Insights
Insights
Practical writing on the work we do — compliance, risk, detection, and the decisions behind them.
October 30, 2026
Segment building systems before the camera becomes the pivot point
The Dahua warning is a prompt to find every building system on your network, put it on a separate VLAN, and put it on the asset register before someone else finds the admin password.
- camera security
- network segmentation
- asset inventory
- firmware hygiene
- building systems
- vlan design
October 29, 2026
Austria's NISG 2026 Is Live: Registration Bites First, Supply Chain Bites Hardest
Austria's NISG 2026 came into force on 1 October for around 4,000 organisations. Registration hits first, but leadership liability and supply-chain duties are already live — and Hungary and Croatia show what waiting looks like.
- nisg-2026
- nis2
- austria
- supply-chain-security
- cybersecurity
October 26, 2026
Does your payment approval process survive a live video call?
Deepfake fraud is now a live-channel problem for finance teams. The fix is a rehearsed, out-of-band verification step on every payment change and urgent transfer, installed before the call arrives.
- deepfake fraud
- payment fraud
- cyber awareness
- out-of-band verification
- executive impersonation
- social engineering
October 25, 2026
Tool calls can all succeed while the business rules fail silently
Before an agent gets a credential, write down the policy it must obey and test a case that should be refused.
- ai governance
- agentic ai
- policy enforcement
- board-level risk
October 20, 2026
The EBA just made internal control vendors critical by default
EBA's final third-party risk guidelines quietly reclassify suppliers that support compliance, risk and audit as critical by default. The first task is not another questionnaire push — it is rebuilding the vendor map so the board sees exposure that was previously filed as routine.
- third-party risk
- eba guidelines
- vendor management
- board reporting
- dora
- supplier assurance
October 18, 2026
Continuity thresholds are becoming the new board-level cyber metric
European banking regulators now judge institutions by whether critical services survive an attack, rather than by whether the intrusion was stopped. Here’s how to turn continuity targets into board-level evidence.
- operational resilience
- dora
- board governance
- business continuity
- third-party risk
- cybersecurity
October 16, 2026
The CRA's 24-hour reporting window is a data integration problem
The Cyber Resilience Act's 24-hour reporting clock only becomes manageable when triage thresholds and data sources are written down before the alert arrives. The post covers the first specification to draft, the systems that must connect, and the supplier question to ask.
- cyber resilience act
- vulnerability management
- sbom
- vulnerability triage
- compliance
- framework mapping
October 14, 2026
Ransomware victims choose recovery partners at the exact moment they cannot judge one
A retainer moves the most expensive procurement decision to a day when you can still ask questions and expect answers.
- ransomware
- incident response
- third-party risk
- procurement
- recovery scams
October 9, 2026
When ChatGPT writes the strategy, directors carry the judgment
The Lanmar court case changes the burden on directors who use AI for board-level decisions. Here is how a mid-sized organisation can make human review a named, recorded step.
- ai governance
- board accountability
- directors duties
- corporate governance
- ai risk management
October 8, 2026
A familiar voice over the phone is no longer a payment control
The Fideuram transfer shows that a familiar voice can no longer satisfy a payment instruction once synthetic voice is cheap. The durable fix is a pre-agreed second channel, independent of any message, that no single call can bypass.
- deepfake fraud
- payment approval
- out-of-band verification
- synthetic voice
- cyber awareness
- finance controls
October 7, 2026
General counsel are inheriting cyber ownership before boards name a single owner
A named security owner becomes the missing link once legal carries accountability, because someone has to turn contract and regulatory obligations into controls the board can verify.
- cyber governance
- general counsel
- security ownership
- virtual ciso
- board reporting
- incident planning
October 6, 2026
Supplier questionnaires cannot see the stale key that exposes your systems
Attackers are using stolen supplier logins to reach customer systems. The controls that matter—MFA on the connecting account, prompt offboarding, least privilege—can be verified before the next renewal.
- third-party risk
- supply chain security
- credential management
- vendor due diligence
- mfa
- offboarding
October 2, 2026
Seller impersonation succeeds on infrastructure your internal controls never touch
What the rise in seller impersonation means for finance and property leaders reviewing fraud controls this quarter, and where to look before closing instructions arrive. The ALTA study shows attempts doubled; the attack surface is now the domains, profiles and documents that make an impersonator credible.
- seller impersonation
- business email compromise
- digital risk protection
- external attack surface
- fraud prevention
- third-party risk
October 1, 2026
The EDPB has just published the five questions behind every GDPR fine
A consultation gives security leaders a five-step method they can use now to test whether their GDPR fine exposure would hold up before an incident, instead of waiting for a breach.
- gdpr
- data protection
- governance
- regulatory enforcement
- third-party risk
- cybersecurity advisory
September 30, 2026
NIS2 makes your security evidence a condition of the customer's contract
A customer's supplier questionnaire is the first sign NIS2 has reached a mid-sized organisation; suppliers that prepare evidence before the request arrives close faster and get fewer follow-up reviews.
- nis2
- third-party risk
- supply chain security
- supplier assurance
- procurement
September 29, 2026
Before money moves, the challenge script is the control
Deepfake fraud has moved past detection. The control that matters is a scripted verification step before payments and data requests, rehearsed by finance and HR under realistic pressure.
- deepfake fraud
- payment fraud
- cyber awareness
- verification controls
- social engineering
September 28, 2026
Austria's NISG 2026 goes live on 1 October — the managing director's deadlines land first
What is live on 1 October, which deadlines hit directors before IT, and the checks to run before registration closes on 31 December.
- nis2
- nisg-2026
- austria
- cybersecurity-compliance
- management-liability
- bcs
September 28, 2026
Awareness programmes should measure whether staff verify the unexpected request
Microsoft's takedown of an AI-enabled cybercrime platform is a narrow news item with a broad training consequence: if attackers can turn stolen access into fraud with less human effort, awareness programmes should test second-channel verification of unexpected requests rather than flaw-spotting alone.
- cyber awareness
- phishing simulation
- ai cybercrime
- business email compromise
- security training
September 24, 2026
The synthesised CEO call is already the cheapest way past your approvals
The survey puts AI voice copying in an infringement report. The more urgent exposure is the payment instruction that rides on it, and the one check that stops it.
- synthetic voice fraud
- executive impersonation
- digital risk protection
- payment fraud
- social engineering
- ai voice cloning
September 6, 2026
Your January Cybersecurity Checklist
A practical, high-impact guide to starting the year with a clean security baseline.
- cyber-checklist
- audit
- patch
September 6, 2026
Why Does Human Risk Spike at the Start of the Year?
Across industries and company sizes, we see the same pattern repeat every year: human-driven security incidents increase in January.
- phishing
- awareness
- humanrisk
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.