Field intelligence for the people who run security programs.
AI Security
Symantec caught an attack agent that hunts for exposed AI model endpoints, takes them over and uses them to plan its attacks. What is proven, what is not, and five checks to run this week.
By Jeff Sowell · Oct 28, 2026
Research report
AI agents are becoming privileged enterprise identities. An original dataset of 21 documented cases on the new identity attack surface, MCP security, and the controls CISOs need.
Read the report
Research report
Third-party involvement in breaches reached 48% in the 2026 Verizon DBIR. The strongest public evidence on vendor and supply-chain cyber risk, every figure traceable to a primary source.
Read the report
Americans in the 50 states and D.C. reported $18.87 billion in cybercrime losses to the FBI in 2025, and 49 of 51 lost more than in 2024. Every state ranked by total losses, year-over-year change and average loss per complaint.
Oct 20, 2026
What a lean security team should preserve, check and rotate in the first 24 hours after an edge appliance zero-day advisory, before the vendor ships a fix and before the logs rotate away. A guest contribution by Naseem Khan.
Oct 8, 2026
A vendor breach compromises everyone downstream at the same moment, and you usually hear about it from a headline, not your own alerts. The playbook you build before the outage, and the four moves that matter in the first hour.
Sep 20, 2026
Three frameworks, one underlying set of security controls. Where SOC 2, HIPAA, and CMMC overlap, where they genuinely diverge, and how to build your program once and satisfy all three.
Sep 20, 2026
A signed control claim is not proof the control was working the day you were breached. Why point-in-time attestation leaves a gap, and what continuous evidence looks like in a real program.
Sep 20, 2026
ISO 27001 vs SOC 2: one is an international certification, the other a US attestation, and they share a large control core. Here is how to choose, and whether to pursue both.
Jun 21, 2026
A working list of the virtual CISO firms worth a call in 2026, what each one is actually good at, and the evaluation questions that separate a real security program from a monthly report nobody reads.
Aug 31, 2026
SaaS companies hit a security inflection point when an enterprise prospect requires SOC 2 or an investor demands a CISO. This guide covers what a vCISO actually does for a SaaS firm, what it costs, and how to structure the engagement.
May 23, 2026
Biotech firms face state-sponsored IP-theft attacks and FDA cybersecurity expectations on top of HIPAA. This guide covers what a vCISO does for a biotech, what it costs, and the engagement scope.
May 23, 2026
Personal AI agents, AI built into the software you already pay for, and agents your teams wired up themselves are connecting to company systems without a security decision. Anthropic's own disclosure shows why that matters, and here is what to do in 30 days.
Oct 14, 2026
McKinsey research finds the gap between disclosure and active exploitation of critical vulnerabilities has shrunk from about three weeks to a matter of hours. The slowest part of most responses is no longer the technology. It is deciding who can act.
Oct 12, 2026
Enterprise customers added an AI section to the security questionnaire. Here is what ISO 42001, the NIST AI RMF and SOC 2 each deliver, who issues them, what they cost, and which one your buyers will actually accept.
Oct 5, 2026
Leadership · Oct 24, 2026
Leadership · Oct 11, 2026
Leadership · Oct 10, 2026
AI Security · Sep 20, 2026
Threat Intelligence · Sep 10, 2026
Research · Aug 21, 2026
Threat Intelligence · Aug 7, 2026
Threat Intelligence · Aug 7, 2026
One email a week. The cyber developments that change a decision, read by people who make them.
Guest Contributor
By Michael Kantor · Oct 27, 2026
Guest Contributor
By Gleb Tsipursky · Oct 26, 2026
Guest Contributor
By Canio Campaniello · Oct 25, 2026
Sponsored
By Laston Madson · Oct 10, 2026
Guest Contributor
By Naseem Khan · Oct 8, 2026
Cyber Insights publishes independent practitioner guest articles. Have a sharp point of view? Yours could run here.
Pitch usThe platform behind the practice
Radius360 is the security program platform we build on: it turns your signals into decisions with the evidence attached, across 30 frameworks.
Explore Radius360