Digests

62 digests · 49 publishers · documents behind a lead form are not digested

• Industry association · ACT-IAC · September 11, 2026 · 8 pages

  ACT-IAC: Proposals to Modernize the Federal CISO Handbook into a Web-Based Playbook

  ACT-IAC white paper for the Federal CISO Council. It proposes replacing the 2019, 100+ page PDF handbook with a living web playbook built on four proposals. It is not the handbook itself.

  Digested October 22, 2026 · 3 min read · federal cybersecurity, ciso role, zero trust, workforce

• Vendor guide · Atos · May 28, 2026 · 16 pages

  Atos whitepaper: Adaptive Cyber Resilience, a Prepare-Respond-Adapt model for AI-speed threats

  Atos Group whitepaper arguing that security must shift from control accumulation to a resilience operating model (Prepare, Respond, Adapt) with AI, sovereignty and board-level outcome metrics.

  Digested October 22, 2026 · 3 min read · cyber resilience, agentic ai, digital sovereignty, post quantum cryptography

• Vendor guide · AXA XL · March 2026 · 21 pages

  AXA XL and Thales, Resilience at Scale: 2026 cyber risk and leadership priorities

  A March 2026 AXA XL report with Thales on four 2026 cyber risk shifts and five board priorities. Its main point: resilience is a governance duty, not only a technical one.

  Digested October 22, 2026 · 3 min read · cyber resilience, ai governance, regulation, third party risk

• Public body · CISA · September 2026 · 113 pages

  CISA Insider Threat Mitigation Guide 2026: building a program to detect, assess, manage

  CISA's September 2026 guide, 113 pages, explains how to build an insider threat program. Its core point: a multidisciplinary, culture-led program using detect and identify, assess, manage.

  Digested October 22, 2026 · 4 min read · insider threat, security program, ai governance, workplace violence

• Public body · Office of Management and Budget · May 22, 2026 · 8 pages

  OMB M-26-14: risk-based federal logging rules replace M-21-31, with a maturity model

  OMB memo M-26-14 (May 22, 2026) rescinds M-21-31 and sets prioritized federal logging goals, a 6/12-month retention baseline, a CISA reference architecture and dated maturity targets.

  Digested October 22, 2026 · 4 min read · logging, federal policy, regulation, security operations

• Public body · CISA · September 16, 2026 · 22 pages

  CISA guidance on cyber decoys: tripwires, honeytokens and MITRE Engage planning

  CISA's introductory guidance on placing decoys inside networks to detect intruders early. It uses MITRE Engage and ATT&CK to plan, deploy and test tripwires and honeytokens.

  Digested October 22, 2026 · 3 min read · cyber deception, detection and response, mitre attack, zero trust

• Vendor guide · Cisco · March 2026 · 16 pages

  Cisco whitepaper: Zero Trust for Agentic AI, three pillars for identity, access, behavior

  Cisco whitepaper that extends Zero Trust to AI agents through three pillars: know every agent, authorize every action, adapt to risk in real time. It maps them to Cisco products.

  Digested October 22, 2026 · 3 min read · agentic ai, zero trust, non human identity, ai governance

• Industry association · Cloud Security Alliance · May 29, 2026 · 20 pages

  CSA paper on GREYVIBE and AI narrowing the gap between state-adjacent and elite cyber actors

  A CSA research paper using WithSecure's GREYVIBE report to argue that AI is raising the capability floor for state-adjacent actors, so enterprises should revise threat models and stress fundamentals.

  Digested October 22, 2026 · 3 min read · threat intelligence, ai enabled threats, state adjacent actors, threat modeling

• Industry association · Cloud Security Alliance · April 3, 2026 · 12 pages

  CSA research note: AI agent governance gap, NIST standards timeline and CISO priorities

  CSA research note on the gap in agent-specific security standards. It says NIST's work is multi-year, so CISOs should build internal agentic AI governance now, starting with inventory, least privilege and monitoring.

  Digested October 22, 2026 · 3 min read · agentic ai, ai governance, identity, regulation

• Industry association · Cloud Security Alliance · April 18, 2026 · 29 pages

  CSA/SANS briefing: building a "Mythos-ready" security program for AI-found vulnerabilities

  A community strategy briefing (v0.95, April 2026) says AI vulnerability discovery will flood defenders with patches and attacks. It gives a draft risk register and an 11-action plan.

