DISC Infosec blog https://blog.deurainfosec.com/ Dedicated to information security assurance Information Security subject matter with related items Sun, 12 Jul 2026 23:02:51 +0000 en-US hourly 1 https://wordpress.org/?v=6.1.10 https://blog.deurainfosec.com/wp-content/uploads/2023/05/disc-logo-144x144.jpg DISC InfoSec blog https://blog.deurainfosec.com/ 32 32 The adversary that treats your balance sheet as the objective https://blog.deurainfosec.com/the-adversary-that-treats-your-balance-sheet-as-the-objective/ https://blog.deurainfosec.com/the-adversary-that-treats-your-balance-sheet-as-the-objective/#respond Sun, 12 Jul 2026 23:02:49 +0000 https://blog.deurainfosec.com/?p=36225 Download html file AI Attack Surface ScoreCard AI Vulnerability Scorecard: Discover Your AI Attack Surface Before Attackers Do Your Shadow AI Problem Has a Name-And Now It Has a Score Most AI Security Tools Won’t Pass an Audit. Here’s a 15-Minute Way to Find Out. AIMS and Data Governance – Managing data responsibly isn’t just […]

The post The adversary that treats your balance sheet as the objective appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-adversary-that-treats-your-balance-sheet-as-the-objective/feed/ 0 Why Supplier Security Is Under the Spotlight — and How to Build a Vendor Management Program for the AI Era https://blog.deurainfosec.com/why-supplier-security-is-under-the-spotlight-and-how-to-build-a-vendor-management-program-for-the-ai-era/ https://blog.deurainfosec.com/why-supplier-security-is-under-the-spotlight-and-how-to-build-a-vendor-management-program-for-the-ai-era/#respond Fri, 10 Jul 2026 14:22:30 +0000 https://blog.deurainfosec.com/?p=36209 Why Supplier Security Is Under the Spotlight — and How to Build a Vendor Management Program for the AI Era Your security program is only as strong as the weakest vendor with access to your environment. That’s not a slogan anymore — it’s what the breach data says, it’s what regulators are writing into law, […]

The post Why Supplier Security Is Under the Spotlight — and How to Build a Vendor Management Program for the AI Era appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/why-supplier-security-is-under-the-spotlight-and-how-to-build-a-vendor-management-program-for-the-ai-era/feed/ 0 GDPR Isn’t a Cookie Banner: The Audit Findings That Actually Get Companies Fined https://blog.deurainfosec.com/gdpr-isnt-a-cookie-banner-the-audit-findings-that-actually-get-companies-fined/ https://blog.deurainfosec.com/gdpr-isnt-a-cookie-banner-the-audit-findings-that-actually-get-companies-fined/#respond Thu, 09 Jul 2026 17:44:39 +0000 https://blog.deurainfosec.com/?p=36204 GDPR Isn’t a Cookie Banner: The Audit Findings That Actually Get Companies Fined Seven years after GDPR took effect, most organizations still treat it like a checkbox they ticked in 2018. They dropped in a cookie banner, published a privacy policy their own lawyers haven’t read since, and moved on. Then a data subject access […]

The post GDPR Isn’t a Cookie Banner: The Audit Findings That Actually Get Companies Fined appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/gdpr-isnt-a-cookie-banner-the-audit-findings-that-actually-get-companies-fined/feed/ 0 ATT&CK vs. ATLAS: Why Securing AI Systems Needs Its Own Playbook https://blog.deurainfosec.com/attck-vs-atlas-why-securing-ai-systems-needs-its-own-playbook/ https://blog.deurainfosec.com/attck-vs-atlas-why-securing-ai-systems-needs-its-own-playbook/#respond Tue, 07 Jul 2026 20:04:42 +0000 https://blog.deurainfosec.com/?p=36194 MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is specifically about attacks on AI and machine learning systems — things like data poisoning, model evasion, model extraction, and prompt injection. It’s modeled on the ATT&CK structure (tactics and techniques) but applied to the AI/ML attack surface. The description in your source looks like it may […]

The post ATT&CK vs. ATLAS: Why Securing AI Systems Needs Its Own Playbook appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/attck-vs-atlas-why-securing-ai-systems-needs-its-own-playbook/feed/ 0 20 State Laws, One Enforcement Standard: Privacy by Design or Pay https://blog.deurainfosec.com/20-state-laws-one-enforcement-standard-privacy-by-design-or-pay/ https://blog.deurainfosec.com/20-state-laws-one-enforcement-standard-privacy-by-design-or-pay/#respond Fri, 03 Jul 2026 17:19:46 +0000 https://blog.deurainfosec.com/?p=36185 Privacy Just Became Infrastructure. Most AI Programs Haven’t Noticed. By DISC InfoSec For twenty years, privacy compliance meant disclosure: post a policy, collect consent, answer the occasional access request. That era is over. In 2026, privacy is infrastructure — regulators are testing whether your controls actually work, not whether your privacy notice reads well. I […]

