The Employee Left. The Access Did Not.
Disabling Active Directory is no longer enough. Effective offboarding must revoke distributed human access, long-lived secrets and machine credentials before they become orphaned trust.
Read article →Shellshock Was Patched Years Ago. Residual Risk Is a Governance Problem.
A decade-old Shellshock finding should trigger questions about asset ownership, deferred remediation, compensating controls, exception expiry and the business dependency keeping vulnerable technology alive.
Read article →When an AI Security Test Becomes a Real Cyber Incident, Who Owns the Breach?
AI agents cannot accept risk or legal accountability. High-risk evaluations need enforceable isolation, real-time monitoring, independent shutdown controls and named incident owners before testing begins.
Read article →Your Vendor Passed the Security Assessment. The Breach Still Came Through Them.
Third-party assessments capture a moment. Strong vendor security limits connected trust, monitors critical access throughout the lifecycle and prepares the business to contain supplier failure.
Read article →Shadow IT Is Not the Problem. Invisible Risk Is.
Shadow IT is driven by productivity. The real security problem begins when technology use and information movement become invisible and ungoverned.
Read article →Risk Acceptance Is Not Risk Transfer
A signed risk acceptance records a conscious decision to proceed. The exposure and accountability still remain with the organisation.
Read article →The Biggest AI Deployment In Your Organisation May Already Be Happening Without You
Shadow AI is spreading through everyday work faster than governance can keep up. Visibility must come before control.
Read article →Employees Are Adopting AI Faster Than Organisations Can Govern It
AI adoption is moving at employee speed while governance moves at organisational speed. The first challenge is visibility.
Read article →