Webinar: Text, Voice, Video: A Field Guide to Generative AI Social Engineering
The post Webinar: Text, Voice, Video: A Field Guide to Generative AI Social Engineering appeared first on Fable Security.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
3,566 matching stories — in GRC & Compliance Automation — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
US Agencies Detail Incident Response Practices for Rogue AI Agents
NIST, CISA and NSA share ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI agent incidents. The post US Agencies Detail Incident Response Practices for Rogue AI Agents appeared first on SecurityWeek.
AI in GRC: Friend or Foe?
Originally published in Business Reporter Every executive leadership team is asking themselves the same question about artificial intelligence right now: is this a tool that makes us better, or a risk we haven’t fully priced in? In governance, risk, and compliance (GRC), that question directly impacts commercial performance. Get the answer wrong and a company... The post AI in GRC: Friend or Foe? appeared first on Hyperproof.
CISA, NSA, NIST urge safeguards, continuous monitoring, incident reporting for autonomous super intelligence systems
Three federal agencies, the National Institute of Standards and Technology, the National Security Agency and the Cybersecurity and... The post CISA, NSA, NIST urge safeguards, continuous monitoring, incident reporting for autonomous super intelligence systems appeared first on Industrial Cyber.
Frost & Sullivan Names CyberSaint 2026 Global Competitive Strategy Leader in Cyber Risk Management
BOSTON, October 20, 2026.CyberSaint, delivering theCyber Risk Intelligence Platform for large enterprises, has receivedFrost & Sullivan's 2026 Global Cyber Risk Management Competitive Strategy Leadership Recognition. Frost & Sullivan analysts spent 12 months evaluating cybersecurity risk and compliance vendors against ten criteria across strategy innovation and customer impact before selecting a winner for the award.
AIUC-1: Turn Agentic AI Risk into Market Trust
Businesses across industries and geographies are racing to develop, deploy, and use AI. Winning responsibly means embedding compliance early, before regulators and clients demand it. Awareness of AI risk is high: 4 out of 5 companies that use AI are getting questions from customers about risk, and for good reason. Data breaches are expensive, but […] The post AIUC-1: Turn Agentic AI Risk into Market Trust appeared first on A-LIGN.
IBM security advisory (AV26-1064)
Anti-Bribery Due Diligence on Agents: What Clients Expect
If you win oil and gas work in Latin America or the Middle East through a local agent, your energy clients will hold you responsible for how that agent behaves. Large energy companies write anti-bribery requirements into their supplier terms, and those requirements extend to the agents and partners you appoint.
5 FedRAMP 20x Audit Wins with Continuum GRC Assessments
FedRAMP 20x is reshaping cloud compliance by moving cybersecurity audits away from static binders and toward automated evidence, NIST 800-53 alignment, continuous monitoring, and assessment-ready cloud telemetry. For cloud service providers, the audit win is not simply “passing FedRAMP”; it is building a repeatable evidence engine that can support federal buyers, agency security teams, and […] The post 5 FedRAMP 20x Audit Wins with Continuum GRC Assessments appeared first on Continuum GRC.
Certificate of Insurance Tracking: Catch Lapses Early
The standard ACORD 25 certificate that most US subcontractors send you states that it is “issued as a matter of information only and confers no rights upon the certificate holder.” The certificate sitting in your files describes the vendor’s coverage on the day the broker issued it, and nothing on that page changes if the policy is cancelled, reduced, or left to lapse afterward.
TPRM Data Migration: Switch Platforms Without Losing History
When your TPRM contract approaches its end date, the biggest worry about switching usually sits in the old platform: three years of assessments, approvals, and evidence that an auditor may ask for long after the contract ends. Some teams replacing older tools have already found archived records missing and had to rebuild vendor profiles by hand, and nobody wants to discover that kind of gap during an exam.
CITRA Framework in Kuwait: How Cloud Residency Rules Apply to AI Workloads
CITRA compliance in Kuwait is often reduced to one question: […] The post CITRA Framework in Kuwait: How Cloud Residency Rules Apply to AI Workloads appeared first on COMPLYAN.
How Quickly Should a Business Recover From a Major IT Outage?
A business should recover each service within the limit its own business impact analysis sets, and no universal number applies. This article explains recovery time and recovery point objectives, important business services, dependency mapping, testing and what DORA requires. The post How Quickly Should a Business Recover From a Major IT Outage? first appeared on DigitalXForce.
Third-Party Concentration Risk Is Growing. Can Your Risk Program See It?
