| GRC Meetup Community Website |
Issue 33 |
https://www.locktivity.com/grc-community |
| LinkedIn Post about GRC Meetup Community Website |
Issue 33 |
https://www.linkedin.com/posts/rcgrc_leading-the-grc-meet-up-has-been-such-a-rewarding-activity-7500931996425211904–yP1 |
| Zero Day Clock |
Issue 33 |
https://zerodayclock.com/ |
| A Cybersecurity Guidance for Directors |
Issue 33 |
https://www.ncsc.gov.ie/pdfs/NCSC-Cyber-Governance-Management-Boards.pdf |
| ISO 27090: Cybersecurity Guidance for AI Systems |
Issue 33 |
https://www.iso.org/standard/27090 |
| IMF Panel Discussion on AI and Cyber Risk Website |
Issue 33 |
https://www.imf.org/en/meetings/2026/annual/schedule/2026/10/16/ai-and-cyber-risks |
| YouTube Video of IMF Panel Discussion on AI and Cyber Risk |
Issue 33 |
https://www.youtube.com/watch?v=FyPANjJEfN8 |
| COBIT 7 Is Coming. Can It Make COBIT Relevant Again? |
Issue 32 |
https://www.isaca.org/store2/product/LMS-W110326 |
| Singapore’s Guidance for Responsible AI Adoption: Useful Beyond Financial Institutions |
Issue 32 |
https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions |
| Stanford’s AI Security Framework (AISF) |
Issue 32 |
https://uit.stanford.edu/security/agenticai/security-framework |
| ENISA Threat Landscape 2026 Report |
Issue 32 |
https://www.enisa.europa.eu/publications/enisa-threat-landscape-2026 |
| ENISA Threat Landscape 2026 Report |
Issue 32 |
https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202026_Final.pdf |
| ENISA Threat Landscape 2026 Report |
Issue 32 |
https://labs.cloudsecurityalliance.org/research/csa-research-note-enisa-threat-landscape-2026-systemic-risk/ |
| Federal News Network interviews CISA’s Chris Butera – Golden Eagle, CI Fortify |
Issue 32 |
https://federalnewsnetwork.com/cybersecurity/2026/10/cyber-leaders-exchange-2026-cisas-chris-butera-on-tackling-ai-fueled-cyber-risks/ |
| Federal News Network interviews CISA’s Chris Butera – Golden Eagle, CI Fortify |
Issue 32 |
https://www.youtube.com/watch?v=H2tyj08U2U0 |
| Lagarde Warns That A.I. Could Give Cyberattackers a Growing Advantage |
Issue 31 |
https://www.ecb.europa.eu/press/key/date/2026/html/ecb.sp261001~cf3c630379.en.html |
| UK Regulator Clarifies When Cyber Incidents Require Market Disclosure |
Issue 31 |
https://www.fca.org.uk/publications/newsletters/primary-market-bulletin-66#lf-chapter-id-disclosing-inside-information-relating-to-cyber-incidents |
| UK Regulator Clarifies When Cyber Incidents Require Market Disclosure |
Issue 31 |
https://www.aoshearman.com/en/insights/ao-shearman-on-investigations/when-a-cyber-incident-becomes-inside-information-new-observations-from-the-uk-fca |
| Thales Launches Cyber Framework for Frontier AI Threats |
Issue 31 |
https://www.thalesgroup.com/en/solutions-catalogue/cybersecurite/services-de-cybersecurite/frontier-ai-models-cybersecurity |
| Thales Launches Cyber Framework for Frontier AI Threats |
Issue 31 |
https://www.thalesgroup.com/en/search/cybersecurite/services-de-cybersecurite/acting-faster-threat-protecting-critical |
| OneTrust launches CORIE to govern AI agents in real time |
Issue 31 |
https://www.onetrust.com/news/onetrust-introduces-corie-to-govern-ai-agents-at-machine-speed/ |
| MIT’s AI Decision Matrix – how to decide when AI can act autonomously |
Issue 31 |
https://mitsloan.mit.edu/ideas-made-to-matter/a-framework-determining-when-ai-can-make-decisions |
| Gartner’s Security & Risk Management Summit 2026 London |
Issue 30 |
https://www.gartner.com/en/newsroom/press-releases/2026-09-22-gartner-security-and-risk-management-summit-emea-2026-day-1-highlights |
| Gartner’s Security & Risk Management Summit 2026 London |
Issue 30 |
https://www.gartner.com/en/newsroom/press-releases/2026-09-23-gartner-security-and-risk-management-summit-emea-2026-day-2-highlights |
