Tag: Trends and Insights
-
The PHP2Shell vulnerability shows why third-party risk management must move at the speed of attackers
Read more: The PHP2Shell vulnerability shows why third-party risk management must move at the speed of attackersCritical PHP vulnerabilities put most of the web at risk and left customers asking suppliers 1 question. Here’s what PHP2Shell teaches third-party risk management teams about supplier assurance. Key takeaways from the PHP vulnerability alert Introduction: “are you affected?” the question every supplier was asked In the days after 21 October, CoreStream GRC’s customer success…
-
Hackers turned French supermarket fridges into ovens: who owns the risk in your building and equipment controls?
Read more: Hackers turned French supermarket fridges into ovens: who owns the risk in your building and equipment controls?Attackers overheated fridges in hundreds of French supermarkets using flaws flagged months earlier. Here’s what it teaches risk and compliance teams about legacy equipment and supplier risk. Key takeaways from the French supermarket hack Introduction: when freezers became ovens On the morning of Monday 12 October, staff at 100s of supermarkets across France found aisles…
-
2026 risk review: the forecasts were right, so why were so few organizations ready?
Read more: 2026 risk review: the forecasts were right, so why were so few organizations ready?Gartner, PwC, Deloitte and the WEF identified 2026’s biggest risks. We compare their forecasts with what really happened, and ask why so few organizations were ready. Key takeaways Introduction: the risks that were missed Picture a risk committee meeting in late January 2026. Near the front of the board pack sits a single line lifted…
-
The ASOS breach shows why customer messaging platforms belong in your third-party risk management framework
Read more: The ASOS breach shows why customer messaging platforms belong in your third-party risk management frameworkHackers used ASOS’s own app to announce its data breach. Here is what the attack, and the retailer’s response, teach GRC teams about third-party risk and incident response. Key takeaways from the ASOS data breach incident Introduction: the risk consequences when the breach notice comes from the attacker At around 10am on Tuesday 6 October,…
-
US banking regulators scrap their third-party risk rulebook: what principles-based oversight really demands
Read more: US banking regulators scrap their third-party risk rulebook: what principles-based oversight really demandsUS regulators want banks to stop following a checklist and start defending their own judgement on vendor risk, a shift now spreading well beyond American banking. Key takeaways Introduction: risk and compliance beyond the checklist For the best part of 3 years, a compliance officer at a mid-sized US bank has had a simple, if…
-
Why employee engagement is critical to your GRC program’s success: key takeaways from Gartner ERAC
Read more: Why employee engagement is critical to your GRC program’s success: key takeaways from Gartner ERACEffective GRC (governance, risk, and compliance) depends on the people across your organization. You can have well-designed, optimized processes supported by sophisticated technology that automates workflows. However, if employees and other stakeholders are not engaged or do not follow those processes, the value is lost. People provide the data, insights, and critical review that make…
-
From risk management to business outcomes: what Gartner’s GRC insights mean for risk leaders
Read more: From risk management to business outcomes: what Gartner’s GRC insights mean for risk leadersRisk leaders do not need more information. They need more of the right context. That was one of the clearest themes we took from the 2026, North American, Gartner’s Enterprise Risk, Audit and Compliance Conference. Across sessions the conversation repeatedly came back to a bigger question: how can GRC help organizations make better decisions and…
-
Norway’s BankID outage shows what DORA-grade third-party risk management actually requires
Read more: Norway’s BankID outage shows what DORA-grade third-party risk management actually requiresFor 2 days, millions of Norwegians couldn’t sign a contract, complete a house sale or access a health record because a single supplier’s infrastructure failed for the second time in 5 years. What happens when an entire country’s digital ID depends on a single supplier? On the morning of 3 September 2026, a real estate agent in…
-
The CareCloud data breach: a third-party risk warning for healthcare compliance teams
Read more: The CareCloud data breach: a third-party risk warning for healthcare compliance teamsKey takeaways Introduction: the changing face of a healthcare data hack In early August 2026, patients of various US healthcare providers began opening data breach notifications from a company many had never heard of: CareCloud, the cloud-based electronic health record and billing platform their doctor’s office quietly ran in the background. The letter said their…
-
Lombard Odier’s money-laundering conviction shows why flagging a compliance risk isn’t enough
Read more: Lombard Odier’s money-laundering conviction shows why flagging a compliance risk isn’t enoughKey takeaways Introduction: failure to go beyond filing a risk report leads to an AML conviction In 2012, a Geneva private bank, Lombard Odier, noticed unusual activity connected to one relationship manager’s client accounts and reported their suspicions to Switzerland’s Money Laundering Reporting Office. 14 years of legal process, and one collapsed prosecution against the alleged ringleader, later, Switzerland’s Federal Criminal Court…