The post 20 State Laws, One Enforcement Standard: Privacy by Design or Pay appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/20-state-laws-one-enforcement-standard-privacy-by-design-or-pay/feed/ 0 Compliance Event vs. Compliance Capability: Why ISO 42001 is How You Actually Meet the EU AI Act https://blog.deurainfosec.com/compliance-event-vs-compliance-capability-why-iso-42001-is-how-you-actually-meet-the-eu-ai-act/ https://blog.deurainfosec.com/compliance-event-vs-compliance-capability-why-iso-42001-is-how-you-actually-meet-the-eu-ai-act/#respond Thu, 02 Jul 2026 16:50:10 +0000 https://blog.deurainfosec.com/?p=36179 How they relate The cleanest way to frame it: the EU AI Act defines outcomes; ISO 42001 supplies the machinery to produce them repeatedly. The Act (Regulation (EU) 2024/1689) is enforceable law with fines up to €35M or 7% of global turnover for prohibited practices. ISO 42001 is a voluntary, certifiable management system standard published […]

The post Compliance Event vs. Compliance Capability: Why ISO 42001 is How You Actually Meet the EU AI Act appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/compliance-event-vs-compliance-capability-why-iso-42001-is-how-you-actually-meet-the-eu-ai-act/feed/ 0 The AI RMF Gap Nobody’s Talking About: Why GOVERN-Heavy Programs Still Fail Audits https://blog.deurainfosec.com/the-ai-rmf-gap-nobodys-talking-about-why-govern-heavy-programs-still-fail-audits/ https://blog.deurainfosec.com/the-ai-rmf-gap-nobodys-talking-about-why-govern-heavy-programs-still-fail-audits/#respond Wed, 01 Jul 2026 15:04:23 +0000 https://blog.deurainfosec.com/?p=36173 This is the AI RMF gap assessment, not the checklist version. Most write-ups treat GOVERN, MAP, MEASURE, and MANAGE as four boxes to tick. In practice, the interesting failure isn’t which box is empty — it’s the pattern across the boxes. That pattern is what tells you whether your AI program is actually managing risk […]

The post <strong>The AI RMF Gap Nobody’s Talking About: Why GOVERN-Heavy Programs Still Fail Audits</strong> appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-ai-rmf-gap-nobodys-talking-about-why-govern-heavy-programs-still-fail-audits/feed/ 0 ISO/IEC 27001:2022 — The Compliance Bedrock Every Serious InfoSec Program Is Built On https://blog.deurainfosec.com/iso-iec-270012022-the-compliance-bedrock-every-serious-infosec-program-is-built-on/ https://blog.deurainfosec.com/iso-iec-270012022-the-compliance-bedrock-every-serious-infosec-program-is-built-on/#respond Mon, 29 Jun 2026 15:53:06 +0000 https://blog.deurainfosec.com/?p=36149 ISO/IEC 27001:2022 — The Compliance Bedrock Every Serious InfoSec Program Is Built On By Disc | Principal Consultant, DISC InfoSec There’s a question I get from almost every B2B SaaS and financial services client at some point: “Which compliance framework should we start with?” My answer is almost always the same: ISO/IEC 27001. Not because […]

The post ISO/IEC 27001:2022 — The Compliance Bedrock Every Serious InfoSec Program Is Built On appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/iso-iec-270012022-the-compliance-bedrock-every-serious-infosec-program-is-built-on/feed/ 0 One Audit – Four Standards – Zero Duplication https://blog.deurainfosec.com/one-audit-four-standards-zero-duplication/ https://blog.deurainfosec.com/one-audit-four-standards-zero-duplication/#respond Fri, 26 Jun 2026 18:16:31 +0000 https://blog.deurainfosec.com/?p=36134 One Audit. Four Standards. Zero Duplication. How to Build a Master Questionnaire as Your Single Source of Truth for ISO 27001, ISO 42001, NIST 800-53, and GDPR I want to tell you about a problem that is quietly draining compliance teams at SaaS companies right now — and a structural fix that changed how we […]

The post One Audit – Four Standards – Zero Duplication appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/one-audit-four-standards-zero-duplication/feed/ 0 GDPR Isn’t a Checkbox. It’s the Privacy Standard Your Organization Can’t Afford to Ignore https://blog.deurainfosec.com/gdpr-isnt-a-checkbox-its-the-privacy-standard-your-organization-cant-afford-to-ignore/ https://blog.deurainfosec.com/gdpr-isnt-a-checkbox-its-the-privacy-standard-your-organization-cant-afford-to-ignore/#respond Wed, 24 Jun 2026 16:46:49 +0000 https://blog.deurainfosec.com/?p=36108 AI Attack Surface ScoreCard AI Vulnerability Scorecard: Discover Your AI Attack Surface Before Attackers Do Your Shadow AI Problem Has a Name-And Now It Has a Score Most AI Security Tools Won’t Pass an Audit. Here’s a 15-Minute Way to Find Out. AIMS and Data Governance – Managing data responsibly isn’t just good practice—it’s a […]