| Gartner’s Security & Risk Management Summit 2026 London |
Issue 30 |
https://www.gartner.com/en/newsroom/press-releases/2026-09-24-gartner-security-and-risk-management-summit-emea-2026-day-3-highlights |
| Capgemini’s AI and GenAI Cybersecurity Report: Published in 2024 and Still Relevant Today |
Issue 30 |
https://www.capgemini.com/insights/research-library/generative-ai-in-cybersecurity/ |
| Minimum Cybersecurity Due Diligence in TPRM |
Issue 30 |
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1326.pdf |
| Did Jaguar Have a Cyber Insurance Gap? |
Issue 30 |
https://www.insurancebusinessmag.com/uk/news/cyber/did-jaguar-land-rovers-cyber-insurance-gap-help-pave-the-way-to-4000-job-losses-588902.aspx |
| AI threats drive investment in cybersecurity startups |
Issue 30 |
https://www.wsj.com/pro/cybersecurity/fledgling-cyber-startups-draw-outsize-funding-86d1cf9b |
| IDC MarketScape: TPRM Software 2026 |
Issue 29 |
https://www.logicgate.ai/resources/the-idc-marketscape-worldwide-third-party-risk-management-software-2026-vendor-assessment/ |
| How to Implement Cyber Decoys in Your Organization |
Issue 29 |
https://www.cisa.gov/news-events/news/new-cisa-guidance-helps-critical-infrastructure-detect-observe-and-impede-malicious-cyber-activity |
| How to Implement Cyber Decoys in Your Organization |
Issue 29 |
https://www.cisa.gov/sites/default/files/2026-09/using-cyber-decoys-to-strengthen-detection-and-response_508c.pdf |
| Reco.ai – State of Agent Security 2026 Report |
Issue 29 |
https://www.reco.ai/state-of-agent-security-2026-form |
| Diligent AI Risk Essentials |
Issue 29 |
https://www.diligent.com/lp/ai-innovation-snapshots |
| Diligent AI Risk Essentials |
Issue 29 |
https://www.diligent.com/products/ai-risk-essentials |
| Diligent AI Risk Essentials |
Issue 29 |
https://share.vidyard.com/watch/nX2xTF3hnoEuiXMFAQiMwt |
| Risks and Controls for Multi-Agent Systems |
Issue 29 |
https://www.industry.gov.au/publications/risks-and-controls-multi-agent-systems |
| UK Government AI Risk Management Toolkit |
Issue 28 |
https://www.gov.uk/government/publications/ai-risk-management-toolkit |
| UK Government AI Risk Management Toolkit |
Issue 28 |
https://assets.publishing.service.gov.uk/media/6a9fdd8962ec7fe7bedf5116/20260522_AI_Risk_Management_Framework_workbook_V1.1_OFF.xlsx |
| UK Government AI Risk Management Toolkit |
Issue 28 |
https://www.gov.uk/government/publications/ai-risk-management-toolkit/ai-risk-management-toolkit-guidance |
| Can your replicate Three Lines of Defense using AI Agents? |
Issue 28 |
https://aws.amazon.com/blogs/industries/mirroring-your-organization-with-multi-agent-ai-for-fsi-risk-assessment/ |
| Can your replicate Three Lines of Defense using AI Agents? |
Issue 28 |
https://github.com/aws-samples/sample-agentic-risk-assessor |
| NIST Draft TEVV-Athlon Framework for Evaluating AI Systems |
Issue 28 |
https://www.nist.gov/artificial-intelligence/ai-research/tevv-athlon-framework-evaluating-ai-systems |
| NIST Draft TEVV-Athlon Framework for Evaluating AI Systems |
Issue 28 |
https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.200-2.ipd.pdf |
| Deloitte Article: How CFOs can turn cybersecurity spend into measurable risk reduction |
Issue 27 |
https://www.deloitte.com/us/en/programs/chief-financial-officer/articles/cfo-cybersecurity-spend-risk-reduction.html |
| Harness Engineering |
Issue 27 |
https://www.bankofengland.co.uk/research/fintech/frontier-ai-information-sharing-forum/frontier-ai-harness-engineering |
| Harness Engineering |
Issue 27 |
https://www.langchain.com/blog/the-anatomy-of-an-agent-harness |
| Harness Engineering |
Issue 27 |
https://en.wikipedia.org/wiki/Agent_harness |
| Best Practices on Cyber Resilience |
Issue 27 |
https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/publication/2025/october/effective-practices-cyber-response-and-recovery-capabilities.pdf |
