Tag: compliance
-
Article 12 and the Logging Mandate: What the EU AI Act Actually Requires FireTail Blog
Tags: access, ai, breach, ciso, cloud, compliance, control, data, data-breach, finance, GDPR, grc, healthcare, infrastructure, insurance, jobs, metric, monitoring, regulation, risk, saas, service, toolApr 16, 2026 – Lina Romero – When GDPR arrived, the organisations that had mistaken documentation for capability were the ones that struggled the most. They had policies about data retention but no technical controls enforcing those policies. They had breach notification procedures but no systems capable of detecting a breach in time to use…
-
Beyond the Spreadsheet: Why Manual AI Audits Are an EU AI Act Compliance Liability FireTail Blog
Tags: access, ai, ciso, cloud, compliance, control, data, detection, finance, framework, GDPR, governance, grc, group, incident response, infrastructure, ISO-27001, monitoring, regulation, risk, saas, service, soc, toolApr 16, 2026 – Alan Fagan – When it comes to the EU AI Act, many organisations take a manual approach to auditing, which looks impressive on paper but collapses under regulatory scrutiny. They use policies, surveys, working groups, and a well-formatted risk register. However, a manual approach does not provide the continuous, automated, technical…
-
Beyond the Spreadsheet: Why Manual AI Audits Are an EU AI Act Compliance Liability FireTail Blog
Tags: access, ai, ciso, cloud, compliance, control, data, detection, finance, framework, GDPR, governance, grc, group, incident response, infrastructure, ISO-27001, monitoring, regulation, risk, saas, service, soc, toolApr 16, 2026 – Alan Fagan – When it comes to the EU AI Act, many organisations take a manual approach to auditing, which looks impressive on paper but collapses under regulatory scrutiny. They use policies, surveys, working groups, and a well-formatted risk register. However, a manual approach does not provide the continuous, automated, technical…
-
The need for a board-level definition of cyber resilience
Tags: awareness, business, cisa, compliance, control, crime, cyber, cybercrime, cybersecurity, detection, finance, framework, governance, law, metric, regulation, resilience, risk, risk-analysis, risk-management, service, supply-chain, technologyWhere the literature converges: Organizational outcomes vs. policy and controls It’s consistently agreed that cyber resilience should be tied to organizational outcomes rather than technical controls and policies. Rather than focusing on metrics such as mean time to detection or number of security controls, organizational cyber resilience needs to evaluate levels of business continuity, preservation…
-
Only 16% of Businesses are Fully Compliant with NIS2 Despite 2024 Compliance Deadline
New research from CyberSmart has revealed that, despite a compliance deadline that has now passed, only 16% of businesses required to comply with the EU’s Network and Information Security Directive 2 (NIS2) are confident that they are fully compliant. Worryingly, 11% of respondents were unsure what NIS2 is, despite falling within its scope. The CyberSmart…
-
Claude Mythos: Prepare for your board’s cybersecurity questions about the latest AI model from Anthropic
Tags: ai, api, application-security, attack, authentication, automation, best-practice, business, ceo, cisa, cloud, compliance, container, control, cve, cvss, cyber, cybersecurity, data, data-breach, endpoint, exploit, fedramp, finance, flaw, framework, governance, group, HIPAA, identity, injection, insurance, kev, law, linkedin, linux, LLM, macOS, network, PCI, risk, service, soc, software, strategy, technology, threat, update, vulnerability, vulnerability-management, windows, zero-day, zero-trustWith the Federal Reserve Chairman meeting with bank CEOs to discuss the security implications of Claude Mythos, you can bet that your board of directors will ask you about the impact of the AI model on your cybersecurity strategy. Here’s how to prepare. Key takeaways Anthropic announced Claude Mythos Preview, its most powerful general-purpose frontier…
-
5 trends defining the future of AI-powered cybersecurity
