-
Before You Protect Anything, Decide Who Is Accountable
Cybersecurity governance starts before the first control is deployed. NIST CSF 2.0’s GOVERN Function asks a fundamental question: who has the authority to make cybersecurity…
-
Assurance Is the Missing Layer in AI Governance
AI governance isn’t complete without assurance. Boards need independent validation that governance controls are operating as intended.
-
The Government Wants Frontier AI Companies to Report Incidents. It Hasn’t Defined How.
The U.S. wants serious frontier AI incidents reported, but key definitions and thresholds remain unsettled. Organizations should not wait for regulation to build AI incident…
-
Your AI Dashboard Probably Measures the Wrong Things
Most AI dashboards measure technical performance. Boards need governance metrics that demonstrate accountability, oversight, risk, and evidence.
-
A Major Cyber Information-Sharing Liability Shield Expires in 9 Days
CISA 2015 expires September 30, potentially changing legal protections for cyber threat sharing. Organizations should know what protections they rely on before they disappear.
-
The Five AI Policies Every Board Should Require
Every board should require five core AI policies that establish accountability, manage risk, and create the foundation for effective AI governance.
-
CISA Is Ending Six Free Critical-Infrastructure Cyber Assessments
CISA is ending six free cyber assessment services for critical infrastructure. The change exposes a larger governance question: can organizations assess and govern their own…
-
AI Policies Don’t Govern AI
AI policies set expectations, but governance creates accountability. Effective oversight requires more than documents—it requires action.
-
The Court Wasn’t Breached. Its Vendor Was. The Consequences Were the Same.
A vendor breach involving court data shows why third-party cyber risk does not transfer accountability. Organizations can outsource systems, but not governance.
-
The Most Dangerous AI Risk Isn’t Hallucination
The greatest AI risk isn’t hallucination. It’s weak governance that allows technical failures to become enterprise-wide crises.
-
The AI Industry Wants a Defensive Cyber Surge—But Leadership Accountability Cannot Be Outsourced to Better Models
AI can accelerate cyber defense to machine speed, but faster models cannot assume leadership accountability. Organizations need governance that can make accountable decisions just as…
-
SPF Passed. DKIM Passed. I Still Wouldn’t Click the Link.
SPF passed. DKIM passed. The sender and event were legitimate. But the email still contained a link I would not click. Here is why authentication…
-
AI Risk Is Enterprise Risk
AI risk extends far beyond model accuracy. Effective governance treats AI as an enterprise risk affecting every business function.
-
The FTC Is Showing How Data Governance Can Become Enforcement Risk
The FTC’s personalized-pricing proposal exposes a growing governance risk: data may be properly collected and protected while its new use creates regulatory exposure.
-
Every AI Decision Needs an Owner
Every significant AI decision needs a clearly defined owner. Authority, accountability, and decision rights are the foundation of effective AI governance.
-
More Than 100 U.S. Water Systems Were Targeted in a Single Month
More than 100 internet-exposed U.S. water-sector systems were targeted in July 2026. At that scale, known OT exposure becomes more than a technical weakness—it becomes…
-
Governing AI Is Not the Same as Managing AI
Managing AI delivers results. Governing AI provides oversight, accountability, and strategic direction to ensure those results serve the enterprise.
-
Cyber Insurers Are Rewriting Policies for Rogue AI Agents
Autonomous AI agents are creating cyber losses that challenge traditional insurance definitions. The emerging governance question is whether organizations can prove the chain between human…
-
The AI Accountability Gap
Organizations can explain what AI does. Fewer can identify who is accountable when AI creates legal, financial, or reputational risk.
-
The 72-Hour Cyber Reporting Clock Is Really a Governance Test
CIRCIA’s 72-hour cyber incident reporting requirement is more than a compliance deadline. It tests whether organizations can move from detection through classification, decision authority, reporting,…