Insights

Analysis that goes past the press release: what an incident says about the wider threat landscape, and what a security leader should do differently on Monday.

13 articles

3D isometric conceptual illustration of European Union cybersecurity regulation with 24-hour countdown timer and software supply chain nodes

InsightsTechnology, Cloud & SaaS

EU Cyber Resilience Act reporting rules go live: Hardware and software vendors face mandatory 24-hour disclosures

The EU CRA’s early reporting mandate is now in effect, requiring manufacturers to report actively exploited vulnerabilities to ENISA and CSIRTs within 24 hours.

14 Sept 20266 min read

Tom Verhoeven

InsightsBanking & FintechBreaking
RBI drafts a time-bound debit-hold SOP for suspected money-mule accounts
RBI’s draft KYC amendment proposes a time-bound process for temporary debit holds on suspected money-mule accounts linked to cyber-enabled fraud.
Tom Verhoeven12 Sept 20266 min read
InsightsTechnology, Cloud & SaaSBreaking
OpenAI positions Daybreak as a governed loop for AI-assisted cyber defense
OpenAI says Daybreak combines models, Codex Security and human oversight into a governed loop for inventory, validation, remediation and proof.
Priya Raman12 Sept 20266 min read
InsightsGovernment & Defence
CISA BOD 26-04 ends CVSS-ordered patching: the four questions that replace it
CISA's Binding Operational Directive 26-04 drops CVSS from federal patch prioritisation, replacing it with four yes/no questions and a sixteen-row deadline table.
Priya Raman11 Sept 20267 min read
InsightsTechnology, Cloud & SaaSMedium
Entra ID's February 2027 Sign-In Block: A Dated Migration Plan for the Accounts That Will Break
Microsoft retires SMS and voice MFA on 1 February 2027 with a blocking passkey prompt and no opt-out. Here is a dated plan for service accounts, break-glass and phoneless users.
Aisha Noor11 Sept 20266 min read
InsightsTechnology, Cloud & SaaSHigh
Nearly 1 in 10 Exposed LiteLLM AI Gateways Leaked Master Admin Keys
Wiz Research discovered that 10% of internet-facing LiteLLM AI proxy gateways accepted the default documentation admin key sk-1234, leaking upstream model keys and cloud IAM tokens.
Aisha Noor10 Sept 20265 min read
InsightsTechnology, Cloud & SaaSHigh
SharePoint 2016/2019 is unpatchable now. Exchange has until 31 October.
SharePoint Server 2016 and 2019 lost support on 14 July 2026 with no paid ESU on offer. Exchange 2016/2019 has until 31 October. Here is how to contain both.
Priya Raman10 Sept 20266 min read
InsightsTechnology, Cloud & SaaSHigh
The agentic AI security gap: 83% are deploying, 29% feel ready
Prompt injection is now OWASP’s top LLM risk with reported success rates of 50–84%. Organisations are shipping agents into production well ahead of their controls.
Priya Raman10 Sept 20268 min read
InsightsEnergy & UtilitiesLow
The EU AI Act's High-Risk Rules Slipped to December 2027. Your Logging Problem Did Not Move
Regulation (EU) 2026/1744 pushed Annex III high-risk obligations to December 2027, but Article 12 logging, Article 14 oversight and Article 15 hardening are engineering work you cannot start late.
Tom Verhoeven9 Sept 20266 min read
InsightsTechnology, Cloud & SaaSHigh
88% Had an AI Agent Incident. 82% Believe Their Policy Covers It.
Gravitee says 88% of organisations had a confirmed or suspected AI agent incident, while 82% of executives trust their policy. Both figures, one population.
Priya Raman9 Sept 20266 min read
InsightsEnergy & Utilities
NIS2 simplification and CSA2: what the January 2026 cybersecurity package actually changes
The European Commission’s cybersecurity package proposes amendments to NIS2 and a revised Cybersecurity Act. Here is what compliance teams need to track.
Tom Verhoeven8 Sept 20267 min read
InsightsTechnology, Cloud & SaaS
MFA failed in 84% of incident responses. The problem is the session, not the factor
With 99% of SaaS compromises originating at the identity provider, MFA is no longer the control organisations think they bought. Here is what changed.
Aisha Noor6 Sept 20267 min read
InsightsBanking & Fintech
The SEC’s four-day disclosure clock in practice: materiality is the hard part
Public companies must disclose material cyber incidents within four business days. The deadline is simple; deciding what counts as material is not.
Tom Verhoeven3 Sept 20266 min read