| Security Autonomy Matrix – Lenny Zeltser |
Issue 27 |
https://zeltser.com/security-autonomy-matrix |
| CSA Report: Top Threats to Cloud Computing in 2026 |
Issue 27 |
https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-2026 |
| Gartner on AI liability |
Issue 26 |
https://www.gartner.com/en/articles/ai-liability |
| A CISA baseline for cybersecurity controls |
Issue 26 |
https://www.cisa.gov/news-events/news/cisa-unveils-enhanced-cross-sector-cybersecurity-performance-goals |
| A CISA baseline for cybersecurity controls |
Issue 26 |
https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0 |
| Claude Security from Anthropic |
Issue 26 |
https://academy.claude.com/tutorials/getting-started-with-claude-security |
| Claude Security from Anthropic |
Issue 26 |
https://www.anthropic.com/webinars/claude-security-putting-claude-to-work-for-defenders |
| Shared Assessment’s Risk Report |
Issue 26 |
https://sharedassessments.org/paper/2026-mid-year-risk-report/ |
| A practical AI and cybersecurity guide for boards |
Issue 26 |
https://www.cyber.gov.au/business-government/protecting-business-leaders/cyber-security-for-business-leaders/frontier-ai-cyber-threat-considerations-for-boards-of-directors |
| NIST Offers AI Prompts for CSF 2.0 Compliance |
Issue 25 |
https://csrc.nist.gov/pubs/sp/1353/ipd |
| NIST Offers AI Prompts for CSF 2.0 Compliance |
Issue 25 |
https://doi.org/10.6028/NIST.SP.1353.ipd |
| Microsoft’s Agent Governance Toolkit (AGT) |
Issue 25 |
https://opensource.microsoft.com/blog/2026/04/02/introducing-the-agent-governance-toolkit-open-source-runtime-security-for-ai-agents/ |
| Microsoft’s Agent Governance Toolkit (AGT) |
Issue 25 |
https://github.com/microsoft/agent-governance-toolkit |
| Only 1.8% of German Websites Use security.txt |
Issue 25 |
https://www.heise.de/en/news/Missing-contact-option-Germany-is-sleeping-on-security-via-security-txt-11402351.html |
| Tabletop Exercise Scenarios from CISA |
Issue 25 |
https://www.cisa.gov/resources-tools/resources/cybersecurity-scenarios |
| NIST Resource: Securing Building Automation Control Systems |
Issue 25 |
https://www.nist.gov/blogs/cybersecurity-insights/nist-releases-tips-tactics-building-automation-control-system |
| NIST Resource: Securing Building Automation Control Systems |
Issue 25 |
https://csrc.nist.gov/csrc/media/Projects/operational-technology-security/documents/NIST_Building_Automation_and_Control_Systems_Tips_and_Tactics_Infographic.pdf |
| CISA’s 2026 Minimum Elements for SBOM |
Issue 24 |
https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf |
| CISA’s 2026 Minimum Elements for SBOM |
Issue 24 |
https://www.cisa.gov/sites/default/files/2024-07/SBOM%20FAQ%202024.pdf |
| CISA’s 2026 Minimum Elements for SBOM |
Issue 24 |
https://www.ntia.gov/files/ntia/publications/ntia_sbom_use_cases_roles_benefits-nov2019.pdf |
| Drata’s SOC 2 vs. ISO 27001 webinar |
Issue 24 |
https://drata.com/resources/webinars/soc2-vs-iso27001 |
| IIA’s Survey: 2026 North American Pulse of Internal Audit |
Issue 24 |
https://www.theiia.org/globalassets/site/resources/research-and-reports/pulse-of-internal-audit/2026-iia-pulse-of-internal-audit-report.pdf |
| How Common Is Generative AI in Internal Audit? |
Issue 24 |
https://www.gartner.com/en/newsroom/press-releases/2026-08-10-gartner-survey-finds-audit-teams-ai-use-is-common-but-most |
| Podcast Episode: Translating Cyber Risk for the Board |
Issue 24 |
https://www.youtube.com/watch?v=D5LIMGWjzic |
| MIT Study: How Experts Rank 24 AI Risks |
Issue 23 |
https://mitsloan.mit.edu/ideas-made-to-matter/these-are-most-urgent-ai-risks-according-to-272-experts |
| MIT Study: How Experts Rank 24 AI Risks |
Issue 23 |
