DISC Infosec blog https://blog.deurainfosec.com/ Dedicated to information security assurance Information Security subject matter with related items Thu, 20 Aug 2026 17:38:53 +0000 en-US hourly 1 https://wordpress.org/?v=6.1.12 https://blog.deurainfosec.com/wp-content/uploads/2026/07/disc-logo-144x144.jpg DISC InfoSec blog https://blog.deurainfosec.com/ 32 32 The AIMS/ISMS readiness ladder: seven steps from curious to certified https://blog.deurainfosec.com/the-aims-isms-readiness-ladder-seven-steps-from-curious-to-certified/ https://blog.deurainfosec.com/the-aims-isms-readiness-ladder-seven-steps-from-curious-to-certified/#respond Thu, 20 Aug 2026 17:38:49 +0000 https://blog.deurainfosec.com/?p=36405 A practical seven-step path from a 15-minute readiness call to ISO 42001 and ISO 27001 certification — with the prep work that makes each step fast instead of painful. Most organizations don’t stall on ISO 42001 or ISO 27001 because the standards are hard. They stall because step one is unclear, and the gap between […]

The post The AIMS/ISMS readiness ladder: seven steps from curious to certified appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-aims-isms-readiness-ladder-seven-steps-from-curious-to-certified/feed/ 0 AI Governance Careers: The Skills Gap Nobody Is Filling (2026) https://blog.deurainfosec.com/ai-governance-careers-the-skills-gap-nobody-is-filling-2026/ https://blog.deurainfosec.com/ai-governance-careers-the-skills-gap-nobody-is-filling-2026/#respond Mon, 17 Aug 2026 18:51:20 +0000 https://blog.deurainfosec.com/?p=36389 Everyone Is Learning to Build With AI. Almost Nobody Is Learning to Govern It. I keep meeting people who are burning nights and weekends teaching themselves to build with AI. Agents, RAG pipelines, orchestration frameworks, the whole stack. I understand the instinct completely. The tooling is genuinely exciting, the demand looks self-evident, and nobody wants […]

The post AI Governance Careers: The Skills Gap Nobody Is Filling (2026) appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/ai-governance-careers-the-skills-gap-nobody-is-filling-2026/feed/ 0 AI Governance & Cybersecurity That Holds Up Under Scrutiny https://blog.deurainfosec.com/ai-governance-cybersecurity-that-holds-up-under-scrutiny/ https://blog.deurainfosec.com/ai-governance-cybersecurity-that-holds-up-under-scrutiny/#respond Sat, 15 Aug 2026 22:08:34 +0000 https://blog.deurainfosec.com/?p=36369 AI risk is moving faster than most organizations’ governance programs. Expert AI Governance and Cybersecurity Consulting Strengthening B2B SaaS and Financial Services with Robust Compliance Frameworks – DISC InfoSec turn AI governance and cybersecurity requirements into practical, defensible programs—not another stack of policies. Deura Information Security Consulting LLC provides expert guidance for B2B SaaS and […]

The post AI Governance & Cybersecurity That Holds Up Under Scrutiny appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/ai-governance-cybersecurity-that-holds-up-under-scrutiny/feed/ 0 “Sorry, Typo”: Why a Markdown File Is Not a Security Control https://blog.deurainfosec.com/sorry-typo-why-a-markdown-file-is-not-a-security-control/ https://blog.deurainfosec.com/sorry-typo-why-a-markdown-file-is-not-a-security-control/#respond Mon, 10 Aug 2026 17:33:07 +0000 https://blog.deurainfosec.com/?p=36359 “Sorry, Typo”: Why a Markdown File Is Not a Security Control PCWorld ran a piece last week on the one command you should never let an AI coding agent execute: rm -rf. The reporting is solid and the anecdotes are grim — developers who let an agent handle a routine cleanup task and lost a […]

The post “Sorry, Typo”: Why a Markdown File Is Not a Security Control appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/sorry-typo-why-a-markdown-file-is-not-a-security-control/feed/ 0 Security against defeat implies defensive tactics; ability to defeat the enemy means taking the offensive https://blog.deurainfosec.com/security-against-defeat-implies-defensive-tactics-ability-to-defeat-the-enemy-means-taking-the-offensive/ https://blog.deurainfosec.com/security-against-defeat-implies-defensive-tactics-ability-to-defeat-the-enemy-means-taking-the-offensive/#respond Wed, 05 Aug 2026 15:35:48 +0000 https://blog.deurainfosec.com/?p=36352 “security against defeat implies defensive tactics; ability to defeat the enemy means taking the offensive” Sun Tzu This quote is essentially saying: If your goal is simply to avoid losing, you play defense. If your goal is to actually defeat the opponent, you must eventually take the initiative. In simpler terms: In cybersecurity This maps […]

