Risk Signals
Current cyber-risk developments interpreted for business leaders, not a news recap.
For CISOs, CROs, executives, advisors.
The only alarm on Denmark's population register was the invoice
About 8.8 million records were read out of Denmark's population register through one company's lawful access, and the only thing counting the queries was the billing run. Most partner data access is metered the same way.
Read the analysis →Every CA did its job and the fake Google certificates were still issued
Counterfeit TLS certificates for Google and other brands were issued without any certificate authority failing, which moves the weak point to domain registries, including the ones behind the defensive domains most organisations never monitor.
Read the analysis →The seven-minute cloud wipe was decided months earlier
A compromised machine identity deleted most of the storage it targeted in about seven minutes, and the only things that held were protections its own permissions could not remove.
Read the analysis →The NetScaler warning arrived before the advisory
Some NetScaler operators were told to shut their appliances down a day before any advisory existed, and the organisations that could act on that call had settled two things in advance.
Read the analysis →A single compromised inbox is a finance-control event
EvilTokens exposes a gap between how organisations assess a mailbox compromise and how quickly attackers can turn its contents into a credible payment request.
Read the analysis →Multi-AZ is not the last copy
The AWS Bahrain and UAE loss is a reminder that cloud resilience ends at the boundary of design, while business recovery depends on the last copy an organisation actually controls.
Read the analysis →When the identity proof becomes part of the attack
A dark web service is selling scans of more than 153 million North American driver's licenses, and the real signal is that document-image identity checks have quietly become load-bearing while losing the assurance value organisations assume they still have.
Read the analysis →NetScaler is a signal about ownership, not just patch speed
A three-day federal deadline to patch a Citrix NetScaler flaw is really a question about who owns internet-facing security appliances, and what an organisation does when the window is missed.
Read the analysis →When Agentic AI Crosses the Boundary
An autonomous AI incident shows why containment, monitoring, and accountability now belong on the management agenda.
Read the analysis →Critical Infrastructure Is Becoming a Disruption Target
State-linked cyber activity against power and water systems signals an operational-continuity risk for any organisation with physical operations or utility dependencies.
Read the analysis →Cyber Claims Are Getting Rarer and More Expensive at the Same Time
New claims data shows the average cyber loss climbing sharply even as the number of claims falls. The reason the two move in opposite directions is where the cost now sits: in court, not in the incident.
Read the analysis →270 Breached Mail Servers Are a Supply Chain Story, Not a Patch Story
A mass-exploitation campaign against a widely used collaboration platform is still running. The number worth tracking is not the vulnerability score, it is how many unrelated organizations just inherited the same exposure window at once.
Read the analysis →