Insights
Analysis, regulatory guidance and threat research for security and risk leaders.
In January 2026, attackers breached eScan Antivirus' regional update infrastructure and turned a routine software update into a malware delivery mechanism. This whitepaper breaks down the technical anatomy of the attack, what our SOC...
Read the article
GRC and TPRM are often used interchangeably, but they are not the same. Governance, Risk & Compliance (GRC) provides the overarching framework for managing organisational risk, while Third-Party Risk Management (TPRM) focuses specifically on...
Read the article
Reinsurance and financial services organisations operate within highly interconnected ecosystems shaped by third-party dependencies, federated access, and complex cloud environments. In this article, we explore why traditional, prevention-first cybersecurity models fall short — and...
Read the article
When highly interconnected financial organisations are compromised, the fallout isn't limited to their own systems. It ripples across partners, clients, and entire markets. In environments built on federated access, shared data, and third-party dependencies,...
Read the article
A real-world incident shows how a supplier’s simple mistake left sensitive data exposed for months. Discover what went wrong, why traditional TPRM missed it, and practical steps IT, risk, and security leaders can take...
Read the article
What’s the difference between a vendor, supplier, and third party - and why does it matter in risk management? This blog explores the real impact of inconsistent labels on TPRM programs, and how to...
Read the article
In theory, grouping suppliers into high, medium, or low risk should make third-party risk management more efficient. In practice, inconsistent definitions, hidden vendors, rigid models, and limited resources often make it messy and ineffective....
Read the article
Your suppliers are part of your business – whether they manage your cloud, payroll, or IT. But what happens when they go down, get breached, or drop the ball? In this blog, we break...
Read the article
How a threat actor exploited a known vulnerability in the Miniorange 2FA plugin to compromise a Wordpress site using a malicious WP Rock plugin, causing unexpected knock-on impacts to the company's email reputation, leading...
Read the articleThirty minutes with a Talanos consultant to work through where you actually stand — no obligation, no sales script.