What Is Detection Engineering? The Life and Decay of a Rule
Detection engineering builds, tests, tunes, and retires the rules your SIEM alerts on. Follow one real Sigma rule through every stage and see where it breaks.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
3,478 matching stories — announcement, in GRC & Compliance Automation — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
What Critical Third-Party Status Doesn’t Change for Prime Contractors
DORA‘s critical third-party oversight regime applies specifically to financial entities and the ICT providers designated as critical to that sector. Defence primes and their contractors are not directly in scope. The pattern it exposes, however, applies just as much to a contractor’s own reliance on cloud and IT vendors: regulatory oversight of a vendor, wherever Read more...
Critical Third-Party Oversight Changes Less Than Banks Think
When European regulators began designating certain ICT providers as critical under DORA, some financial institutions read it as good news: a vendor now facing direct supervisory oversight sounded like someone else doing the compliance work. The opposite is true. Designation puts a vendor under a regulator’s microscope. It does not move the institution’s own accountability Read more...
Agencies Relying on Shared Infrastructure Still Own the Risk
DORA‘s critical third-party oversight regime applies specifically to financial entities and the ICT providers designated as critical to that sector. Government agencies are not directly in scope. The pattern it exposes, however, applies just as much to an agency’s own reliance on shared cloud infrastructure: regulatory oversight of a vendor, wherever it exists, never transfers Read more...
FedRAMP 20x Modernization: Risk Management Assessments by Lazarus
The FedRAMP 20x modernization initiative represents a fundamental shift from static documentation to dynamic, machine-readable risk intelligence. By replacing traditional System Security Plans with OSCAL packages and Key Security Indicators, the program demands that Cloud Service Providers demonstrate continuous risk posture rather than periodic snapshots. Lazarus Alliance brings specialized expertise in translating these new requirements […] The post FedRAMP 20x Modernization: Risk Manage
Cross-Mapping Standards: Continuum GRC Audit Services Efficiency
Cross-mapping compliance frameworks allows organizations to eliminate redundant control testing and evidence collection across overlapping regulatory requirements. By unifying control libraries, audit teams achieve measurable efficiency gains while maintaining full coverage of NIST SP 800-171 Rev 3, CMMC 2.0, ISO 27001, SOC 2 Trust Services Criteria, and FedRAMP 20x Key Security Indicators. Executive Summary: Why […] The post Cross-Mapping Standards: Continuum GRC Audit Services Efficiency
What is a data retention policy? EU requirements, retention periods and examples
A data retention policy answers a question that supervisors, auditors and data subjects all ask in different words: why are you still holding this? In the EU the answer begins with the storage limitation principle in the General Data Protection Regulation (GDPR), then has to sit alongside DORA, NIS2 and ISO 27001, which expect certain […] The post What is a data retention policy? EU requirements, retention periods and examples first appeared on Copla.
Kuwait’s Data Privacy Protection Regulations: What Telecom and IT Licensees Must Do Within 24 Hours of a Breach
Kuwait’s Data Privacy Protection Regulations place strict breach-response duties on […] The post Kuwait’s Data Privacy Protection Regulations: What Telecom and IT Licensees Must Do Within 24 Hours of a Breach appeared first on COMPLYAN.
NIST 800-53: 8 Control Assessment Tips from Lazarus Alliance
The strongest NIST 800-53 assessments are not won by having more screenshots; they are won by proving control intent, implementation, and operating effectiveness with evidence that is current, complete, attributable, and repeatable. NIST SP 800-53 provides a catalog of security and privacy controls used across federal and enterprise risk programs, and NIST SP 800-53A provides […] The post NIST 800-53: 8 Control Assessment Tips from Lazarus Alliance appeared first on Lazarus Alliance, Inc..
8 NIST Governance Wins with Continuum GRC Compliance Assessments
NIST CSF 2.0, NIST 800-53, governance risk compliance, compliance assessments, cybersecurity audits, control maturity, and Continuum GRC now belong in the same executive conversation. The shift is not simply toward more controls; it is toward board-visible governance that proves risk decisions, control ownership, cyber resilience, and evidence integrity across regulated systems. Executive Summary: Governance Is […] The post 8 NIST Governance Wins with Continuum GRC Compliance Assessments a
NIS2-Umsetzung in Deutschland: Stand und BSI-Pläne 2026
Wie weit ist die NIS2-Umsetzung in Deutschland? Zahlen aus 51 Unternehmen, wer intern zuständig ist und was das BSI ab Q4 2026 plant.
Vendor Security Assessment Is Broken. Here’s What’s Replacing It.
A supplier breach rarely starts with the organization that gets breached. It starts with a vendor, or a vendor’s vendor, […] The post Vendor Security Assessment Is Broken. Here’s What’s Replacing It. appeared first on Network Intelligence.
Structuring: the oldest trick, still the hardest to prove
Discover how Unit21’s AI Rule Writer and Investigation agents help compliance teams detect and prove structuring, turning complex cash splitting patterns into clear examiner-ready findings.