https://cdn.prod.website-files.com/669550d38372f33552d2516e/6a172558bd2947234379749f_a8684052fd49a64374c9a9d3e4e5ab59_Prioritizing%20the%20risks%20from%20Artificial%20Intelligence.pdf |
| OSCAL – Open Security Controls Assessment Language |
Issue 23 |
https://pages.nist.gov/OSCAL/ |
| OSCAL – Open Security Controls Assessment Language |
Issue 23 |
https://docs.oscal.io/ |
| Petual AI – Automate SOX Testing |
Issue 23 |
https://petual.ai/ |
| McKinsey’s Global GRC Survey 2025 |
Issue 23 |
https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/governance-risk-and-compliance-a-new-lens-on-best-practices |
| A Game to Learn Business Continuity |
Issue 22 |
https://resilience-race.lovable.app/ |
| Forrester’s Article on Microsoft Project Perception |
Issue 22 |
https://www.forrester.com/blogs/microsofts-project-perception-announcement-and-how-to-implement-it-right/ |
| Forrester’s Article on Microsoft Project Perception |
Issue 22 |
https://www.microsoft.com/en-us/security/business/ai-powered-cybersecurity/project-perception-agentic-system |
| Handling Enterprise-wide Risks |
Issue 22 |
https://www.vanta.com/resources/enterprise-risk-designations |
| Gartner’s Cyber Resilience Framework |
Issue 22 |
https://www.absolute.com/resources/research-reports/gartner-cyber-resilience-framework-report |
| Four Questions to Frame the Board Conversation on AI Discovery |
Issue 22 |
https://www.linkedin.com/posts/wendiwhitmore2_this-weeks-headlines-gave-the-frontier-ai-activity-7486408619807174657-3gkI/ |
| AISVS 1.0 is out |
Issue 21 |
https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/ |
| AI makes GRC jobs harder? |
Issue 21 |
https://drata.com/blog/state-of-grc-2026 |
| OneTrust’s Supply Chain Risk Checklist |
Issue 21 |
https://www.onetrust.com/resources/where-does-risk-live-in-the-supply-chain-checklist/ |
| Recommended Article: How mapping security controls can ease the compliance burden |
Issue 21 |
https://www.techtarget.com/searchsecurity/tip/How-mapping-security-controls-can-ease-the-compliance-burden |
| AIUC-1 |
Issue 21 |
https://www.aiuc-1.com/ |
| Three Videos to Learn About SOC2 Reports |
Issue 20 |
https://www.youtube.com/watch?v=WytvB5yGNOs |
| Three Videos to Learn About SOC2 Reports |
Issue 20 |
https://www.youtube.com/watch?v=cBV39VSWq_U |
| Three Videos to Learn About SOC2 Reports |
Issue 20 |
https://www.youtube.com/watch?v=AbqQ1XrkCwk |
| IIA’s New Paper on Three Lines Model |
Issue 20 |
https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf |
| IIA’s New Paper on Internal Audit’s Role in Enterprise Risk Management |
Issue 20 |
https://www.theiia.org/globalassets/site/resources/statements-of-position/role_of_ia_function_enterprise_risk_mgmt_en.pdf |
| Vanta launches Agentic Trust Controls (ATC) |
Issue 20 |
https://www.linkedin.com/posts/vanta-security_introducing-agentic-trust-controls-activity-7481044716348796929-suEj/ |
| AI Usecase – SOX Testing Automation |
Issue 20 |
https://www.linkedin.com/posts/akshayamurthy_at-zendesk-we-have-been-working-on-automating-activity-7480682634793144320-n9iw |
| Microsoft’s Cyber Risk Process |
Issue 19 |
https://www.microsoft.com/insidetrack/blog/how-we-approach-cybersecurity-risk-management-at-microsoft/ |
| Implementing Zero Trust for AI Agents |
Issue 19 |
https://claude.com/blog/zero-trust-for-ai-agents |
| Palo Alto CEO Says 1200 Customers Asked About New AI Defense Service |
Issue 19 |
https://www.paloaltonetworks.com/blog/2026/04/introducing-unit-42-frontier-ai-defense/ |
| A GRC Policy Reviewer Agent |
Issue 19 |
https://aigrcdesk.com/p/i-built-a-grc-policy-reviewer-agent-here-is-exactly-how |
| GitLab’s Security Control Framework |
Issue 19 |
https://about.gitlab.com/blog/how-gitlab-built-a-security-control-framework-from-scratch/ |
| GitLab’s Security Control Framework |
Issue 19 |
https://handbook.gitlab.com/handbook/security/security-assurance/security-compliance/sec-controls/ |
