Cybersecurity & Cyber Risk Quantification

August 18, 2026

Multi-Agent AI Systems: When Separation of Duties Dissolves

Three agents with modest permissions can compose an action nobody authorized. Governing a chain differs from governing an agent.

AI Regulations & Compliance

August 18, 2026

The EU AI Act's Missing Standards: What to Do Before They Arrive

No EU AI Act standard has been cited yet, and ISO 42001 was not adopted for the purpose. What Article 17 requires while you wait.

Cyber GRC

August 17, 2026

Concentration Risk: What to Do When You Cannot Diversify

Fourth-party dependencies invalidate simple diversification. The four types of concentration, and what to do when switching is not possible.

AI Security

August 17, 2026

Managing AI Agent Identity at Scale: The Lifecycle Nobody Triggers

Human identity governance works because HR emits events. Agent identities emit none. How to manufacture the missing lifecycle.

AI Security

August 17, 2026

Real-Time AI Security Monitoring: Why One Assessment Expires

An AI assessment starts expiring immediately, because the system changes without you touching it. The three mechanisms behind that.

Cyber Risk Management

August 16, 2026

What an Open Control Weakness Costs You Every Month

Investment framing asks whether a control is worth fixing. Accrual framing asks what the delay costs, and reorders the queue.

Thought Leadership

August 16, 2026

OpenTelemetry and AI Governance: Where the Standard Stops

OpenTelemetry now gives AI interactions a standard shape. What its conventions record, and where judgment has to be added on top.

Cyber Risk Quantification

August 15, 2026

7 Things People Get Wrong About Quantifying Cyber Risk

A median is not a forecast, better security can mean higher exposure, and aggregate is less than the sum of the scenarios.

AI Governance

August 15, 2026

AI Governance Tools and the Audit Trail Problem

A dashboard stores the latest value. An audit asks about a date. The trail properties governance tools most often underdeliver on.

Cyber Insurance

August 14, 2026

Does Cyber Insurance Cover AI Incidents?

Silent AI ended in January 2026. Where an AI incident lands across policies, and why sublimits matter more than exclusions.

AI Security

August 14, 2026

A Prompt Is Not a Boundary: Lessons From the AI Eval Incidents

Three organizations were compromised during AI evaluations and none noticed. What the disclosures show about enforcing agent scope.

Threat Research

August 13, 2026

Where Cyber Loss Comes From: Attack Vectors Ranked by Exposure

Valid account abuse carries roughly a quarter of modeled loss and phishing sits sixth. What that says about where controls belong.

AI Regulations & Compliance

August 13, 2026

What an AI Compliance Audit Involves, Stage by Stage

Two stages, predictable evidence requests, and findings that cluster tightly. What an AI audit examines and where points get lost.

AI Governance

August 13, 2026

The Top AI Governance Platforms in 2026: A Comparison Guide

Twelve AI governance platforms compared side by side. Analyst positions, runtime enforcement, deployment, and buyer fit for 2026.

Cyber Risk Management

August 12, 2026

Building a Security Budget Case With Return on Security Investment

Security budget cases fail on arithmetic rather than argument. The calculation, the inputs that make it defensible, and its limits.

AI Security

August 12, 2026

AI Security Posture Management: What It Covers and What It Misses

AI-SPM inherited cloud assumptions that hold for infrastructure and fail for a browser tab. What the term covers, and what it does not.

AI Governance

August 12, 2026

Building a Defensible AI Governance Framework for Regulated Industries

Revised model risk guidance excludes generative and agentic AI while leaving accountability in place. What defensible governance requires.

Cyber Regulations & Compliance

August 11, 2026

DORA, NIS2 and the Four-Hour Clock Reshaping GRC

DORA gives four hours for an initial notification. Why overlapping reporting clocks break annual-cycle GRC, and what closes the difference.

Board Reporting

August 11, 2026

Reporting AI Risk to the Board: What Directors Want to See

Oversight failure is personally actionable for directors. What belongs in an AI board pack, what to cut, and the cadence that holds up.

AI Governance

August 11, 2026

NIST AI RMF vs ISO 42001: Choosing Your AI Governance Framework

One is a certifiable management system, the other an operational risk playbook. How to choose, and why most enterprises run both.

