Blog · 2026

DORA

Golden-hour twilight over Paris. The Eiffel Tower stands inside a translucent hexagonal shield of cyan and violet light while a bolt of lightning strikes the dome and dissipates in soft ripples. Honeybees fly over a meadow of lavender and daisies.

NIS 2 · DORA · Cyber Resilience Act

Cyber defence is built before the incident, not enforced after it

2026-07-02

France's national cyber agency is navigating four legal regimes and a twentyfold expansion of its remit at once. Because enforcement can only act after an event has happened, defending an ecosystem this much larger depends on training, tooling and staffing capacity built ahead of need, by every actor able to build it.

$A clear glass prism stands on a glowing honeycomb base in a sunlit lavender-and-daisy meadow; a cyan beam passes through a luminous wireframe globe into the prism and refracts into four coloured streams curving to the right, a violet stream with a faint ring of stars, a green stream with a maple-leaf glint and a warm-amber stream with a single star spark, against bright empty parchment light on the left.$

SWIFT CSCF · DORA · NIS2 · NYDFS 500 · OSFI B-13

Test once, satisfy many: the SWIFT CSCF v2026 7.3A penetration test as a cross-regime exercise

2026-06-24

Read the sharpened 7.3A guidance as a checkbox and you will run four tests for four regulators. Read it as one supervisory expression of a global shift to intelligence-led testing, and a single well-designed exercise produces evidence all four accept.

$A clear glass prism stands in a sunlit lavender-and-daisy meadow on a softly glowing honeycomb base; a cyan beam passes through a luminous wireframe globe into the prism and refracts into glowing network streams that curve away to the right and dissolve into bokeh, with bright empty parchment light filling the left of the frame.$

SWIFT CSCF · DORA · NIS2 · NYDFS 500 · OSFI B-13

How to prepare your SWIFT penetration test in 2026 (and satisfy four regulators at once)

2026-06-24

Most institutions scope the SWIFT penetration test to the minimum the control names, then commission three more tests for three more regulators. That is the expensive way. One well-designed test, recorded against a shared framework, satisfies them all.

$Cinematic macro photograph: a rack-mounted firewall appliance with a shattered front face glowing orange at the fracture, behind a deep-violet hexagonal containment lattice, leaking golden credential keys along cyan signal filaments into a softly lit server-room corridor.$

DORA · NIS2 · ISO/IEC 27001

The bleeding edge: when 75,000 firewalls became the open door

2026-06-20

The device whose entire job is to keep intruders out became the way in. FortiBleed handed attackers verified credentials to ~73,932 Fortinet firewalls, half the internet-facing fleet, without a single new vulnerability. The exploit was patience.

DORA · Operational resilience

When one update grounded the world: the CrowdStrike outage as a DORA case study

2026-06-11

A single faulty channel file took down 8.5 million Windows machines, grounded flights and froze trading desks. Under DORA, the question is no longer 'whose bug?' but 'where was your simulation?'