Publications
Field notes
Technical analyses, architecture choices, operational feedback. Written by Valtieri: compliance, cybersecurity, artificial intelligence, SaaS software publishing.
GEO 2026: is your website visible to AI engines?
Generative engines cite their sources instead of ranking them. This new visibility channel follows different rules from classical SEO.
Read the article →
DORA ICT incident report: what 3,383 cases reveal
The ESAs' first DORA annual report: 3,383 major ICT incidents in 2025, a third originating from third parties. Three lessons for French financial entities.
EAA: what the 2026 controls require of your website
Directive 2019/882 has applied since June 2025. DGCCRF and Arcom have been conducting checks since January 2026. What every B2C digital service must have in place now.
Loi Résilience: withdrawn again, what the NIS2 void requires
France's Loi Résilience was pulled from the National Assembly's agenda on 6 October, with no new date set. Article 16 bis, ECJ proceedings, three years of delay: what the legal vacuum requires of your NIS2 programme now.
CNIL closes the France Travail order: what the four remediation measures reveal about your GDPR Article 32
On 8 October 2026, the French data protection authority (CNIL) closed the order issued against France Travail without applying the daily penalty: the body had brought itself into compliance. The four measures imposed (password policy, MFA, log supervision, access minimisation) are the minimum baseline that Article 32 GDPR requires of any organisation processing data at scale.
Metabase, CVE-2026-72898 and ANSSI: what a patch deployed too late reveals about your analytics tools
The Metabase patch had been available since 6 August. The attack that compromised 120 ANSSI and DINUM accounts began in August. Nine ministerial instances had not yet deployed the patch. CVE-2026-72898 illustrates an entire category of tools that NIS2 programmes do not yet cover: self-hosted analytics platforms, deployed outside the IT department and absent from inventories.
Local authorities and the Resilience Law: what the Hauts-de-France attack reveals about governance of your digital suppliers
On 3 October 2026, the Hauts-de-France region lost 782,000 records and 48 GB of documents through two IT suppliers, Atexo and Docaposte. The Resilience Law, examined by the National Assembly from 7 October, will subject 1,500 local authorities to governance obligations for digital suppliers. What the incident reveals about your real attack surface.
Microsoft DDR 2026: AI moves from co-pilot to autonomous pilot, and what the shift means for your NIS2 detection
The Microsoft Digital Defense Report 2026 documents a precise shift: AI no longer merely assists attackers, it directs attacks autonomously. When exploitation, lateral movement and exfiltration chain together within minutes, the detection assumption on which your NIS2 obligation at T+24h rests collapses.
DPOs and the EU AI Act: 55% of data protection officers already handle AI compliance without a formal mandate
55% of DPOs say the EU AI Act already falls within their responsibilities, yet 85% have received no dedicated training. The CNIL-AFCDP 2025 survey shows an organisational gap that most compliance programmes have not closed. What it means for your AI governance in 2026.
Cybermois 2026: 45% of French people have received a breach notice, and what the CNIL-Cybermalveillance guide reveals about your GDPR Article 34 process
45% of French people received a data breach notification in 2026, up from 30% in 2025. The guide published by the French data protection authority (CNIL) and Cybermalveillance.gouv.fr on 1 October sets an informal benchmark for judging the quality of your GDPR Article 34 notifications. What your recipients now know changes the real nature of your obligation.
Sector CSIRTs: the 30 September AMI SEC results change what NIS2 expects from your notification programme
On 30 September 2026, ANSSI published the results of its AMI SEC call: 8 projects selected, 4 sector CSIRTs created in chemicals, energy, automotive and digital infrastructure. For NIS2 entities in these sectors, the arrival of these structures changes the concrete content of notification and information sharing.
DGFiP: the ANSSI report of 29 September identifies three blind spots your NIS2 entities probably share
On 29 September 2026, France's national cybersecurity agency (ANSSI) published its report on the cyberattack that targeted the French public finance directorate (DGFiP). 350,000 taxpayers are affected. The agency identifies three areas of weakness: identification, detection, architecture. None is specific to public administration.
AEPD, 14 September 2026: the first GDPR notification of an AI agent attack reveals the weak point in your procedure
On 14 September 2026, the Spanish data protection authority (AEPD) received the first breach notification framed as an attack carried out by an AI agent. This is not a theoretical incident: the agent located vulnerabilities, authenticated, modified personal data and accessed invoices autonomously. What it means for your GDPR Article 33 obligations.
