Latest Articles

Two years after publication, the NIST Cybersecurity Framework 2.0 has become the document most boards ask about by name. It is the most downloaded NIST technical publication, with over 3 million views and downloads, and it is no longer a US critical infrastructure document. It is a global reference used by banks in São Paulo, […]

One weak software dependency can disrupt hospital operations and compromise patient information within a day. Developing healthcare software in an insecure manner results in late-stage patches, audit failures, and delayed product release. This is why the NIST Secure Software Development Framework (SSDF) is essential for the healthtech community. Integrating the NIST 800- 218 practices allows […]

Your external attack surface does not stop changing when a penetration test ends. A new cloud instance can go live, a forgotten subdomain can remain exposed, or a previously safe service can become vulnerable after a configuration change.  IBM’s 2026 Cost of a Data Breach Report puts the global average cost of a data breach […]

Introduction In late 2025, Spain’s data protection authority fined AENA just over €10 million in connection with its use of biometric facial-recognition systems at airports. The case raised concerns around the organisation’s data protection impact assessment (DPIA), including how it assessed the necessity, proportionality and risks of the processing. The authority also imposed corrective measures […]

Application security posture management (ASPM) is a control layer that ingests findings from every security tool you already run, removes the duplicates, adds context about what each finding can actually reach, and turns the result into a ranked list somebody can work through. Gartner defines the category as tools that continuously manage application risk through […]

What Are API Security Standards? API security standards are published and verifiable rules that outline how the API must prove its authentication, authorisation, data protection and everything else in transit to an auditor. They are from various sources: standards bodies such as OWASP and NIST, protocol specifications such as OAuth 2.0 and OpenID Connect, and […]

APRA CPS 234 is the information security standard APRA regulated organisations in Australia use to guide how they manage cyber risk and protect critical information assets. The harder part is turning that expectation into a testing program that reflects the actual risk around your information assets. Penetration testing can play an important role here by […]

For many Australian organisations, the Essential Eight becomes difficult at the point where implementation has to be measured. The framework itself is clear. The harder part is knowing whether each control is working across the environment and whether the organisation can prove its maturity level during an assessment. That challenge is widespread. In 2025, only […]

To successfully launch a medical device in the Philippine market, there are certain regulatory requirements that need to be fulfilled. The FDA Philippines medical device registration is conducted using a risk-based approach, in which the device’s classification determines everything. The FDA Philippines operates under a risk-based classification system with the ASEAN Medical Device Directive (AMDD). […]