  Digested October 22, 2026 · 3 min read · ai security, vulnerability management, agentic ai, security strategy

• Public body · ENISA · May 2026 · 82 pages

  ENISA NIS360 2026: cyber maturity and criticality of NIS2 high-criticality sectors

  ENISA's third NIS360 report assesses the cyber maturity and criticality of NIS2 high-criticality sectors. Maturity is rising, but rail, water and waste water join the risk zone.

  Digested October 22, 2026 · 4 min read · regulation, nis2, critical infrastructure, third party risk

• Public body · ENISA · September 2026 · 101 pages

  ENISA's 2026 EU threat report: 2025 incident data by sector and threat type

  ENISA's annual EU threat report on 8,257 incidents from 2025. DDoS and hacktivism dominate by count. Ransomware and data theft are the most impactful. Public administration is hit most.

  Digested October 22, 2026 · 4 min read · threat reporting, ransomware, hacktivism, state nexus

• Vendor guide · Fortinet · November 13, 2025 · 9 pages

  Fortinet Cyberthreat Predictions for 2026: industrialized cybercrime, faster attacks

  Fortinet's FortiGuard Labs forecasts for 2026: attackers will use AI agents and automation to move from access to extortion faster, so defenders must compress detection and containment.

  Digested October 22, 2026 · 3 min read · threat predictions, agentic ai, ransomware, identity

• Vendor guide · Google Cloud · 2 pages

  Google Cloud Cybersecurity Forecast 2026: EMEA special report on threats and regulation

  Two-page EMEA edition of Google Cloud's 2026 forecast. It expects cyber physical attacks, DPRK IT worker growth in Europe, and active enforcement of EU AI and NIS2 rules.

  Digested October 22, 2026 · 3 min read · threat forecast, regulation, nation state, ai governance

• Industry association · GovRAMP · April 16, 2026 · 23 pages

  GovRAMP white paper: OMB-led reciprocity to harmonize federal and state cyber frameworks

  A GovRAMP symposium white paper (March 2026) arguing that OMB guidance on reciprocity and a shared NIST SP 800-53 baseline is the top near-term step to cut duplicate cyber compliance.

  Digested October 22, 2026 · 3 min read · regulation, framework harmonization, fedramp, state and local government

• Vendor guide · GuidePoint Security · 2026 · 38 pages

  FAIR Institute 2026 State of Cyber Risk Management: survey of 400 risk leaders

  FAIR Institute survey of 400 cyber risk practitioners, sponsored by GuidePoint and SAFE. FAIR use or plans reach 58%, AI use or trials 80%, and silos between security teams are the most cited challenge at 33%.

  Digested October 22, 2026 · 3 min read · cyber risk quantification, risk management, ai governance, board reporting

• Analyst report · IDC · September 2026 · 54 pages

  IDC white paper: managing AI agents through identity, with a sponsor-and-lifecycle model

  IDC white paper, sponsored by GuidePoint Security. It argues identity is the control plane for AI agents and that every agent needs a named human sponsor and a managed lifecycle.

  Digested October 22, 2026 · 4 min read · agentic ai, identity, non human identity, ai governance

• Vendor guide · init 6 · April 2026 · 29 pages

  The Day-Zero Normal: a CISO brief on reprioritizing security for AI-speed exploits

  A 29-page practitioner brief (April 2026) that maps what to raise, cut or add across NIST CSF 2.0 as AI shortens exploit time, with a 90-day plan, board script and KPI table.

  Digested October 22, 2026 · 4 min read · ai vulnerability, vulnerability management, nist csf, identity

• Analyst report · KPMG · March 2026 · 44 pages

  KPMG Cybersecurity considerations 2026: eight priorities for CISOs, from AI agents to PQC

  KPMG's 44-page paper sets out eight cyber considerations for 2026, each with suggested actions. Non-human identities, AI agents, supply chain risk and geopolitics rise to the top across sectors.

  Digested October 22, 2026 · 3 min read · agentic ai, non human identity, post quantum cryptography, third party risk

• Public body · Malta Financial Services Authority · June 16, 2026 · 27 pages

  MFSA Cyber Threats Awareness Brief: 2025 trends, Jan-May 2026 and H2 2026 outlook

  Malta regulator's open-source brief on cyber threats to financial firms in 2025 and early 2026. AI-enabled threats were the largest root-cause category (26%) of 70 observations.

