Cybersecurity Insights for Business Leaders

The SEC's FY 2027 exam priorities name SI-generated phishing, deepfake social engineering, Reg S-P/S-ID programs and vendor risk. The artifacts to stage now.

NIST's ten agent identity management tenets, explained for deployers: zero standing privilege, just-in-time grants, and the SOC 2 and ISO 42001 evidence angle.

OCC super intelligence framework: what Bulletin 2026-54 means for bank AI exams, its 16 components and 4-tier scale, and what fintech vendors should prepare.

SOC 2 Trust Services Criteria 2027 update: AI points of focus, sharper vendor-risk and resilience expectations, key dates. Comments close Jan. 15, 2027.

A tampered Claude Code extension sat in Cursor’s marketplace for 11 hours. What the attack says about shadow AI, and the five controls to run this quarter.

Inside the $6.3 billion Binance hack: a DevOps laptop, a service container, and a signing path no one questioned. What mid-market teams should change.

ENISA analysed 8,257 incidents from 2025. Volume says DDoS; impact says ransomware and AI. What mid-market security teams should prioritise in 2026.

OWASP LLM Top 10 2026: Excessive Agency rose to #3, Improper Output Handling fell to #10; System Prompt Leakage is now Hidden Context Exposure. What changed.

EN 18286:2026, the first AI Act harmonised standard, brings a presumption of conformity for Article 17 QMS duties. 400 days to 2 December 2027.

A vendor's ISO 27001 certificate is not proof by itself. The 2026 buyer checklist: edition, amendment, accreditation chain, scope and surveillance.

ESMA's 8 October 2026 stablecoin opinion orders MiCA CASPs to cease non-compliant stablecoin services; remediation within three months (8 January 2027).

Cyber insurance rates fell four years running while 2025 losses hit $20.877 billion. What mid-market fintech should prove at renewal before binding.

EO 14412 set federal post-quantum deadlines for 2030 and 2031. The G7 and Treasury made quantum-readiness a sector program. What actually binds fintech.

Three companies earned ISO 42001 certification in two weeks. What an AIMS certificate guarantees, and why it is not EU AI Act conformity.

The NSA's May 2026 MCP security guidance, translated into a mid-market checklist: inventory, boundaries, sandboxing, logging, and scans.

The SEC brought three AI-washing actions in six weeks. What fintech vendors must fix now.

The EU CRA's 24-hour vulnerability reporting went live 11 September 2026. Deadlines, legacy scope, SaaS obligations.

NIST's SP 1353 draft shows three AI-assisted CSF 2.0 workflows with human-review guardrails. Comments close October 15, 2026.

The Fed’s GENIUS Act proposal writes a five-element information security program into proposed Section 247.13(b) and names attacker-side AI as a threat. What issuers and their vendors must build.

SR 26-2 and OCC Bulletin 2026-13 exclude generative and agentic AI from formal model risk. Examiners test AI anyway. What vendors selling into banks should build now.

The Fed, OCC, FDIC and NCUA proposed replacing the 2023 third-party risk guidance with a risk-based, tailored approach. What it means for fintech vendors.

The FSB told G20 ministers frontier AI could rewrite cyber risk economics through concentrated third-party providers. What fintech and SaaS operators do now.

How to decide between executive security leadership on a flexible basis and committing to a full-time hire, and what each model actually buys.

The signals that informal security ownership has stopped keeping pace with the business.

Why audit readiness and security maturity are related but different things, and what happens when they are confused.

SOC 2's criteria predate generative AI, so auditors improvise AI evidence requests no AICPA criteria define. What AI sellers and buyers must do now.

CIRCIA's final rule lands soon: 72 hours to report an incident, 24 for ransom payments, 316,244 entities in scope. What fintech and SaaS teams must do now.

Texas TRAIGA's complaint portal is live. Penalties run $10K–$200K per violation plus $2K–$40K/day. What fintech and SaaS teams must do now.

NSA, CISA and the FBI flagged industrial-scale AI distillation days before Congress aligned on AI risk. What regulated companies should do this quarter.

NYDFS's Sept 10, 2026 guidance shows examiners what a risk assessment must prove. For fintech and crypto firms, AI adoption is now a trigger event.

The Digital Omnibus moved parts of the EU AI Act to 2027–2028. Post-market monitoring and incident reporting went live 2 August 2026. What deployers owe now.

California's SB 813 and AB 1405 create the first US Independent Verification Organizations and AI Auditor Registry. What deployers should do before 2028.

Only 34% of companies trust their AI agents. Five AI agent governance controls mid-market fintech and SaaS teams can adopt before an auditor or insurer asks.

How much does a fractional CISO cost in 2026? Published market ranges by model and company size, plus the fractional vs full-time breakeven math.

Shadow AI is the AI your company didn’t buy. A practical discovery-and-governance roadmap from someone who has run the inventory exercise inside real companies.

Seven security priorities for FinTech, payments, and digital asset CISOs, ranked by what actually breaks first. Written from inside a Nasdaq-listed crypto platform.

A founder told me his Series B term sheet was delayed six weeks because of one security question. Here’s what it was, and how to make sure it doesn’t happen to you.

Most crypto companies fail SOC 2 on key management and access control, not because they’re sloppy, but because the auditor doesn’t understand digital assets.