Anthropic has confirmed the first large-scale cyberattack executed autonomously by an AI system. A Chinese state actor directed Claude Code through the full intrusion lifecycle against 30 global organisations with minimal human involvement. This briefing translates the implications for CISOs and their boards.
European regulators are issuing the first material penalties under DORA's 2026 enforcement cycle. Register of Information gaps and ICT risk management failures are the lead findings. Here's what boards and CISOs need to do before Q3 supervisory reviews.
NIST's post-quantum cryptography standards are final, NSA compliance deadlines for national security systems begin in January 2027, and adversaries are already collecting encrypted data for future decryption. This briefing provides CISOs with the governance framework for starting migration now.
Nation-state cyber operations have moved from targeted espionage to broad pre-positioning and disruptive campaigns affecting commercial organisations. This briefing provides CISOs with a framework for assessing and communicating geopolitical cyber risk to boards.
Three quarters of CISOs have already discovered unsanctioned GenAI tools running in their environments. The data suggests the breach hasn't happened yet -- but the conditions are in place.
On 11 November 2026 Maersk disclosed unauthorised access and data extraction from a legacy system inherited in an acquisition. The investigation is ongoing. Here is what the company has and has not said, and the governance questions it raises.
The UK's NCSC has launched an assurance scheme for providers that test how critical organisations prevent, detect and respond to realistic attacks. Here is what the scheme is, what it is not, and the questions executives should put to their security teams.
The UK's National Cyber Security Centre says AI-powered malware will highly likely be used in a ransomware attack on UK critical national infrastructure by 2028. The message to leaders: the weaknesses AI will exploit are old ones, and the cost of leaving them is now a board-level choice.
On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the EU Court of Justice for not transposing NIS2. The case is about governments, not companies, but it changes how boards should plan across the EU.
New joint guidance from CISA and the Canadian Cyber Centre treats AI token consumption as an operational resilience issue. What it says, why denial-of-wallet matters, and five questions for management.
NIST CSF 2.0 gives boards a six-part lifecycle for cyber risk. Most boards focus on prevention. Here are the questions that test whether the organisation can actually respond and recover.
CISA sent the final CIRCIA incident reporting rule to OIRA on 1 October 2026. It is not yet in force, but the review stage is the right moment for boards to confirm scope, decision rights and evidence retention.