Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

NIST AI RMF and ISO/IEC 42001 answer different questions, so the choice is rarely about which one is better. One gives you a risk process your engineering teams can run. The other gives you a management system an auditor can certify. Organizations that treat them as rival options usually pick the wrong one for the problem in front of them. ‍

Directors ask for AI risk reporting because oversight failure is personally actionable. Under the Caremark line of cases, a board that cannot demonstrate it monitored a material risk carries exposure of its own, and AI has moved into that category for most enterprises. The request is rarely curiosity about the technology. ‍ The framing determines what belongs in the pack.

Most vendor onboarding and app access work is waiting and follow-ups. Waiting for someone to notice a form came in, assign a tier, chase a questionnaire, or dig up the context behind a Slack request. Risk Automations workflows remove that wait and automate the follow-up. A trigger fires, and the workflow runs to a concrete outcome: a ticket created, a message sent, a risk tier assigned. To make those workflows easier to launch, Risk Automations includes an ever-expanding template library.

CVE-2026-34265 is a memory corruption vulnerability in the Application Server ABAP component of SAP NetWeaver and the ABAP Platform. The flaw stems from logical errors in how the SAP kernel parses DIAG protocol messages, the proprietary protocol that carries traffic between the SAP GUI presentation layer and the application server. Malformed input reaching the parser leads to an out-of-bounds write, classified as CWE-787. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

Sir Robert Peel defined good policing as "the absence of crime and disorder, and not the visible evidence of police action in dealing with them." Gregory Francis of the Netherlands National Police quoted this at the INTERCOP conference held at INTERPOL headquarters, and this principle framed the entire event. Young people are increasingly drawn into cybercrime through the platforms where they already spend their time — Discord, Telegram and gaming servers.

Has your organization been exposed? How can you act on the exposures that matter most? What’s the best way to demonstrate measurable risk reduction?

Between April and August 2026, at least six distinct AI-security efforts launched across North America, Europe, and Asia, several in the same week as one another and some for contradictory reasons. This piece maps 18 of them: what each says it's trying to achieve, who founded and backs it, and what it has actually shipped versus only announced.

A Reddit thread on r/activedirectory asking whether Active Directory is going away pulled in loads of comments, and the most upvoted answer compared AD to COBOL: still running, still critical, still not going anywhere. That comparison holds up when you check whether COBOL is still used today, since it runs core banking and government systems decades after its supposed retirement. The real risk for most IT teams isn't AD disappearing.

Most vault programs track a numerator without a denominator. See how vault coverage turns secrets management into a measurable, reportable control.