Practical briefings for the people accountable for cyber risk.
Short, direct pieces on the cyber risk, governance, resilience, and regulatory questions that reach the board, written for the people who have to decide.
PHP2Shell vulnerabilities: what boards need management to confirm now
Two critical flaws in PHP, the language behind a large share of the web, can let an attacker take control of a web server with a single request. This article explains the risk in business terms, what the NCSC advises and what boards should ask management this week.
The Cyber Security and Resilience Bill: what the new penalty regime means for boards
The Bill would give UK cyber regulators turnover-based fines of up to £17 million or 4% of worldwide turnover. This article explains what is changing, who comes into scope and what boards should ask management now.
Follow the chain: who really keeps your services running?
Today's Google Cloud outage reached banks, courts and parcel deliveries several links away from a power event in London. Mapping the chain behind each critical service, and rehearsing the loss of a link, gives leadership the evidence that resilience and supply chain obligations ask for.
AI risk in business terms: what the board needs to understand
AI failures can interrupt services, cause financial loss, expose confidential information or harm customers and employees. Leadership can examine the risk through what AI produces, what it can access or change and what it depends on, within an appetite the board approves.
Limiting the damage: Zero Trust lessons from three UK breaches
Recent UK breaches show that a breach is rarely the expensive part. The cost comes from how far attackers can reach once inside and how long recovery takes, which is what a sequenced Zero Trust programme is built to limit.
Ransomware and the board: preparing decisions that can be defended
Ransomware can force decisions on shutdown, engagement and payment within hours. This article explains what the evidence shows, what regulation expects of leadership, and how boards can prepare those decisions and the investment behind them in advance.
Scaling AI safely: what leadership should expect
A shared capability for assessing, delivering and operating AI under common governance helps leadership fund the use cases that deliver value, see what AI is doing in the business and keep people in control where it matters.
Why Zero Trust programmes stall: an executive guide to risk-led security
A Zero Trust programme can stall, or deliver new tools without reducing risk, when it starts from technology, skips discovery or ignores systems that cannot adopt the model. This article explains what a risk-led approach requires and the questions leadership should put to management.
Cyber resilience: how boards can prepare the organisation to recover from disruption
UK and EU regulation now expects organisations to plan for severe but plausible disruption and show they can recover within defined limits. This article explains how boards can apply that approach to cyber risk, including suppliers and cloud services, and what to ask management.
Answering the NIS2 scope question before you commit to a programme
A five-day NIS2 Readiness Diagnostic establishes a provisional scope position, assesses governance readiness and identifies priority gaps, giving the management body an evidenced basis for programme decisions.
Zero Trust starts with discovery and prioritisation
Discovery establishes the organisation's Zero Trust maturity and identifies where change will reduce business risk, giving leadership a basis for priorities, ownership and investment.
Software supply chain risk: what the board needs to oversee
Business services depend on software built, updated and operated by others. Overseeing that dependency means clear ownership, assurance over suppliers and the ability to recover when a supplier fails.
Supply chain cyber risk: what the Jaguar Land Rover shutdown means for boards
The cyber incident at Jaguar Land Rover has halted production for more than three weeks and put pressure on hundreds of suppliers. This article sets out what is on the public record and what boards should expect management to do about supply chain cyber risk.
Recovering from a cyber attack: lessons for boards from the collapse of KNP Logistics
A 158-year-old UK transport company went into administration after a ransomware attack reportedly began with a guessed password. This article sets out the public record and what boards should expect management to do about access security and recovery.
Cloud incident detection: what boards should ask about visibility and response time
A new industry survey suggests few organisations detect cloud security incidents quickly. This article explains why detection and response time matter to the business, where responsibility sits in the cloud, and what boards should expect from management.
Secure software development: what boards should expect from management
Security leaders are planning more investment in cloud security and support building security into software development. This article explains what that means in business terms, the UK and EU rules now shaping it, and the questions boards can ask about the software their organisation builds and buys.
Putting Zero Trust strategy into practice in your cloud estate
Cloud platforms provide many of the capabilities a Zero Trust strategy needs. Business priorities, access policy and continuing governance determine how well they are used.
AI security: what the board needs to oversee as the organisation adopts AI
AI systems can be manipulated through their inputs, corrupted through their data and made to reveal information users should not see. This article explains those risks, the standards that help manage them and what the board should require of management.
Cloud growth needs a governed foundation
A landing zone is a shared foundation that sets rules for who can access cloud services, how activity is monitored, how environments connect and who owns the costs. It helps the organisation maintain visibility, control and recoverability as the estate grows.