DISC Infosec blog

The Batch Model Is Broken: Vulnerability Management in the Era of AI-Accelerated Discovery

disc7 — Fri, 31 Jul 2026 16:37:22 +0000

The Batch Model Is Broken: Vulnerability Management in the Era of AI-Accelerated Discovery Scheduled scans. Monthly patch windows. A CVSS-sorted queue that someone works down until capacity runs out. That model was never elegant, but it worked because of three assumptions. All three are now false, and the data from the first half of 2026 […]

The post The Batch Model Is Broken: Vulnerability Management in the Era of AI-Accelerated Discovery appeared first on DISC InfoSec blog.

NIST CSF 2.0 and ISO 27001: Why the Strongest Programs Use Both

disc7 — Thu, 30 Jul 2026 16:51:21 +0000

NIST CSF 2.0 and ISO 27001: Why the Strongest Programs Use Both Every security leader eventually gets asked the same question by a board member, a founder, or a prospect’s procurement team: “Which framework are we doing?” The question assumes the frameworks compete. They don’t. NIST CSF 2.0 and ISO/IEC 27001:2022 are built for different […]

The post
NIST CSF 2.0 and ISO 27001: Why the Strongest Programs Use Both appeared first on DISC InfoSec blog.

Continuous NIST 800-53 Compliance: How to Stop Failing in the Eleven Months Between Audits

disc7 — Mon, 27 Jul 2026 14:33:24 +0000

Continuous NIST 800-53 Compliance: How to Stop Failing in the Eleven Months Between Audits Most organizations do not fail NIST SP 800-53 during the assessment. They fail three months after it, quietly, and only find out the following year when an assessor pulls a sample and the sample doesn’t hold. The pattern is always the […]

The post Continuous NIST 800-53 Compliance: How to Stop Failing in the Eleven Months Between Audits appeared first on DISC InfoSec blog.

AI Governance Readiness Assessment — Service

disc7 — Wed, 22 Jul 2026 21:03:36 +0000

A fixed-scope, fixed-fee, two-week engagement that tells a company exactly where it stands against an AI governance standard — and hands them a prioritized, costed remediation plan they can execute against. Auditor-grade certainty in two weeks, not a six-month program. Included Explicitly excluded (these are the follow-on engagement) Framework lenses (pick one) Lens Best fit […]

The post AI Governance Readiness Assessment — Service appeared first on DISC InfoSec blog.

GRC Engineering: From Evidence Theater to Genuine Assurance

disc7 — Tue, 21 Jul 2026 18:14:04 +0000

GRC Engineering: From Evidence Theater to Genuine Assurance Most GRC programs are quietly optimized for the wrong outcome. They are built to survive an audit, not to reduce risk. The busiest weeks on the calendar are the ones before an assessor arrives, and the measure of success is a clean opinion rather than a safer […]

The post GRC Engineering: From Evidence Theater to Genuine Assurance appeared first on DISC InfoSec blog.

AI Risk Management: AIRM isn’t a Security Problem — It’s Bigger

disc7 — Mon, 20 Jul 2026 16:23:53 +0000

AI Risk Management: The Discipline Your AI Strategy is Missing Most organizations discovered last year just how much AI they were already running. A customer support chatbot here. Copilot in the IDE. Einstein scoring leads in the CRM. A fraud model someone built in 2021 that nobody owns anymore. When I run AI inventories for […]

The post AI Risk Management: AIRM isn’t a Security Problem — It’s Bigger appeared first on DISC InfoSec blog.

The adversary that treats your balance sheet as the objective

disc7 — Sun, 12 Jul 2026 23:02:49 +0000

Download html file AI Attack Surface ScoreCard AI Vulnerability Scorecard: Discover Your AI Attack Surface Before Attackers Do Your Shadow AI Problem Has a Name-And Now It Has a Score Most AI Security Tools Won’t Pass an Audit. Here’s a 15-Minute Way to Find Out. AIMS and Data Governance – Managing data responsibly isn’t just […]

The post The adversary that treats your balance sheet as the objective appeared first on DISC InfoSec blog.

Why Supplier Security Is Under the Spotlight — and How to Build a Vendor Management Program for the AI Era

disc7 — Fri, 10 Jul 2026 14:22:30 +0000

Why Supplier Security Is Under the Spotlight — and How to Build a Vendor Management Program for the AI Era Your security program is only as strong as the weakest vendor with access to your environment. That’s not a slogan anymore — it’s what the breach data says, it’s what regulators are writing into law, […]

The post Why Supplier Security Is Under the Spotlight — and How to Build a Vendor Management Program for the AI Era appeared first on DISC InfoSec blog.