  Digested October 22, 2026 · 3 min read · threat landscape, financial sector, dora, ai threats

• Vendor guide · Menlo Security · September 2026 · 24 pages

  SANS 2026 Threat Hunting Survey: data quality overtakes staffing as top barrier

  SANS survey of 500 security professionals on threat hunting. Data quality (50%) has passed skilled staff (45%) as the top barrier, while formal methodology and measurement both fell.

  Digested October 22, 2026 · 3 min read · threat hunting, survey, detection engineering, cloud security

• Vendor guide · Microsoft · 2026 · 103 pages

  Microsoft Digital Defense Report 2026: AI-speed attacks, identity and interconnected risk

  Microsoft's annual report for July 2025 to June 2026. Its main point: AI is compressing attack timelines, so identity, patch speed and cross-signal correlation matter most.

  Digested October 22, 2026 · 3 min read · agentic ai, identity, threat intelligence, nation state

• Vendor guide · MintMCP · September 2, 2026

  Mintive guide to non-human identity management for AI agents: types, controls, lifecycle

  A vendor blog guide for CISOs on managing AI agents as non-human identities: five agent types, authentication, least privilege, runtime guardrails and audit. It pairs advice with Mintive product features.

  Digested October 22, 2026 · 3 min read · non human identity, agentic ai, identity, zero trust

• Public body · Office of the Comptroller of the Currency · June 2026 · 31 pages

  OCC 2026 report to Congress: how it supervises bank cybersecurity and secures itself

  The OCC's annual statutory report to Congress on cybersecurity policy, bank supervision, internal security and threats. It says cyber supervision is part of every exam cycle and lists the threats it watches.

  Digested October 22, 2026 · 3 min read · regulation, bank supervision, third party risk, incident response

• Vendor guide · Trend Micro · November 25, 2025 · 2 pages

  Trend Micro 2026 Security Predictions: two-page summary for business leaders

  Trend Micro's two-page summary of its 2026 predictions. It says attacks will be faster and more automated, and urges leaders to cut exposure, tighten cloud and identity controls, and test recovery.

  Digested October 22, 2026 · 2 min read · threat predictions, agentic ai, cloud security, ransomware

• Report · World Economic Forum · October 2026 · 25 pages

  WEF Council report: governing cybersecurity as economic risk, with a five-move 2027 agenda

  WEF Global Future Council report (Oct 2026). It says cyber is still governed as a cost, and urges common language, value and recovery metrics, pricing of cyber posture, and a finance mechanism.

  Digested October 22, 2026 · 4 min read · cyber economics, board governance, cyber resilience, cyber risk measurement

• Report · World Economic Forum · January 2026 · 64 pages

  WEF Global Cybersecurity Outlook 2026: AI, geopolitics, scams and resilience survey

  World Economic Forum and Accenture's fifth annual report, built on a survey of 804 qualified respondents. Its main point: AI is the top driver of cyber change, and resilience gaps are widening.

  Digested October 22, 2026 · 4 min read · ai security, cyber resilience, geopolitics, third party risk

• Report · World Economic Forum · February 2026 · 3 pages

  WEF Global Cybersecurity Outlook 2026: East Asia and Pacific regional analysis

  A three-page World Economic Forum regional cut of its 2026 survey: East Asia and Pacific reports wide AI tool vetting and AI adoption, and 44% say they lack needed cyber skills.

  Digested October 22, 2026 · 3 min read · ai security, regional analysis, third party risk, cyber resilience

• Vendor guide · Zero Networks · June 9, 2026 · 32 pages

  Zero Networks 2026 Lateral Movement Exposure Report: 10 risks, 312 environments

  Vendor report on lateral movement exposure from 54 trillion activities in 312 environments. Main point: broad internal trust lets one compromised host reach most systems, so containment matters.

  Digested October 22, 2026 · 3 min read · lateral movement, network segmentation, zero trust, agentic ai

• Vendor guide · Anthropic · 36 pages

  Anthropic's Zero Trust for AI Agents: a three-tier security framework for enterprise agents

  Anthropic's 36-page guide applies Zero Trust to autonomous AI agents with Foundation, Enterprise and Advanced control tiers. Its main point: raise the Foundation floor and design for breach.

  Digested October 21, 2026 · 4 min read · agentic ai, zero trust, identity, ai governance