Series
Each series collects every piece we've written on a single topic. Start with the overview, work through the rest in order, or jump in wherever fits.
Risk Quantification
FAIR-based methodology, sized for companies without an enterprise risk team.
Translating cybersecurity risk into dollars the CFO defends, the board funds, and the auditor accepts. FAIR-based methodology without enterprise overhead — for the 33 million US small and mid-sized businesses that don't have a CISO yet.
Explore the seriesCyber Insurance Is Broken
Why cyber insurance pricing inverted, and what to do about it.
The structural problem behind premium hikes, narrowed coverage, and claim denials: carriers can't see inside the policyholder. Coverage analysis, underwriting playbook, and the controls that actually move premium.
Explore the seriesSOC 2 in 2026
Real pricing, real controls, real framework choice. No marketing-speak.
Real pricing, the CI/CD controls auditors actually test, the framework choice against ISO 27001, and what changed in 2026 audit interpretation. The long-tail SOC 2 questions every founder Googles at 11pm.
Explore the seriesSomeone Else's Breach
When your vendor breaks: the discipline most TPRM programs are missing.
Vendor incident response as its own discipline — distinct from TPRM and from internal IR. The DC-TPIR framework: conditional exposure analysis, calibrated estimation, defensible decisions, institutional memory. Based on the practitioner's guide of the same name.
Explore the seriesThird-Party Risk Management
The standing vendor discipline that catches what per-incident analysis misses.
Per-vendor TPRM, concentration risk across the vendor portfolio, AI-specific vendor evaluation. The standing discipline that runs in the background between incidents — paired with the Someone Else's Breach cluster for incident response.
Explore the seriesISO 42001 and AI Governance
The first AI audits hit in 2027. Here's what they look for.
The 2027 ISO 42001 AI audits most mid-market companies will fail, the EU AI Act Article 12 logging requirements, and the 2027-2030 AI assurance market for the firms building this practice now.
Explore the seriesM&A Diligence
Quantitative cyber diligence from LOI to investment committee.
Quantitative cyber due diligence for PE and strategic acquirers: the CCOD worked example, the 72-hour IC playbook, the R&W insurance vs price-reduction decision, and the year-zero baseline for portfolio companies.
Explore the seriesOperating Security
The day-two playbook for security teams running the program, not building it.
The day-two playbook: incident response, awareness training, documentation, secrets management, data classification, and the operational practices that keep a security program running once the program exists.
Explore the seriesCompliance Frameworks
The framework decisions that determine which customers you can sell to.
Beyond SOC 2 — the broader compliance framework landscape (CMMC, ISO 27001, NIST CSF) and how to pick the right one for your sector, customer base, and growth trajectory.
Explore the seriesCompliance in Academia
The frameworks and AI-vendor expectations that determine which districts and campuses you can sell to.
FERPA, COPPA, CIPA, state student-privacy laws, and the AI-in-classroom vendor responsibilities that districts and universities now check for. What EdTech vendors, K-12 IT teams, and higher-ed compliance officers actually need to prove — with the 2027 enforcement posture already in scope.
Explore the seriesTrustworthy Autonomy
Autonomous compliance, measured and audited — not asserted.
Autonomous compliance is coming. The only version worth trusting is one you can measure and audit. Our POV on how to certify a compliance agent for autonomous action — and how to validate the test that produced the certification.
Explore the seriesContinuous Indicators
See what's coming. Indicators derived live, with named owners.
Risk indicators that move before the loss does. Auto-derived from your dependency graph, your scanner stream, your incident feed, and your risk quantification — calibrated against whether the warnings actually predict anything. The alternative to the 20-to-50 manually-defined KRIs that nobody has touched since 2023.
Explore the seriesThe vCISO Series
vCISO pricing, scope, and the 11pm founder questions — answered.
What a virtual CISO actually costs, what they actually do, and when a 25-person company needs one instead of a $415K full-time hire. Honest pricing, named contemporaries, and the vertical playbooks for healthtech and fintech founders Googling 'do we need a CISO yet' at 11pm.
Explore the seriesThe Cyber-Attest Practice
Methodology, tooling, and P&L for the modern cyber-attest practice.
Running a modern cyber-attest practice — SOC 2, ISO 27001, ISO 42001, PCI DSS, HITRUST, FedRAMP, and DORA — in one console. Cross-framework control drift, IPE completeness at scale, evidence integrity, independence-by-design, and the engagement-margin math that decides which of your services survive AI pricing pressure.
Explore the seriesHIPAA Compliance Software
The six HIPAA compliance platforms, ranked for the healthtech SMB buyer.
The six HIPAA compliance software platforms serving SMB and mid-market healthtech buyers in 2026 — what makes each different at the BAA and Security Rule layer, published pricing where it exists, and what separates real HIPAA-specific automation from generic compliance software with a HIPAA checkbox.
Explore the seriesGDPR Compliance Software
GDPR compliance software for US SaaS selling to EU — six platforms ranked.
GDPR compliance software for US SaaS companies selling into the EU. The six platforms serving SMB and mid-market buyers, Article 30 records-of-processing, DSAR workflow, Schrems II subprocessor management, and what separates real GDPR automation from cookie-consent-only tools.
Explore the seriesGRC Software
GRC software for the board meeting where 'high/medium/low' stopped being enough.
Governance, Risk, and Compliance software for the SMB and mid-market buyer whose board is starting to ask for quantified risk in dollar terms. Six platforms across the tiers — platform-augmented, mid-market compliance automation, and enterprise GRC — with the differences that matter for the CFO and audit committee.
Explore the seriesISO 27001 Certification
ISO 27001 certification without the marketing-page consultancy handshake.
ISO/IEC 27001:2022 certification for the SMB and mid-market buyer — the two-stage audit sequence, the four documents that make or break certification, choice of certification body (BSI, SGS, DNV, Schellman), real cost across three years, and what platform-augmented ISMS tools actually do versus what they leave to the ISMS lead.
Explore the seriesPCI DSS Compliance Software
PCI DSS v4.0.1 compliance software — six platforms ranked for the merchant and FinTech buyer.
PCI DSS v4.0.1 compliance software for merchants, service providers, and FinTechs handling cardholder data. Six platforms compared across four merchant levels + nine SAQ types + full ROC scope. What's different at CDE scoping, network segmentation validation, and quarterly ASV scan management — plus the March 31, 2025 v4.0.1 enforcement date for the 51 future-dated requirements.
Explore the seriesSecurity Questionnaires
Answer SIG Lite, CAIQ Lite, and any enterprise questionnaire honestly, with evidence, before the buyer follows up.
Enterprise security questionnaires — SIG Lite, full SIG, CAIQ Lite, CAIQ, and the custom Fortune 500 spreadsheets that show up on Wednesday and want a response by Friday. What buyers actually ask, how to answer defensibly, and how to turn every response into a reusable asset that compounds across future deals.
Explore the series