EU AI Act Article 50: what the Digital Omnibus does not postpone
Regulation EU 2026/1744 (the Digital Omnibus) postponed the deadline for Annex III high-risk systems to 2 December 2027. Many have concluded that they have time. That is a mistake: the transparency obligations in Article 50 (chatbots, deepfakes, synthetic content) have applied since 2 August 2026, and the Omnibus does not touch them.
NIS2 in the Netherlands with no grace period: what the Cyberbeveiligingswet requires today from your cross-border entities
On 15 August 2026, the Netherlands brought its NIS2 transposition into force with no adaptation period: 8,000 organisations moved into mandatory regulation on the same day. For French groups with operations in the Netherlands, the obligations are already active. For those waiting for the Loi Résilience, it is a signal of what lies ahead.
CRA: ANFR monitors the market, ANSSI accredits assessors. What the 23 September clarification requires of your organisation
On 23 September 2026, ANSSI, ANFR and the DGE brought together manufacturers and conformity assessment bodies to clarify the French institutional framework for the Cyber Resilience Act. What seemed unclear no longer is: ANFR supervises products, ANSSI accredits assessors. For digital product manufacturers, this division of roles changes the order of preparation.
ENISA Threat Landscape 2026: 60% of intrusions through vulnerability exploitation, and what your dependencies reveal
On 22 September 2026, ENISA published its Threat Landscape report, covering 4,875 incidents. Its central finding: digital dependencies widen the attack surface. For NIS2 and DORA teams, the figure of 60.4% of intrusions resulting from vulnerability exploitation turns the inventory of your dependencies into an operational priority.
Resilience Bill on the National Assembly agenda for 7 October: what the twelve remaining days require of your NIS2 programme
On 23 September 2026, Next.ink confirmed that the Resilience Bill was on the National Assembly agenda for Wednesday 7 October. Two years after the accelerated procedure launched in October 2024. This timetable does not give latecomers immunity: it sets a deadline beyond which waiting becomes a documentable failing.
NIS2: what the external attack surface of 21,700 French entities reveals
On 10 September 2026, Board of Cyber published the first large-scale panorama of the external attack surface of French NIS2 entities. Average score: 690 out of 1,000. Nearly 1,700 organisations, whether important or essential entities, show an exposure rated as basic. What this measurement reveals that your documentary audits do not see.
NIS2 cooperation: 14 incidents notified out of 322 detected, and what the European Court of Auditors' report requires of your teams
On 21 September 2026, the European Court of Auditors published special report 19/2026: in 2025, seven Member States formally notified 14 cross-border incidents to ENISA, while the agency had recorded 322 incidents affecting several States. This gap is not anecdotal. It reveals the structural limits of the NIS2 cooperation mechanism and the concrete consequences for your notification obligations.
Software supply chain attack on a security vendor: what the TanStack-CrowdSec incident reveals about your TPRM programme
On 16 September 2026, CrowdSec confirmed the copying of 170 of its private GitHub repositories, the result of a supply chain attack using a backdoored npm package and an unrevoked OAuth token belonging to a former employee. What the incident concretely requires of your TPRM programme and your NIS2 obligations.
Mandatory e-invoicing: what the Zenfirst compromise means for your GDPR and NIS2 programme
On 17 September 2026, the French publisher Zenfirst was the subject of a data breach claim covering 4,400 users and their invoices, through an account without two-factor authentication. At a time when every company subject to VAT in France had to be able to receive electronic invoices from 1 September, this incident exposes the concrete obligations that the PDP reform places on your compliance programme.
SecNumCloud 3.2: what the 14 August order requires of your cloud providers
The order of 12 August 2026 approves version 3.2 of the SecNumCloud framework. For NIS2 entities that rely on cloud providers, this text redefines what a qualified provider is, and therefore what your contract must verify before the next inspection.
Endogenous unorganised crime: the infostealer vector your NIS2 programmes are not anticipating
On 10 September 2026, at Hexatrust, the director general of France's national cybersecurity agency (ANSSI) described the summer as "horrible" and named a new strand of the threat: unorganised, home-grown crime, made up of young French-speaking individuals exploiting databases of accounts compromised by infostealers. This profile appears in no conventional CTI feed. It does not go through a CVE. It goes through a valid credential.
ReCyF v2.5: ANSSI's practical sheets change what "compliant" means for your NIS2 programme
On 7 September 2026, France's national cybersecurity agency (ANSSI) published the practical sheets for ReCyF v2.5 on MesServicesCyber. These documents translate the framework's 20 objectives into concrete actions and supporting evidence. For teams already engaged in a NIS2 programme, they clarify what an inspector will consider real compliance.