Tags: ai, automation, backup, breach, business, cloud, compliance, cyber, cybersecurity, data, defense, detection, endpoint, framework, government, metric, monitoring, msp, regulation, resilience, threatSee how AI is altering the landscape in the new N-able and Futurum report, Cybersecurity in the Age of AI: Moving from Fragile to Resilient. Get key insights on building a modern framework for business resilience. 2. From perimeter security to continuous cyber resilience: The “castle and moat” approach is obsolete. In a world of…
-
Space Force official touts AI’s impact on cyber compliance
The acting CISO said that AI is reshaping how the service measures and tracks cyber compliance, moving it from a box-checking exercise to something nimbler and more substantive. First seen on cyberscoop.com Jump to article: cyberscoop.com/space-force-ciso-touts-ai-impact-cyber-compliance/
-
How to Choose the Right Cybersecurity Vendor: An Enterprise Buyer’s No-BS Guide (2026)
Most enterprises select cybersecurity vendors using broken signals: checkbox compliance, paid analyst reports, and feature demos. This guide reveals the framework that works – evaluating founder DNA, technical depth, and verified security posture. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/how-to-choose-the-right-cybersecurity-vendor-an-enterprise-buyers-no-bs-guide-2026/
-
“MomentTime” GRC Is Becoming Obsolete
New native ServiceNow application embeds continuous compliance monitoring, risk quantification and remediation workflows directly into enterprise IT and security operations. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/moment-in-time-grc-is-becoming-obsolete/
-
Shopify PCI Compliance: What the Platform Covers and What It Doesn’t
Shopify has become the default choice for ecommerce operations, and for good reason. It simplifies infrastructure, accelerates go-to-market, and comes with a PCI-compliant checkout out… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/shopify-pci-compliance-what-the-platform-covers-and-what-it-doesnt/
-
Avalara baut seine agentenbasierte Compliance weiter aus
Avalara wird seine agentengesteuerten Funktionen auch künftig weiter ausbauen. Im Verlauf des Jahres 2026 sind zusätzliche KI-basierte Features und Plattform-Erweiterungen geplant. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/avalara-baut-seine-agentenbasierte-compliance-weiter-aus/a44604/
-
Google Brings EndEnd Encrypted Gmail to Android and iPhone
Google has officially expanded Gmail’s end-to-end encryption (E2EE) feature to Android and iOS devices, empowering organizations and users to protect the confidentiality of email content directly from their mobile devices. This enhancement is part of Gmail’s client-side encryption (CSE) program, enabling stricter compliance controls and preserving data sovereignty across regulated industries. With this new rollout, Gmail users can…
-
How does Agentic AI ensure compliance in healthcare?
What Role Does Non-Human Identities (NHI) Play in Securing Cloud Environments? Cybersecurity domain is continually evolving, and threats increasingly target gaps left by human oversight. Have you considered how Non-Human Identities (NHI) are becoming pivotal in mitigating these threats, especially within cloud environments? With machine identities become more prominent, their management proves crucial in strengthening……
-
Getarnte Experten: Die systematische IT-Infiltration durch nordkoreanische Akteure
Professionell, erfahren und perfekt getarnt: Eine neue Untersuchung zeigt, wie staatlich gesteuerte Fachkräfte mittels synthetischer Identitäten und KI-Workflows die IT-Infiltration globaler Unternehmen vorantreiben und dabei gezielt Compliance-Lücken ausnutzen. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/systematische-it-infiltration
-
The cyber winners and losers in Trump’s 2027 budget
Tags: cisa, communications, compliance, corporate, cyber, cybersecurity, defense, government, group, infrastructure, international, network, office, risk, service, strategy, threatFigure 1- Top gainers in Trump’s 2027 budget. Compilation from OMB cross-cut tables. CSOSeveral smaller agencies, including the EPA, Department of Education, Tennessee Valley Authority, Federal Mine Safety and Health Review Commission, and the US Army Corps of Engineers, also stand to post modest gains under the 2027 budget. Losers: DHS, VA, and research programs…
-
CMMC compliance in the age of AI
