risk-analysis
-
M&A Cyber Due Diligence: The Hidden Liabilities Acquirers Miss
Cyber risk in acquisitions frequently goes unquantified until after deal close, when undisclosed breaches, inherited vulnerabilities, and regulatory exposure surface as material liabilities. This briefing outlines what CISOs need from the target company before signing, and how to structure cyber risk in deal governance.
risk-analysis -
AI Gateway Risk: Managing Exposed Model Endpoints Before They Become Your Next Major Incident
Research in mid-2026 confirmed that exposed LiteLLM and Ollama deployments are being exploited for compute theft, credential exfiltration, and autonomous attack operations — in some cases using the victim's own AI infrastructure to attack third parties. This briefing translates the threat into CISO-level risk posture and actionable governance steps.
risk-analysis -
ITDR: What the Board Needs to Know About Identity Threat Detection
Identity Threat Detection and Response addresses the gap that SIEM and EDR leave open — the lateral movement, credential abuse, and token theft that lives inside authenticated sessions. This briefing explains what ITDR is, what it catches that existing tools miss, and how to build the business case.
risk-analysis -
The 2026 Regulatory Stack: How to Manage NIS2, DORA, CIRCIA, and the UK Cyber Resilience Bill Without Drowning
European and US cyber regulations now overlap substantially, creating a compliance management problem that's as much about operational efficiency as about meeting individual requirements. This brief outlines a unified controls approach that satisfies multiple regimes simultaneously and reduces duplicated audit effort.
risk-analysis -
AI Security Posture Management: What CISOs Need to Know About AISPM
As enterprises deploy AI across every function, a new risk category has emerged: the AI attack surface. AI Security Posture Management (AISPM) is the discipline of continuously assessing that surface — model access, training pipelines, inference infrastructure, and prompt injection exposure — before it becomes a breach.
risk-analysis -
Developer Secrets as Board Risk: The GitHub PAT Exposure Problem in 2026
Developer credentials — GitHub personal access tokens, API keys, cloud IAM secrets — are now a primary initial access vector for data extortion groups targeting enterprises. The FulcrumSec breach pattern illustrates how a single exposed PAT can cascade into multi-terabyte data theft. This briefing frames the risk for board and C-suite reporting.
risk-analysis -
CTEM: Why CISOs Are Moving Beyond Vulnerability Management
Continuous Threat Exposure Management gives security leaders a structured framework for managing exposure rather than just patching CVEs. This briefing covers how CTEM works, its business case, and what a mature programme looks like in 2026.
risk-analysis -
Operational Technology: The Board-Level Risk That Most Governance Frameworks Still Miss
OT environments — SCADA, PLCs, industrial control systems — carry material cyber risk that sits outside most board risk frameworks, insurance programmes, and security investments. This briefing explains what boards need to understand and the governance questions they should be asking.
risk-analysis