Cybersecurity & Cyber Risk Quantification

Cyber Risk Quantification

September 29, 2026

The Cyber Outage That Ends Before the Recovery Does

The outage ends well before the recovery does, and the second clock is set by constraints that ignore effort.

AI Regulations & Compliance

September 29, 2026

Crossing 750 Employees Triples an AI Act Penalty

The penalty calculation inverts at the boundary, from the higher of two figures to the lower.

Agentic AI

September 29, 2026

AI Agents Were Never Outside the Definition

The existing definitions already cover agents. Autonomy sits inside the definition rather than outside it.

Cyber Risk Quantification

September 28, 2026

Cyber Loss When the Company Is Someone Else's Fourth Party

The contract caps what a provider owes and says nothing about what it loses.

AI Regulations & Compliance

September 28, 2026

The AI Act Duty That Applies Regardless of Risk Tier

It applies to any AI system regardless of tier, and enforcement began while the high-risk regime moved to 2027.

AI Governance

September 28, 2026

Underwriting an AI Agent

Absent loss history is a pricing problem the market solved. Correlation across a shared model is not.

Cyber Regulations & Compliance

September 27, 2026

The Cybersecurity Directive That Reached Ten Times More Entities

The classification moved from the regulator to the entity, so nobody writes to tell you.

AI Governance

September 27, 2026

AI Review of Privileged Material and the Waiver Question

Two federal courts, two answers. One submission can waive privilege while leaving work product intact.

AI Governance

September 27, 2026

An AI Risk Figure That Updates Without a Reassessment

Frequency is observable and magnitude is not, so a half-updating figure makes its own movement unreadable.

Cyber GRC

September 26, 2026

The Cyber Dependency a Register of Information Forces Into the Open

The register joins provider to service to function, which is a join nobody held whole before.

AI Governance

September 26, 2026

AI Governance When the Data Subject Is a Minor

Consent is usually the wrong lawful basis here. What differs is that the subject cannot exercise their own rights.

Cyber Risk Quantification

September 25, 2026

Cyber Loss When the Product Is a Clinical Trial

Data whose integrity cannot be demonstrated is unusable even where nothing was altered.

AI Regulations & Compliance

September 25, 2026

Fine-Tuning Is Not What Reclassifies an AI Deployer

Fine-tuning rarely reclassifies a deployer. Defining a high-risk purpose does it with no compute at all.

AI Regulations & Compliance

September 24, 2026

AI Governance for Public Bodies, and Who Shares the Obligation

Deferred to December 2027, and it reaches four categories including credit scoring deployers.

Cyber Risk Quantification

September 24, 2026

The Medical Device Submission That Never Gets Reviewed

A submission missing cybersecurity content can be refused at intake, so the cost is delay to market.

Cyber Risk Quantification

September 23, 2026

When Notification Cost Scales With the Subscriber List

Customer notification can be avoided where no harm is likely, so the cost is bimodal rather than linear.

Agentic AI

September 23, 2026

Measuring AI Agent Coverage Against the Gateway Log

A gateway cannot report what did not cross it, so it cannot define its own coverage denominator.

Cyber GRC

September 22, 2026

When Certification Decides Who Can Bid

Certification still decides eligibility. Since July the requirement narrowed to what a contractor asserts itself.

AI Governance

September 22, 2026

AI Governance When the Output Is a Hiring Decision

The statistical test examines the tool and the legal test examines the outcome. Those are different subjects.

AI Governance

September 22, 2026

What It Takes to Say an AI Control Reduces Loss by a Number

The method assumes a control reduces frequency or magnitude. Several AI controls do neither.

Cyber GRC

September 21, 2026

What the Cyber Risk Register Does Between Reviews

Agentic AI

September 21, 2026

The New Agent Control Standard Names the Controls, Not Their Value

A control standard says what enforcement looks like. It does not say which control to build first.

AI Governance

September 21, 2026

Why AI Review Cannot Keep Up With the Decision

The bottleneck argument addresses capacity. The prior question is whether looking was possible at all.

AI Regulations & Compliance

September 20, 2026

Two Reporting Clocks on One AI Product, Only One Running

The product security clock started in September. The AI Act duty was deferred to December 2027.

Cyber Risk Quantification

September 20, 2026

Losing the Right to Process

The body that writes the standard does not enforce it, so the remedy is contractual rather than statutory.

AI Governance

September 20, 2026

AI Governance as a Condition of Writing Coverage

A carrier asking about oversight has already defined it for its own regulator, so the standard is knowable.

Cyber Risk Quantification

September 19, 2026

The Cyber Loss That Fits Inside a Single Weekend

The revenue concentration is overstated. What makes a peak outage expensive is that demand has a deadline.

Agentic AI

September 19, 2026

The AI Agent Whose Builder Already Left

An automation on a leaver's credentials fails loudly. One holding its own continues silently.

Cyber Risk Quantification

September 18, 2026

When a Cybersecurity Finding Stops the Sale

A finding changes a certification status and the status removes market access. No attacker anywhere in it.

AI Governance

September 18, 2026

AI Governance for Content Nobody Has Released Yet

Pre-release content is a confidentiality requirement with an expiry, which inverts how controls are chosen.

Blog

The Cyber Outage That Ends Before the Recovery Does

Crossing 750 Employees Triples an AI Act Penalty

AI Agents Were Never Outside the Definition

Cyber Loss When the Company Is Someone Else's Fourth Party

The AI Act Duty That Applies Regardless of Risk Tier

Underwriting an AI Agent

The Cybersecurity Directive That Reached Ten Times More Entities

AI Review of Privileged Material and the Waiver Question

An AI Risk Figure That Updates Without a Reassessment

The Cyber Dependency a Register of Information Forces Into the Open

AI Governance When the Data Subject Is a Minor

Cyber Loss When the Product Is a Clinical Trial

Fine-Tuning Is Not What Reclassifies an AI Deployer

AI Governance for Public Bodies, and Who Shares the Obligation

The Medical Device Submission That Never Gets Reviewed

When Notification Cost Scales With the Subscriber List

Measuring AI Agent Coverage Against the Gateway Log

When Certification Decides Who Can Bid

AI Governance When the Output Is a Hiring Decision

What It Takes to Say an AI Control Reduces Loss by a Number

What the Cyber Risk Register Does Between Reviews

The New Agent Control Standard Names the Controls, Not Their Value

Why AI Review Cannot Keep Up With the Decision

Two Reporting Clocks on One AI Product, Only One Running

Losing the Right to Process

AI Governance as a Condition of Writing Coverage

The Cyber Loss That Fits Inside a Single Weekend

The AI Agent Whose Builder Already Left

When a Cybersecurity Finding Stops the Sale

AI Governance for Content Nobody Has Released Yet