In August, Andrew Bailey, chair of the Financial Stability Board, delivered a specific warning to G20 finance ministers: the immediate threat to global financial stability isn’t frontier AI itself, but frontier AI concentrated in a small number of third-party technology providers. His words to regulators were direct: “For the financial system, the most immediate concern […] The post Third-Party Concentration Risk Is Growing. Can Your Risk Program See It? appeared first on Arche
Que faire si l'IA part en vrille ? Le gouvernement américain vient de publier un guide
Le NIST, la NSA et la CISA ont récemment listé une série de pratiques pour gérer les incidents où un agent d'IA hors de contrôle agit sans demande explicite de la part d'un humain, pendant son entraînement ou son évaluation. Ce guide se divise en cinq étapes : préparer, détecter, répondre, reprendre et signaler.
Shadow AI: Why Banning AI Tools Fails and What to Do Instead | Hoxhunt HRM category highlights
Oct 20, 2026 | Shadow AI is the unapproved use of AI tools, accounts or features by employees. Bans rarely remove the behaviour. What security leaders can do instead.
Don’t Be an Easy Target: Why Vulnerability Scanning Is Essential to Cybersecurity
Cybercriminals don’t always go after the biggest companies or the most valuable data. Often, they go after the easiest targets. Artificial intelligence (AI) is making it easier and faster to identify potential vulnerabilities, businesses that overlook basic cybersecurity practices may be putting themselves directly in the path of an attack. One of the most effective […] The post Don’t Be an Easy Target: Why Vulnerability Scanning Is Essential to Cybersecurity appeared first on
The Next Underwriting Advantage Is Prevention
How insurers can turn risk signals into action and prove which interventions actually reduce loss
AI is Table Stakes. Winning at Fraud Takes More Than a Good Model.
I spent about three years playing poker semi-professionally. One of the most important lessons I took from it had very little to do with the cards I was dealt. The best players weren’t the ones who won the most hands. They were the ones who consistently made better decisions with the information they had. They […] The post AI is Table Stakes. Winning at Fraud Takes More Than a Good Model. appeared first on Sift.
NIS2-Zuständigkeit: IT, QM oder Geschäftsführung?
Wer ist für NIS2 zuständig? Was § 38 BSIG verlangt, wie 51 Unternehmen NIS2 verteilen und welches Rollenmodell zwischen IT, QM und GF trägt.
What MSPs Should Know About the AI in the Software They Use
Someone on your team clicked the AI button inside a vendor’s portal this week, and the request that left the building carried more than the words they typed. Your client will eventually ask what happened to their data in that moment, and four different companies touched it before the request came back. Your team sends […] The post What MSPs Should Know About the AI in the Software They Use appeared first on Cynomi.
ISO 27090 erklärt: KI-Sicherheit in Ihrem ISMS (2026)
ISO 27090 erklärt: was die KI-Sicherheitsnorm abdeckt, wie sie sich von ISO 42001 unterscheidet und wie KI-Risiken in Ihr ISO-27001-ISMS gehören.
Access Isn’t Trust: A Behavioral Risk Framework for People, Service Accounts, and AI Agents
Risk in the agentic enterprise spans people, service accounts, and AI agents. All three act with legitimate credentials, so access controls alone can’t show whether their activity is safe. A behavioral risk framework applies one model to every actor: Verify expected behavior before access goes live, observe activity once it does, analyze behavior for risk … Continued The post Access Isn’t Trust: A Behavioral Risk Framework for People, Service Accounts, and AI Agents appeared fi
Case study: How Packetlabs made AI-enabled penetration testing easier to trust
How Packetlabs made AI-enabled penetration testing easier to trust Client contracts were increasingly restricting AI use. Packetlabs used CREST’s AI-enabled penetration testing accreditation to strengthen and evidence its controls, giving […] The post Case study: How Packetlabs made AI-enabled penetration testing easier to trust appeared first on CREST.
So arbeiten Sie mit Kertos: 3 Stufen Managed Compliance
Drei Wege mit Kertos: von der Engine für Ihr internes Team bis zum externen ISB oder Datenschutzbeauftragten. Managed Compliance nach Maß.
Drupal Patches Critical RCEs: CVE-2026-108097 & 108099
Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple serious exploit paths exist through contributed […]
OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what universities, government websites, and security teams need to think about next.
