Latest Articles

A mid-sized payments company completes its Series B funding round and starts onboarding banking partners across three countries within the same quarter. The US partner asks for evidence of GLBA safeguards and NYDFS Part 500 alignment. The UK partner asks about FCA operational resilience testing. The Indian partner asks for proof of RBI-aligned VAPT and […]

2 out of every 3 federal agencies failed their own government’s security audit. It is neither a hypothetical nor a worst-case scenario dreamed up by a vendor trying to sell you something. The U.S. Government Accountability Office looked at 23 major civilian federal agencies and found that 15 of them, about two-thirds, had ‘ineffective’ information […]

When people think about any AI applications, they only talk about a large language model like GPT-4, Claude, or Llama generating responses to user prompts. The model is actually just a small part of what they are seeing. There is much more inside an AI system. This shows the importance of an AI Bill of […]

Key Takeaways A CSITE RBI audit is a regulatory examination, not an internal audit, and carries penalty and remediation consequences under the Banking Regulation Act. Documentation alone does not satisfy examiners; evidence that controls are actively operating, like logs and test reports, is what closes findings. Manual VAPT with verified remediation is expected, not an […]

Your team deployed an MCP server last month. It connects your AI agent to your company’s internal tools, databases, and APIs. Everything seems to work fine. Last week, someone asked a question that nobody has a good answer for: “Are we actually secure when it comes to MCP Security?” Why MCP Security Differs from Traditional […]

The NYDFS Cybersecurity Regulation under 23 NYCRR 500 mandates that regulated financial institutions implement security testing programs, including penetration testing and NYDFS vulnerability assessment, to identify and remediate cybersecurity weaknesses. The NYDFS Cybersecurity regulation has emerged as a response to the rapid increase in cyberattacks targeting financial institutions during the early 2010s. Banks, insurers, and […]

Every Microsoft 365 tenant starts life with the same problem: the security defaults Microsoft ships are designed for usability, not for the threat environment most organisations actually face. According to the Identity Theft Resource Centre’s 2025 Annual Data Breach Report, data compromises hit a record high of 3,322 tracked events. Microsoft 365 is a primary […]

An Indian SaaS company signs its first enterprise client in Germany. The contract closes, onboarding begins, and nobody on the founding team asks whether the company needs to comply with European data protection law, since it has no office or employees in the EU. Eighteen months later, a security review by the German client’s legal […]

Introduction The Gramm-Leach-Bliley Act (GLBA) is a U.S. federal law that requires financial institutions and fintech companies to protect customers’ nonpublic personal information (NPI). As part of achieving GLBA compliance, security testing for fintech organizations plays a critical role in identifying vulnerabilities and validating security controls. A key part of this law is the GLBA […]