risk-analysis
-
DPRK IT Workers Are Reaching Onboarding: What One Vendor's Data Says About Exposure and What Leaders Should Ask
Material Security reports 27 suspected DPRK personas reached onboarding in 12 months, and exposure varied widely across four organizations. A single-source briefing for executives.
risk-analysis -
Maersk's Legacy System Incident: The Acquired IT Estate Question for Your Board
On 11 November 2026 Maersk disclosed unauthorised access and data extraction from a legacy system inherited in an acquisition. The investigation is ongoing. Here is what the company has and has not said, and the governance questions it raises.
risk-analysis -
CISA and Canada Warn on AI Token Exhaustion: A Resilience Question for the Board
New joint guidance from CISA and the Canadian Cyber Centre treats AI token consumption as an operational resilience issue. What it says, why denial-of-wallet matters, and five questions for management.
risk-analysis -
UK Corporate Governance Code Provision 29: What the Board's Material Controls Declaration Means for Cyber
Provision 29 of the 2024 UK Corporate Governance Code now applies to financial years beginning on or after 1 January 2026. Boards must declare the effectiveness of material controls, and CISOs should be ready to evidence the cyber controls that sit inside that scope.
risk-analysis -
The Board-CISO Trust Gap: What New 2026 Data Reveals About Cyber Risk Reporting
New 2026 survey data from IANS/Artico/CAP Group and a forthcoming board-relationships report show CISOs leaving boardrooms feeling heard while directors leave uneasy. Here is what the gap actually measures and how to close it.
risk-analysis -
IBM's 2026 Breach Report: AI Governance Gaps Are Now a Quantified Board Risk
IBM and Ponemon's 21st annual Cost of a Data Breach Report puts the global average at $4.99 million, with AI-enabled breaches running $1 million higher. The data gives boards a hard number for the AI governance gap they've been debating in the abstract.
risk-analysis -
AgentForger: When a Phishing Link Becomes a Persistent AI Insider
Zenity Labs' disclosure of AgentForger demonstrates that enterprise AI agents can be weaponised from outside the organisation via a single phishing link, creating an attacker-controlled agent that inherits authorised access to email, calendar, Slack, and Teams. OpenAI patched the specific flaw in June — but the governance problem is structural and ongoing.
risk-analysis -
LAUNDRY BEAR: What the NCSC Zero-Click Advisory Means for Your Email Security Posture
The joint NCSC advisory AA26-204A naming LAUNDRY BEAR represents a materially different email threat model than phishing: no link to click, no attachment to execute. CISOs running Zimbra need to act now; those who aren't face similar risks from analogous techniques. Here's the executive brief.
risk-analysis