Cyber Risk Management

August 10, 2026

Third-Party Cyber Risk: A GRC Playbook for Tiering and Concentration

DORA moved concentration assessment before the contract. Why criticality tiering misranks vendors and what to do when one fails.

AI Security

August 10, 2026

AI Browser Security: What to Look For in Identity-Based Controls

Authentication secures the login and goes blind afterward. What identity-based browser controls require, and where the approach breaks down.

Shadow AI

August 10, 2026

Shadow AI Monitoring: Keeping Watch After Discovery

Discovery answers a question once. Monitoring keeps the answer true as tools appear, vendors ship AI features, and agents change access.

Cyber GRC

August 9, 2026

Cyber Risk Appetite Statements That Can Be Breached

Most appetite statements cannot be violated by any real event. The four terms, testable thresholds, and the breach procedure.

AI Security

August 9, 2026

How Regulated Data Leaks Through AI, One Paste at a Time

One paste into a consumer assistant, traced end to end. What leaves, why nothing fires, and the six places it could have stopped.

Cyber GRC

August 8, 2026

Continuous Control Monitoring: What Annual Testing Misses

An annual assessment evidences one day out of 365. Which controls close that interval, and which stay manual regardless of tooling.

AI Regulations & Compliance

August 8, 2026

EU AI Act Compliance Roadmap: What Enterprises Must Document and When

The Digital Omnibus moved high-risk obligations to December 2027 & left Article 50 transparency live on August 2, 2026. Here's the sequence.

Cyber GRC

August 7, 2026

Mapping One Control Set to NIST CSF, ISO 27001 and CIS v8

Three frameworks, one security program. Which crosswalks already exist, how to pick a spine, and where mapping genuinely breaks.

AI Governance

August 7, 2026

Who's Accountable When an AI Agent Makes the Wrong Call?

When an autonomous AI agent makes a wrong call, accountability fractures across deployer, developer, and human operator.

Cyber GRC

August 6, 2026

How to Prioritize Cyber Risks: Deciding Where to Focus First

Prioritize cyber risks with quantified financial exposure, residual risk ranking, and the mitigate-transfer-avoid-accept response framework.

Blog

Multi-Agent AI Systems: When Separation of Duties Dissolves

The EU AI Act's Missing Standards: What to Do Before They Arrive

Concentration Risk: What to Do When You Cannot Diversify

Managing AI Agent Identity at Scale: The Lifecycle Nobody Triggers

Real-Time AI Security Monitoring: Why One Assessment Expires

What an Open Control Weakness Costs You Every Month

OpenTelemetry and AI Governance: Where the Standard Stops

7 Things People Get Wrong About Quantifying Cyber Risk

AI Governance Tools and the Audit Trail Problem

Does Cyber Insurance Cover AI Incidents?

A Prompt Is Not a Boundary: Lessons From the AI Eval Incidents

Where Cyber Loss Comes From: Attack Vectors Ranked by Exposure

What an AI Compliance Audit Involves, Stage by Stage

The Top AI Governance Platforms in 2026: A Comparison Guide

Building a Security Budget Case With Return on Security Investment

AI Security Posture Management: What It Covers and What It Misses

Building a Defensible AI Governance Framework for Regulated Industries

DORA, NIS2 and the Four-Hour Clock Reshaping GRC

Reporting AI Risk to the Board: What Directors Want to See

NIST AI RMF vs ISO 42001: Choosing Your AI Governance Framework

Third-Party Cyber Risk: A GRC Playbook for Tiering and Concentration

AI Browser Security: What to Look For in Identity-Based Controls

Shadow AI Monitoring: Keeping Watch After Discovery

Cyber Risk Appetite Statements That Can Be Breached

How Regulated Data Leaks Through AI, One Paste at a Time

Continuous Control Monitoring: What Annual Testing Misses

EU AI Act Compliance Roadmap: What Enterprises Must Document and When

Mapping One Control Set to NIST CSF, ISO 27001 and CIS v8

Who's Accountable When an AI Agent Makes the Wrong Call?

How to Prioritize Cyber Risks: Deciding Where to Focus First