Tags: access, ai, automation, awareness, business, compliance, control, data, detection, email, governance, government, grc, metric, risk, tool, trainingThe primary readiness gap: data scope awareness: Central to preparation is gaining a complete understanding of the data subject to CMMC 2.0 controls. Many organizations are still struggling to define the full scope of systems, workflows and third-party relationships that process or store CUI. When contractors conduct detailed CMMC-focused data inventories, it’s common that they’ll…
-
Compliance-Angebot – Axians veröffentlicht SAP-Add-ons für KRITIS von Energie bis Verteidigung
First seen on security-insider.de Jump to article: www.security-insider.de/axians-24-sap-add-ons-kritis-compliance-a-28df3decdc4630a5629bf012c276aef9/
-
What to Know About CyberAv3ngers: The IRGC-Linked Group Targeting Critical Infrastructure
Tags: access, advisory, ai, attack, authentication, automation, backup, cctv, chatgpt, cisa, communications, compliance, control, credentials, crypto, cve, cyber, cybersecurity, data, data-breach, defense, detection, dns, email, exploit, finance, firewall, flaw, government, group, healthcare, infrastructure, intelligence, international, Internet, iot, iran, kev, leak, linux, malicious, malware, mitigation, mitre, monitoring, network, office, openai, password, radius, resilience, risk, router, service, siem, software, strategy, switch, technology, threat, tool, update, vpn, vulnerability, vulnerability-managementAn Iran-affiliated threat group has evolved from defacing water utility displays to deploying custom ICS malware and exploiting Rockwell Automation PLCs across multiple U.S. critical infrastructure sectors. Key takeaways: CyberAv3ngers is a state-directed threat group operating under Iran’s IRGC Cyber-Electronic Command. The U.S. Treasury sanctioned six named officials in February 2024 and the State Department…
-
Cloudflare ‘actively adjusting’ quantum priorities in wake of Google warning
Tags: android, attack, awareness, browser, chrome, ciso, communications, compliance, computer, computing, crypto, cryptography, cybersecurity, data, encryption, google, government, group, Hardware, infrastructure, Internet, ml, mobile, regulation, risk, service, strategy, technology, threat, vulnerabilityNational Institute of Standards and Technology (NIST) has set a 2030 deadline for depreciating legacy encryption algorithms ahead of their planned retirement in 2035.Late last month Google brought forward its own post-quantum cryptography (PQC) deadline a year to 2029 because advances in quantum computers mean that legacy encryption and digital signature systems are at greater…
-
CMMC Non-Compliance: Violations of FCA
Key Takeaways For many defense contractors, CMMC treated as a security project. It is discussed in terms of controls, readiness work, outside assessors, documentation, and the cost of getting prepared. Of course, all of that is important. But beyond that, CMMC also affects what a contractor is saying about itself when it pursues, performs, and……
-
Weak at the seams
Tags: advisory, ai, attack, automation, business, cloud, compliance, control, crowdstrike, cybersecurity, data, data-breach, endpoint, exploit, finance, firewall, framework, healthcare, infrastructure, insurance, Internet, network, resilience, risk, service, supply-chain, technology, tool, update, vulnerability, windows, zero-dayThe normal choices are the dangerous ones: Consider the stack a typical large enterprise was running in 2024: One vendor for ERP and supply chain, another for perimeter enforcement, another for networking and another for endpoint protection. Standard choices, responsibly made. Within a twelve-month window, each of those categories experienced significant disruptions, from zero-day exploits…
-
Weak at the seams
Tags: advisory, ai, attack, automation, business, cloud, compliance, control, crowdstrike, cybersecurity, data, data-breach, endpoint, exploit, finance, firewall, framework, healthcare, infrastructure, insurance, Internet, network, resilience, risk, service, supply-chain, technology, tool, update, vulnerability, windows, zero-dayThe normal choices are the dangerous ones: Consider the stack a typical large enterprise was running in 2024: One vendor for ERP and supply chain, another for perimeter enforcement, another for networking and another for endpoint protection. Standard choices, responsibly made. Within a twelve-month window, each of those categories experienced significant disruptions, from zero-day exploits…
