ServiceNow + UpGuard: Automating Risk Management Together | UpGuard
See how UpGuard’s Risk Automations ServiceNow integration turns vendor, breach, and user risk findings into tickets and syncs without manual data entry.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
3,597 matching stories — in GRC & Compliance Automation — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
CVE-2026-91843: Check Point Root RCE
CVE-2026-91843: Check Point Root RCE Check Point has patched CVE-2026-91843 , a critical stack-based buffer overflow flaw in the login process of its Security Management and Log Server products. If exploited, an unauthen
Black Kite: Manufacturing ransomware surged in 2026, spreading beyond the US, with 1,183 victims through July
New data from Black Kite’s 2026 Manufacturing & Distribution Ransomware Report identified that manufacturers continue to bear a... The post Black Kite: Manufacturing ransomware surged in 2026, spreading beyond the US, with 1,183 victims through July appeared first on Industrial Cyber.
ISO 42001 and AIUC-1: How Two AI Assurance Standards Work Together
AI agent vendors are starting to arrive at your procurement review with two certificates instead of one. A growing number hold ISO 42001 certification for their AI management system, and a smaller but visible group has added AIUC-1, a use-case-level standard for AI agent security, safety, and reliability published by the Artificial Intelligence Underwriting Company. If […] The post ISO 42001 and AIUC-1: How Two AI Assurance Standards Work Together appeared first on A-LIGN.
Your Complete ISO 27001 Checklist Guide
Follow this ISO 27001 checklist to prepare for certification, meet key requirements, and stay audit-ready. The post Your Complete ISO 27001 Checklist Guide appeared first on Scytale.
How to Implement DORA Incident Reporting for Spanish Financial Entities
The Digital Operational Resilience Act fundamentally transforms how Spanish financial institutions must approach cybersecurity incident reporting. With enforcement underway, Spanish banks, insurers, and investment firms face stringent requirements for detecting, documenting, and reporting operational disruptions within tight timeframes. DORA incident reporting requires Spanish financial entities to build comprehensive monitoring capabilities, establish clear escalation pathways, and Read more...
SOC 2 Reporting Enhancements: AI and Audits from Continuum GRC
As organizations navigate increasingly complex digital ecosystems in 2026, SOC 2 reporting enhancements driven by artificial intelligence are transforming how audit services integrate with risk management frameworks. Continuum GRC is at the forefront of these advancements, combining AI-powered analytics with traditional SOC 1 and SOC 2 audit methodologies to deliver faster, more precise compliance outcomes. […] The post SOC 2 Reporting Enhancements: AI and Audits from Continuum GRC appeare
CJIS Compliance Renewals: Lazarus Alliance Governance Audits
CJIS Security Policy Audits: Governance and Readiness Organizations that access, store, process, or transmit Criminal Justice Information must maintain security controls consistent with the FBI Criminal Justice Information Services Security Policy. Effective governance helps organizations assign responsibility, preserve evidence, correct deficiencies, and demonstrate that required safeguards operate as intended. CJIS compliance should be treated as […] The post CJIS Compliance Renewals: La
How Belgium Defence Contractors Meet GDPR Requirements
Belgium’s defence contractors face unique challenges balancing national security imperatives with stringent data protection obligations. These organisations must secure classified information whilst ensuring personal data handling meets GDPR standards, creating complex compliance requirements that traditional security frameworks often fail to address comprehensively. The intersection of defence contracting and data compliance regulation demands specialised approaches to Read more...
From Data Breaches to AI Harm: Why Incident Management Needs to Expand
Learn how AI is expanding the incident landscape and how Regulatory Incident Management helps teams assess risk, coordinate response, and document decisions. The post From Data Breaches to AI Harm: Why Incident Management Needs to Expand appeared first on RadarFirst.
Two Years to Reimbursement, and Most Banks Aren’t Ready
ThreatMark’s Fraud Readiness Benchmark 2026 revealed that almost 70% of financial institutions expect banking regulation mandating reimbursement for authorized push payment fraud within the next two years. Yet most are still far from ready.  Banks aren’t expecting reimbursement mandates to... Read More »
AI for MSPs in 2026: Where It Saves Hours for Security Teams and Where It Doesn't
MSSP teams spend hours each week on alert summaries, client reports, and security questionnaires. Here is where AI actually saves that time, where it does not, and how to adopt it without exposing client data.
