Deepfakes·
Deepfake CEO fraud: a familiar voice proves nothing.
Deepfake CEO fraud now runs on cloned voices. Recognising your boss is no longer a check. Three checks still work, and the chief executive owns them.
Business Email Compromise·
Business email compromise needs no malware. The loss is yours by law.
Business email compromise needs no malware, so your security tools miss it, and EU payment law leaves the loss with you. Five rules stop it.
Supply Chain Attack·
Supply chain attacks in 2026: the supplier you never chose
Two of the three supply-chain routes into an SMB in 2026 sit largely beyond what a vendor questionnaire can settle. Here is what to do about them.
Risk Management·
How Much Should an SMB Spend on Cybersecurity? Every Benchmark Answers in Percentages. You Need a Number.
Security benchmarks say 9–11% of IT budget, but enterprise percentages mislead SMBs. What a 50, 150 or 500-person company should budget, in euros.
Virtual CISO·
The Brain, the Hands, and the Specialist: A Buyer's Guide to vCISO vs. MSSP vs. Consultant
SMBs under €50M are really choosing between three things: a leader, an operator, and a specialist. How to tell a vCISO, an MSSP and a consultant apart.
NIS2·
NIS2 and the CRA: two clocks on one factory
NIS2 regulates the plant you run. The CRA regulates what leaves it. Two 24-hour clocks, two different triggers — and in most factories, no owner.
ISO 42001·
ISO 42001: your buyers will ask before the regulator does
Buyers are writing AI governance into vendor questionnaires, and ISO 42001 is the established certifiable answer. What it costs an SMB — and why 2026 is early.
Cyber Resilience Act·
CRA reporting is live. You may be the manufacturer.
CRA reporting went live on 11 September 2026: 24 hours to report an exploited vulnerability in something you sold. Manufacturer is a role, not an industry.
Incident Response·
One Incident, Three Regulators: Why Your Real Deadline Is Four Hours, Not 72
Everyone learned 72 hours from GDPR. DORA's first filing is due in four hours and NIS2's early warning at 24. One incident, three clocks, three start times.
AI Act·
On 2 August, Your Chatbot Must Say It's a Bot. The AI Deadline the Omnibus Didn't Move.
Everyone heard the AI Act was delayed sixteen months. Article 50 wasn't. From 2 August 2026, your chatbot must say it's a bot — fines up to €15M or 3%.
Virtual CISO·
What a vCISO Actually Does in Month 1, Month 3, and Month 12 — A Timeline Your Board Can Hold Us To
What a virtual CISO actually delivers in month 1, month 3, and month 12 — a concrete milestone timeline SMB and mid-market boards can hold any provider to.
Virtual CISO·
10 Questions to Ask Before You Hire a vCISO — And the Answers That Should End the Meeting
Ten questions that separate a real vCISO from a templated invoice — and the red-flag answers to listen for. A vendor-neutral buyer's guide for SMB and mid-market boards.
AI Act·
AI Omnibus: The 16-Month AI Act Reprieve, and Why Your Real Deadline Just Got Closer
The AI Omnibus is law. It moved the high-risk deadline to December 2027 — and created a new one on 2 December 2026, in the €35M/7% penalty band.
DORA·
You're Not a Bank. DORA Still Applies. And the First Inspections Have Started.
DORA has been fully applicable since 17 January 2025. Most non-banks read that as someone else's problem. In 2026, that misread becomes a supervisory problem.
NIS2·
NIS2 Enforcement Has Started: 8 Questions Your Board Must Answer in the First 30 Days
NIS2 is now enforced across most of the EU. Article 20 puts directors personally on the hook. Eight questions every board must answer in 30 days.
Training & Awareness·
The Human Firewall: How to Turn Your Employees from Your Weakest Link into Your First Line of Defense
Over 90% of breaches start with human error. Treat employees as a security control to invest in, not a problem to mitigate — here is how.
GDPR·
Paper compliance is not security. It isn't compliance either.
GDPR, NIS2, PCI DSS and ISO 27001 now ask whether your controls work. After a breach, a control that exists only on paper fails both tests.
Cyber Insurance·
Cyber Insurance Isn't Enough: What Insurers Won't Tell You About Coverage Gaps
A cyber policy pays on what you declared, not on what you think you bought. What it pays, what it never will, France's 72-hour rule and a 30-minute check.