Anthropic has confirmed the first large-scale cyberattack executed autonomously by an AI system. A Chinese state actor directed Claude Code through the full intrusion lifecycle against 30 global organisations with minimal human involvement. This briefing translates the implications for CISOs and their boards.
European regulators are issuing the first material penalties under DORA's 2026 enforcement cycle. Register of Information gaps and ICT risk management failures are the lead findings. Here's what boards and CISOs need to do before Q3 supervisory reviews.
NIST's post-quantum cryptography standards are final, NSA compliance deadlines for national security systems begin in January 2027, and adversaries are already collecting encrypted data for future decryption. This briefing provides CISOs with the governance framework for starting migration now.
Nation-state cyber operations have moved from targeted espionage to broad pre-positioning and disruptive campaigns affecting commercial organisations. This briefing provides CISOs with a framework for assessing and communicating geopolitical cyber risk to boards.
Three quarters of CISOs have already discovered unsanctioned GenAI tools running in their environments. The data suggests the breach hasn't happened yet -- but the conditions are in place.
Provision 29 of the 2024 UK Corporate Governance Code now applies to financial years beginning on or after 1 January 2026. Boards must declare the effectiveness of material controls, and CISOs should be ready to evidence the cyber controls that sit inside that scope.
With the Second Amendment to 23 NYCRR Part 500 now fully phased in and more than $144 million in consent-order penalties on the books, NYDFS has become one of the most consequential — and most overlooked — cybersecurity regulators for CISOs outside the financial sector's core.
New 2026 survey data from IANS/Artico/CAP Group and a forthcoming board-relationships report show CISOs leaving boardrooms feeling heard while directors leave uneasy. Here is what the gap actually measures and how to close it.
CISA added a maximum-severity Oracle WebLogic and HTTP Server flaw to its Known Exploited Vulnerabilities catalogue on August 24, with a three-day federal remediation deadline -- but Oracle patched the bug back in January, and a China-linked threat actor has reportedly been exploiting it against government infrastructure since then. For CISOs, the real story is not the CVE. It is why a patched, unauthenticated, CVSS 10 vulnerability sat unremediated for seven months.
Carriers are moving away from once-a-year, point-in-time underwriting toward continuous monitoring of a policyholder's security posture. For CISOs, that turns cyber insurance from an annual paperwork cycle into a year-round governance obligation — with real budget and reporting consequences.
IBM and Ponemon's 21st annual Cost of a Data Breach Report puts the global average at $4.99 million, with AI-enabled breaches running $1 million higher. The data gives boards a hard number for the AI governance gap they've been debating in the abstract.
CISA, the FBI, and HHS jointly updated their Medusa ransomware advisory on August 18-19, reporting the group has now hit over 500 critical infrastructure organizations since 2021, up from 300 in March 2025. This briefing covers what changed, why healthcare is bearing the brunt, and the governance actions CISOs should take this quarter.