Arceo

How many 24-hour reporting clocks are you running? The EU Cyber Resilience Act gives manufacturers 24 hours to file, and companies already reporting under NIS2 may now be filing twice from a single incident. Tom Egglestone September 17, 2026 5 Min Read Th

The Entra ID flaw and the OAuth campaigns are one finding A maximum-severity Entra ID flaw and a wave of Russian OAuth phishing surfaced in the same week, and together they show why identity should be treated as infrastructure, not a checkbox control. Ste

How many 24-hour reporting clocks are you running? The scheme runs on stolen identities and AI-assisted interviews. Steph Barnes, Senior Threat Intelligence Analyst September 3, 2026 6 Min Read North Korean IT worker fraud is a state-directed employment s

Agentic attacks can now be done at the price of a laptop What Alibaba's August release changes about agentic AI attacks, and why the insurance market feels it before it shows up in the claims data. David Meese September 1, 2026 9 Min Read With the release

Frequency modeling alone can't validate a FAIR estimate Loss event frequency and magnitude describe how an estimate is built, not whether it holds up against outcomes. Travis Wong August 27, 2026 3 Min Read A FAIR estimate can be built exactly to spec, re

Third-party risk management is a blind spot for most executives Most vendor risk programs still run on relationships and reputation, and the software bought to fix that usually ends up sitting half-used. Charles Norton August 25, 2026 3 Min Read Most orga

The water utility attacks in 12 states are a vendor risk problem What a dozen simultaneous water utility attacks reveal about vendor risk in public entities. Jud Dressler, PhD, Director, Resilience Risk Operations Center August 19, 2026 4 Min Read The FBI

The water utility attacks in 12 states are a vendor risk problem What a dozen simultaneous water utility attacks reveal about vendor risk in public entities. Jud Dressler, PhD, Director, Resilience Risk Operations Center August 19, 2026 4 Min Read The FBI

How to govern GenAI risk without losing your mind GenAI governance is access control, observability, and incident response applied to a new category of actor: one that can take actions at scale without a human reviewing each step. Chris Wheeler August 10,

When patching everything stops being a strategy CISA's new directive prioritises vulnerabilities by exploitation and impact, and drops the CVSS mandate altogether. Cyber Essentials hardened the opposite rule. For large enterprises forced to hold CE+ for g