Blog

Every incident is a lesson someone else paid for

Each day we take what just happened, read it through the regulatory frameworks you answer to, and show what prediction, simulation or early remediation would have changed. Collect the lessons without paying the tuition.

Frameworks covered

DORA 5 NIS2 3 SWIFT CSCF 2 NYDFS 500 2 OSFI B-13 2 Operational resilience 2 NIS 2 1 Cyber Resilience Act 1 ISO/IEC 27001 1 Resilience 1 Collective intelligence 1 Incident response 1 GDPR 1 DPDP 1 Cross-border data transfer 1 Asset inventory 1

Cyber defence is built before the incident, not enforced after it

2026-07-02

France's national cyber agency is navigating four legal regimes and a twentyfold expansion of its remit at once. Because enforcement can only act after an event has happened, defending an ecosystem this much larger depends on training, tooling and staffing capacity built ahead of need, by every actor able to build it.

$A clear glass prism stands on a glowing honeycomb base in a sunlit lavender-and-daisy meadow; a cyan beam passes through a luminous wireframe globe into the prism and refracts into four coloured streams curving to the right, a violet stream with a faint ring of stars, a green stream with a maple-leaf glint and a warm-amber stream with a single star spark, against bright empty parchment light on the left.$

SWIFT CSCF · DORA · NIS2 · NYDFS 500 · OSFI B-13

Test once, satisfy many: the SWIFT CSCF v2026 7.3A penetration test as a cross-regime exercise

2026-06-24

Read the sharpened 7.3A guidance as a checkbox and you will run four tests for four regulators. Read it as one supervisory expression of a global shift to intelligence-led testing, and a single well-designed exercise produces evidence all four accept.

$A clear glass prism stands in a sunlit lavender-and-daisy meadow on a softly glowing honeycomb base; a cyan beam passes through a luminous wireframe globe into the prism and refracts into glowing network streams that curve away to the right and dissolve into bokeh, with bright empty parchment light filling the left of the frame.$

SWIFT CSCF · DORA · NIS2 · NYDFS 500 · OSFI B-13

How to prepare your SWIFT penetration test in 2026 (and satisfy four regulators at once)

2026-06-24

Most institutions scope the SWIFT penetration test to the minimum the control names, then commission three more tests for three more regulators. That is the expensive way. One well-designed test, recorded against a shared framework, satisfies them all.

$Cinematic macro photograph: a rack-mounted firewall appliance with a shattered front face glowing orange at the fracture, behind a deep-violet hexagonal containment lattice, leaking golden credential keys along cyan signal filaments into a softly lit server-room corridor.$

DORA · NIS2 · ISO/IEC 27001

The bleeding edge: when 75,000 firewalls became the open door

2026-06-20

The device whose entire job is to keep intruders out became the way in. FortiBleed handed attackers verified credentials to ~73,932 Fortinet firewalls, half the internet-facing fleet, without a single new vulnerability. The exploit was patience.

Honeybees forming a heat-ball around an Asian hornet, with cyan holographic containment filaments - the biological model for collective cyber-incident response.

Resilience · Collective intelligence · Incident response

The heat-ball: what honeybees can teach a CISO about collective cyber defence

2026-06-14

A swarm of honeybees kills an Asian hornet by cooking it alive - 46 °C, sustained for twenty minutes, with no individual bee in command. This is not instinct. It is distributed incident response, and it is more sophisticated than most SOC playbooks.