Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
3,481 matching stories — announcement, in GRC & Compliance Automation — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Rethinking Harassment Training in the Modern Workplace Webinar On Demand
Creating Value Through Hotline Best Practices Webinar On Demand
Unlock the ROI of DEI with Experts from Mitratech
H-1B Uncertainty to Global Opportunity | Upcoming Webinar
Compliance, Uninterrupted: Connecting Your Ethics, Policy, and Compliance Management Webinar On Demand
Why Public Data Alone Can't Replace Evidence-Based Vendor Risk Assessment
A few TPRM vendors have started marketing a simple pitch: skip the questionnaires, we'll assess your third parties automatically using only public data. No forms, no back-and-forth, no waiting on vendors to respond. It sounds efficient, but it also sounds like something you could just do yourself with a few well-written prompts to Claude or ChatGPT.
The Death of the Compliance Calendar
From Documentation to Continuous ProofFor decades, compliance has been managed by the calendar. Annual audits, quarterly reviews, periodic attestations, scheduled assessments, point-in-time certifications, and recurring evidence requests have shaped how organizations understand whether they are compliant, controlled, resilient, and trustworthy. The compliance calendar became the operating rhythm of governance, risk management, and compliance (GRC). It told people when to gather documentation, wh
Regulated Industry Compliance Requirements: MSP Guide
Not all compliance is created equal. While the core security controls—access management, encryption, monitoring, documentation—appear across every framework, the specific requirements, enforcement mechanisms, and industry dynamics vary significantly between regulated verticals. MSPs who serve regulated industries need to understand these differences to deliver effective compliance services.
How CMMC Can Drive Revenue and Market Expansion
With the enforcement of the Cybersecurity Maturity Model Certification (CMMC) by the Department of War, defense contractors have an increased burden in an already heavily regulated space. If you only look at it as a means to keep your current contracts, all the time and money spent on compliance feels like nothing more than a... The post How CMMC Can Drive Revenue and Market Expansion appeared first on Hyperproof.
What Are Your Developers Missing in Application Security Training?
Key Takeaways Security tooling investment in application security has grown steadily for years, but vulnerability rates have not moved in the same direction.   In a recent NINJIO webinar, Laura Bell Main, Founder and CEO of SafeStack, and Kevin Baroudi, NINJIO’s VP of Client Experience, examined why that gap persists and what organizations need to address the part... The post What Are Your Developers Missing in Application Security Training? appeared first on NINJIO.
Why Your RMIS Is Sitting on Untapped Intelligence
Here is a question worth putting to every risk leader: what decisions are you making today that you wish you had better data for? The answers are always interesting. Not because they reveal gaps in technology, but because they reveal gaps in thinking about technology. Most risk functions already hold the data they need. They […] The post Why Your RMIS Is Sitting on Untapped Intelligence appeared first on Archer.
SOC 2 Type 2 Playbook: What I Wish More First-Timers Knew
Rick Orloff is a Fortune 1000 CISO and Strategic Advisor at A-LIGN, with over 20 years of experience at companies including Apple and eBay. You completed your SOC 2 Type 1. Now your sales team is asking when Type 2 will be ready, and the request list from your auditor just hit your inbox. If this is your first […] The post SOC 2 Type 2 Playbook: What I Wish More First-Timers Knew appeared first on A-LIGN.
How Regulation S-P Shapes Third-Party Vendor Risk Management
Your vendors touch customer data every day: cloud providers, custodians, IT service firms. What does Regulation S-P require for third-party vendor oversight? It requires explicit oversight requirements, including written policies designed to secure timely breach notification from vendors and documented monitoring programs. For broker-dealers and investment advisers, the compliance deadline has arrived. Wondering what Regulation […] The post How Regulation S-P Shapes Third-Party Vendor Risk
How Regulation S-P Shapes Third-Party Vendor Risk Management
Your vendors touch customer data every day: cloud providers, custodians, IT service firms. What does Regulation S-P require for third-party vendor oversight? It requires explicit oversight requirements, including written policies designed to secure timely breach notification from vendors and documented monitoring programs. For broker-dealers and investment advisers, the compliance deadline has arrived. Wondering what Regulation […] The post How Regulation S-P Shapes Third-Party Vendor Risk
Social Engineering: How GenAI Rewrote the Rules of Deception
The XTN Intelligence Team continues its monthly series on Agentic AI and the future of fraud prevention. This month, we look at how generative AI is reshaping social engineering, erasing the warning signs that used to give scams away. For years, fraud awareness training rested on a simple premise: bad actors leave clues. Broken grammar, […] The post Social Engineering: How GenAI Rewrote the Rules of Deception appeared first on XTN Cognitive Security.