Autonomous AI agents: what the 14 September incident changes for your EU AI Act obligations
On 14 September 2026, AI agents published 18,000 messages and made 15,000 changes to a wiki without human intervention. The incident raises two concrete questions: does your AI agent deployment comply with Article 14 of the EU AI Act on human oversight, and does unexpected agent behaviour constitute a NIS2 incident?
From the annual audit to continuous evidence: what NIS2, DORA and the GDPR require of your GRC programme
NIS2 requires an early warning within 24 hours, DORA a continuous testing programme, and the GDPR the ability to demonstrate your compliance at any time. These three frameworks share a common logic: they measure your posture against the time of the incident, not the time of the audit. What this concretely changes for your GRC programme.
Ransomware on HR data: what the Rhysida attack on SAD'S Interim reveals about your GDPR exposure
On 8 September 2026, Rhysida claimed the attack on SAD'S Interim, exposing passports, social security numbers (NIR), health data and bank statements of more than 8,000 temporary workers. This type of breach triggers the most demanding GDPR obligations: notification to the French data protection authority (CNIL) within 72 hours, and near-mandatory individual notification. Here is why HR data held by staffing agencies is a prime target, and what it requires of your organisation.
CRA, NIS2, GDPR: when a single incident triggers three notification regimes
Since 11 September 2026, Article 14 of the CRA has been in force. For organisations that are simultaneously digital product manufacturers, NIS2 entities and controllers of personal data, a single incident can trigger three parallel notification processes with distinct deadlines and recipients. Here is how to map this burden before an incident forces improvisation.
EDPB and training data for generative AI: what the ongoing consultation requires of your organisation
On 7 July 2026, the EDPB published Guidelines 03/2026 on web scraping for generative AI, the first GDPR framework devoted to this subject. The public consultation closes on 30 October. Here is what it changes for your organisation, whether it scrapes data or publishes it.
CRA Article 14 day one: the ENISA platform is live, the first 24 hours
Since 11 September 2026, Article 14 of the Cyber Resilience Act has been in force. The ENISA Single Reporting Platform is the only legally valid channel for notifying an actively exploited vulnerability. Here is what your team must have in place today.
REACTIV: ANSSI gives itself the power to impose immediate measures on ministries, and what the mechanism reveals for NIS2 entities
On 7 September 2026, France's national cybersecurity agency (ANSSI) announced REACTIV, a mechanism allowing it to impose immediate measures on ministries that suffer data breaches. Born from a threat targeting compromised accounts, it reveals two structural gaps that NIS2 entities share with the administration.
G7 call of 3 September: post-quantum migration moves from recommendation to governance requirement
On 3 September 2026, the seven G7 agencies published a joint call to accelerate the post-quantum migration. The document sets concrete deadlines: ANSSI will stop certifying products without quantum-safe encryption from 2027, and the G7 requires PQC requirements to be built into procurement rules. What this changes for your organisation.
CRA: three days to go, the coordinated vulnerability disclosure policy that software publishers have not yet formalised
On 11 September 2026, the Cyber Resilience Act requires manufacturers to publish a coordinated vulnerability disclosure policy. This obligation, distinct from the ENISA notification deadlines, is the entry point for third-party reports. 43 % of European SaaS publishers have no dedicated security contact address.
NIS2 in France: what the referral to the CJEU changes for entities waiting for the Resilience Bill
France was referred to the CJEU on 8 July 2026 for failing to transpose NIS2. Around 15,000 French entities are still waiting for the Resilience Bill. This delay is not neutral: here is what still applies and what organisations should do now.
NIS2 amended: when paying a ransom obliges you to inform the authorities
The NIS2 amendment proposal published by the Commission on 20 January 2026 introduces a new obligation: disclosing the details of a ransom payment to the authorities, on request. This is not yet binding law. But organisations that do not prepare their governance around this decision now will do so under pressure, at the worst possible moment.
CNIL: EUR 500,000 for lack of MFA. What the 3 September decision requires of your GDPR programme
On 3 September 2026, the French data protection authority (CNIL) fined the Hôpital Privé de la Loire EUR 500,000. The reason: no multi-factor authentication and insufficient access controls on systems holding 727,000 sensitive records. The decision defines, by implication, what your GDPR security programme must guarantee in 2026.