The post GDPR Isn’t a Checkbox. It’s the Privacy Standard Your Organization Can’t Afford to Ignore appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/gdpr-isnt-a-checkbox-its-the-privacy-standard-your-organization-cant-afford-to-ignore/feed/ 0 Most companies deploying AI in the EU still don’t know what tier they’re in https://blog.deurainfosec.com/most-companies-deploying-ai-in-the-eu-still-dont-know-what-tier-theyre-in/ https://blog.deurainfosec.com/most-companies-deploying-ai-in-the-eu-still-dont-know-what-tier-theyre-in/#respond Tue, 23 Jun 2026 18:12:17 +0000 https://blog.deurainfosec.com/?p=36095 Most companies deploying AI in the EU still don’t know what tier they’re in Most companies deploying AI in the EU still don’t know what tier they’re in. That’s not an opinion. It’s what I see in every engagement. The EU AI Act (Reg. 2024/1689) has been in force since August 2024. Prohibited practices have […]

The post Most companies deploying AI in the EU still don’t know what tier they’re in appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/most-companies-deploying-ai-in-the-eu-still-dont-know-what-tier-theyre-in/feed/ 0 You Can’t Certify What You Haven’t Mapped: The Case for an ISO 27001 Gap Assessment https://blog.deurainfosec.com/you-cant-certify-what-you-havent-mapped-the-case-for-an-iso-27001-gap-assessment/ https://blog.deurainfosec.com/you-cant-certify-what-you-havent-mapped-the-case-for-an-iso-27001-gap-assessment/#respond Mon, 22 Jun 2026 20:02:23 +0000 https://blog.deurainfosec.com/?p=36083 You Can’t Certify What You Haven’t Mapped: The Case for an ISO 27001 Gap Assessment Every ISO 27001 certification journey starts the same way — with a question that sounds simple and isn’t: Where are we right now? That question is the gap assessment. And whether you’re a 20-person SaaS company trying to win enterprise […]

The post You Can’t Certify What You Haven’t Mapped: The Case for an ISO 27001 Gap Assessment appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/you-cant-certify-what-you-havent-mapped-the-case-for-an-iso-27001-gap-assessment/feed/ 0 The New Identity Perimeter: Machines, Agents, and the Trust Problem https://blog.deurainfosec.com/the-new-identity-perimeter-machines-agents-and-the-trust-problem/ https://blog.deurainfosec.com/the-new-identity-perimeter-machines-agents-and-the-trust-problem/#respond Tue, 16 Jun 2026 17:40:13 +0000 https://blog.deurainfosec.com/?p=35987 The New Identity Perimeter: Machines, Agents, and the Trust Problem Identity security is entering a fundamentally new phase — one where protecting access is no longer just about people, but about the full ecosystem of entities, human and non-human, that touch enterprise data and systems. Delinea CPO Phil Calvin, in conversation with OWASP contributor Chris […]

The post The New Identity Perimeter: Machines, Agents, and the Trust Problem appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-new-identity-perimeter-machines-agents-and-the-trust-problem/feed/ 0 Securing the Agentic Enterprise: Where AI Autonomy Meets ISO 42001 and the EU AI Act https://blog.deurainfosec.com/securing-the-agentic-enterprise-where-ai-autonomy-meets-iso-42001-and-the-eu-ai-act/ https://blog.deurainfosec.com/securing-the-agentic-enterprise-where-ai-autonomy-meets-iso-42001-and-the-eu-ai-act/#respond Mon, 15 Jun 2026 16:17:08 +0000 https://blog.deurainfosec.com/?p=35862 Architecting Secure Enterprise AI Agents: A Practitioner’s Guide to Building AI That Earns Trust The enterprise AI landscape has fundamentally shifted. We’ve moved beyond chatbots that answer questions to autonomous agents that perceive context, reason over goals, and take action through real tools and services. But here’s the uncomfortable truth that IBM’s recent guide (verified […]

The post Securing the Agentic Enterprise: Where AI Autonomy Meets ISO 42001 and the EU AI Act appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/securing-the-agentic-enterprise-where-ai-autonomy-meets-iso-42001-and-the-eu-ai-act/feed/ 0 Regulatory Relief Is Not Risk Relief: The EU AI Act Delay Trap https://blog.deurainfosec.com/regulatory-relief-is-not-risk-relief-the-eu-ai-act-delay-trap/ https://blog.deurainfosec.com/regulatory-relief-is-not-risk-relief-the-eu-ai-act-delay-trap/#respond Thu, 11 Jun 2026 15:18:12 +0000 https://blog.deurainfosec.com/?p=35878 The Delay Trap: Why the EU AI Act Postponement Is the Most Dangerous Gift Your Compliance Program Ever Received Brussels just handed enterprises sixteen extra months. Most of them are about to spend it accumulating governance debt. On May 7, 2026, EU legislators reached a provisional agreement on the Digital Omnibus on AI — the […]

The post Regulatory Relief Is Not Risk Relief: The EU AI Act Delay Trap appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/regulatory-relief-is-not-risk-relief-the-eu-ai-act-delay-trap/feed/ 0