance

September 24, 2026

AI Governance for Public Bodies, and Who Shares the Obligation

Deferred to December 2027, and it reaches four categories including credit scoring deployers.

Cyber Risk Quantification

September 24, 2026

The Medical Device Submission That Never Gets Reviewed

A submission missing cybersecurity content can be refused at intake, so the cost is delay to market.

Cyber Risk Quantification

September 23, 2026

When Notification Cost Scales With the Subscriber List

Customer notification can be avoided where no harm is likely, so the cost is bimodal rather than linear.

Agentic AI

September 23, 2026

Measuring AI Agent Coverage Against the Gateway Log

A gateway cannot report what did not cross it, so it cannot define its own coverage denominator.

Cyber GRC

September 22, 2026

When Certification Decides Who Can Bid

Certification still decides eligibility. Since July the requirement narrowed to what a contractor asserts itself.

Blog

When the Adversary Is Running the AI Agents

When Two Cyber Risk Models Disagree on the Same Company

The AI Agent That Was Never Registered Anywhere

The AI Incident Reporting Duty Nobody Can Date

Cyber Loss in Rail and Signalling

Reading AI Use From the Browser When the Network Sees Nothing

The Cyber Risk Inputs That Move the Answer Most

Reconciling an AI Risk Estimate Against What Truly Happened

Cyber Loss When the Stolen Asset Is a Trained Model

The AI Marking Deadline That Applies Only to Systems Already Running

The Cyber Loss Where the Stolen Records Belong to Other Companies

Which AI Signals Carry a Finding and Which Only Size It

The Cyber Outage That Ends Before the Recovery Does

Crossing 750 Employees Triples an AI Act Penalty

AI Agents Were Never Outside the Definition

Cyber Loss When the Company Is Someone Else's Fourth Party

The AI Act Duty That Applies Regardless of Risk Tier

Underwriting an AI Agent

The Cybersecurity Directive That Reached Ten Times More Entities

AI Review of Privileged Material and the Waiver Question

An AI Risk Figure That Updates Without a Reassessment

The Cyber Dependency a Register of Information Forces Into the Open

AI Governance When the Data Subject Is a Minor

Cyber Loss When the Product Is a Clinical Trial

Fine-Tuning Is Not What Reclassifies an AI Deployer

AI Governance for Public Bodies, and Who Shares the Obligation

The Medical Device Submission That Never Gets Reviewed

When Notification Cost Scales With the Subscriber List

Measuring AI Agent Coverage Against the Gateway Log

When Certification Decides Who Can Bid