ISO 27001 SME Risk Management Without the Document Factory
Efficiency is a thin chain from risk to treatment to Statement of Applicability — not ninety-three green cells on a borrowed spreadsheet.
Compliance & GRC
Security Insights & Research
Original analysis from our penetration testing, cloud security, and AI research teams — updated regularly. · Page 1 of 2
Filter by topic:Cybersecurity 3ISO 27001 2AI security 2cybersecurity compliance 2ISO 27001 SME risk management 1Statement of Applicability 1Annex A 1information security 1risk treatment 1SME compliance 1Cyber Essentials 1ISMS 1insider threats 2027 1insider threat SME 1shadow AI insider risk 1non-human identity 1CISA insider threat 1privilege misuse 1
Identity & Access
The Types of Multi-Factor Authentication a Fake Portal Still Beats
SMS still counts as MFA on the dashboard, which is why the shared kiosk and the helpdesk reset never leave it.
AI Security & Policy
The Fable 5 Shutdown Reads Like a Security Recall — It Isn't One
Anthropic disabled its newest models worldwide because export control asked for something SaaS identity cannot deliver: proof of nationality at request time.
Compliance & GRC
ISO 27001 vs SOC 2 vs Cyber Essentials Plus: Choosing the Right Framework
Side-by-side comparison of ISO 27001, SOC 2, and Cyber Essentials Plus. Which framework fits your market, budget, and customer base?
Penetration Testing
Active Directory Attack Paths in 2026: What's Changed and What Hasn't
Kerberoasting and pass-the-hash remain evergreen — but DCSync via Azure AD Connect and PRT token theft have fundamentally shifted hybrid environment attacks.
OffSecAI · AI Security
When AI Audits AI: Securing LLM Deployments with OffSecAI's Prompt Injection Framework
Prompt injection and data exfiltration via model outputs are emerging as critical enterprise risks. Here is how OffSecAI tests them.
Cloud Security
The 7 AWS Misconfigurations We Find in Every Enterprise Audit
A technical breakdown of the seven AWS misconfigurations that appear in nearly every enterprise cloud audit we conduct.
Compliance & GRC
NIS2 Directive: What UK & US Operators Must Do Now
UK and US organisations with EU exposure face NIS2 obligations. We break down Article 21 requirements, liability, and a 90-day plan.