| Security Debt Index |
Issue 18 |
https://www.isaca.org/resources/white-papers/2026/security-debt-the-unseen-risk-undermining-cyber-resilience |
| A Maturity Model for Security Culture |
Issue 18 |
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5256044 |
| A six-agent Cyber Risk Assessor |
Issue 18 |
https://arxiv.org/pdf/2603.20131 |
| Norman Marks: “Is Risk Appetite Relevant?” |
Issue 18 |
https://normanmarks.wordpress.com/2026/06/22/is-risk-appetite-relevant/ |
| Article: EU asks for feedback for guidelines on high-risk AI systems |
Issue 17 |
https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems |
| Industry Report: Verizon’s 2026 Breach Impact Study |
Issue 17 |
https://www.verizon.com/business/resources/reports/2026-breach-impact-study-dbir.pdf |
| Article: “Minimum Viable Governance” for AI |
Issue 17 |
https://mitsloan.mit.edu/ideas-made-to-matter/balance-ai-innovation-and-risk-minimum-viable-governance |
| Article: Gartner’s AI TRiSM |
Issue 17 |
https://www.gartner.com/en/articles/ai-governance-trism |
| Resource: Google DeepMind’s TRAIT&R Framework |
Issue 17 |
https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/securing-the-future-of-ai-agents/gdm-ai-control-roadmap.pdf |
| Article: How UK and EU Banks Navigate Dual Incident Reporting Under DORA and the New FCA Rules |
Issue 16 |
https://www.mayerbrown.com/en/insights/publications/2026/06/cyber-risk-how-uk-and-eu-banks-will-navigate-incident-reporting-under-eu-dora-and-new-fca-requirements |
| Resource: ICT Risk Management- Range of Practices |
Issue 16 |
https://www.bis.org/bcbs/publ/d611.pdf |
| Industry Report: Hyperproof’s 2026 IT Risk and Compliance Benchmark Report |
Issue 16 |
https://hyperproof.io/resource/mid-year-review-of-it-risk-and-compliance/ |
| Article: EU Cybersecurity Act 2.0 – Trade Restrictions Built Into a Cybersecurity Regulation |
Issue 16 |
https://www.hoganlovells.com/en/publications/eu-cybersecurity-act-20-proposal-new-trade-controls-targeting-highrisk-suppliers-across |
| Resource: AAISM Exam |
Issue 16 |
https://www.reddit.com/r/aaism/ |
| Article: Is GRC Cool Again? How Frontier AI Models Are Bringing a New Focus to Governance and Risk Management |
Issue 15 |
https://www.bitsight.com/blog/ai-governance-third-party-risk-grc |
| Article: Diligent Launches AI-Powered Cyber Risk Management |
Issue 15 |
https://www.diligent.com/company/newsroom/diligent-launches-ai-powered-cyber-risk-management |
| Industry Report: 2026 KPMG Cybersecurity & Technology Risk Survey |
Issue 15 |
https://kpmg.com/us/en/articles/2026/cybersecurity-technology-risk-survey-ciso-resilience.html |
| Industry Report: 2026 State of Cyber Risk Management Report |
Issue 15 |
https://www.fairinstitute.org/blog/what-400-cyber-risk-leaders-told-us-about-the-future-of-cyber-risk-management |
| Resource: Agent Control Standard (ACS) |
Issue 15 |
https://agentcontrolstandard.ai/ |
| Resource: Agent Control Standard (ACS) |
Issue 15 |
https://github.com/Agent-Control-Standard/ACS |
| Resource: Agent Control Standard (ACS) |
Issue 15 |
https://commandline.microsoft.com/agent-control-specification-runtime-governance/ |
| Resource: Rampart and Clarity, Microsoft’s Open-Source AI Agent Safety Tools |
Issue 14 |
https://www.microsoft.com/en-us/security/blog/2026/05/20/introducing-rampart-and-clarity-open-source-tools-to-bring-safety-into-agent-development-workflow/ |
| Resource: Rampart and Clarity, Microsoft’s Open-Source AI Agent Safety Tools |
Issue 14 |
https://github.com/microsoft/RAMPART |
| Resource: Rampart and Clarity, Microsoft’s Open-Source AI Agent Safety Tools |
Issue 14 |
https://github.com/microsoft/clarity-agent/ |
| Resource: EUVD, Europe’s Own Vulnerability Database |
Issue 14 |
https://euvd.enisa.europa.eu/ |
| Industry Report: Systematic Security Evaluation of AI Agent Frameworks |
