briefing
-
NCSC Launches Cyber Adversary Simulation Scheme: What Boards Should Ask Before Buying a Red Team
The UK's NCSC has launched an assurance scheme for providers that test how critical organisations prevent, detect and respond to realistic attacks. Here is what the scheme is, what it is not, and the questions executives should put to their security teams.
briefing -
NCSC Warns of AI-Powered Ransomware Against UK Critical Infrastructure by 2028: What Boards Should Ask
The UK's National Cyber Security Centre says AI-powered malware will highly likely be used in a ransomware attack on UK critical national infrastructure by 2028. The message to leaders: the weaknesses AI will exploit are old ones, and the cost of leaving them is now a board-level choice.
briefing -
NIST CSF 2.0 Beyond Govern: Five Board Questions on Responding to and Recovering from an Incident
NIST CSF 2.0 gives boards a six-part lifecycle for cyber risk. Most boards focus on prevention. Here are the questions that test whether the organisation can actually respond and recover.
briefing -
When an AI Agent Acts Without Instruction: What the New NIST, NSA and CISA Incident Guidance Means for Your Board
A voluntary joint document published on 16 October sets out ten practices for incidents in which an AI agent takes unauthorised action. It is aimed at frontier developers, but it offers boards a useful benchmark.
briefing -
When a VPN Flaw Becomes a Hypervisor Problem: Five Questions for the Board After the PAN-OS Update
Palo Alto's Unit 42 now links Qilin and Inc to attempts on a known VPN flaw, and describes attackers reaching vCenter and backup software. Here is what directors should ask management, in business terms.
briefing -
The Annual Cyber Insurance Renewal Is Dying: What Continuous Underwriting Means for CISOs
Carriers are moving away from once-a-year, point-in-time underwriting toward continuous monitoring of a policyholder's security posture. For CISOs, that turns cyber insurance from an annual paperwork cycle into a year-round governance obligation — with real budget and reporting consequences.
briefing -
Black Hat USA 2026: The Executive Threat Briefing
Black Hat USA 2026 ran in Las Vegas this week. The themes that dominated — AI infrastructure exploitation as an independent attack discipline, nation-state credential harvesting through trusted third-party networks, and autonomous agent weaponisation — carry direct implications for enterprise risk posture. This briefing distils what security leaders need to know.
briefing -
Security Awareness Training ROI: Measuring Real Behavioural Change Beyond Click Rates
Phishing simulation click rates are not a security metric — they're an activity metric. This briefing covers what CISOs should actually measure when evaluating security awareness programmes, why most current approaches fail to demonstrate ROI, and how to build a measurement framework boards will accept.
briefing