Anthropic has confirmed the first large-scale cyberattack executed autonomously by an AI system. A Chinese state actor directed Claude Code through the full intrusion lifecycle against 30 global organisations with minimal human involvement. This briefing translates the implications for CISOs and their boards.
European regulators are issuing the first material penalties under DORA's 2026 enforcement cycle. Register of Information gaps and ICT risk management failures are the lead findings. Here's what boards and CISOs need to do before Q3 supervisory reviews.
NIST's post-quantum cryptography standards are final, NSA compliance deadlines for national security systems begin in January 2027, and adversaries are already collecting encrypted data for future decryption. This briefing provides CISOs with the governance framework for starting migration now.
Nation-state cyber operations have moved from targeted espionage to broad pre-positioning and disruptive campaigns affecting commercial organisations. This briefing provides CISOs with a framework for assessing and communicating geopolitical cyber risk to boards.
Three quarters of CISOs have already discovered unsanctioned GenAI tools running in their environments. The data suggests the breach hasn't happened yet -- but the conditions are in place.
Zero Trust Architecture has moved from best practice to mandatory requirement. OMB M-22-09 federal deadlines are now enforceable, CISA's updated Zero Trust Maturity Model defines the measurement framework, and DORA, CIRCIA, and the UK Cyber Security and Resilience Bill are converging on the same underlying controls. Here's what the board needs to understand about where ZTA compliance now sits.
Cyber insurance underwriters have substantially tightened requirements since 2022. The questions have become more technical, the exclusions more specific, and the attestations more consequential. This briefing outlines what underwriters expect in 2026 and how security leaders should prepare.
Insider threats account for a disproportionate share of high-impact data loss events. Building a detection and response programme requires balancing UEBA technology, HR integration, legal frameworks, and employee privacy rights. This briefing covers programme design, governance, technology selection, and the organisational challenges CISOs consistently underestimate.
DORA's Threat-Led Penetration Testing requirements under Article 26 apply to significant financial entities across the EU and have extraterritorial reach for UK firms with EU operations. Here's what CISOs need to have in place, the testing scope requirements, and how to manage third-party ICT provider involvement.
SAP environments are among the highest-value targets in enterprise IT — they hold payroll, financials, supply chain, and HR. Yet many security programmes treat SAP as an IT infrastructure question rather than a board-level risk. This briefing covers the real attack surface and what CISOs need to ask.
Phishing simulation click rates are not a security metric — they're an activity metric. This briefing covers what CISOs should actually measure when evaluating security awareness programmes, why most current approaches fail to demonstrate ROI, and how to build a measurement framework boards will accept.
CISA added CVE-2026-46817 to the Known Exploited Vulnerabilities catalogue on July 15 with a 72-hour federal deadline -- the tightest ever imposed on an Oracle ERP vulnerability. For CISOs with Oracle E-Business Suite deployments, this is a board-level risk requiring immediate escalation.