risk-analysis
-
The 2026 Cyber Insurance Renewal: What Underwriters Are Now Requiring
Cyber insurance underwriters have substantially tightened requirements since 2022. The questions have become more technical, the exclusions more specific, and the attestations more consequential. This briefing outlines what underwriters expect in 2026 and how security leaders should prepare.
risk-analysis -
Building an Insider Threat Programme: A CISO Playbook
Insider threats account for a disproportionate share of high-impact data loss events. Building a detection and response programme requires balancing UEBA technology, HR integration, legal frameworks, and employee privacy rights. This briefing covers programme design, governance, technology selection, and the organisational challenges CISOs consistently underestimate.
risk-analysis -
SAP ERP: The Attack Surface Your Security Programme Probably Under-Indexes
SAP environments are among the highest-value targets in enterprise IT — they hold payroll, financials, supply chain, and HR. Yet many security programmes treat SAP as an IT infrastructure question rather than a board-level risk. This briefing covers the real attack surface and what CISOs need to ask.
risk-analysis -
Cyber Insurance in 2026: Coverage Gaps, Exclusion Clauses, and What CISOs Need to Negotiate Before the Claim
Cyber insurance pricing has stabilised after years of volatility, but coverage exclusions have become more complex. War exclusions, systemic event exclusions, and ransomware sublimits are the terms most likely to leave organisations without the cover they assumed they had. This briefing prepares security leaders for the conversations that matter.
risk-analysis -
Cyber Due Diligence in M&A: What CISOs Must Assess Before Deal Close
Cyber risk has become a dealbreaker in M&A transactions. Hidden liabilities — undisclosed breaches, inherited ransomware, regulatory exposure — regularly surface after close when they are most expensive to address. This guide covers what a CISO-led cyber due diligence programme should examine and what findings warrant deal renegotiation.
risk-analysis -
Security Operations Cost Management: Build vs. Buy vs. MDR — The 2026 CISO Framework
Security operations is the largest line item in most security budgets and the most contested. As MDR providers mature and internal SOC costs rise, CISOs face a structural decision about how to deliver detection and response at sustainable cost. A framework for thinking through the options.
risk-analysis -
Vulnerability Prioritization in 2026: CVSS, EPSS, and CISA KEV for Enterprise Security Leaders
CVSS scores alone generate patch queues no organisation can work through. EPSS and the CISA Known Exploited Vulnerabilities catalogue add exploitation likelihood and confirmed real-world abuse to the picture. This briefing explains how to combine all three into a prioritization framework that actually reduces risk.
risk-analysis -
Januscape: Why Your Cloud Provider's Patch Schedule Now Matters to the Board
CVE-2026-53359 allows a compromised virtual machine to escape to the host server, threatening the isolation guarantees that underpin multi-tenant cloud and private data centre security. A board-level briefing on what Januscape means for enterprise risk.
risk-analysis