Anthropic has confirmed the first large-scale cyberattack executed autonomously by an AI system. A Chinese state actor directed Claude Code through the full intrusion lifecycle against 30 global organisations with minimal human involvement. This briefing translates the implications for CISOs and their boards.
European regulators are issuing the first material penalties under DORA's 2026 enforcement cycle. Register of Information gaps and ICT risk management failures are the lead findings. Here's what boards and CISOs need to do before Q3 supervisory reviews.
NIST's post-quantum cryptography standards are final, NSA compliance deadlines for national security systems begin in January 2027, and adversaries are already collecting encrypted data for future decryption. This briefing provides CISOs with the governance framework for starting migration now.
Nation-state cyber operations have moved from targeted espionage to broad pre-positioning and disruptive campaigns affecting commercial organisations. This briefing provides CISOs with a framework for assessing and communicating geopolitical cyber risk to boards.
Three quarters of CISOs have already discovered unsanctioned GenAI tools running in their environments. The data suggests the breach hasn't happened yet -- but the conditions are in place.
CISA added a maximum-severity Oracle WebLogic and HTTP Server flaw to its Known Exploited Vulnerabilities catalogue on August 24, with a three-day federal remediation deadline -- but Oracle patched the bug back in January, and a China-linked threat actor has reportedly been exploiting it against government infrastructure since then. For CISOs, the real story is not the CVE. It is why a patched, unauthenticated, CVSS 10 vulnerability sat unremediated for seven months.
Carriers are moving away from once-a-year, point-in-time underwriting toward continuous monitoring of a policyholder's security posture. For CISOs, that turns cyber insurance from an annual paperwork cycle into a year-round governance obligation — with real budget and reporting consequences.
IBM and Ponemon's 21st annual Cost of a Data Breach Report puts the global average at $4.99 million, with AI-enabled breaches running $1 million higher. The data gives boards a hard number for the AI governance gap they've been debating in the abstract.
CISA, the FBI, and HHS jointly updated their Medusa ransomware advisory on August 18-19, reporting the group has now hit over 500 critical infrastructure organizations since 2021, up from 300 in March 2025. This briefing covers what changed, why healthcare is bearing the brunt, and the governance actions CISOs should take this quarter.
Black Hat USA 2026 ran in Las Vegas this week. The themes that dominated — AI infrastructure exploitation as an independent attack discipline, nation-state credential harvesting through trusted third-party networks, and autonomous agent weaponisation — carry direct implications for enterprise risk posture. This briefing distils what security leaders need to know.
Zenity Labs' disclosure of AgentForger demonstrates that enterprise AI agents can be weaponised from outside the organisation via a single phishing link, creating an attacker-controlled agent that inherits authorised access to email, calendar, Slack, and Teams. OpenAI patched the specific flaw in June — but the governance problem is structural and ongoing.
The joint NCSC advisory AA26-204A naming LAUNDRY BEAR represents a materially different email threat model than phishing: no link to click, no attachment to execute. CISOs running Zimbra need to act now; those who aren't face similar risks from analogous techniques. Here's the executive brief.