The post Security against defeat implies defensive tactics; ability to defeat the enemy means taking the offensive appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/security-against-defeat-implies-defensive-tactics-ability-to-defeat-the-enemy-means-taking-the-offensive/feed/ 0 ISO 27001 Got You in the Door. ISO 42001 Keeps You There https://blog.deurainfosec.com/iso-27001-got-you-in-the-door-iso-42001-keeps-you-there/ https://blog.deurainfosec.com/iso-27001-got-you-in-the-door-iso-42001-keeps-you-there/#respond Mon, 03 Aug 2026 17:19:26 +0000 https://blog.deurainfosec.com/?p=36324 Your Buyer Now Audits Your AI Before They Sign Two years ago, the security questionnaire that stalled your enterprise deal asked about encryption at rest, access reviews, and whether you had a SOC 2 report. It still asks those things. But now there’s a second section — and most B2B SaaS and financial services firms […]

The post ISO 27001 Got You in the Door. ISO 42001 Keeps You There appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/iso-27001-got-you-in-the-door-iso-42001-keeps-you-there/feed/ 0 The Batch Model Is Broken: Vulnerability Management in the Era of AI-Accelerated Discovery https://blog.deurainfosec.com/the-batch-model-is-broken-vulnerability-management-in-the-era-of-ai-accelerated-discovery/ https://blog.deurainfosec.com/the-batch-model-is-broken-vulnerability-management-in-the-era-of-ai-accelerated-discovery/#respond Fri, 31 Jul 2026 16:37:22 +0000 https://blog.deurainfosec.com/?p=36309 The Batch Model Is Broken: Vulnerability Management in the Era of AI-Accelerated Discovery Scheduled scans. Monthly patch windows. A CVSS-sorted queue that someone works down until capacity runs out. That model was never elegant, but it worked because of three assumptions. All three are now false, and the data from the first half of 2026 […]

The post The Batch Model Is Broken: Vulnerability Management in the Era of AI-Accelerated Discovery appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-batch-model-is-broken-vulnerability-management-in-the-era-of-ai-accelerated-discovery/feed/ 0 NIST CSF 2.0 and ISO 27001: Why the Strongest Programs Use Both https://blog.deurainfosec.com/nist-csf-2-0-and-iso-27001-why-the-strongest-programs-use-both/ https://blog.deurainfosec.com/nist-csf-2-0-and-iso-27001-why-the-strongest-programs-use-both/#respond Thu, 30 Jul 2026 16:51:21 +0000 https://blog.deurainfosec.com/?p=36305 NIST CSF 2.0 and ISO 27001: Why the Strongest Programs Use Both Every security leader eventually gets asked the same question by a board member, a founder, or a prospect’s procurement team: “Which framework are we doing?” The question assumes the frameworks compete. They don’t. NIST CSF 2.0 and ISO/IEC 27001:2022 are built for different […]

The post <br>NIST CSF 2.0 and ISO 27001: Why the Strongest Programs Use Both appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/nist-csf-2-0-and-iso-27001-why-the-strongest-programs-use-both/feed/ 0 Continuous NIST 800-53 Compliance: How to Stop Failing in the Eleven Months Between Audits https://blog.deurainfosec.com/continuous-nist-800-53-compliance-how-to-stop-failing-in-the-eleven-months-between-audits/ https://blog.deurainfosec.com/continuous-nist-800-53-compliance-how-to-stop-failing-in-the-eleven-months-between-audits/#respond Mon, 27 Jul 2026 14:33:24 +0000 https://blog.deurainfosec.com/?p=36293 Continuous NIST 800-53 Compliance: How to Stop Failing in the Eleven Months Between Audits Most organizations do not fail NIST SP 800-53 during the assessment. They fail three months after it, quietly, and only find out the following year when an assessor pulls a sample and the sample doesn’t hold. The pattern is always the […]

The post Continuous NIST 800-53 Compliance: How to Stop Failing in the Eleven Months Between Audits appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/continuous-nist-800-53-compliance-how-to-stop-failing-in-the-eleven-months-between-audits/feed/ 0 AI Governance Readiness Assessment — Service https://blog.deurainfosec.com/ai-governance-readiness-assessment-service/ https://blog.deurainfosec.com/ai-governance-readiness-assessment-service/#respond Wed, 22 Jul 2026 21:03:36 +0000 https://blog.deurainfosec.com/?p=36273 A fixed-scope, fixed-fee, two-week engagement that tells a company exactly where it stands against an AI governance standard — and hands them a prioritized, costed remediation plan they can execute against. Auditor-grade certainty in two weeks, not a six-month program. Included Explicitly excluded (these are the follow-on engagement) Framework lenses (pick one) Lens Best fit […]

