Financial Services Archives

Non-Human Identity Governance Reduces Breach Damage in Zero Trust

Authentication Gets You In. Governance Determines the Damage.

by Patrick Spencer June 1, 2026June 1, 2026 | Cybersecurity Risk Management

Seventy-one percent. That’s the share of enterprises that experienced an identity-related breach in 2025 according to new Sophos research. More than two-thirds of organizations had their identity systems compromised in...

Cyber Resilience Strategies for Benelux Banking

Cyber Resilience in Benelux Banking: Navigating Regulatory Demands and Evolving Threats

by Marc ten Eikelder May 30, 2026May 30, 2026 | Regulatory Compliance

Benelux banking institutions face an evolving cyber threat landscape while managing stringent regulatory requirements across Belgium, the Netherlands, and Luxembourg. Financial services leaders need comprehensive strategies that address both immediate...

PraisonAI Lesson: Why AI Agents Ship Insecure by Default

When AI Agents Ship Insecure by Default: The PraisonAI Lesson Every CISO Needs to Read

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

On May 11, 2026, at 13:56 UTC, GitHub published advisory GHSA-6rmh-7xcm-cpxj for CVE-2026-44338, an authentication-bypass flaw in PraisonAI. At 17:40 UTC — three hours, 44 minutes, and 39 seconds later...

AI Adoption Outpaces Governance and Policy Controls

The AI Policy Gap: When 90% Use AI and 25% Have No Rules

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

ISACA’s 2026 AI Pulse Poll surveyed 3,400 digital trust professionals across IT audit, governance, cybersecurity, privacy, and emerging technology roles. Three numbers tell a story most security leaders already know...

Indirect Prompt Injection Attacks Now in Production

Indirect Prompt Injection Goes Live: Why Guardrails Won’t Save You

by Patrick Spencer May 26, 2026May 27, 2026 | Cybersecurity Risk Management

Researchers from Google and Forcepoint have documented indirect prompt injection attacks executing against production AI systems. Attackers embed hidden instructions in web pages, documents, and emails. AI agents that browse,...

Federal Preemption Reshapes U.S. Data Privacy

Federal Privacy Preemption Just Got Real: What the SECURE Act Means

by Danielle Barbour May 26, 2026May 27, 2026 | Regulatory Compliance

For seven years, U.S. data privacy has run on two parallel tracks. State legislatures enacted comprehensive privacy laws — California first in 2018, then 20 others — while Congress repeatedly...

ICO Guidance: AI Threats Meet Article 32

The ICO Just Made AI Security a UK GDPR Article 32 Duty

by Marc ten Eikelder May 25, 2026May 25, 2026 | GDPR Compliance

5 Key Takeaways 1. AI security is now a data protection duty. The ICO’s new guidance frames AI-powered threats as a present-day obligation under UK GDPR Article 32, not a...

Beyond SCCs: Enforcing Real Data Controls

€100 Million Says Your SCCs Aren’t Enough for Data Sovereignty

by Marc ten Eikelder May 25, 2026May 25, 2026 | GDPR Compliance

Key Takeaways Contracts didn’t save the controller. The Dutch Data Protection Authority fined a taxi platform €100 million for transferring EU personal data to Russia — even though the company...

The IMF Just Made AI Cyber Risk a Financial Stability Issue. Most Banks Are Not Ready

by Patrick Spencer May 25, 2026May 25, 2026 | Cybersecurity Risk Management

5 Key Takeaways The IMF reframed AI cyber risk as macro-financial risk. On May 7, 2026, the International Monetary Fund warned that AI-powered cyberattacks could trigger funding strains, raise solvency...

Developing DORA-Compliant Exit Strategies for Banks

DORA Article 28 Requirements: Why UK Banks Need Documented Exit Strategies for ICT Third-Party Services

by Danielle Barbour May 24, 2026May 24, 2026 | Third Party Risk

Financial institutions across the UK face mounting pressure to demonstrate comprehensive control over their ICT third-party relationships. DORA Article 28 establishes specific requirements for documented exit strategies that enable banks...

DORA Resilience Requirements for UK Financial Firms

How UK Financial Services Firms Comply with DORA Requirements in 2026

by Danielle Barbour May 22, 2026May 22, 2026 | Regulatory Compliance

The Digital Operational Resilience Act (DORA) is an EU regulation that establishes comprehensive operational resilience requirements for financial entities operating within EU markets. UK-based firms are subject to DORA where...

Zero Trust Data Protection for UK Insurers

How UK Insurers Secure Customer Data Across Digital Channels

by Tim Freestone May 21, 2026May 21, 2026 | Cybersecurity Risk Management

UK insurers manage vast volumes of sensitive customer data across email, file sharing, APIs, and mobile applications, creating complex security challenges that traditional perimeter defences cannot address. As digital transformation...

Financial Services: AI Governance's First Real Test

Financial Services Just Became the Test Case for Whether AI Governance Is Real

by Patrick Spencer May 20, 2026May 20, 2026 | Cybersecurity Risk Management

Key Takeaways High Breach Costs in Finance. The average cost of a financial-sector data breach reached $5.56 million per incident in 2025, second-highest among industries. Financial Motives Dominate Incidents. Roughly...

AI Governance in 2026: Why Boards That Wait Will Inherit an Ungovernable Mess

by Patrick Spencer May 20, 2026May 20, 2026 | Cybersecurity Risk Management

Key Takeaways Board Priority Gap. 54% of boards have not placed AI governance in their top five priorities, yet board engagement is the strongest predictor of governance maturity. Regulatory Deadline...

Device Code Phishing: AI's Silent M365 Breach

M365 Device Code Phishing: The AI-Assisted Kill Chain Compromising Hundreds of Organizations Daily

by Uri Kedem May 20, 2026May 20, 2026 | Secure Email

Key Takeaways Daily Mass Compromises. Hundreds of M365 tenants are breached daily through an automated, AI-driven phishing campaign abusing device code authentication. Legitimate Flow Exploitation. Attackers weaponize Microsoft’s device code...

Get started.