Blog
Practical guides written by our consultants: how attacks work, what regulators ask for, and what to do about both.
Threats & advisoriesOctober 3, 202616 min read
Between 27 September and 1 October 2026, critical flaws in Citrix NetScaler, Cisco Catalyst SD-WAN Manager and Fortinet FortiMail were confirmed exploited. What each allows, what to do this week, why patching is only half the response, and how to assess the perimeter.
Read article
Compliance & GRCBusiness Impact Analysis: Setting RTO and RPO You Can Actually Meet After RansomwareOctober 1, 2026 · 16 min read
Application securityPCI DSS 6.4.3 and 11.6.1: Proving the Scripts on Your Payment Page Haven't Been Tampered WithSeptember 29, 2026 · 18 min read
AI securityOWASP Top 10 for LLM Applications 2026: What Changed and How to Update Your AI Test PlanSeptember 27, 2026 · 15 min readSeries · 11 parts
Which assessment you need, how to choose a laboratory, what happens during testing and how to check the result. Read in order.
81 articles in total
Compliance & GRCSeptember 25, 202621 min read
RBI replaced its cyber and IT governance instructions on 31 July 2026 with entity-wise Directions that took effect the same day. What applies to banks and NBFCs, the VAPT and DR drill cadence, six-hour reporting on DAKSH, the CSOC and CISO lines, and a 90-day plan.
Read article
Application securitySeptember 23, 202619 min read
Three of the ten API Top 10 categories are authorisation failures, and they account for most serious API findings. How BOLA, BOPLA and BFLA are each tested, the account matrix that covers them, what evidence a finding needs, and how to fix the pattern rather than the instance.
Read article
Compliance & GRCSeptember 22, 202617 min read
Most companies need more than one, and the order you do them in matters. Match the assessment to where your code runs, see the combinations that actually occur, and avoid the routing mistake that sends a server component to the wrong profile.
Read article
Compliance & GRCSeptember 21, 202617 min read
ADA requires its laboratories to be ISO/IEC 17025 accredited. What that standard actually demands of a laboratory, why accreditation is not the same as certification, how to read a scope of accreditation, and what accreditation does not mean.
Read article
Compliance & GRCSeptember 19, 202634 min read
The checklists are public and free. Where they live, how to read a requirement entry field by field, how to run a self-assessment, ten worked examples with the evidence to submit, and the screenshot rules that decide whether your submission is accepted first time.
Read article
Compliance & GRCSeptember 18, 202617 min read
Every ADA requirement is published openly, versioned and free to read, so you never have to take a vendor’s word for what a programme demands. Where to look, what to check in ten minutes, the version trap that catches careful people, and the licence position almost nobody mentions.
Read article
Compliance & GRCSeptember 17, 202632 min read
What the Mobile Application Security Assessment is, who has to do one, what the laboratory actually does to your app, and how often you have to repeat it. Covers Android, iOS and Meta Quest.
Read article
Compliance & GRCSeptember 16, 202621 min read
What an authorised laboratory actually does, phase by phase: the checks it must make before taking your money, the evidence standard behind every verdict, the independent reviewer who can withhold your report, and what happens when the lab gets it wrong.
Read article
Compliance & GRCSeptember 14, 202614 min read
A practical four-week plan before the laboratory starts. Most of what makes a first assessment expensive is avoidable, and almost all of it is avoidable before anyone bills you at lab rates.
Read articleShowing 9 of 77
Tell us what you are dealing with. A consultant who works on it every day will reply, under NDA from the first conversation.