Is Your Annual Pentest Report Enough? Understanding Industry-Specific VAPT Requirements
Annual security testing has become a familiar routine for many organisations. Once a year, a testing firm is hired, a pentest report lands in the inbox, the critical findings get patched, and the document is filed away for the next audit. The box is ticked. But attackers do not work on an annual calendar. Code […] The post Is Your Annual Pentest Report Enough? Understanding Industry-Specific VAPT Requirements appeared first on Kratikal Blogs.
Corelation KeyStone integration: act on fraud from the case
See how the Unit21-Corelation KeyStone integration works: member data flows in for fraud and BSA/AML, and analysts block cards or stop payments from the case.
Solution brief: Change how your people behave, and prove it to your board
The post Solution brief: Change how your people behave, and prove it to your board appeared first on Fable Security.
New Cloud Security Alliance Survey Finds Data Loss Prevention (DLP) Often Detects Data Loss Only After It Happens
Research conducted in collaboration with Jazz finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization SEATTLE – Oct. 13, 2026 — Data loss prevention (DLP) tools are often functioning as after-the-fact forensic systems rather than prevention controls, according to DLP in the AI Era, a new survey from the Cloud Security Alliance (CSA), the world's leading not-for-profit organization committed t...
Resurgence of Social Engineering Teams calls from External Domains
Lumifi Cyber regularly issues notifications regarding emerging and critical security vulnerabilities that could pose a risk to your organization's network and assets. Staying up to date with these vulnerabilities is a key part of maintaining a strong security posture. This is an advisory only and is not indicative of activity seen in your network. Summary: […] The post Resurgence of Social Engineering Teams calls from External Domains appeared first on Lumifi Cybersecurity.
Auditing and Monitoring—It’s Not Just for Privacy
Clearwater’s Melissa Andrews, Chief Compliance Officer, joins Angela Alton, Chief Privacy Officer, and Nicole Brown, Privacy Manager, of City of Hope for a discussion of how teams can share audit insights across privacy, legal, HR, and IT. The post Auditing and Monitoring—It’s Not Just for Privacy appeared first on Clearwater.
Data before the tool: the real EPM challenge
The hidden challenge of ERP ↔ EPM data integration Rankings of the best EPM platforms are multiplying, and with them a litany of criteria: functional coverage, native artificial intelligence, deployment times, fit with the size of the organization. All legitimate …
ISO 42001: 6 AI Governance Audit Moves by Lazarus Alliance
The most important ISO 42001 audit question is not whether an organization uses artificial intelligence. It is whether leadership can prove that AI is governed as an enterprise risk system rather than managed as a collection of experimental models. That distinction is where many AI compliance programs fail. A chatbot pilot, fraud model, document classifier, […] The post ISO 42001: 6 AI Governance Audit Moves by Lazarus Alliance appeared first on Lazarus Alliance, Inc..
9 PCI and HIPAA Audit Moves with Continuum GRC Risk Management
PCI DSS v4.0.1 and the HIPAA Security Rule are converging around the same operational reality: regulated industries can no longer treat cybersecurity audits as periodic paperwork exercises. Payment security, ePHI protection, third-party oversight, vulnerability management, logging, and risk management must be continuously validated with defensible evidence. The contrarian lesson from recent audits is simple: most […] The post 9 PCI and HIPAA Audit Moves with Continuum GRC Risk Management a
The Proof Is In the Platform: Why Modern GRC Teams Choose Hyperproof Over Trackers
Most GRC platforms were built as trackers, not operational systems. They log that work happened without doing anything to reduce the manual burden. Teams re-map the same controls every time a new framework enters scope, coordinate audit prep by hand across siloed departments, and get stuck flat-structuring compliance for an enterprise that’s anything but flat. ... The post The Proof Is In the Platform: Why Modern GRC Teams Choose Hyperproof Over Trackers appeared first on Hyperproof.
7 Shadow AI Mistakes That Make the Problem Worse
On May 7, 2026, a community bank in Pennsylvania filed something no public company had filed before. Its Form 8-K disclosed a material cybersecurity incident, […] The post 7 Shadow AI Mistakes That Make the Problem Worse appeared first on Olakai.
Lightwell project filters out 400 Java library vulnerabilities
Lightwell, the open-source security initiative set up by IBM and Red Hat, has identified more than 400 previously undiscovered vulnerabilities in widely used Java libraries — and now the companies are inviting customers to submit their own code dependencies to a new service, Lightwell Clearinghouse, for review. They’ll be looking for bugs such as the critical sandbox bypass in Java template engine Thymeleaf, with a CVSS score of 9.1, discovered in April. “AI agents shifted the threat landscape o
Do You Need a Full-Time Compliance Hire to Meet CPCSC Requirements?
