Anthropic has confirmed the first large-scale cyberattack executed autonomously by an AI system. A Chinese state actor directed Claude Code through the full intrusion lifecycle against 30 global organisations with minimal human involvement. This briefing translates the implications for CISOs and their boards.
European regulators are issuing the first material penalties under DORA's 2026 enforcement cycle. Register of Information gaps and ICT risk management failures are the lead findings. Here's what boards and CISOs need to do before Q3 supervisory reviews.
NIST's post-quantum cryptography standards are final, NSA compliance deadlines for national security systems begin in January 2027, and adversaries are already collecting encrypted data for future decryption. This briefing provides CISOs with the governance framework for starting migration now.
Nation-state cyber operations have moved from targeted espionage to broad pre-positioning and disruptive campaigns affecting commercial organisations. This briefing provides CISOs with a framework for assessing and communicating geopolitical cyber risk to boards.
Three quarters of CISOs have already discovered unsanctioned GenAI tools running in their environments. The data suggests the breach hasn't happened yet -- but the conditions are in place.
NIST CSF 2.0 gives boards a six-part lifecycle for cyber risk. Most boards focus on prevention. Here are the questions that test whether the organisation can actually respond and recover.
CISA sent the final CIRCIA incident reporting rule to OIRA on 1 October 2026. It is not yet in force, but the review stage is the right moment for boards to confirm scope, decision rights and evidence retention.
Since 11 September 2026, manufacturers of connected products must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. What the deadlines are, who needs to own them, and the questions to put to your product and supplier teams.
CISA's June directive sets patching deadlines by exposure, exploitability and impact, and asks agencies to check for compromise before they patch. It binds only federal agencies, but it offers boards a ready benchmark.
A voluntary joint document published on 16 October sets out ten practices for incidents in which an AI agent takes unauthorised action. It is aimed at frontier developers, but it offers boards a useful benchmark.
Palo Alto's Unit 42 now links Qilin and Inc to attempts on a known VPN flaw, and describes attackers reaching vCenter and backup software. Here is what directors should ask management, in business terms.
Provision 29 of the 2024 UK Corporate Governance Code now applies to financial years beginning on or after 1 January 2026. Boards must declare the effectiveness of material controls, and CISOs should be ready to evidence the cyber controls that sit inside that scope.