5 Critical Security Risks in Defence Sector AI Adoption
Defence organisations worldwide are accelerating artificial intelligence deployment to maintain competitive advantages and operational readiness. However, this rapid AI integration introduces unprecedented security vulnerabilities that traditional cybersecurity frameworks struggle to address effectively. The unique nature of defence AI systems—processing classified intelligence, controlling autonomous weapons platforms, and managing sensitive operational data—creates attack surfaces that adversa
ISO 27001 certification cost: The EU and UK breakdown for 2026
ISO 27001 certification cost runs roughly EUR 10,000 to more than EUR 100,000, with UK organisations in broadly the same range in GBP. The number moves with company size, scope, and audit days, across four budget areas: preparation, implementation, the audit, and ongoing maintenance. The audit fee is the smallest of the four. The largest, […] The post ISO 27001 certification cost: The EU and UK breakdown for 2026 first appeared on Copla.
Webinar Series: Risk in Real Time: How Dayforce Runs Continuous Third-Party Risk
This panel webinar brings three perspectives together to talk through how to close that gap. Giles Witherspoon of Dayforce shares how his team moved from periodic questionnaires to continuous monitoring. Sophia Corsetti of ProcessUnity and Austin Starowicz of RiskRecon by Mastercard, add their perspectives on what a data-first program looks like in practice, from pairing […] The post Webinar Series: Risk in Real Time: How Dayforce Runs Continuous Third-Party Risk appeared first on ProcessU
Fable Security Launches AI Agent to Turn Emerging Cyber Threats Into Employee Training
The post Fable Security Launches AI Agent to Turn Emerging Cyber Threats Into Employee Training appeared first on Fable Security.
Fable Launches Briefing Agent to Turn Emerging Threats Into Interventions
The post Fable Launches Briefing Agent to Turn Emerging Threats Into Interventions appeared first on Fable Security.
Rogue ScreenConnect Clients Spread Malware Through Guest File Transfers
Lumifi Cyber regularly issues notifications regarding emerging and critical security vulnerabilities that could pose a risk to your organization's network and assets. Staying up to date with these vulnerabilities is a key part of maintaining a strong security posture. This is an advisory only and is not indicative of activity seen in your network. Summary: […] The post Rogue ScreenConnect Clients Spread Malware Through Guest File Transfers appeared first on Lumifi Cybersecurity.
Vendor Risk Just Became the Primary Attack Vector: Where HITRUST® Fits
Building Cybersecurity to Scale: Lessons from 25m Health’s DH Portfolio
The post Building Cybersecurity to Scale: Lessons from 25m Health’s DH Portfolio appeared first on Clearwater.
What OpenAI’s Misalignment Reports Tell Security Teams About AI Agents
AI Agents are no longer the new insider threat. They’ve become firmly planted as the primary challenge for security leaders when it comes to insider threat activity. They have credentials, they act autonomously, and increasingly, they can take real actions on real systems.   How would you know when one of your digital workers starts doing … Continued The post What OpenAI’s Misalignment Reports Tell Security Teams About AI Agents appeared first on Exabeam.
Mapping Multiple Frameworks into a Unified Compliance Program
Compliance teams waste resources managing multiple frameworks with disconnected tools. Learn how unified GRC technology eliminates duplicated work and strengthens collaboration across teams. The post Mapping Multiple Frameworks into a Unified Compliance Program appeared first on Onspring.
Family Office Security and External Identity Security: Protecting High-Net-Worth Households
A family office overseeing hundreds of millions of dollars typically has fewer employees, no dedicated security function, and direct wire authority. Attackers understand this dynamic. What makes the household reachable is rarely a technical weakness. It’s the information already sitting in public: home and property records, personal mobile numbers, the names of children and their schools, adviser relationships, travel details, and philanthropy patterns. An attacker assembles that in under
How many 24-hour reporting clocks are you running?
The post How many 24-hour reporting clocks are you running? appeared first on Resilience.
Why Your GRC Platform Isn’t Delivering the Value You Expected
Most healthcare GRC platforms are live but underperforming. Learn why the gap isn’t the tool — it’s the program — and what operationalized GRC looks like. The post Why Your GRC Platform Isn’t Delivering the Value You Expected appeared first on Meditology Services.
Why Your GRC Platform Isn’t Delivering the Value You Expected
Most healthcare GRC platforms are live but underperforming. Learn why the gap isn’t the tool — it’s the program — and what operationalized GRC looks like. The post Why Your GRC Platform Isn’t Delivering the Value You Expected appeared first on Meditology Services.
Why Your GRC Platform Isn’t Delivering the Value You Expected
by Alan DeVaughan How much of your Governance, Risk and Compliance (GRC) program is still running on spreadsheets and manual processes even though you have a platform in place? Most healthcare GRC platforms underdeliver not… The post Why Your GRC Platform Isn’t Delivering the Value You Expected appeared first on Meditology Services.
