Risk Management

ISO/IEC 27090: AI Security Without a New System

ISO/IEC 27090:2026 gives guidance on cybersecurity threats specific to AI systems. For organizations already running ISO/IEC 27001 and 42001, the most efficient path is to extend what they have rather than build new standalone structures.

OAuth Grants Are Piling Up Faster Than Security Teams Can Review Them

Employees routinely connect SaaS apps and AI tools via OAuth, creating thousands of hard-to-track access grants per company. Security researchers warn this backlog is a growing breach risk and outline how automation can help teams keep up.

AI Agents Are Straining SOC 2 Assumptions About Identity and Access

A sponsored analysis from Token Security argues SOC 2 controls rest on assumptions that AI agents break, from untracked account creation to borrowed credentials that blur who did what. Here is what it means for organizations.

When an AI Agent Should Refuse or Pause Before Taking an Action

Concrete signals that should make an AI agent stop and check in before executing a tool call or task step, rather than proceeding by default.

When to Escalate to a Human: Practical Triggers for AI Agents

Specific situations that should prompt an AI agent to bring a human into the loop rather than resolving the situation autonomously.

Getting Started: A Security and AI Governance Roadmap for Large Enterprises

Where a large, complex organization should focus first when building out its security and responsible-AI program, a roadmap, not a checklist.

Getting Started: A Security Roadmap for Public Sector Organizations

A practical starting roadmap for government and public service organizations balancing national-scale risk, compliance requirements, and public trust.

Active Cyber Defence and National Strategy: Protecting Critical Infrastructure

How national cyber strategies and active defence programs work together to protect the infrastructure that societies depend on, and what it means for organizations operating within it.

Building an Incident Response Plan for Small Teams

You don't need a security team to have a plan. A simple, written incident response plan turns a chaotic security event into a manageable one.

Back Up Your Important Files Regularly

Photos, documents and memories can disappear in an instant. A simple approach to backing up your phone (Android/iPhone) and computer.

EU Publishes Enforcement Guidance for High-Risk AI Systems Under the AI Act

Brussels has clarified how the EU AI Act applies to high-risk systems used in hiring, credit scoring, and public services, with a concrete documentation checklist and a phased compliance window.

AI-Generated Deepfake Voice Calls Used in Executive Impersonation Scams

Vishing attacks using AI-cloned executive voices are rising, with attackers needing only a short public recording to produce a convincing impersonation for a wire-transfer request.

How Companies Are Building AI Governance Programs From Scratch

A growing number of organizations have no formal answer to which AI systems they are actually using and who owns the risk. Here is what building that answer from zero tends to look like.

The Hidden Risk of Shadow AI in the Workplace

An employee pastes a contract into a free AI tool to get a quick summary. It does not feel like a security incident. It might be one.

The 3-2-1 Backup Rule, and Why It Still Holds Up

The rule predates both modern ransomware and cloud storage as most people use it. It still holds up, and the reason why has not changed.