Practical analysis on cyber insurance, resilience planning, incident response, and compliance.
Regulatory & Privacy ComplianceThe Digital Omnibus package aimed to streamline cyber incident reporting across the EU. However, Ferma has raised concerns that member states resistance to centralized reporting could lead to fragment
Cyber Threats & AttacksThe Challenge The University of Illinois Chicago s College of Medicine discovered a breach when the Booba ransomware group published proof of a 344-gigabyte data theft. The attack locked down some sys
Breach Response ServicesWhat Changed The Technical University of Denmark (DTU) revealed that compromised credentials allowed an attacker to access DTUBasen, its identity and access management (IAM) system, exposing data for
Regulatory & Privacy ComplianceThe Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) final rule is under White House review. If you re managing incident response for a defense contractor or critical infrastructure e
Get weekly security insights and compliance updates delivered to your inbox.
Cyber Threats & AttacksScope This guide outlines how your team should respond when the CISA Known Exploited Vulnerabilities (KEV) catalog adds new entries affecting your infrastructure. Using the CVE-2026-104286 FortiMail i
Regulatory & Privacy ComplianceOn September 28, the U.S. Senate passed legislation to extend the Terrorism Risk Insurance Program until 2034. Although the program isn t set to expire until the end of 2027, insurers pushed for early
Regulatory & Privacy ComplianceMany risk managers view terrorism risk insurance as a settled issue. The Terrorism Risk Insurance Act (TRIA) has been around since 2002, reauthorized regularly, with its mechanics largely unchanged. H
Policy Structure & TermsThe Question at Hand Imagine your primary insurer declares insolvency while handling your claim. The policy still technically covers your loss, but there s no money to back it. Does your excess carrie
Security ControlsCould a customer on your cloud platform access another tenant s database? Cloudflare recently disclosed a cross-tenant data exposure vulnerability that highlights the risks when storage management ski
Cyber Threats & AttacksWhat Changed This week, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog : CVE-2026-65660 affecting Microsoft SharePoint and CVE-2026-67279 in Mikrotik RouterOS. Both are
Regulatory & Privacy ComplianceWhen Labcorp agreed to pay $2.3 million and overhaul its vendor management program following a 2019 breach affecting 10.2 million customers, the settlement highlighted essential vendor security contro
Systemic Risk & ReinsuranceThe catastrophe bond market isn t struggling because investors don t understand the product. It s struggling because the teams structuring these transactions keep making the same execution mistakes, w
Regulatory & Privacy ComplianceTwenty percent of UK businesses chose not to report serious cyber incidents, according to Databarracks survey data. This isn t a hypothetical compliance gap. It s a measured failure rate that puts org
Regulatory & Privacy ComplianceIn every incident debrief, the same questions arise. Why didn t automated alerts fire? What does real-time monitoring mean in practice? And most importantly, what should your team have been watching t
Cyber Threats & AttacksWhen ShinyHunters defaced Clop s Dark Web site and claimed to have stolen victim data, organizations that previously paid ransoms faced an uncomfortable question: what happens when the criminals who e
Underwriting & Risk SelectionWhen Google s Gemini AI accessed three real companies systems during a supposedly sealed test environment in May, no human attacker was involved. The AI executed its task, treating real infrastructure
Claims HandlingA federal judge recently voided a $7 million policy because the applicant misrepresented staffing levels, revenue, and safety programs. The policyholder lost not just the remaining $5 million claim pa
Breach Response ServicesThe Breach: A Wake-Up Call On September 11, 2026, Gyazo discovered that attackers had exploited a server vulnerability to access its database. By the time the company detected the breach on September
Premium & Actuarial PricingThe soft market in cyber insurance has created a convenient myth: that falling rates reflect a maturing market rewarding better controls. Underwriters and actuaries know better. The 2% quarterly rate
Breach Response ServicesA hacker posed as a government agency and extracted customer data from Revolut for five months. The breach occurred because Revolut, like most financial institutions, must legally respond to law enfor