Issue 14 |
https://arxiv.org/abs/2604.03131 |
| Article: Operational Risk in the Age of AI (KPMG) |
Issue 14 |
https://kpmg.com/us/en/articles/2026/operational-risk-in-the-age-of-ai.html |
| Industry Report: Reinventing Cyber Budgeting |
Issue 13 |
https://kpmg.com/uk/en/insights/regulatory/reinventing-cyber-budgeting.html |
| Article: What US Public Sector Leaders May Miss in NIST CSF Assessments |
Issue 13 |
https://www.forvismazars.us/forsights/2026/05/what-public-sector-leaders-may-miss-in-nist-csf-assessments |
| Article: Cyber Insurance Company Cowbell’s New Australia Boss Says Industry Is Still Doing Cyber Insurance Wrong |
Issue 13 |
https://www.insurancebusinessmag.com/au/news/cyber/why-cowbells-new-australia-boss-says-the-industry-is-still-doing-cyber-insurance-wrong-575925.aspx |
| Resource: Threat Modeling Your Generative AI Workload |
Issue 13 |
https://aws.amazon.com/blogs/security/threat-modeling-your-generative-ai-workload-to-evaluate-security-risk/ |
| Resource: AWS Threat Composer |
Issue 13 |
https://github.com/awslabs/threat-composer |
| Article: OpenClaw’s Security Approach |
Issue 12 |
https://openclaw.ai/blog/where-openclaw-security-is-heading |
| Resource: Rapid7 Launches Cyber GRC Platform |
Issue 12 |
https://www.rapid7.com/about/press-releases/rapid7-launches-cyber-governance-risk-and-compliance-grc-early-access-program-to-unify-security-data-risk-context-and-compliance-workflows/ |
| Resource: ServiceNow AI Control Tower Demo |
Issue 12 |
https://www.servicenow.com/products/ai-control-tower.html |
| Article: 9 Things Your Auditor Will Ask About AI Agents |
Issue 12 |
https://www.vanta.com/resources/ai-agent-audit-preparation |
| Article: The IMF on AI-Fueled Cyber Risk as a Financial Stability Threat |
Issue 12 |
https://www.imf.org/en/blogs/articles/2026/05/07/financial-stability-risks-mount-as-artificial-intelligence-fuels-cyberattacks |
| Article: OpenAI launches two Cyber versions of their GPT-5.5 |
Issue 11 |
https://openai.com/index/gpt-5-5-with-trusted-access-for-cyber/ |
| Article: NAVEX Appoints Arpan Sheth as CEO |
Issue 11 |
https://www.navex.com/en-us/company/press-room/navex-appoints-arpan-sheth-chief-executive-officer/ |
| Industry Report: Microsoft Cyber Pulse AI Security Report |
Issue 11 |
https://www.microsoft.com/en-us/security/security-insider/emerging-trends/cyber-pulse-ai-security-report |
| Resource: Adapting Zero Trust Principles to Operational Technology |
Issue 11 |
https://www.ic3.gov/CSA/2026/260429.pdf |
| Resource: CIS Releases AI Security Companion Guides for LLMs, Agents, and MCP |
Issue 11 |
https://www.cisecurity.org/about-us/media/press-release/cis-astrix-and-cequence-release-new-ai-security-companion-guides |
| Article: AI Will Reach an Offense-Defense Equilibrium in Cyber |
Issue 10 |
https://x.com/DavidSacks/status/2049907993588769006 |
| Article: Third-Party AI Risk: Why Vendor Due Diligence Needs an Upgrade |
Issue 10 |
https://www.jdsupra.com/legalnews/third-party-ai-risk-why-vendor-due-9641737/ |
| Article: AI Workflows Could Waiving Legal Privilege |
Issue 10 |
https://www.claytonutz.com/insights/2026/april/ai-and-legal-professional-privilege-why-common-workflows-now-carry-uncommon-risk/ |
| Resource: ISO/IEC 23894:2023 — AI Risk Management Guidance |
Issue 10 |
https://blog.ansi.org/ansi/iso-iec-23894-2023-ai-risk-management/ |
| Industry Report: State of AI Trust in 2026: Shifting to the Agentic Era |
Issue 9 |
https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/tech-forward/state-of-ai-trust-in-2026-shifting-to-the-agentic-era |
| Article: GRC Startup Petual Raises $20M to Automate SOX Audit with Agentic AI |
Issue 9 |
https://petual.ai/blog/audit-is-meant-to-be-creative-were-bringing-it-back-with-agentic-ai/ |
| Industry Report: MetricStream’s Total Economic Impact Study |
