Supply Chain Attack·
Supply chain attacks in 2026: the supplier you never chose
Two of the three supply-chain routes into an SMB in 2026 sit largely beyond what a vendor questionnaire can settle. Here is what to do about them.
Risk Management·
How Much Should an SMB Spend on Cybersecurity? Every Benchmark Answers in Percentages. You Need a Number.
Security benchmarks say 9–11% of IT budget, but enterprise percentages mislead SMBs. What a 50, 150 or 500-person company should budget, in euros.
Virtual CISO·
The Brain, the Hands, and the Specialist: A Buyer's Guide to vCISO vs. MSSP vs. Consultant
SMBs under €50M are really choosing between three things: a leader, an operator, and a specialist. How to tell a vCISO, an MSSP and a consultant apart.
NIS2·
NIS2 and the CRA: two clocks on one factory
NIS2 regulates the plant you run. The CRA regulates what leaves it. Two 24-hour clocks, two different triggers — and in most factories, no owner.
ISO 27001·
One ISMS, three regulators: the same nine documents
NIS2, DORA and your ISO auditor ask for the same nine documents — and reject them for three different reasons. Here is the pack, mapped.
Vendor Risk Management·
You've Spent Years Answering Security Questionnaires. Here's the One You Should Be Sending.
A 12-question vendor security questionnaire for SMBs — the red-flag answers and a one-page scoring rule, mapped to NIS2 Article 21(2)(d).
Incident Response·
One Incident, Three Regulators: Why Your Real Deadline Is Four Hours, Not 72
Everyone learned 72 hours from GDPR. DORA's first filing is due in four hours and NIS2's early warning at 24. One incident, three clocks, three start times.
Incident Response·
Incident Response Without a SOC: The 5-Step Playbook a 50-Person Company Can Actually Run
A practical 5-step incident response playbook for SMEs without a SOC — prepare, detect, contain, recover, report. Mapped to NIST 800-61r3, NIS2 and CRA clocks.
NIS2·
NIS2 vs DORA vs ISO 27001: which ones apply to you
NIS2, DORA and ISO 27001 are not rival options: two are law, one is a standard. Who each one binds, where they overlap, and which one wins.
NIS2·
NIS2 Enforcement Has Started: 8 Questions Your Board Must Answer in the First 30 Days
NIS2 is now enforced across most of the EU. Article 20 puts directors personally on the hook. Eight questions every board must answer in 30 days.
GDPR·
Paper compliance is not security. It isn't compliance either.
GDPR, NIS2, PCI DSS and ISO 27001 now ask whether your controls work. After a breach, a control that exists only on paper fails both tests.