A Faster Path from New Client to Real Value
We built Cynomi from a straightforward belief: every small business deserves the kind of security guidance that used to require a full-time CISO. For our partners, that belief is also a growth opportunity, because there are far more businesses that need this guidance than there are firms able to deliver it profitably at scale.  For the past couple […] The post A Faster Path from New Client to Real Value appeared first on Cynomi.
Fable Security & PCI DSS Compliance
A requirement-by-requirement mapping of PCI DSS 4.0.1’s Requirement 12.6, showing exactly how Fable satisfies each part of it. Useful for any security or compliance team that needs evidence beyond a completion report, not just an argument for why one matters. The post Fable Security & PCI DSS Compliance appeared first on Fable Security.
How to write AI agent prompts for AML investigations
What separates a good AI agent prompt from a vague one: the number, the time frame, the data fields, and what the write-up should contain.
Introducing macOS LAPS in Iru: Secure, automated local admin passwords
Local administrator accounts are indispensable for troubleshooting and recovery, but the passwords behind them can also become a serious security liability. Shared credentials, long or nonexistent rotation intervals, and inconsistent storage practices give attackers more time and opportunity to move laterally after a compromise.
The FedRAMP SSP Replacement: Security Decision Record
If you’ve worked in FedRAMP, you know the System Security Plan (SSP). Hundreds of pages, usually updated right before assessment, and potentially out-of-date three weeks  later. Under the 2026 Consolidated Rules, the SSP is gone and replaced by something called the Security Decision Record (SDR).  The SDR isn’t a simple rebrand, and it’s not a document you write once and defend at assessment time. In
Internet-Exposed OT: What the UK Generator Incident Tells CNI Operators About Attack Surface
Key Takeaways A small UK power generator was reportedly forced offline for four days in July 2026. Press reporting attributes the incident to Iran-linked actors, but the UK government has confirmed only that an incident occurred, declining to attribute it or identify the facility. The initial access vector has not been disclosed. Operators cannot map the incident to a specific product or vulnerability, and any vendor claiming otherwise is speculating. CISA’s Internet Exposure Reduction Gui
34 Biggest Healthcare Data Breaches (Updated July 2026) | UpGuard
A list of the biggest data breaches rocking the healthcare industry in 2026, ranked by degree of impact.
23 Biggest Data Breaches in Australia (Updated July 2026) | UpGuard
Learn about some of the biggest data breaches that have impacted Australian businesses, including recent cyberattacks in 2025.
Self-modifying AI agents expose a blind spot in enterprise security
As debate over AI safety intensifies, new research is drawing attention to a more immediate risk for enterprises: AI agents that can alter the models they rely on while carrying out routine tasks. Researchers at AI security firm Irregular asked a coding agent to solve a software maintenance problem involving an application built on a local AI model that was returning incorrect answers. Instead of limiting its changes to the application, the agent fine-tuned the open-weight model it used — a mode
FedRAMP 20x Ready: Lazarus Alliance Compliance Assessments Now
FedRAMP 20x Readiness and Independent Assessments FedRAMP 20x modernizes federal cloud security certification through measurable security outcomes, persistent verification, machine-readable information, and greater reliance on automation. The FedRAMP Consolidated Rules for 2026 establish the applicable requirements. Cloud service providers should use those rules, rather than assumptions carried over from legacy FedRAMP processes, to select a […] The post FedRAMP 20x Ready: Lazarus Alliance
FedRAMP 20x Ready: Lazarus Alliance Compliance Assessments Now
In 2026, organizations pursuing cloud service offerings for federal agencies face a transformed landscape where FedRAMP 20x emphasizes automated evidence collection and continuous monitoring to slash authorization timelines. Lazarus Alliance delivers targeted compliance assessments that align precisely with these modernization mandates, enabling providers to achieve Authority to Operate (ATO) faster while maintaining rigorous risk management […] The post FedRAMP 20x Ready: Lazarus Alliance
55 HIPAA Right of Access Enforcement Actions Later: Are Healthcare Providers Getting the Message?
Part 2 of 2: Seven years after OCR’s first HIPAA Right of Access enforcement action, case #55 shows why timely access to medical records remains a compliance issue for healthcare providers. A patient waited nearly two years for her medical records. Now Azul Vision will pay $50,000 and spend two years under a corrective action […] The post 55 HIPAA Right of Access Enforcement Actions Later: Are Healthcare Providers Getting the Message? appeared first on uRISQ | Cyber Privacy and Cyber Secur
CVE-2026-76460: Cisco ISE Flaw Actively Exploited
CVE-2026-76460: Cisco ISE Flaw Actively Exploited CVE-2026-76460 represents a critical security flaw in Cisco’s Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Because the vulnerability bypas