Issue 9 |
https://www.metricstream.com/blog/forresters-total-economic-impact-study-true-value-of-modern-grc.html |
| Resource: Databricks AI Security Framework 3.0 (DASF 3.0) |
Issue 9 |
https://www.databricks.com/blog/agentic-ai-security-new-risks-and-controls-databricks-ai-security-framework-dasf-v30 |
| Article: Diligent Launches AI Board Member and Agentic GRC Workforce |
Issue 9 |
https://www.diligent.com/company/newsroom/diligent-unveils-ai-board-member-and-agentic-grc-workforce |
| Resource: Claude Skills for Governance, Risk & Compliance |
Issue 8 |
https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance |
| Article: BCG’s excellent AI Risk Management Model |
Issue 8 |
https://www.bcg.com/publications/2026/ai-risk-management-needs-a-better-model |
| Resource: AI Security Podcast |
Issue 8 |
https://www.youtube.com/@AISecurityPodcast |
| Article: Anthropic’s Mythos Model Triggered an Emergency Meeting Between Powell, Bessent, and Wall Street CEOs |
Issue 7 |
https://www.cnbc.com/2026/04/10/trump-white-house-ai-cyber-threat-anthropic-mythos.html |
| Article: Anthropic’s Mythos Model Triggered an Emergency Meeting Between Powell, Bessent, and Wall Street CEOs |
Issue 7 |
https://www.anthropic.com/glasswing |
| Resource: MITRE Fight Fraud Framework (F3) |
Issue 7 |
https://ctid.mitre.org/fraud |
| Resource: AI Self-Assessment Template for Board Directors |
Issue 7 |
https://www.diligent.com/resources/guides/ai-self-assessment-template |
| Article: EY Rolls Out Agentic AI Across Its Entire Global Audit Business |
Issue 7 |
https://itbrief.com.au/story/ey-rolls-out-ai-audits-across-global-assurance-business |
| Article: EY Rolls Out Agentic AI Across Its Entire Global Audit Business |
Issue 7 |
https://www.ey.com/en_gl/newsroom/2026/04/ey-launches-enterprise-scale-agentic-ai-to-redefine-the-audit-experience-for-the-ai-era |
| Article: FCA Confirms New Incident and Third-Party Reporting Rules |
Issue 6 |
https://www.fca.org.uk/news/news-stories/fca-confirms-new-incident-and-third-party-rules-bolster-resilience |
| Resource: MitraTech’s Webinar about Top 15 NIST SP 800-53 Supply Chain Controls |
Issue 6 |
https://mitratech.com/resource-hub/videos/the-top-15-nist-supply-chain-risk-management-controls/ |
| Article: Concept of “Risk Amnesty” |
Issue 6 |
https://drata.com/blog/achieve-nis-2-strategically |
| Resource: LogicGate Experience Report 2026 GRC Platform Outcomes |
Issue 6 |
https://www.logicgate.com/resources/reports/ |
| Industry Report: PwC Annual Threat Dynamics: Identity Is the New Perimeter |
Issue 6 |
https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/annual-threat-dynamics.html |
| Industry Report: The Forrester Wave™: Third-Party Risk Management Platforms, Q1 2026 |
Issue 5 |
https://reprint.forrester.com/reports/the-forrester-wave-tm-third-party-risk-management-platforms-q1-2026-16c13b09/index.html |
| Resource: Ten Practical Guidelines to Improving Board Communication |
Issue 5 |
https://csiaorg.com/wp-content/uploads/2023/02/Ten_Guidelines_Board_Communication_28Apr16.pdf |
| Resource: LogicGate Experience Report 2026 – 96% Manager Approval |
Issue 5 |
https://www.logicgate.com/resources/reports/ |
| Article: BSP Orders Philippine Banks to Phase Out SMS OTPs by June 2026 |
Issue 5 |
https://www.bsp.gov.ph/Regulations/Issuances/2025/1213.pdf |
| Article: The Delve Controversy |
Issue 4 |
https://www.linkedin.com/posts/troyjfine_details-have-emerged-regarding-a-widespread-share-7415043498904666112-No0y |
| Article: UK Cyber Security and Resilience Bill |
Issue 4 |
https://www.gov.uk/government/collections/cyber-security-and-resilience-bill |
| Article: UK Cyber Security and Resilience Bill |
Issue 4 |
https://publications.parliament.uk/pa/bills/cbill/59-01/0385/240385.pdf |
| Article: OneTrust has a New CEO |