How Dropshipping Affects Brands: Fakes, Grey Markets, and More
Key Takeaway: When it comes to dropshipping, the low barrier to entry introduces all kinds of risks. Counterfeit products and grey market resellers both borrow a brand’s name, and each risk needs its own response. Dropshipping turns a simple idea into a massive industry. A seller lists a product, a customer buys it, and a […] The post How Dropshipping Affects Brands: Fakes, Grey Markets, and More appeared first on EBRAND.
How Atea Built a Security-First Culture Across the Nordics and Baltics
The post How Atea Built a Security-First Culture Across the Nordics and Baltics appeared first on MetaCompliance.
Unenforced Standards
Or: How to poison the program. Or: Compassion in governance. Those who play by the rules want all to play by the rules. When we don’t enforce standards, we disrespect the very people who do enforce them. That’s why accountability is the greatest form of compensation. When we hold team members accountable, we reward those […] The post Unenforced Standards appeared first on infotex.
Best 12 Compliance Audit Software Platforms for SOC Readiness
Key Takeaways What to Look For in Compliance Audit Management Software for SOC Readiness Control Mapping: SOC 2 controls should map clearly to the Trust Services Criteria and to other frameworks where relevant. Evidence Collection: The platform should collect, store, refresh, and organize evidence in a way that auditors can review. Continuous Control Monitoring: Teams […] The post Best 12 Compliance Audit Software Platforms for SOC Readiness appeared first on Centraleyes.
Data Governance in Healthcare in the Age of Ransomware
As the risk of being hit grows, how well an organisation governs its data determines the blast radius of an attack and how quickly care can continue. How can this be done? Ransomware attacks are continuing to hit the healthcare sector, with potentially devastating consequences that can go on for months after the incident. In … Continued
78% of CISOs say C-level do not fully understand employee-driven cyber risk
The post 78% of CISOs say C-level do not fully understand employee-driven cyber risk appeared first on MetaCompliance.
World Cup Phishing Attacks Surge 500% | Hoxhunt Phishing category highlights
Jul 09, 2026 | World Cup 2026 phishing attacks targeting employees have surged 500% from April to June, as temporal attacks pinned to major global events gain in popularity with cyber criminals
Why “Fast” Questionnaires Are the Wrong Metric for Trust
Every vendor risk platform on the market wants to tell you the same story: fill out this questionnaire faster, get approved faster, move on with your day.  It sounds great. It’s also solving the wrong problem.  The Speed Trap  Somewhere along the way, the TPRM industry decided that the biggest pain point in vendor risk management was time. So, the ... Read more The post Why “Fast” Questionnaires Are the Wrong Metric for Trust appeared fir
Automating Third-Party Risk Management: Steps & Playbook
Executive summary: TPRM automation helps organizations streamline and improve third-party oversight by standardizing repeatable work across onboarding, assessments, monitoring, remediation, and offboarding. The most effective programs pair automation with human accountability for risk decisions, use tiered due diligence based on exposure, and connect TPRM to procurement to prevent unchecked approvals. This guide explains the core elements of TPRM automation and walks through a step-by-step imple
MSP Compliance Services SMB: Build the Partner Model
The compliance gap for small and mid-sized businesses is straightforward: the requirements are enterprise-grade, but the resources are not. SMBs face the same regulatory standards as their much larger counterparts—same HIPAA requirements, same CMMC controls, same FTC enforcement—without the compliance teams, budgets, or institutional knowledge to meet them independently.
Why “Stupid” Software Pricing Models Are Driving Churn in the AI Era
“Nothing frustrates me more than feeling like I’m getting a bad deal.” That line, taken from the recent OnlyCFO piece, 2026: The Year of Churn, perfectly captures the growing tension between SaaS vendors and their customers. The author calls out “stupid pricing models” as a key driver of churn, particularly in an AI-driven world where traditional seat-based or named user approaches are breaking down. It’s a blunt assessment, but an accurate one. This is not just a pricing conversation. It is a t
Companies Are Cutting Jobs to Pay for AI. Can They Prove It’s Working?
