Practical analysis on cyber insurance, resilience planning, incident response, and compliance.
Cyber Threats & AttacksRecent Mior and Skyfall attacks reveal vulnerabilities in AMD SEV-SNP confidential VMs, highlighting risks from rogue hypervisors and hardware flaws.
Cyber Threats & AttacksThis post debunks five common myths about third-party cloud risk, highlighting the importance of thorough risk management to prevent data breaches and reputational damage.
generalA 16-year-old UEFI boot flaw exposes common firmware security myths, highlighting the need for better inventory, patch management, and vendor oversight.
Cyber Threats & AttacksAI enhances ransomware speed, but known vulnerabilities and technical debt pose the greatest threat. Addressing these is critical to strengthening defenses.
Get weekly security insights and compliance updates delivered to your inbox.
Systemic Risk & ReinsurancePHP vulnerabilities create complex cyber risks affecting breach response, regulatory claims, and aggregation. Choosing the right insurance structure is vital.
Cyber Threats & AttacksExplore the risks of granting Directory.ReadWrite.All permissions in Microsoft 365 and how to manage third-party access to prevent supply chain attacks.
Cyber Threats & AttacksMulti-factor authentication (MFA) is often touted as your frontline defense against unauthorized access. The common advice is to enable MFA everywhere, closing the door on most credential-based attack
Cyber Threats & AttacksIf you re still prioritizing vulnerabilities by CVSS score alone, you re fixing the wrong things first. The CISA Known Exploited Vulnerabilities Catalog offers a curated list of CVEs that threat actor
Regulatory & Privacy ComplianceThe Digital Omnibus package aimed to streamline cyber incident reporting across the EU. However, Ferma has raised concerns that member states resistance to centralized reporting could lead to fragment
Cyber Threats & AttacksThe Challenge The University of Illinois Chicago s College of Medicine discovered a breach when the Booba ransomware group published proof of a 344-gigabyte data theft. The attack locked down some sys
Regulatory & Privacy ComplianceOn September 28, the U.S. Senate passed legislation to extend the Terrorism Risk Insurance Program until 2034. Although the program isn t set to expire until the end of 2027, insurers pushed for early
Security ControlsCould a customer on your cloud platform access another tenant s database? Cloudflare recently disclosed a cross-tenant data exposure vulnerability that highlights the risks when storage management ski
Regulatory & Privacy ComplianceWhen Labcorp agreed to pay $2.3 million and overhaul its vendor management program following a 2019 breach affecting 10.2 million customers, the settlement highlighted essential vendor security contro
Regulatory & Privacy ComplianceTwenty percent of UK businesses chose not to report serious cyber incidents, according to Databarracks survey data. This isn t a hypothetical compliance gap. It s a measured failure rate that puts org
Breach Response ServicesA hacker posed as a government agency and extracted customer data from Revolut for five months. The breach occurred because Revolut, like most financial institutions, must legally respond to law enfor
Regulatory & Privacy ComplianceThe Question at Hand A joint government advisory is urging organizations to adopt more transparent breach notification and incident response protocols. This raises a practical dilemma for risk manager
Cyber Threats & AttacksAfter the Veradigm breach made headlines, questions about third-party risk management arose in several risk committee meetings. One CISO asked during a vendor review, a compliance officer sought to up
Systemic Risk & ReinsuranceUnderstanding the Shift Insurance industry losses from non-peak perils surpassed $100 billion for the first time in 2025, marking the sixth consecutive year of global insured losses exceeding this thr
Breach Response ServicesWhen Manchester Airports Group disclosed that 8.8 million records leaked after refusing a ransom demand, the story wasn t just about extortion. It revealed how organizations often mishandle third-part
Systemic Risk & ReinsuranceContext: Questions from the Renewal Planning Trenches These questions arise from discussions with enterprise risk managers preparing for the January 2027 renewal season. You re seeing headlines about
