Briefings
Practical briefings for the people accountable for cyber risk.
Short, direct pieces on the cyber risk, governance, resilience, and regulatory questions that reach the board, written for the people who have to decide.
Latest
· Paul WalkerPHP2Shell vulnerabilities: what boards need management to confirm nowTwo critical flaws in PHP, the language behind a large share of the web, can let an attacker take control of a web server with a single request. This article explains the risk in business terms, what the NCSC advises and what boards should ask management this week. · Paul WalkerThe Cyber Security and Resilience Bill: what the new penalty regime means for boardsThe Bill would give UK cyber regulators turnover-based fines of up to £17 million or 4% of worldwide turnover. This article explains what is changing, who comes into scope and what boards should ask management now. · Dom ReidFollow the chain: who really keeps your services running?Today's Google Cloud outage reached banks, courts and parcel deliveries several links away from a power event in London. Mapping the chain behind each critical service, and rehearsing the loss of a link, gives leadership the evidence that resilience and supply chain obligations ask for. · Marcin PajdzikHow boards can understand AI risk in business termsAI failures can interrupt services, cause financial loss, expose confidential information or harm customers and employees. Leadership can examine the risk through what AI produces, what it can access or change and what it depends on, within an appetite the board approves.
All briefings
Archive
Topic
Paul WalkerPHP2Shell vulnerabilities: what boards need management to confirm nowTwo critical flaws in PHP, the language behind a large share of the web, can let an attacker take control of a web server with a single request. This article explains the risk in business terms, what the NCSC advises and what boards should ask management this week.ResilienceSupply Chain
Paul WalkerThe Cyber Security and Resilience Bill: what the new penalty regime means for boardsThe Bill would give UK cyber regulators turnover-based fines of up to £17 million or 4% of worldwide turnover. This article explains what is changing, who comes into scope and what boards should ask management now.RegulationResilience
Dom ReidFollow the chain: who really keeps your services running?Today's Google Cloud outage reached banks, courts and parcel deliveries several links away from a power event in London. Mapping the chain behind each critical service, and rehearsing the loss of a link, gives leadership the evidence that resilience and supply chain obligations ask for.Supply ChainResilience
Marcin PajdzikHow boards can understand AI risk in business termsAI failures can interrupt services, cause financial loss, expose confidential information or harm customers and employees. Leadership can examine the risk through what AI produces, what it can access or change and what it depends on, within an appetite the board approves.AI Governance
Dom ReidLimiting the damage: Zero Trust lessons from three UK breachesRecent UK breaches show that a breach is rarely the expensive part. The cost comes from how far attackers can reach once inside and how long recovery takes, which is what a sequenced Zero Trust programme is built to limit.Zero Trust
Paul WalkerRansomware and the board: preparing decisions that can be defendedRansomware can force decisions on shutdown, engagement and payment within hours. This article explains what the evidence shows, what regulation expects of leadership, and how boards can prepare those decisions and the investment behind them in advance.ResilienceRegulation
Marcin PajdzikScaling AI safely: what leadership should expectA shared capability for assessing, delivering and operating AI under common governance helps leadership fund the use cases that deliver value, see what AI is doing in the business and keep people in control where it matters.AI GovernanceRegulation
Joseph CaxtonWhy Zero Trust programmes stall: an executive guide to risk-led securityA Zero Trust programme can stall, or deliver new tools without reducing risk, when it starts from technology, skips discovery or ignores systems that cannot adopt the model. This article explains what a risk-led approach requires and the questions leadership should put to management.Zero TrustCloud Security
Paul WalkerCyber resilience: how boards can prepare the organisation to recover from disruptionUK and EU regulation now expects organisations to plan for severe but plausible disruption and show they can recover within defined limits. This article explains how boards can apply that approach to cyber risk, including suppliers and cloud services, and what to ask management.Resilience
Marcin PajdzikAnswering the NIS2 scope question before you commit to a programmeA five-day NIS2 Readiness Diagnostic establishes a provisional scope position, assesses governance readiness and identifies priority gaps, giving the management body an evidenced basis for programme decisions.NIS2Regulation
Marcin PajdzikZero Trust starts with discovery and prioritisationDiscovery establishes the organisation's Zero Trust maturity and identifies where change will reduce business risk, giving leadership a basis for priorities, ownership and investment.Zero Trust
Marcin PajdzikSoftware supply chain risk: what the board needs to overseeBusiness services depend on software built, updated and operated by others. Overseeing that dependency means clear ownership, assurance over suppliers and the ability to recover when a supplier fails.Supply ChainResilience
Paul WalkerSupply chain cyber risk: what the Jaguar Land Rover shutdown means for boardsThe cyber incident at Jaguar Land Rover has halted production for more than three weeks and put pressure on hundreds of suppliers. This article sets out what is on the public record and what boards should expect management to do about supply chain cyber risk.Supply ChainResilience
Paul WalkerRecovering from a cyber attack: lessons for boards from the collapse of KNP LogisticsA 158-year-old UK transport company went into administration after a ransomware attack reportedly began with a guessed password. This article sets out the public record and what boards should expect management to do about access security and recovery.Resilience
Paul WalkerCloud incident detection: what boards should ask about visibility and response timeA new industry survey suggests few organisations detect cloud security incidents quickly. This article explains why detection and response time matter to the business, where responsibility sits in the cloud, and what boards should expect from management.Cloud SecurityResilience
Paul WalkerSecure software development: what boards should expect from managementSecurity leaders are planning more investment in cloud security and support building security into software development. This article explains what that means in business terms, the UK and EU rules now shaping it, and the questions boards can ask about the software their organisation builds and buys.Cloud SecurityRegulation
Marcin PajdzikPutting Zero Trust strategy into practice in your cloud estateCloud platforms provide many of the capabilities a Zero Trust strategy needs. Business priorities, access policy and continuing governance determine how well they are used.Zero TrustCloud Security
Joseph CaxtonAI security: what the board needs to oversee as the organisation adopts AIAI systems can be manipulated through their inputs, corrupted through their data and made to reveal information users should not see. This article explains those risks, the standards that help manage them and what the board should require of management.AI Governance
Marcin PajdzikCloud growth needs a governed foundationA landing zone is a shared foundation that sets rules for who can access cloud services, how activity is monitored, how environments connect and who owns the costs. It helps the organisation maintain visibility, control and recoverability as the estate grows.Cloud SecurityResilience