Knowledge base

Updated: 6 August 2026 What is the difference between a network token and an agentic token? A network token replaces a card number with a surrogate issued by the card network and works within the domain it was issued for. An agentic token uses the same rails but adds a binding to a named AI […]

Read more →

Updated: 4 August 2026 What does GDPR require from cybersecurity? Article 32 of GDPR requires controllers and processors to implement “appropriate technical and organisational measures” to protect personal data – including encryption, resilience, the ability to restore availability quickly after an incident, and a process for regularly testing and evaluating the effectiveness of those measures. […]

Read more →

Update: 28 July 2026 What is the Cyber Resilience Act and why does it matter for software houses? The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is the first horizontal EU law imposing mandatory cybersecurity requirements on software and hardware made available on the Union market. If your company builds and supplies software commercially – […]

Read more →

Updated: 28 July 2026 What is vendor security due diligence readiness? It is the operational state in which a company can respond quickly, consistently and with evidence to the security due diligence requirements of enterprise buyers – including security questionnaires (CAIQ, SIG), certification evidence (ISO 27001, PCI DSS, SOC 2), contractual audit rights and insurance […]

Read more →

Updated: 21 July 2026 What is the NIS2 Directive and who does it cover? NIS2 (Directive (EU) 2022/2555) entered into force on 16 Jan 2023 and required Member States to transpose it by 17 Oct 2024. It is the EU’s baseline cybersecurity framework for organisations operating in 18 critical sectors – far broader than the […]

Read more →

Updated: 6 July 2026 What is AI governance and why is it a priority now? AI governance is the set of policies, processes, and oversight mechanisms that ensure artificial intelligence systems within an organisation are deployed and used in a lawful, ethical, and secure manner. The EU AI Act, in force since 2 Aug 2024, […]

Read more →

Updated: 6 July 2026 What are AI-enhanced attacks and how do they differ from traditional threats? AI-enhanced attacks are cyberattacks in which artificial intelligence helps attackers accelerate, scale, or improve traditional methods such as phishing, social engineering, reconnaissance, or vulnerability exploitation. The key difference is that AI removes historical barriers for attackers: time, cost, language […]

Read more →

Updated: 23 June 2026 What is an AI usage policy? An AI usage policy is an operational document setting out who in an organisation may use artificial intelligence tools, what data they are allowed to put into those tools, and who is accountable for oversight. Every organisation whose staff use generative AI on company or […]

Read more →

What is modern phishing in 2026? Modern phishing is no longer defined by obvious errors – poor grammar, generic attachments, or suspicious sender addresses. It is defined by believable business context, compressed attacker preparation time, and process manipulation that targets money, identity, or approvals. According to Verizon DBIR 2024, the human element was present in […]

Read more →

What is a ransomware response playbook? It is a pre-documented sequence of decisions and actions – covering containment, authority, communications, and regulatory notification – that an organisation executes in the hours immediately following a ransomware detection. Sophos reports that average recovery costs from ransomware in 2024, excluding the ransom itself, reached USD 2.73 million, while […]

Read more →

Updated: 9 June 2026 What is an Agentic Payment Provider? An Agentic Payment Provider (APP) is a new category of Visa-regulated service provider, formally defined in the Visa Core Rules and Visa Product and Service Rules effective 18 April 2026. An APP is an entity that acts autonomously on a cardholder’s behalf – searching for […]

Read more →

What is Business Continuity Management (BCM) in the context of cybersecurity? BCM is the discipline of keeping critical operations running during disruption – not merely of restoring IT systems. A Business Impact Analysis (BIA) identifies which processes matter most, how long they can be down, and what dependencies they rely on. Recovery Time Objective (RTO) […]

Read more →