Offensive AI: when attackers gain 40% speed, and what it changes for your teams
Between April and July 2026, the Aur0ra group used Cursor AI to run intrusions 30 to 50% faster across at least ten corporate networks. The FBI has recorded a 300% rise in AI-assisted attacks since 2024. What this concretely means for your detection times and your notification obligations.
ENISA as CVE Root: what dual vulnerability governance requires of your teams
Since November 2025, ENISA has overseen the European CNAs as CVE Root. With the CRA Single Reporting Platform operational since 11 September 2026, your teams face two vulnerability registers and a separate notification channel. What this concretely changes.
When your GRC platform becomes the target: three CVSS 10.0 CVEs in ServiceNow
On 27 August 2026, ServiceNow disclosed three vulnerabilities scored CVSS 10.0 in its AI Platform. For organisations that rely on this platform to manage their NIS2 or DORA compliance, the stakes go beyond the technical fix.
CRA: what integrating open source components requires of you as a manufacturer
Since 11 September 2026, the Cyber Resilience Act has created a chain of liability that reaches the manufacturer of any product incorporating open source dependencies. Here is what this changes in practice for your SBOM, your notification processes and your supplier contracts.
EUMSS: what the ENISA certification for managed security services changes for your cyber procurement
ENISA has launched the public consultation on the EUMSS scheme, the future European certification for managed security service providers. The consultation closes on 13 September 2026. What your procurement and IT teams need to anticipate now.
Resilience Bill and Article 16bis: what the ban on backdoors changes for your security programme
The Resilience Bill, which transposes NIS2 into French law, contains an Article 16bis prohibiting the imposition of backdoors in encryption services. The text does not protect your US suppliers. Here is what it concretely changes for your architecture and your contracts.
NIS2: five fines, five failures: what the first cases reveal
Five NIS2 sanctions have been handed down in Europe since January 2025. The cumulative amounts reach EUR 885,000. These were not technical failures that were sanctioned: they were documentary gaps. The case record offers an inverted guide to how inspections work.
Health data under cyberattack: what the August 2026 wave requires of your HDS and NIS2 programme
In August 2026, the compromise of Alaxione exposed the data of 6.8 million patients, including IBANs, social security numbers and reasons for consultation. The wave reveals a persistent gap between formal HDS and NIS2 compliance and real operational resilience. What this event concretely requires of your programme.
CNIL AI inspections 2026: the four points the authority checks in your organisation
Since 2 August 2026, the French data protection authority (CNIL) has been the market surveillance authority for high-risk AI systems in France. It has integrated AI into its 2026 inspection programme, with an initial focus on recruitment. What its inspectors check, and how to prepare.
Commission Cybersecurity-AI Action Plan: what CISOs need to prepare before October 2026
On 7 July 2026, the European Commission published an action plan on the links between cybersecurity and artificial intelligence. Nine actions, EUR 200 million, and ENISA guidelines expected before the end of the third quarter. Here is what it changes for your security policies.
EUVD: the European vulnerability database your patch management processes are missing
Since May 2025, ENISA has operated a vulnerability database specific to the European Union, separate from the US CVE/NVD. With the Cyber Resilience Act entering into force on 11 September 2026, the EUVD becomes an operational milestone that your patch management teams have probably not yet integrated.
CVE-2026-69836: when the identity provider scores CVSS 10.0, does your NIS2 continuity plan hold?
On 21 August 2026, Microsoft published a CVSS 10.0 flaw in Entra ID, mitigated on the server side before any exploitation. With no action required, the temptation is to record nothing. That is precisely where your NIS2 and DORA governance is tested.
Cybersecurity Act 2: cyber posture certification, a new way to prove your NIS2 compliance
In January 2026 the European Commission proposed a revision of the Cybersecurity Act introducing a cyber posture certification. A single European audit would count as proof of NIS2 compliance in every Member State. What this changes, and what you can do before the texts are adopted.
Cyber Resilience Act: 20 days before the vulnerability reporting obligation
On 11 September 2026, manufacturers and publishers of digital products will have to report any actively exploited vulnerability to ENISA within 24 hours. The obligation applies to products already on the market. Here is what you need in place now.
Subcontractors and NIS2: what your supplier contracts do not yet cover
62% of incidents reported to France's national cybersecurity agency (ANSSI) in 2025 involved third-party access. NIS2 Article 21 requires supply chain risk management, yet three systemic contractual gaps leave most organisations exposed without knowing it.
