Threat analysis, guidance and product news
Practical reads on cyber risk, compliance and threat intelligence from the FortaRisks team.
RSS feed- Guidance
Risk register: your vendor list is not a risk register
A critical supplier is not a line in another spreadsheet: it is a risk source in its own right, with its own scenarios. The three ways a third party enters a scenario, what NIST CSF 2.0, OSFI Guideline B-10 and the Canadian Centre for Cyber Security say, the traps and this week's test.
November 8, 2026 · 7 min read - AI
AI security: your customers will ask for evidence, not promises
AI questions are reaching your customers' security questionnaires: a published Cloud Security Alliance matrix, OSFI Guideline E-23, section 12.1 of Quebec's Law 25. The eight questions to prepare, the three levels of answer, the evidence file this series has already built, and this week's test.
November 5, 2026 · 8 min read - Third-Party Risk
The access nobody reviewed: contractors, remote access and connected apps
The account created for the integrator, the remote support tool the IT provider installed, the app connected to the CRM in one click: three kinds of access granted for a specific need, then never reviewed. What the Salesloft Drift incident showed, why this access slips through every review, the three-field rule and a thirty-minute test to find it.
November 3, 2026 · 6 min read - Threat Intelligence
The cyber week, through a risk lens: your MFA won't survive a phone call
26 October to 1 November 2026. Four of Canada's top law firms (McCarthy Tétrault, Davies, Bennett Jones, BLG) breached by fake IT help desk calls that bypass multifactor authentication; the Canadian Centre for Cyber Security confirms an ongoing campaign. Two Ivanti flaws and a Cisco firewall added to the KEV catalogue, US$6.3 billion stolen from Binance. On the AI side, the Cyber Centre publishes a bulletin on agentic AI accelerating attacks.
November 2, 2026 · 7 min read - AI
What you need to protect is no longer just your data and your operations, but your company's DNA!
Protection was built around data, then around operations. With AI, a third perimeter appears: your company's DNA, the know-how we hand to the models every day through the trace our usage leaves. What the TRACE is, why it slips past today's controls, how to protect that DNA, and your view in the comments.
November 2, 2026 · 9 min read - Guidance
Risk register: "hackers" is not a risk source
A risk source written as "hackers" lets you neither prioritize nor defend a budget. How threat intelligence enters the register: who really targets your sector and your country, why, by which method, and how that reading moves a scenario's likelihood. Free sources, the traps and this week's test.
November 1, 2026 · 6 min read - Guidance
Your incident plan has never been used. Test it in 60 minutes
An incident response plan that has never been walked through is an assumption, not a plan. A 60-minute tabletop exercise for a small or mid-sized organization, in four parts, with who to invite, including people who are not on your payroll, and the three actions to walk out with.
October 31, 2026 · 5 min read - AI
AI security: banning public AI assistants doesn't protect your data
A contract pasted into a chatbot, a browser extension that reads every page, a connector granted to the mailbox in one click: what leaves the company when employees use public AI assistants. Why a ban only moves the problem, the rules that fit on one page, and this week's test.
October 29, 2026 · 7 min read - Third-Party Risk
Concentration risk: the vendors you cannot lose
Your biggest vendor risk is often a provider you never chose: the one your vendors share, or your whole sector. What this year's incidents teach about concentration, a four-step method to map your critical dependencies, and a thirty-minute test to find out how many vendors could stop you tomorrow.
October 27, 2026 · 8 min read
Get AI Thursday
One signal, our take, one method to apply: adopt AI without losing control, every Thursday in your inbox.
30 minutes to know what to fix first.
A member of our team walks you through FortaRisks on threats relevant to your sector, and you leave with your priorities.