-
MIWIC26: Funke Omolere, Senior Technology Compliance Product Owner at Adobe
Organised by Eskenzi PR in media partnership with the IT Security Guru, the Most Inspiring Women in Cyber Awards aim to shed light on the remarkable women in our industry. The following is a feature on one of 2026’s Top 20 women selected by an esteemed panel of judges. Presented in a Q&A format, the nominee’s answers are…
-
Questions raised about how LinkedIn uses the petabytes of data it collects
CSOonline. “We do disclose that we scan for browser extensions in our privacy policy, in order to detect abuse and provide defense for site stability.” When asked whether it uses that data solely to do those things, LinkedIn did not reply. The key person behind the allegations calls himself Steven Morrell (not his legal name, which…
-
The 2026 Digital Omnibus
For the better part of a decade, doing business under EU digital law has been challenging, with DDPR, ePrivacy updates, the NUS2 Directive, the AI and Data Acts, and others coming in rapid succession. For organizations already investing heavily in compliance frameworks like CMMC, the prospect of layering on yet another set of requirements has”¦…
-
Feds Are Still Assessing Proposed HIPAA Security Rule Update
HHS OCR Director Says Cost of Inaction May Outweigh Compliance Burdens. The Trump administration has yet to decide whether to continue a proposed overhaul of the HIPAA Security Rule floated by its predecessor administration. But the nation’s top federal enforcer of health regulation provided some insight into what regulators are thinking. First seen on govinfosecurity.com…
-
AI Security Risks: How Enterprises Manage LLM, Shadow AI and Agentic Threats FireTail Blog
Tags: access, ai, api, attack, breach, business, ciso, cloud, compliance, conference, control, cybersecurity, data, data-breach, detection, email, endpoint, exploit, finance, framework, gartner, GDPR, governance, guide, infrastructure, injection, LLM, malicious, microsoft, monitoring, network, nvidia, office, regulation, risk, saas, software, threat, tool, training, vulnerabilityApr 08, 2026 – – Quick Facts: Enterprise AI Security Most enterprises are running AI at scale before their security teams have visibility into it. Shadow AI (unsanctioned AI tools spreading department by department) is now the most common entry point for data leakage. Agentic AI introduces a new category of risk: autonomous systems that…
-
US warns of Iran-affiliated cyber-attacks on critical infrastructure across country
Tags: attack, breach, compliance, country, cyber, cyberattack, government, infrastructure, iran, middle-east, resilience, threat, updateSecurity agencies say municipalities should watch out for unusual activity, especially in water and energy sectors<ul><li><a href=”https://www.theguardian.com/world/live/2026/apr/07/iran-war-live-updates-trump-hormuz-threats-deadline-strikes-middle-east-conflict”>Middle East crisis live updates</li></ul>Top government security agencies issued a warning of Iran-affiliated cyber-attacks on critical infrastructure across the US on Tuesday. In a <a href=”https://www.ic3.gov/CSA/2026/260407.pdf”>joint statement, the agencies said municipalities, especially in the water and energy sectors, should…
-
US warns of Iran-affiliated cyberattacks on critical infrastructure across country
Tags: breach, compliance, country, cyberattack, government, infrastructure, iran, middle-east, resilience, threat, updateSecurity agencies say municipalities should watch out for unusual activity, especially in water and energy sectors<ul><li><a href=”https://www.theguardian.com/world/live/2026/apr/07/iran-war-live-updates-trump-hormuz-threats-deadline-strikes-middle-east-conflict”>Middle East crisis live updates</li></ul>Top government security agencies issued a warning of Iran-affiliated cyberattacks on critical infrastructure across the US on Tuesday. In a <a href=”https://www.ic3.gov/CSA/2026/260407.pdf”>joint statement, the agencies say that municipalities, especially in the water and energy sectors,…