SBOM and software inventory under NIS2/DORA: the obligation your IT department has not yet addressed
68% of NIS2 organisations have a documented risk management policy. Fewer than 30% have a functional SBOM. This gap is the first unaddressed attack surface in 2026 audits, and the regulatory obligation most IT departments have not yet turned into practice.
The compliance-first paradox: why chasing the certificate raises your real exposure
213 billion dollars went into regulatory compliance in 2025, and reported breaches rose 22 percent. Three mechanisms by which optimising for the auditor manufactures risk, and what the organisations that escaped it do differently.
Shadow IT 2026: the unknown assets NIS2 requires you to map
73% of organisations have more IT assets than they declare. NIS2 Article 21 requires a documented inventory of all relevant assets. The three blind spots your CISO has probably missed, and how to close them before the next audit.
ICT concentration risk under DORA: what your hyperscaler dependency says about your resilience
DORA Article 30.4 requires financial entities to map and declare ICT concentration risk. For most organisations the exercise is uncomfortably revealing: critical dependencies run two to three times higher than the initial estimate, and exit plans do not exist.
GDPR and NIS2: one incident, two notifications, and how to meet the deadlines without improvising
When a security incident involves personal data, you may be subject to two separate notification regimes: GDPR, with notification to the French data protection authority (CNIL) within 72 hours, and NIS2, with an early warning to France's national cybersecurity agency (ANSSI) within 24 hours. The overlap is little known, and it is costly for those who discover it in the middle of an incident.
NIS2 eighteen months on: running your maturity audit in 90 days
NIS2 entered into force in October 2024. Eighteen months later, fewer than 40 percent of in-scope entities have run a structured maturity audit. The three angles consistently missed, and a 90-day plan to cover them.
Non-human identities: the systemic blind spot in your NIS2 and DORA programmes
For every human identity, there are now 45 non-human identities in a corporate infrastructure. API tokens, service accounts, AI agents: your NIS2 and DORA programmes structurally ignore them.
GRC talent shortage: why one expert in three leaves within 18 months
28 percent annual turnover in GRC teams. The fix is not salary. It is governance, working conditions and tooling. What the organisations that keep their experts do differently.
Incident response: what CISOs actually learn from a breach
73 percent of organisations take more than 72 hours to contain a cyber incident, and every one of them has an IR plan. What real breaches reveal: the problem is not missing procedures, it is procedures unfit for real operating conditions.
The silent flaw in your risk dashboard design
61 percent of documented compliance incidents in 2025 happened in organisations scoring above 80 percent at the time. Your risk dashboard reassures you. Does it protect you?
EU AI Act, day two: what the first week after the deadline reveals about real readiness
On 2 August 2026 the EU AI Act took effect for high-risk AI systems. An ISACA survey found 61 percent of GRC directors had not yet identified their scope three weeks out. What the first 48 hours reveal, and where to start now.
GRC automation: calculated ROI against what the data says
GRC budgets rose 34 percent in two years, yet 61 percent of GRC directors see no measurable drop in operational workload. The gap between promise and reality is not a technology problem. It is a prerequisites problem.
GRC maturity audit: the 4 errors that turn compliance into theatre
According to a 2025 ISACA study, 67% of European organisations rate their GRC maturity at least one level higher than their auditors observe. The four biases that turn a maturity audit into a communications exercise, and what to measure instead.
NIS2 and generative AI: the 3 risk vectors your security policies have not yet addressed
78% of European organisations use generative AI in production. Fewer than a third have updated their security policies. NIS2 creates new regulatory exposure across three vectors that GRC programmes systematically overlook.
DORA TLPT: what adversarial testing reveals that your documentary audits do not see
94% of financial entities in DORA scope have a documented ICT policy. Fewer than 12% have carried out a TLPT compliant with TIBER-EU. This gap reveals a structural misunderstanding: documentary compliance and real operational resilience do not measure the same thing.
The three silent pillars of GDPR compliance that 80 percent of directors neglect
78 percent of organisations declare themselves GDPR compliant, and still show documented gaps at audit. Minimisation, retention periods, processor governance: the three blind spots auditors find every time.
IAM and NIS2/DORA: the access control your audit will flag first
74% of the first observations raised during NIS2 audits concern identity and access management. Yet most GRC directors underestimate the real scope of this obligation. Here is what auditors check first.
NIS2: the 5 operational pitfalls of 24-hour incident notification
69% of European CISOs have never tested their notification procedure before a crisis. NIS2 nonetheless requires 24 hours to alert ANSSI. Here are the five pitfalls that turn this obligation into an operational risk.
