Analysis library
Clear analysis for consequential cybersecurity decisions.
Browse independent analysis of cybersecurity architecture, business risk, resilience, AI, and emerging technology.
-
Your Security Plan Should Be an Operating Contract, Not an Audit Artifact
NIST’s updated system-planning guidance gives leaders an opportunity to connect security, privacy, and supply-chain decisions to business ownership, evidence, and…
-
Weekly Cybersecurity Report: OT Exposure, RMM Exploitation, and AI Agent Risk
Water-sector intrusions expanded, N-central required a superseding hotfix, and new research exposed consequential weaknesses in enterprise AI agents and connected…
-
Weekly Cybersecurity Report: PLM Extortion, Agentic Defense, and AI Security
A leadership brief on healthcare-data exposure, active Windchill exploitation, agentic cyber defense, and the emerging AI-security ecosystem.
-
Securing AI Agents: Moving From One-Time Approval to Continuous Assurance
Why this matters now Organizations are beginning to use AI agents for activities that extend beyond generating or summarizing information.…
-
Modernizing Enterprise Security Architecture Beyond Framework Compliance
A practical model for connecting business outcomes, risk decisions, security capabilities, architecture patterns, controls, evidence, and measurable improvement.
-
Autonomous AI as a Cyber Threat: What Leaders Should Prepare For
Agentic AI can plan, use tools, and adapt across multiple steps. Leaders should constrain identity, authority, data, execution, telemetry, and…
-
Short-Lived TLS Certificates: Preparing for the 47-Day Lifecycle
Publicly trusted TLS certificates are moving to a 47-day maximum by 2029. Prepare with end-to-end discovery, issuance, deployment, validation, and…
-
API Security Is Business Security: Architecture Priorities for Modern Enterprises
Modern API security depends on inventory, fine-grained authorization, abuse-resistant business flows, safe third-party consumption, and end-to-end transaction visibility.
-
Critical Infrastructure Cyber Resilience: Architecture Priorities for Leaders
Critical infrastructure security should preserve essential functions through consequence-driven architecture, controlled access, segmentation, trusted recovery, and realistic exercises.
-
Building a Hybrid Security Operating Model with External Services
External providers can extend security capability, but accountability remains internal. Design explicit outcomes, decision rights, access boundaries, telemetry, and exit…
-
Secure Decommissioning of Wi-Fi and Network Devices
Secure device retirement removes trust as well as data: revoke identities and credentials, sanitize storage, remove management associations, and verify…
-
CVSS 4.0: Using Severity Without Losing Business Context
CVSS 4.0 improves severity communication, but prioritization still requires threat evidence, exposure, asset criticality, business impact, and remediation context.