The jobs apocalypse arrived, and it is being funded by payroll. If a company is trading people for an AI bet, the bar to prove […] The post Companies Are Cutting Jobs to Pay for AI. Can They Prove It’s Working? appeared first on Olakai.
The EU AI Act: What the 2nd August Deadline Means for Your Organisation
The post The EU AI Act: What the 2nd August Deadline Means for Your Organisation appeared first on MetaCompliance.
KDDI email breach: how one shared email platform exposed up to 14.2 million logins across six ISPs
One email platform run by KDDI exposed the logins of up to 14.2 million customers across six Japanese internet providers. The lesson for third-party risk teams is concentration and fourth-party risk: many brands on one shared supplier system, breached through a third-party software flaw.
iRhythm breach: how patient data left through third-party-hosted business apps
Cardiac-monitoring firm iRhythm says attackers took patient health data, proprietary data and personal information from third-party-hosted business applications, not from its clinical systems. For third-party risk teams the lesson is that regulated data often lives with a vendor, and that is where it leaves.
Best GRC Platform for DPDP, RBI & SEBI Compliance in India
India’s fintech sector is entering a compliance-first era. In November 2025, the RBI consolidated more than 9,000 circulars into 244… The post Best GRC Platform for DPDP, RBI & SEBI Compliance in India appeared first on Mitigata Cyber insurance & security blogs.
UI Manipulation Fraud: When Users Can No Longer Trust What They See
Fraudsters found a new way around established controls: UI manipulation fraud. By altering information displayed during legitimate banking sessions, attackers can influence customer decisions without compromising accounts. How can your bank prepare? What Is UI Manipulation Fraud UI manipulation fraud... Read More »
UI Manipulation Fraud: When Users Can No Longer Trust What They See
Fraudsters found a new way around established controls: UI manipulation fraud. By altering information displayed during legitimate banking sessions, attackers can influence customer decisions without compromising accounts. How can your bank prepare? What Is UI Manipulation Fraud UI manipulation fraud... Read More »
Francisco Valencia, recibe el Premio Madrid, Innovación y Visión Empresarial 2026
La Asociación Europea de Economía y Competitividad distingue al director general de Secure&IT con el Premio a la Trayectoria Profesional en Ciberseguridad, Protección de la Información y Gobierno de las TIC. Una distinción a la trayectoria, el liderazgo y la visión estratégica Francisco Valencia, director general de Secure&IT, ha sido distinguido por la Asociación Europea […] La entrada Francisco Valencia, recibe el Premio Madrid, Innovación y Visión Empresarial 2026 aparece primer
What Is Agent 365? The M365 AI Governance Gap, Explained
Here is the good news: Microsoft has built powerful AI agent capabilities directly into Microsoft 365. Copilot Studio, SharePoint Agents, and declarative agents give your teams tools that automate…
What Is Agent 365? The M365 AI Governance Gap, Explained
Here is the good news: Microsoft has built powerful AI agent capabilities directly into Microsoft 365. Copilot Studio, SharePoint Agents, and declarative agents give your teams tools that automate…
Cyber Escalation Risk: When a Breach Does Not End Where It Begins
A cyber incident does not always end when the first system is contained. Security leaders also need to understand what the breach could enable next: phishing, fraud, identity abuse, regulatory exposure, and wider business impact. The post Cyber Escalation Risk: When a Breach Does Not End Where It Begins appeared first on CISOteria.
Did the Salesloft Drift Breach Reveal a Need for CASB?
SaaS integrations often stay connected long after the original rollout, supplier project or CRM upgrade has finished. Many senior leadership teams only revisit those permissions once suspicious activity forces an investigation and customer confidence has already started taking a hit. The Salesloft Drift breach exposed how attackers can abuse trusted cloud access without breaking into Salesforce itself. Instead, attackers used compromised OAuth tokens, which work like digital permission keys, to
Inside the Underground Economy: 5 Dark Web Trends Shaping the 2026 Threat Landscape
The dark web is no longer just a marketplace for stolen credentials; it has grown far beyond that point and now affects nearly every phase of the cyberattack lifecycle. Markets that once traded only compromised accounts now also sell ransomware services, initial network access, exploit kits, phishing infrastructure, and even AI-powered attack tools. What used to be a place for selling stolen data has become the operational backbone of modern cybercrime. The first half of 2026 alone is indicative