Explore the publication
Cybersecurity
Identity, access, security operations, supplier risk and organisational resilience.
Explore this topic
Cybersecurity · Practical guide
SBOM requirements: ask for a file your security team can actually use
Tie the SBOM to the deployed release, validate its scope and identifiers, and rehearse the vulnerability workflow before treating delivery as acceptance.
Cybersecurity · Decision guide
How to evaluate an MDR service against your operating needs
An MDR contract is also an agreement about who may act. Compare response authority, missing telemetry and retained staffing before comparing prices.
Cybersecurity · Decision guide
SAST, DAST and SCA: buy coverage your delivery teams can use
Compare SAST, DAST and SCA by coverage, access and remediation work. Test real delivery paths before treating scanner findings as a release decision.
Cybersecurity · Explainer
SIEM, XDR and MDR: find the gap before buying another security layer
SIEM, XDR and MDR overlap, but the buying decision turns on evidence, investigation and authority to act. Follow one incident to find the missing capability.
Cybersecurity · Practical guide
A secure release checklist needs an exception decision, not another green tick
Tie secure release checks to the deployed artefact, verified provenance and explicit exceptions. Keep missing tests and rollback limits visible.
Cybersecurity · Practical guide
Ransomware recovery exercises: prove the service can take an order again
Design a ransomware tabletop and controlled restore around one business transaction, with safe boundaries, dependency failures and a clear acceptance decision.
Cybersecurity · Practical guide
RTO and RPO testing: stop the clock when the service works
Turn RTO and RPO targets into recovery tests with observable start and stop points, usable data and evidence of service recovery beyond a completed restore.
Cybersecurity · Decision guide
ZTNA versus VPN: migrate the access journey, not just the tunnel
Choose ZTNA or retained VPN access by application, device and failure mode. Test protocol support, denied access and recovery before retiring the old route.
Cybersecurity · Decision guide
Enterprise passkeys: choose who controls the credential lifecycle
Compare synced and device-bound enterprise passkeys through key custody, shared devices and recovery. Entra policy details show why configuration matters.
Cybersecurity · Explainer
Cyber resilience starts with the business service that must return
Set cyber resilience priorities around business services, shared dependencies and evidence of useful recovery, rather than an undifferentiated list of critical systems.
Connected topics
