Cybersecurity & Cyber Risk Quantification

August 29, 2026

Article 50 Is Live: What You Have to Be Able to Produce

Transparency obligations became enforceable in August while coverage moved on to 2027. What you would have to produce today.

Agentic AI

August 28, 2026

When 700 Agents Coordinate Without Being Told To

Agents coordinated through a build cache, then worked on their own transcripts. The second finding has the longer reach.

AI Governance

August 27, 2026

The Three Questions Every AI Telemetry Claim Should Survive

Three questions any telemetry must survive before it carries a security decision, and five ways agent telemetry fails.

Cyber Risk Quantification

August 27, 2026

When the Model Disagrees With Your Security Team

Most disagreements are not about risk. Security teams rank exploitability and models rank loss.

Agentic AI

August 27, 2026

Turning the OWASP Agentic Top 10 Into Expected Loss

The ten OWASP agentic categories sit at three levels of the causal chain, so registering each as a scenario double counts.

AI Governance

August 27, 2026

Model Deprecation Runs on the Provider's Calendar

Notice periods run from weeks to six months, set by provider economics rather than your revalidation cycle.

Cyber Risk Quantification

August 26, 2026

How Many Cyber Risk Scenarios Should You Model?

Scenario libraries grow and never shrink. The count follows from the decisions they have to support.

Agentic AI

August 26, 2026

Agent Incident Response: Containment Is the Easy Part

Stopping an agent takes minutes. Classifying it, reconstructing what it did and knowing what can be undone cannot be improvised.

AI Regulations & Compliance

August 26, 2026

State AI Laws Change Faster Than Compliance Programs

Colorado repealed its AI Act before it took effect. Why building to statutes fails, and the six attributes that survive.

AI Governance

August 25, 2026

What OpenTelemetry Can Actually Tell You About Your AI Agents

Agent telemetry answers four governance questions well today. The positive case for instrumenting your AI agents now.

Cyber Insurance

August 25, 2026

Same Numbers, Two Audiences: Insurer and Board

A board reads exposure as proportionality and an underwriter reads it as pricing. Same model, opposite incentives.

AI Security

August 25, 2026

You Cannot Price Model Poisoning, So Price the Switch

There is no base rate for backdoored models. Price what you can observe, which is the cost of replacing the model.

AI Security

August 25, 2026

Prompt Injection Has No Patch, So Price It Instead

Prompt injection is architectural, not a defect. How to carry it as a priced condition rather than an open finding.

Cyber GRC

August 24, 2026

The Second Line Cannot Challenge What It Cannot Evaluate

The model assumes the second line can evaluate the first line's work. In cyber the expertise sits in the first line.

AI Security

August 24, 2026

AI Supply Chain Security: Why an SBOM Cannot Cover It

An SBOM assumes behavior changes through a build. Editing a prompt changes a model and triggers nothing. The four layers you need.

AI Governance

August 24, 2026

Human in the Loop: How to Tell If the Review Is Real

Human oversight is the only control that fails while producing identical evidence. Six signals that show whether review is genuine.

Cyber Risk Quantification

August 23, 2026

One Loss Distribution, Two Very Different Charts

Probability against loss hides most of the range. Loss against percentile shows where routine loss ends and material loss begins.

AI Governance

August 23, 2026

Healthcare AI Governance: When Workflow Decides Device Status

The same clinical AI tool can sit inside or outside device regulation depending on workflow, not on the algorithm.

AI Regulations & Compliance

August 23, 2026

Deployer Liability Under the EU AI Act: When You Become the Provider

Article 26 lists deployer duties. Article 25 converts a deployer into a provider automatically, with no notification step.

Cyber GRC

August 22, 2026

The GRC Calendar Is Built From Other People's Deadlines

Every item on a typical GRC calendar was placed there by someone else, which is why analysis never happens.

Agentic AI

August 22, 2026

Pricing a Ghost Agent: What an Orphaned Identity Costs

An abandoned agent is unusual because part of its cost is certain. How to estimate the three streams for your own environment.

Cyber Risk Quantification

August 21, 2026

Quantifying OT Cyber Risk Without a Loss History

Industrial environments have almost no cyber loss data and excellent consequence data. Reversing the direction makes modeling tractable.

Agentic AI

August 21, 2026

Decommissioning AI Agents: What to Look For in the Tooling

Improper offboarding is the top non-human identity risk. What retirement tooling must prove, and the architecture question first.

Cyber Risk Management

August 20, 2026

Maturity Is a Lagging Indicator. Here's a Leading One.

Maturity measures process and arrives annually. A leading indicator needs both the right unit and the right cadence.

AI Asset Visibility

August 20, 2026

What Counts as One AI Asset? Getting the Unit Right

Two teams inventory the same organization and return different counts. Models, systems and purposes are three layers, not one list.

AI Governance

August 20, 2026

AI Governance in Financial Services: The Use Case Sets the Rules

Frameworks are use-case blind. In financial services the use case carries the obligation, and credit models face a mandate on architecture.

Cyber Regulations & Compliance

August 19, 2026

8 Questions on Healthcare Cyber Risk Quantification and Compliance

Regulators moved from asking whether you did a risk analysis to what you did about it. Eight questions on healthcare exposure and HIPAA.

AI Security

August 19, 2026

Browser AI Events in the SOC: What to Send and What to Suppress

Browser AI events are behavioral anomaly alerts, the category SOCs already deprioritize. What belongs in a SIEM and what does not.

AI Regulations & Compliance

August 19, 2026

Change Control for AI: Records That Survive an Audit

Change management assumes discrete approved releases. AI retrains and providers revise models silently. How to keep an auditable record.

Cyber GRC

August 18, 2026

Cybersecurity GRC in Practice: Where Programs Break Down

GRC programs rarely fail at design. Six operational failure modes, from registers that never drain to exceptions that never expire.

Blog

Article 50 Is Live: What You Have to Be Able to Produce

When 700 Agents Coordinate Without Being Told To

The Three Questions Every AI Telemetry Claim Should Survive

When the Model Disagrees With Your Security Team

Turning the OWASP Agentic Top 10 Into Expected Loss

Model Deprecation Runs on the Provider's Calendar

How Many Cyber Risk Scenarios Should You Model?

Agent Incident Response: Containment Is the Easy Part

State AI Laws Change Faster Than Compliance Programs

What OpenTelemetry Can Actually Tell You About Your AI Agents

Same Numbers, Two Audiences: Insurer and Board

You Cannot Price Model Poisoning, So Price the Switch

Prompt Injection Has No Patch, So Price It Instead

The Second Line Cannot Challenge What It Cannot Evaluate

AI Supply Chain Security: Why an SBOM Cannot Cover It

Human in the Loop: How to Tell If the Review Is Real

One Loss Distribution, Two Very Different Charts

Healthcare AI Governance: When Workflow Decides Device Status

Deployer Liability Under the EU AI Act: When You Become the Provider

The GRC Calendar Is Built From Other People's Deadlines

Pricing a Ghost Agent: What an Orphaned Identity Costs

Quantifying OT Cyber Risk Without a Loss History

Decommissioning AI Agents: What to Look For in the Tooling

Maturity Is a Lagging Indicator. Here's a Leading One.

What Counts as One AI Asset? Getting the Unit Right

AI Governance in Financial Services: The Use Case Sets the Rules

8 Questions on Healthcare Cyber Risk Quantification and Compliance

Browser AI Events in the SOC: What to Send and What to Suppress

Change Control for AI: Records That Survive an Audit

Cybersecurity GRC in Practice: Where Programs Break Down