When Attackers Are Faster Than the Patch
Between disclosure and exploitation of a vulnerability, only days often pass today. The State of Vulnerabilities Report 2026 reveals what matters now.
Section
Strategy & Governance
All articles
205 articles
Part-Time CISO: What Can Be Outsourced and What Must Stay In-House
A virtual CISO takes over the security expertise in medium-sized businesses. However, certain responsibilities under Paragraph 38 of the BSIG (Federal…
Which CISO Decision Rights Must Be Set Out in Writing
CISO Mandate 2026: Which decision-making, veto, and escalation rights must be documented in writing so that it's clear who can act during an incident.
Supply Chain Risk Is a Program, Not an Audit Checklist
Supply chain risks according to NIS2 and DORA: Why the vendor questionnaire isn't enough and how a TPRM program with tiering, a register, and …
KRITIS-Dachgesetz: When Resilience Becomes a CISO’s Mandatory Duty
The KRITIS umbrella law has been in effect since March 2026 and makes physical resilience mandatory.
Zombie Accounts: The IAM Blind Spot in Offboarding
Service accounts can survive disabled services for years. This is why OWASP considers it the number one NHI risk and how CISOs can identify …
Why an ISO Certificate Alone Is Not Enough for the BSI
ISO 27001 is often considered proof of compliance with NIS2. However, the BSI takes a different view.
QuiltWorks: CrowdStrike and AWS Against AI-Driven Cloud Attacks
Cloud security: CrowdStrike expands Project QuiltWorks with AWS. What the alliance against AI-driven attacks accomplishes and what teams must do…
SearchLeak: How a Link Turned Microsoft 365 Copilot into a Data Leak
SearchLeak turned Microsoft 365 Copilot into a data leak via a link. What parameter injection teaches about Copilot governance and AI security.
NIS2 after the deadline: Now the BSI supervision begins
The NIS2 oversight has begun: the BSI registration deadline has passed, and the authority is now reviewing and imposing sanctions.
Older entries
Load older articles
articles: 205