The post AI Governance Readiness Assessment — Service appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/ai-governance-readiness-assessment-service/feed/ 0 GRC Engineering: From Evidence Theater to Genuine Assurance https://blog.deurainfosec.com/grc-engineering-from-evidence-theater-to-genuine-assurance/ https://blog.deurainfosec.com/grc-engineering-from-evidence-theater-to-genuine-assurance/#respond Tue, 21 Jul 2026 18:14:04 +0000 https://blog.deurainfosec.com/?p=36252 GRC Engineering: From Evidence Theater to Genuine Assurance Most GRC programs are quietly optimized for the wrong outcome. They are built to survive an audit, not to reduce risk. The busiest weeks on the calendar are the ones before an assessor arrives, and the measure of success is a clean opinion rather than a safer […]

The post GRC Engineering: From Evidence Theater to Genuine Assurance appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/grc-engineering-from-evidence-theater-to-genuine-assurance/feed/ 0 AI Risk Management: AIRM isn’t a Security Problem — It’s Bigger https://blog.deurainfosec.com/ai-risk-management-airm-isnt-a-security-problem-its-bigger/ https://blog.deurainfosec.com/ai-risk-management-airm-isnt-a-security-problem-its-bigger/#respond Mon, 20 Jul 2026 16:23:53 +0000 https://blog.deurainfosec.com/?p=36237 AI Risk Management: The Discipline Your AI Strategy is Missing Most organizations discovered last year just how much AI they were already running. A customer support chatbot here. Copilot in the IDE. Einstein scoring leads in the CRM. A fraud model someone built in 2021 that nobody owns anymore. When I run AI inventories for […]

The post AI Risk Management: AIRM isn’t a Security Problem — It’s Bigger appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/ai-risk-management-airm-isnt-a-security-problem-its-bigger/feed/ 0 The adversary that treats your balance sheet as the objective https://blog.deurainfosec.com/the-adversary-that-treats-your-balance-sheet-as-the-objective/ https://blog.deurainfosec.com/the-adversary-that-treats-your-balance-sheet-as-the-objective/#respond Sun, 12 Jul 2026 23:02:49 +0000 https://blog.deurainfosec.com/?p=36225 Download html file AI Attack Surface ScoreCard AI Vulnerability Scorecard: Discover Your AI Attack Surface Before Attackers Do Your Shadow AI Problem Has a Name-And Now It Has a Score Most AI Security Tools Won’t Pass an Audit. Here’s a 15-Minute Way to Find Out. AIMS and Data Governance – Managing data responsibly isn’t just […]

The post The adversary that treats your balance sheet as the objective appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-adversary-that-treats-your-balance-sheet-as-the-objective/feed/ 0 Why Supplier Security Is Under the Spotlight — and How to Build a Vendor Management Program for the AI Era https://blog.deurainfosec.com/why-supplier-security-is-under-the-spotlight-and-how-to-build-a-vendor-management-program-for-the-ai-era/ https://blog.deurainfosec.com/why-supplier-security-is-under-the-spotlight-and-how-to-build-a-vendor-management-program-for-the-ai-era/#respond Fri, 10 Jul 2026 14:22:30 +0000 https://blog.deurainfosec.com/?p=36209 Why Supplier Security Is Under the Spotlight — and How to Build a Vendor Management Program for the AI Era Your security program is only as strong as the weakest vendor with access to your environment. That’s not a slogan anymore — it’s what the breach data says, it’s what regulators are writing into law, […]

The post Why Supplier Security Is Under the Spotlight — and How to Build a Vendor Management Program for the AI Era appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/why-supplier-security-is-under-the-spotlight-and-how-to-build-a-vendor-management-program-for-the-ai-era/feed/ 0 GDPR Isn’t a Cookie Banner: The Audit Findings That Actually Get Companies Fined https://blog.deurainfosec.com/gdpr-isnt-a-cookie-banner-the-audit-findings-that-actually-get-companies-fined/ https://blog.deurainfosec.com/gdpr-isnt-a-cookie-banner-the-audit-findings-that-actually-get-companies-fined/#respond Thu, 09 Jul 2026 17:44:39 +0000 https://blog.deurainfosec.com/?p=36204 GDPR Isn’t a Cookie Banner: The Audit Findings That Actually Get Companies Fined Seven years after GDPR took effect, most organizations still treat it like a checkbox they ticked in 2018. They dropped in a cookie banner, published a privacy policy their own lawyers haven’t read since, and moved on. Then a data subject access […]

The post GDPR Isn’t a Cookie Banner: The Audit Findings That Actually Get Companies Fined appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/gdpr-isnt-a-cookie-banner-the-audit-findings-that-actually-get-companies-fined/feed/ 0