Insights
Insights
Practical writing on the work we do — compliance, risk, detection, and the decisions behind them.
October 18, 2026
Continuity thresholds are becoming the new board-level cyber metric
European banking regulators now judge institutions by whether critical services survive an attack, rather than by whether the intrusion was stopped. Here’s how to turn continuity targets into board-level evidence.
- operational resilience
- dora
- board governance
- business continuity
- third-party risk
- cybersecurity
October 16, 2026
The CRA's 24-hour reporting window is a data integration problem
The Cyber Resilience Act's 24-hour reporting clock only becomes manageable when triage thresholds and data sources are written down before the alert arrives. The post covers the first specification to draft, the systems that must connect, and the supplier question to ask.
- cyber resilience act
- vulnerability management
- sbom
- vulnerability triage
- compliance
- framework mapping
October 14, 2026
Ransomware victims choose recovery partners at the exact moment they cannot judge one
A retainer moves the most expensive procurement decision to a day when you can still ask questions and expect answers.
- ransomware
- incident response
- third-party risk
- procurement
- recovery scams
October 9, 2026
When ChatGPT writes the strategy, directors carry the judgment
The Lanmar court case changes the burden on directors who use AI for board-level decisions. Here is how a mid-sized organisation can make human review a named, recorded step.
- ai governance
- board accountability
- directors duties
- corporate governance
- ai risk management
October 8, 2026
A familiar voice over the phone is no longer a payment control
The Fideuram transfer shows that a familiar voice can no longer satisfy a payment instruction once synthetic voice is cheap. The durable fix is a pre-agreed second channel, independent of any message, that no single call can bypass.
- deepfake fraud
- payment approval
- out-of-band verification
- synthetic voice
- cyber awareness
- finance controls
October 7, 2026
General counsel are inheriting cyber ownership before boards name a single owner
A named security owner becomes the missing link once legal carries accountability, because someone has to turn contract and regulatory obligations into controls the board can verify.
- cyber governance
- general counsel
- security ownership
- virtual ciso
- board reporting
- incident planning
October 6, 2026
Supplier questionnaires cannot see the stale key that exposes your systems
Attackers are using stolen supplier logins to reach customer systems. The controls that matter—MFA on the connecting account, prompt offboarding, least privilege—can be verified before the next renewal.
- third-party risk
- supply chain security
- credential management
- vendor due diligence
- mfa
- offboarding
October 2, 2026
Seller impersonation succeeds on infrastructure your internal controls never touch
What the rise in seller impersonation means for finance and property leaders reviewing fraud controls this quarter, and where to look before closing instructions arrive. The ALTA study shows attempts doubled; the attack surface is now the domains, profiles and documents that make an impersonator credible.
- seller impersonation
- business email compromise
- digital risk protection
- external attack surface
- fraud prevention
- third-party risk
October 1, 2026
The EDPB has just published the five questions behind every GDPR fine
A consultation gives security leaders a five-step method they can use now to test whether their GDPR fine exposure would hold up before an incident, instead of waiting for a breach.
- gdpr
- data protection
- governance
- regulatory enforcement
- third-party risk
- cybersecurity advisory
September 30, 2026
NIS2 makes your security evidence a condition of the customer's contract
A customer's supplier questionnaire is the first sign NIS2 has reached a mid-sized organisation; suppliers that prepare evidence before the request arrives close faster and get fewer follow-up reviews.
- nis2
- third-party risk
- supply chain security
- supplier assurance
- procurement
September 29, 2026
Before money moves, the challenge script is the control
Deepfake fraud has moved past detection. The control that matters is a scripted verification step before payments and data requests, rehearsed by finance and HR under realistic pressure.
- deepfake fraud
- payment fraud
- cyber awareness
- verification controls
- social engineering
September 28, 2026
Austria's NISG 2026 goes live on 1 October — the managing director's deadlines land first
What is live on 1 October, which deadlines hit directors before IT, and the checks to run before registration closes on 31 December.
- nis2
- nisg-2026
- austria
- cybersecurity-compliance
- management-liability
- bcs
September 28, 2026
Awareness programmes should measure whether staff verify the unexpected request
Microsoft's takedown of an AI-enabled cybercrime platform is a narrow news item with a broad training consequence: if attackers can turn stolen access into fraud with less human effort, awareness programmes should test second-channel verification of unexpected requests rather than flaw-spotting alone.
- cyber awareness
- phishing simulation
- ai cybercrime
- business email compromise
- security training
September 24, 2026
The synthesised CEO call is already the cheapest way past your approvals
The survey puts AI voice copying in an infringement report. The more urgent exposure is the payment instruction that rides on it, and the one check that stops it.
- synthetic voice fraud
- executive impersonation
- digital risk protection
- payment fraud
- social engineering
- ai voice cloning
September 6, 2026
Your January Cybersecurity Checklist
A practical, high-impact guide to starting the year with a clean security baseline.
- cyber-checklist
- audit
- patch
September 6, 2026
Why Does Human Risk Spike at the Start of the Year?
Across industries and company sizes, we see the same pattern repeat every year: human-driven security incidents increase in January.
- phishing
- awareness
- humanrisk
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.