01
22 October 2026 · 22 min read
Business cybersecurity: the complete 2026–2027 guide
How should a company build cybersecurity? A complete plan for leaders, employees and IT covering risks, priorities, budget, training, incidents and metrics.
Topic · 18 articles
Governance and Compliance
Risk management, NIS2, DORA, GDPR and organisational practices that turn requirements into operating controls, ownership and measurable improvement.
FIELD NOTES
TOPIC INDEX
Latest research
02
20 October 2026 · 9 min read
Poland's CSIRE reaches its final rollout stage: what people and businesses should know
Poland began the final statutory CSIRE onboarding stage on October 19. Learn what it means for energy customers, businesses and market participants—and how to verify related messages safely.
03
18 October 2026 · 8 min read
Digital evidence after a cyber incident: business lessons from Europol's new report
Europol identifies gaps in digital forensic tools, standards and skills. For organisations, the practical lesson is to preserve evidence before remediation destroys the timeline.
04
17 October 2026 · 7 min read
Cyber incident communication: plan before rumours take over
CERT Polska has published crisis-communication guidance. We turn it into a practical plan for the first statement, roles, channels and updates.
05
15 October 2026 · 7 min read
CISA BOD 26-04: urgent patching and rapid forensic triage belong together
CISA's new model combines exposure, active exploitation, impact and evidence review. We show how organisations elsewhere can use the sequence.
06
11 October 2026 · 5 min read
TLP 2.0: sharing boundaries are not information classification
A SANS commentary from 10 October highlights the limits of TLP. Make better decisions about sharing reports, working with partners and using AI tools.
07
1 October 2026 · 10 min read
Poland's Cyber Five: proposals that could reshape health-data protection
The ministry proposes supplier certification, minimum safeguards, patient alerts and new duties for large-scale health-data processors.
08
30 September 2026 · 9 min read
Poland's KSC self-registration deadline is 3 October: a final checklist for organisations
Essential and important entities have until 3 October to apply for Poland's KSC register. Here is what to verify and what comes next.
09
29 September 2026 · 9 min read
Manufacturers now have 24 hours for an initial CRA report: Poland's CSIRT NASK coordinates submissions
Reporting duties for actively exploited vulnerabilities and severe product incidents are already in force through ENISA's new platform.
10
28 September 2026 · 9 min read
BCX incident affected a legacy test environment: why old data still creates real risk
BCX found no evidence of live production compromise but continues to assess legacy information. It is a practical lesson in test data and retention.
11
25 September 2026 · 10 min read
Scam ads impersonate businesses and agencies. The FTC asks what platforms should do
The FTC is considering new platform duties for impersonation ads. It is not a final rule, but it matters to consumers, brands and advertisers now.
12
10 July 2026 · 9 min read
EU AI content labelling rules before 2 August 2026
The EU approved a code for AI-generated content transparency. Learn what AI Act Article 50 requires from 2 August and how companies should prepare.
13
7 July 2026 · 10 min read
External attack surface management: a practical guide
EASM discovers unknown domains, IPs, cloud and services. Build a repeatable process for discovery, ownership, risk prioritisation and remediation.
14
28 June 2026 · 12 min read
NIS2 in Poland: new obligations and 2026 deadlines
The amended KSC act implements NIS2 and applies from 3 April 2026. We explain who it covers, the deadlines and what you need to do.
15
31 May 2026 · 12 min read
DORA: what it really requires of financial firms
DORA has applied since January 2025 and covers far more than banks. The five pillars, mandatory resilience testing and ICT supplier duties.
16
21 May 2026 · 11 min read
Shadow IT: the apps IT doesn't know about
Employees use several times more applications than IT has approved. Where shadow IT comes from, what it risks and how to control it without bans.
17
26 April 2026 · 12 min read
GDPR in IT practice: technical security measures
'Appropriate technical measures' — but which exactly? GDPR Article 32 as an IT checklist: encryption, access, logs, backups and testing.
18
16 April 2026 · 12 min read
Small business cybersecurity: a 90-day plan
A small company doesn't need a security department to stop being an easy target. A 90-day plan: what to do in-house, what to buy, what to outsource.
BR / NEXT STEP
Want to prepare your team for these threats?
We turn current threats into role-based training, safe exercises and a clear reporting path. The free Academy remains available for self-directed learning.
NDA · clear scope · direct communication