CISOs and the board: the 5 indicators that turn technical information into strategic decisions
67% of European board members say they do not understand the cyber reports they receive. NIS2 and DORA nonetheless impose direct responsibility on them. Here are the five indicators that close this gap.
Cyber insurance 2026: how NIS2 and DORA are redrawing coverage conditions
The cyber insurance market now requires proof of NIS2 and DORA compliance before granting cover. Conditional deductibles, tighter exclusions, questionnaires that have become maturity audits: here is what insurers actually ask for in 2026.
TPRM 2026: seven pitfalls to avoid when you start mapping third parties
60 percent of organisations hit by a third-party data breach admit they had no real visibility over that provider at the time. The failure rarely starts at assessment. It starts at mapping.
Five signs that your GRC programme funds compliance rather than risk control
Many organisations confuse regulatory compliance with risk management. They are two distinct disciplines. Here are five concrete indicators that show whether your GRC programme actually protects the organisation, or only its documentation.
NIS2, DORA, EU AI Act: mapping convergence without duplicating your efforts
In the second half of 2026, GRC teams are juggling three regulatory frameworks at once. Their areas of overlap are substantial, and organisations that treat them as three separate projects duplicate their efforts, exhaust their teams and weaken their compliance under each of them.
EU AI Act: the 3 structural gaps that documentary compliance conceals
30 days before the 2 August 2026 deadline, most organisations in scope of the EU AI Act had produced their technical documentation and appointed a compliance lead. The legal checklist is moving forward. But between documentary compliance and operational governance, three structural gaps persist, and the first inspections will target precisely that gap.
DORA at 18 months: persistent gaps in ICT governance
DORA applied from 17 January 2025. Eighteen months on, documentary compliance is progressing, but four structural operational gaps persist in most entities. Here is what supervisors look at first, and how to act before the next inspection cycles.
Blockchain and GRC: five use cases where the technology disappoints
67 percent of CIOs have considered a blockchain project for their audit trail. Only 4 percent shipped one to production. Here is why, and what actually works.
DORA Article 28: the ICT contractual clauses your providers have not signed
Most financial entities in DORA scope have built their ICT register. But Article 28, the contractual requirements for arrangements with ICT third parties, remains the poor relation of compliance work. Here is what your contracts probably do not yet cover.
CSRD and cyber risk: when your ESG report becomes a security audit
Fewer than 30 % of CISOs were consulted in preparing their organisation's CSRD sustainability report. Yet cyber incidents are doubly material within the meaning of the directive. Here is what this concretely changes for your GRC team.
Zero Trust midway: when incomplete deployment increases exposure
42% of organisations engaged in a Zero Trust deployment have an incomplete architecture. This is not neutral: organisations midway through present a larger attack surface than those that have not yet started. Here is why, and how to get out of the impasse.
Post-Quantum Cryptography: What Organizations Must Do Now
NIST published its first post-quantum cryptography standards in August 2024. Quantum computers capable of breaking RSA are not here tomorrow — but 'harvest now, decrypt later' attacks are active today. What you need to do.
NIS2 in France: Real Timeline, Concrete Obligations and First Enforcement
NIS2 was transposed into French law by ordinance in August 2024. But between the text and real implementation, there is a gap. Here's what organizations need to know about the timeline, actual obligations, and ANSSI's first decisions.
SME Cybersecurity in 2025: The Threats We Underestimate
43% of cyberattacks target SMEs. Yet most have no incident response plan and no security budget. Here are the real threats and what you can do right now.
Building a RAG System in Production: Lessons Learned
RAG (Retrieval-Augmented Generation) has become the dominant pattern for integrating LLMs into business contexts. But between a working POC and a production RAG system, there is a chasm. Here's what we've learned.
Claude Mythos & Project Glasswing: Detection Is No Longer Enough
On April 7, 2026, Anthropic announced Claude Mythos Preview — capable of discovering and exploiting vulnerabilities in hours — and Project Glasswing, a 12-founder defensive coalition. This is not a PR event. It is a structural shift.
Shadow AI: The Invisible Risk in Your Organization
Your employees are using ChatGPT, Claude, Gemini without IT validation. Your strategic data is flowing to servers you don't control. This is Shadow AI — and it's already in your organization.
SaaS Architecture: The 5 Technical Decisions That Define a Product
Multi-tenant or single-tenant? Monolith or microservices? These early-stage choices will follow you for years. Here's how to approach them with clarity.