Field intelligence for the people who run security programs.
Threat Intelligence
A vendor breach compromises everyone downstream at the same moment, and you usually hear about it from a headline, not your own alerts. The playbook you build before the outage, and the four moves that matter in the first hour.
By Jeff Sowell · Sep 20, 2026
Research report
AI agents are becoming privileged enterprise identities. An original dataset of 21 documented cases on the new identity attack surface, MCP security, and the controls CISOs need.
Read the report
Research report
Third-party involvement in breaches has doubled to 30%. The strongest public evidence on vendor and supply-chain cyber risk, every figure traceable to a primary source.
Read the report
InformationWeek asked when a business is really recovered from a cyberattack. Here is the longer answer: the three questions that piece left open, and the exercise that answers them before the attack.
Sep 10, 2026
The FBI logged over 1 million internet crime complaints and $20.9 billion in losses in 2025, and government facilities ranked third among targeted critical infrastructure sectors. This sourced national report tracks the ransomware wave hitting cities, counties, and states, and the 2026 attacks on water utilities in at least 12 states.
Aug 7, 2026
Georgia entered the FBI IC3 top 10 in 2025 with 25,936 complaints and $534.6 million in losses, and leads the nation in cybercrime losses among minor victims. This report documents the county ransomware wave, the Murray County payment that broke an eight-year no-pay pattern, and Georgia's weak breach law.
Aug 7, 2026
ISO 27001 vs SOC 2: one is an international certification, the other a US attestation, and they share a large control core. Here is how to choose, and whether to pursue both.
Jun 21, 2026
PCI DSS 4.0.1 is now the only active version of the standard. Here is what mid-market companies that accept card payments need to know: merchant levels, SAQ selection, the 12 requirements, and a readiness checklist.
Jun 17, 2026
275 million Americans had their PHI exposed in 2024 — a new HIPAA breach record. Here's what the OCR data shows about ransomware, business associates, and what mid-market healthcare must do next.
Apr 19, 2026
A working list of the virtual CISO firms worth a call in 2026, what each one is actually good at, and the evaluation questions that separate a real security program from a monthly report nobody reads.
Aug 31, 2026
SaaS companies hit a security inflection point when an enterprise prospect requires SOC 2 or an investor demands a CISO. This guide covers what a vCISO actually does for a SaaS firm, what it costs, and how to structure the engagement.
May 23, 2026
Biotech firms face state-sponsored IP-theft attacks and FDA cybersecurity expectations on top of HIPAA. This guide covers what a vCISO does for a biotech, what it costs, and the engagement scope.
May 23, 2026
AI agents do not just generate text, they take actions: calling APIs, moving money, changing systems. Here is the agentic AI attack surface and a practical control set for deploying agents safely in 2026.
Jun 17, 2026
The NIST AI Risk Management Framework (NIST AI 100-1) is the de facto US baseline for managing AI risk. This guide covers the four core functions, the Generative AI Profile (NIST AI 600-1), the April 2026 Critical Infrastructure profile, crosswalks to ISO 42001 and the EU AI Act, and a practical adoption path for mid-market organizations.
Jun 1, 2026
The definitive record of AI security in 2025-2026: four zero-click prompt injection chains, the Salesloft Drift breach of 700+ organizations, the first autonomous-agent breach, $893M in FBI-reported AI-enabled fraud, and the corrected EU AI Act timeline. Sourced and footnoted for mid-market leaders.
May 24, 2026
Research · Aug 21, 2026
Threat Intelligence · Aug 7, 2026
Threat Intelligence · Aug 7, 2026
Managed Security · Jun 21, 2026
Leadership · Jun 21, 2026
Leadership · Jun 21, 2026
Threat Intelligence · May 31, 2026
Threat Intelligence · May 27, 2026
One email a week. The cyber developments that change a decision, read by people who make them.
Practitioner voices, published independently.
Cyber Insights runs guest articles from the people who actually operate security programs. Editorial is free and independent; sponsored content is separate and clearly labeled. Have a sharp point of view worth publishing? This is where it runs.