GDPR Isn’t a Cookie Banner: The Audit Findings That Actually Get Companies Fined

disc7 — Thu, 09 Jul 2026 17:44:39 +0000

GDPR Isn’t a Cookie Banner: The Audit Findings That Actually Get Companies Fined Seven years after GDPR took effect, most organizations still treat it like a checkbox they ticked in 2018. They dropped in a cookie banner, published a privacy policy their own lawyers haven’t read since, and moved on. Then a data subject access […]

The post GDPR Isn’t a Cookie Banner: The Audit Findings That Actually Get Companies Fined appeared first on DISC InfoSec blog.

ATT&CK vs. ATLAS: Why Securing AI Systems Needs Its Own Playbook

disc7 — Tue, 07 Jul 2026 20:04:42 +0000

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is specifically about attacks on AI and machine learning systems — things like data poisoning, model evasion, model extraction, and prompt injection. It’s modeled on the ATT&CK structure (tactics and techniques) but applied to the AI/ML attack surface. The description in your source looks like it may […]

The post ATT&CK vs. ATLAS: Why Securing AI Systems Needs Its Own Playbook appeared first on DISC InfoSec blog.

20 State Laws, One Enforcement Standard: Privacy by Design or Pay

disc7 — Fri, 03 Jul 2026 17:19:46 +0000

Privacy Just Became Infrastructure. Most AI Programs Haven’t Noticed. By DISC InfoSec For twenty years, privacy compliance meant disclosure: post a policy, collect consent, answer the occasional access request. That era is over. In 2026, privacy is infrastructure — regulators are testing whether your controls actually work, not whether your privacy notice reads well. I […]

The post 20 State Laws, One Enforcement Standard: Privacy by Design or Pay appeared first on DISC InfoSec blog.

Compliance Event vs. Compliance Capability: Why ISO 42001 is How You Actually Meet the EU AI Act

disc7 — Thu, 02 Jul 2026 16:50:10 +0000

How they relate The cleanest way to frame it: the EU AI Act defines outcomes; ISO 42001 supplies the machinery to produce them repeatedly. The Act (Regulation (EU) 2024/1689) is enforceable law with fines up to €35M or 7% of global turnover for prohibited practices. ISO 42001 is a voluntary, certifiable management system standard published […]

The post Compliance Event vs. Compliance Capability: Why ISO 42001 is How You Actually Meet the EU AI Act appeared first on DISC InfoSec blog.

The AI RMF Gap Nobody’s Talking About: Why GOVERN-Heavy Programs Still Fail Audits

disc7 — Wed, 01 Jul 2026 15:04:23 +0000

This is the AI RMF gap assessment, not the checklist version. Most write-ups treat GOVERN, MAP, MEASURE, and MANAGE as four boxes to tick. In practice, the interesting failure isn’t which box is empty — it’s the pattern across the boxes. That pattern is what tells you whether your AI program is actually managing risk […]

The post The AI RMF Gap Nobody’s Talking About: Why GOVERN-Heavy Programs Still Fail Audits appeared first on DISC InfoSec blog.

ISO/IEC 27001:2022 — The Compliance Bedrock Every Serious InfoSec Program Is Built On

disc7 — Mon, 29 Jun 2026 15:53:06 +0000

ISO/IEC 27001:2022 — The Compliance Bedrock Every Serious InfoSec Program Is Built On By Disc | Principal Consultant, DISC InfoSec There’s a question I get from almost every B2B SaaS and financial services client at some point: “Which compliance framework should we start with?” My answer is almost always the same: ISO/IEC 27001. Not because […]

The post ISO/IEC 27001:2022 — The Compliance Bedrock Every Serious InfoSec Program Is Built On appeared first on DISC InfoSec blog.

One Audit – Four Standards – Zero Duplication

disc7 — Fri, 26 Jun 2026 18:16:31 +0000

One Audit. Four Standards. Zero Duplication. How to Build a Master Questionnaire as Your Single Source of Truth for ISO 27001, ISO 42001, NIST 800-53, and GDPR I want to tell you about a problem that is quietly draining compliance teams at SaaS companies right now — and a structural fix that changed how we […]

The post One Audit – Four Standards – Zero Duplication appeared first on DISC InfoSec blog.