Anthropic has confirmed the first large-scale cyberattack executed autonomously by an AI system. A Chinese state actor directed Claude Code through the full intrusion lifecycle against 30 global organisations with minimal human involvement. This briefing translates the implications for CISOs and their boards.
European regulators are issuing the first material penalties under DORA's 2026 enforcement cycle. Register of Information gaps and ICT risk management failures are the lead findings. Here's what boards and CISOs need to do before Q3 supervisory reviews.
NIST's post-quantum cryptography standards are final, NSA compliance deadlines for national security systems begin in January 2027, and adversaries are already collecting encrypted data for future decryption. This briefing provides CISOs with the governance framework for starting migration now.
Nation-state cyber operations have moved from targeted espionage to broad pre-positioning and disruptive campaigns affecting commercial organisations. This briefing provides CISOs with a framework for assessing and communicating geopolitical cyber risk to boards.
Three quarters of CISOs have already discovered unsanctioned GenAI tools running in their environments. The data suggests the breach hasn't happened yet -- but the conditions are in place.
On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the EU Court of Justice for not transposing NIS2. The case is about governments, not companies, but it changes how boards should plan across the EU.
New joint guidance from CISA and the Canadian Cyber Centre treats AI token consumption as an operational resilience issue. What it says, why denial-of-wallet matters, and five questions for management.
NIST CSF 2.0 gives boards a six-part lifecycle for cyber risk. Most boards focus on prevention. Here are the questions that test whether the organisation can actually respond and recover.
CISA sent the final CIRCIA incident reporting rule to OIRA on 1 October 2026. It is not yet in force, but the review stage is the right moment for boards to confirm scope, decision rights and evidence retention.
Since 11 September 2026, manufacturers of connected products must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. What the deadlines are, who needs to own them, and the questions to put to your product and supplier teams.
CISA's June directive sets patching deadlines by exposure, exploitability and impact, and asks agencies to check for compromise before they patch. It binds only federal agencies, but it offers boards a ready benchmark.
A voluntary joint document published on 16 October sets out ten practices for incidents in which an AI agent takes unauthorised action. It is aimed at frontier developers, but it offers boards a useful benchmark.