Issue 4 |
https://www.onetrust.com/news/onetrust-appoints-john-heyman-as-chief-executive-officer-to-drive-ai-ready-governance-platform-innovation/ |
| Article: Creating a Defensible Assessment of AI Hiring Tools |
Issue 4 |
https://media.crai.com/wp-content/uploads/2025/11/18105516/Workday-Case-Shows-Auditing-AI-Hiring-Tools-Is-Crucial.pdf |
| Article: Diligent Launches AI features for Internal Audit |
Issue 4 |
https://www.diligent.com/lp/auditai |
| Article: AuditBoard Rebrands as Optro |
Issue 3 |
https://optro.ai/blog/auditboard-is-now-optro |
| Article: UK Government Cuts Cyber Attack Fix Times by 84% |
Issue 3 |
https://www.gov.uk/government/news/government-cuts-cyber-attack-fix-times-by-84-and-launches-new-profession-to-protect-public-services |
| Resource: CISA’s Guide to Building an Insider Threat Management Team |
Issue 3 |
https://www.cisa.gov/sites/default/files/2026-01/Assembling%20a%20Multidisciplinary%20Insider%20Threat%20Management%20Team_508.pdf |
| Article: UAE Central Bank Issues AI Guidance for Financial Institutions |
Issue 3 |
https://rulebook.centralbank.ae/en/rulebook/guidance-note-consumer-protection-and-responsible-adoption-and-use-artificial-intelligence |
| Resource: Six AI Security Risk Categories for Enterprise Teams |
Issue 3 |
https://www.checkpoint.com/cyber-hub/what-is-ai-security/ai-security-for-enterprises/ |
| Resource: Six AI Security Risk Categories for Enterprise Teams |
Issue 3 |
https://engage.checkpoint.com/2025-ai-security-report |
| Article: New Cybersecurity Package proposed by European Commission |
Issue 2 |
https://www.matheson.com/insights/new-cybersecurity-package-proposed-by-european-commission/ |
| Article: New Cybersecurity Package proposed by European Commission |
Issue 2 |
https://digital-strategy.ec.europa.eu/en/library/proposal-regulation-eu-cybersecurity-act |
| Resource: Singapore Monetary Authority’s AI Risk Management Guidelines |
Issue 2 |
https://www.mas.gov.sg/news/media-releases/2025/mas-guidelines-for-artificial-intelligence-risk-management |
| Resource: OSCAL |
Issue 2 |
https://statetechmagazine.com/article/2026/02/nist-oscal-framework-state-and-local-governments-perfcon |
| Resource: OSCAL |
Issue 2 |
https://pages.nist.gov/OSCAL/ |
| Resource: OSCAL |
Issue 2 |
https://pages.nist.gov/OSCAL/learn/tutorials/ |
| Resource: OSCAL |
Issue 2 |
https://pages.nist.gov/OSCAL/learn/presentations/mini-workshop/ |
| Resource: OSCAL |
Issue 2 |
https://pages.nist.gov/OSCAL/learn/concepts/layer/ |
| Industry Report: Exabeam finds that 95% of organizations increasing security spending in 2026, driven by AI |
Issue 2 |
https://www.exabeam.com/hubs/from-adoption-to-accountability-the-new-economics-of-ai-in-cybersecurity/ |
| Resource: Building a Unified Control Framework for your organization |
Issue 2 |
https://arxiv.org/abs/2503.05937 |
| Resource: Building a Unified Control Framework for your organization |
Issue 2 |
https://facct2025-submission.netlify.app/ |
| Resource: Internal Control Practices for GenAI |
Issue 1 |
https://www.coso.org/generative-ai |
| Resource: Swift Customer Security Controls Framework |
Issue 1 |
https://www2.swift.com/knowledgecentre/rest/v1/publications/cscf_dd/70.0/CSCF_v2026_202507015.pdf |
| Resource: Swift Customer Security Controls Framework |
Issue 1 |
https://www.linkedin.com/pulse/do-you-have-confidence-your-swift-security-programme-has-robin-oldham/ |
| Resource: AI Risk Management Framework for Financial Services |
Issue 1 |
https://cyberriskinstitute.org/artificial-intelligence-risk-management/ |
| News: Two years of NIST CSF 2.0 |
Issue 1 |
https://www.nist.gov/blogs/cybersecurity-insights/celebrating-two-years-csf-20 |
| Podcast: Solving GRC Complexity with Anecdotes By CISO Series |
Issue 1 |
https://cisoseries.com/solving-grc-complexity-with-anecdotes/ |
