Page - Resilience

How many 24-hour reporting clocks are you running? The EU Cyber Resilience Act gives manufacturers 24 hours to file, and companies already reporting under NIS2 may now be filing twice from a single incident. Tom Egglestone September 17, 2026 5 Min Read Th

The Entra ID flaw and the OAuth campaigns are one finding A maximum-severity Entra ID flaw and a wave of Russian OAuth phishing surfaced in the same week, and together they show why identity should be treated as infrastructure, not a checkbox control. Ste

How to identify a North Korean IT scammer before hiring one The scheme runs on stolen identities and AI-assisted interviews. Steph Barnes, Senior Threat Intelligence Analyst September 3, 2026 6 Min Read North Korean IT worker fraud is a state-directed emp

Agentic attacks can now be done at the price of a laptop What Alibaba's August release changes about agentic AI attacks, and why the insurance market feels it before it shows up in the claims data. David Meese September 1, 2026 9 Min Read With the release

Frequency modeling alone can't validate a FAIR estimate Loss event frequency and magnitude describe how an estimate is built, not whether it holds up against outcomes. Travis Wong August 27, 2026 3 Min Read A FAIR estimate can be built exactly to spec, re

Third-party risk management is a blind spot for most executives Most vendor risk programs still run on relationships and reputation, and the software bought to fix that usually ends up sitting half-used. Charles Norton August 25, 2026 3 Min Read Most orga

The water utility attacks in 12 states are a vendor risk problem What a dozen simultaneous water utility attacks reveal about vendor risk in public entities. Jud Dressler, PhD, Director, Resilience Risk Operations Center August 19, 2026 4 Min Read The FBI

How to govern GenAI risk without losing your mind GenAI governance is access control, observability, and incident response applied to a new category of actor: one that can take actions at scale without a human reviewing each step. Chris Wheeler August 10,

When patching everything stops being a strategy CISA's new directive prioritises vulnerabilities by exploitation and impact, and drops the CVSS mandate altogether. Cyber Essentials hardened the opposite rule. For large enterprises forced to hold CE+ for g

AI is reshaping cyber risk, but H1 2026 losses still trace to human error AI is already making phishing and social engineering more effective, and H1 2026 claims data shows how much costlier those attacks have become. Emma McGowan July 30, 2026 4 Min Read