Blog
Strategy, psychology, engineering, and the patterns that actually compound.
178 articles • Page 1 of 20
The Kaseya VSA incident reached roughly 1,500 businesses through 50 to 60 providers, none of whom used the compromised product directly. Vendor contract security obligations are how requirements reach that far.
NYDFS guidance issued October 2025 tells regulated entities to review provider agreements before termination. Three vendor contract exit terms do most of the work, and all three are negotiable at signing.
Coalition found 64% of closed cyber claims in 2025 resolved with no out-of-pocket cost. Most claims pay. Here is what separates the ones that do not, and the five habits that close the gap.
Coalition put average global cyber claim severity at $116,000 for 2025, well under most policy limits. That means cyber insurance exclusions and sublimits, not the limit, decide what you collect.
Marsh recorded cyber rates down 4% globally in Q2 2026, the twelfth straight quarterly decline, while underwriting evidence standards tightened. What a cyber insurance renewal application asks now, and the folder to have ready.
An AI audit for a business is an inventory plus an evidence check on every AI system in use. IBM found 92 percent of organizations hit by an AI-related breach in 2026 had no AI access controls. The inventory is where the surprise is.
Cyber resilience tools cost versus breach recovery and fines is a recurring number you choose against a one-time number you do not. IBM's 2026 average breach is $4.99 million globally and $11.5 million in the US. The fine is rarely the largest line.
Questions to ask vendors about protecting proprietary data in collaborative scenarios cover ownership, retention, isolation, subcontractors, and model training. IBM's 2026 study found supply chain compromise added about $227,250 above the average breach cost.
Vendor security protocol questions for mixed data environments come down to who owns each control across your estate and theirs. CSA added Shared Security Responsibility Model columns to CAIQ v4 because unassigned controls are a leading source of cloud risk.
