Threat analysis, guidance and product news
Practical reads on cyber risk, compliance and threat intelligence from the FortaRisks team.
RSS feed- Threat Intelligence
The cyber week, through a risk lens: your trusted tools became the way in
28 September to 6 October 2026. A FortiMail email gateway exploited with no patch available yet, three NetScaler flaws exploited in a week, antivirus switched off in two hours before ransomware, and the FBI dropping a contractor over a patch that was never applied. In Canada, a northern Ontario hospital claimed, a mortgage lender and a small Quebec distributor on leak sites. On the AI side, an autonomous agent reaches root in seconds.
October 9, 2026 · 11 min read - AI
AI security: ISO 42001 or the NIST AI RMF, where to start
Two frameworks come up as soon as AI governance does: one helps you understand and treat AI risk, the other proves it is managed. How to sequence them, what to do in the first 30 days, and the test that tells you whether you are ready.
October 8, 2026 · 6 min read - AI
AI security: offensive AI, and the one control that still holds
Phishing without typos, cloned voices, a video call where everyone is fake: AI has erased the tells we trained people to spot. What has really changed in attacks, what has not, and the fifteen-minute test to run on your four most exposed requests.
October 1, 2026 · 5 min read - Third-Party Risk
Master of Malt, Cooksongold, the Nepal Stock Exchange: three incidents, no direct hack
An API key held by an app on a platform, an unredacted log at a payment provider, a data centre shared by 72 of 90 brokers. Three organizations had to notify customers or suspend operations this week without being attacked themselves. What it changes for your third-party register, and five actions for this week.
September 29, 2026 · 6 min read - Guidance
Thank you for visiting us at GoSec 2026
Two days at the Palais des congrès in Montreal, full of conversations, opportunities and concrete evidence of how cyber risk gets reduced. Thank you to everyone who stopped by the FortaRisks booth. The conversation continues.
September 28, 2026 · 1 min read - Third-Party Risk
The 5 questions to ask any vendor at a cyber trade show
Three hours in the aisles, fifteen business cards, and back at the office nothing tells them apart. Five questions that flip the conversation, what a real answer contains, and the three lines that should worry you.
September 22, 2026 · 6 min read - Threat Intelligence
The cyber week, risk lens: the code you run is not the code you approved
Week of 14 September 2026. CrowdSec discovers that 170 of its private repositories were copied back in May, through the account of a departed employee that was never revoked. Plugin4Shell defeats commit pinning across all four major AI coding agents. An abandoned CDN domain was re-registered, and thousands of sites still call it. On the infrastructure side, two Cisco products exploited in three days, vCenter picked up by ransomware crews, and five Canadian organizations claimed in one week.
September 18, 2026 · 14 min read - AI
AI security: your vendors are using AI, and nobody asked you
Every SaaS product in your stack added an AI assistant in eighteen months. Your data now flows through models and subprocessors you never assessed. The three risks that creates, the ten questions to add to your vendor questionnaire, and the clauses that hold.
September 17, 2026 · 6 min read - Threat Intelligence
CCQ: fifteen days without services for an entire industry, and what the recovery teaches
Intrusion on 24 August, website back on 2 September, data theft confirmed on the 4th, full restoration on the 8th. Qilin claims the data of 350,000 people. Five continuity and governance lessons from a cyberattack the whole Quebec construction industry lived through, and five actions for this week.
September 14, 2026 · 5 min read
Get the Friday recap
The week in cybersecurity and what it changes for a company here, every Friday in your inbox.
30 minutes to know what to fix first.
A member of our team walks you through FortaRisks on threats relevant to your sector, and you leave with your priorities.