All Articles
-
SEC's FY2026 Enforcement Results: One Cyber Case, and What the Rest Says About Controls and Disclosure
The SEC's annual enforcement results name one cybersecurity policies case. The wider pattern, individual accountability, internal controls and credit for self-reporting, matters more to executives.
regulatory-update -
DPRK IT Workers Are Reaching Onboarding: What One Vendor's Data Says About Exposure and What Leaders Should Ask
Material Security reports 27 suspected DPRK personas reached onboarding in 12 months, and exposure varied widely across four organizations. A single-source briefing for executives.
risk-analysis -
Maersk's Legacy System Incident: The Acquired IT Estate Question for Your Board
On 11 November 2026 Maersk disclosed unauthorised access and data extraction from a legacy system inherited in an acquisition. The investigation is ongoing. Here is what the company has and has not said, and the governance questions it raises.
risk-analysis -
NCSC Launches Cyber Adversary Simulation Scheme: What Boards Should Ask Before Buying a Red Team
The UK's NCSC has launched an assurance scheme for providers that test how critical organisations prevent, detect and respond to realistic attacks. Here is what the scheme is, what it is not, and the questions executives should put to their security teams.
briefing -
NCSC Warns of AI-Powered Ransomware Against UK Critical Infrastructure by 2028: What Boards Should Ask
The UK's National Cyber Security Centre says AI-powered malware will highly likely be used in a ransomware attack on UK critical national infrastructure by 2028. The message to leaders: the weaknesses AI will exploit are old ones, and the cost of leaving them is now a board-level choice.
briefing -
EU Takes Four Countries to Court Over NIS2: What It Means for Multi-Country Compliance Plans
On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the EU Court of Justice for not transposing NIS2. The case is about governments, not companies, but it changes how boards should plan across the EU.
regulatory-update -
CISA and Canada Warn on AI Token Exhaustion: A Resilience Question for the Board
New joint guidance from CISA and the Canadian Cyber Centre treats AI token consumption as an operational resilience issue. What it says, why denial-of-wallet matters, and five questions for management.
risk-analysis -
NIST CSF 2.0 Beyond Govern: Five Board Questions on Responding to and Recovering from an Incident
NIST CSF 2.0 gives boards a six-part lifecycle for cyber risk. Most boards focus on prevention. Here are the questions that test whether the organisation can actually respond and recover.
briefing