For many small and midsize Canadian defense contractors, meeting CPCSC requirements raises an important resourcing question: does compliance justify hiring a full-time specialist? The work typically requires ongoing attention to cybersecurity controls, evidence, documentation, and remediation, but maintaining all of those responsibilities in-house can add considerable cost to a growing organization. A full-time hire is […] The post Do You Need a Full-Time Compliance Hire to Meet CPCSC Requ
CPCSC Compliance: When to Move Off Spreadsheets (and What to Replace Them With)
Canada’s defense supply chain is changing quickly. With the Canadian Program for Cyber Security Certification (CPCSC) now appearing in select Department of National Defence and Public Services and Procurement Canada contracts, suppliers handling Specified Information must demonstrate their security posture rather than simply describe it. Most teams begin tracking that work in spreadsheets, and at […] The post CPCSC Compliance: When to Move Off Spreadsheets (and What to Replace Them With) a
CMMC Level 2 Requirements: What Compliance Software Can (and Can’t) Automate
Update, September 30, 2026: The Department of War suspended CMMC Phase II, the mandate that would have required third-party (C3PAO) Level 2 certification starting November 10, 2026. The 60-day Reform Task Force has now submitted its recommendations on the future of the program, which have not been made public. Self-assessment requirements, SPRS scoring, annual affirmations, […] The post CMMC Level 2 Requirements: What Compliance Software Can (and Can’t) Automate appeared first on Car
Secure Product Development Lifecycle Requirements
A final penetration test can miss a design choice that gives attackers an easy path later. An open debug port, a weak update process, or an unknown dependency can affect the whole product. For CISOs, CTOs, and product security leaders, secure product development lifecycle requirements define what to protect, which controls to build, how to test for vulnerabilities, and who owns each security decision. In practice, these requirements span six connected areas: security goals, threat modeling, hard
Critical Cisco NX-OS Flaws Threaten Nexus Switches
Critical Cisco NX-OS Flaws Threaten Nexus Switches Cisco has patched five critical vulnerabilities affecting Nexus 3000 and Nexus 9000 switches running standalone NX-OS. The flaws can allow unauthenticated remote attacke
5 takeaways from Precisely Now: Trusted AI starts with trusted data
Key Takeaways AI moved from planning to production faster than data readiness did, and agents now act on untrusted data at machine speed, before anyone can intervene. Precisely announced the Precisely Platform for unified data management and Precisely AI Studio for building on it. AI Studio is available today. Customers at Lake Michigan Credit Union […] The post 5 takeaways from Precisely Now: Trusted AI starts with trusted data appeared first on Precisely.
5 takeaways from Precisely Now: Trusted AI starts with trusted data
Key Takeaways AI moved from planning to production faster than data readiness did, and agents now act on untrusted data at machine speed, before anyone can intervene. Precisely announced the Precisely Platform for unified data management and Precisely AI Studio for building on it. AI Studio is available today. Customers at Lake Michigan Credit Union […] The post 5 takeaways from Precisely Now: Trusted AI starts with trusted data appeared first on Precisely.
Why AI Transformation Is a Problem of Governance in 2026
Your organization is deploying AI. Lots of it. Model pilots, vendor tools, internal RAG systems, and generative workflows embedded in business processes. The conversations in your boardroom and your engineering team are almost entirely technical: "What models are we using? How do we ensure accuracy? Can we scale this?" Here's what they're missing: AI transformation ... The post Why AI Transformation Is a Problem of Governance in 2026 appeared first on SAI360.
AI Governance Monitoring Tools for Enterprises
Evaluate AI governance monitoring tools for enterprises across behavior, access, and threats, with practical safeguards and human oversight.
When Should Privacy Bring Security Into an AI Incident?
Learn when Privacy should involve Security in AI incident response to establish facts, contain exposure, and document defensible regulatory decisions. The post When Should Privacy Bring Security Into an AI Incident? appeared first on RadarFirst.
VMaaS vs In-House Vulnerability Management: 7 Questions to Ask Before You Decide
This blog explains seven practical questions that expose which model fits your team – VMaaS or in-house vulnerability management. Choosing between the two is a decision almost every security team faces sooner or later: keep building the vulnerability management tool or programme yourself, or hand the heavy lifting to a service. It looks like a […] The post VMaaS vs In-House Vulnerability Management: 7 Questions to Ask Before You Decide appeared first on Kratikal Blogs.
The real ROI of running compliance with Scytale
See how Scytale cuts compliance costs, saves time and accelerates growth with AI automation and expert GRC support. The post The real ROI of running compliance with Scytale appeared first on Scytale.
What Is a Common Control Framework?
A common control framework is one set of controls, each written, owned and tested once, mapped to every requirement it satisfies across an organization's frameworks. This article shows how to build one, with a single access review control traced through NIST, ISO/IEC 27001, HIPAA and SOC 2 requirements. The post What Is a Common Control Framework? first appeared on DigitalXForce.
How Automated Control Testing Decides Whether a Control Still Works
Automated control testing decides whether a control still works by comparing its actual state, read from the system that enforces it, with an expected state written down in advance. This article explains how the expected state is set, what happens when a test fails, how exceptions and compensating controls are handled and how to check that the test itself can be trusted. The post How Automated Control Testing Decides Whether a Control Still Works first appeared on DigitalXForce.
Risk management frameworks: types, examples and how to choose
Risk management frameworks exist because teams in the same organisation score risk differently: a five-point scale in IT, a heat map in finance, no formal method in procurement. A framework sets out the principles, processes and responsibilities for managing risk the same way everywhere, so a ‘high’ in one team means a ‘high’ in another […] The post Risk management frameworks: types, examples and how to choose first appeared on Copla.