ConnectWise Cloud Backup Breach: What We Know
ConnectWise is investigating unauthorized access to application identities associated with Cloud Backup, formerly SkyKick, after researchers detected the applications authenticating into customer Microsoft 365 environments. A vendor-controlled Microsoft 365 application credential was compromised and used to obtain Microsoft Graph access tokens in customer tenants. ConnectWise subsequently disabled seven application identities and suspended Cloud Backup, SaaS […]
ISO 27701 Audit Checklist: Building a Certification-Ready PIMS
As digital service providers increasingly rely on personal data to personalise customer experiences and support business decisions, managing privacy risks has become a business priority. Collecting and processing personally identifiable information (PII) also introduces regulatory, operational, and reputational risks. Organisations must not only protect personal data but also demonstrate that privacy controls are effectively implemented […] The post ISO 27701 Audit Checklist: Building a Ce
How Much Does ISO 42001 Certification Cost?
Learn about ISO 42001 certification costs, key cost drivers, and practical ways to reduce expenses without compromising audit readiness. The post How Much Does ISO 42001 Certification Cost? appeared first on Scytale.
12 PCI DSS Audit Controls with Continuum GRC Assessments
PCI DSS v4.0.1 has changed the nature of the payment security audit: assessors are no longer looking only for policies and annual screenshots; they are looking for risk-based audits, defensible MFA validation, payment-page script security, cardholder data environment scoping, and evidence traceability that proves controls operated as designed. For CISOs and compliance leaders, the central […] The post 12 PCI DSS Audit Controls with Continuum GRC Assessments appeared first on Continuum GRC.
FedRAMP 20x Audits by Lazarus Alliance: 7 Cloud Moves
FedRAMP 20x is not merely a faster authorization path; it is a different evidence economy. The organizations that benefit most will not be the ones with the thickest System Security Plan. They will be the cloud service providers that can continuously prove control performance through structured, reusable, machine-readable evidence aligned to NIST 800-53, OSCAL, and […] The post FedRAMP 20x Audits by Lazarus Alliance: 7 Cloud Moves appeared first on Lazarus Alliance, Inc..
File Integrity Monitoring on IBM i: How to Detect Unauthorized Changes
IBM i environments support some of the most critical applications, processes, and data in an organization. Protecting these environments requires more than controlling user access or securing network connections. Organizations also need visibility into what changes inside their IBM i environment. A modification to a critical object or file may be legitimate. It may also […] The post File Integrity Monitoring on IBM i: How to Detect Unauthorized Changes appeared first on Raz-Lee Security.
Henekom Group and Exiger Partner to Create Human Rights Due Diligence Technology Solution for Global Businesses
Exiger and Henekom Group announce a partnership to develop an AI-powered human rights due diligence solution, combining advanced technology and expert advisory services to help global businesses identify, prioritize and address human rights risks across complex value chains. The post Henekom Group and Exiger Partner to Create Human Rights Due Diligence Technology Solution for Global Businesses appeared first on Exiger.
ZoomInfo Sale, TryCircle, Vicente López, HDB, and X Leaks
SOCRadar Dark Web Team identified several underground posts, including an alleged ZoomInfo database sale involving 185 million records, an alleged TryCircle customer data leak, and an alleged Vicente López municipal database exposure. Other posts advertised a previously compromised HDB Financial Services dataset and an unverified X (Twitter) user database leak claim. Alleged ZoomInfo Database Sale […]
Dubai Electronic Security Center (DESC) Compliance in 2026: A Guide to Dubai ISR Requirements
Dubai Electronic Security Center compliance in 2026 requires more than […] The post Dubai Electronic Security Center (DESC) Compliance in 2026: A Guide to Dubai ISR Requirements appeared first on COMPLYAN.
Third Parties Rated Very Weak by ProcessUnity Risk Index are 47 Times More Likely to Suffer Publicly Reported Breach, ProcessUnity Research Finds
ProcessUnity Research Shows Controls-Based Risk Index Rating Predicts Third-Party Breaches CONCORD, Mass., October 19, 2026 – ProcessUnity, the Third-Party Risk Management (TPRM) company, today released new research showing that third parties rated Very Weak by ProcessUnity Risk Index went on to experience publicly evidenced breaches at 47 times the rate of third parties rated Strong. […] The post Third Parties Rated Very Weak by ProcessUnity Risk Index are 47 Times More Likely to Suffer P
Human Risk Management Employee Offboarding Guide
Human Risk Management New Hire Onboarding Guide
How to Continuously Validate Third-Party Controls
You continuously validate a third party's controls by writing down the state each critical control should be in, reading evidence of that state from sources you can check on a schedule set by risk, and reopening the assessment whenever the evidence or the relationship changes. This article sets out the evidence sources, an 8 step method, the events that should reopen an assessment and what to do when a supplier's controls deteriorate after onboarding. The post How to Continuously Validate Third-