Threat analysis, guidance and product news
Practical reads on cyber risk, compliance and threat intelligence from the FortaRisks team.
RSS feed- Guidance
Cybersecurity talent: you won't hire your way out of risk
In the United States, cybersecurity job postings fell by a quarter in 2026 while AI security roles tripled. In Canada, fewer organizations employ their own security staff, and in Quebec one specialist position in five sat vacant in 2024. The shortage didn't vanish: it changed shape. The three roles to keep in-house, what to hand to a provider and how to govern it, and this week's thirty-minute test.
October 26, 2026 · 7 min read - Guidance
Risk register: exposure, what attackers see first
An attacker doesn't read your risk register, they read your attack surface. How to link each of your scenarios to the entry points visible from outside that make it possible, what exposure changes about a risk's likelihood, and a thirty-minute test to do it on three scenarios.
October 25, 2026 · 6 min read - Guidance
A critical vulnerability isn't necessarily urgent: three filters to prioritize
A CVSS score measures how severe a flaw is, not your risk. Three questions are enough to cut a list of thousands of vulnerabilities down to five or ten actions: is it exploited, is it exposed, is it targeted? The method, the public sources behind it, and a thirty-minute test to try it on your own list.
October 24, 2026 · 6 min read - Threat Intelligence
The cyber week, through a risk lens: the people who keep your secrets
16 to 22 October 2026. A ransom negotiator arrested by the FBI and suspicion cast on his peers, two software supply chains hijacked within 48 hours (OVHcloud, LiteLLM), a Palo Alto VPN flaw patched in May but exploited by Qilin and INC, two PHP flaws out before their time. In Canada, a security firm, a software vendor and two patent law firms claimed in four days. On the AI side, Microsoft treats its own agents as insiders.
October 23, 2026 · 14 min read - AI
AI security: governance you can't measure is just an intention
Seven episodes, one roadmap on a single page. The seven steps to govern AI, the evidence and the indicator for each, what to show the board, and the test that tells you whether your AI governance is steering or just hoping.
October 22, 2026 · 7 min read - Guidance
Risk register: the four owners of every risk
"IT" is not a risk owner. Every scenario in the register needs four names: the person who accepts the risk, the one who treats it, the one who watches it and the one who reports on it. Why mixing them up empties the register of meaning, and a thirty-minute test to fill in the four columns.
October 18, 2026 · 8 min read - Guidance
How many subdomains do you have? Your number is probably wrong
A subdomain from a finished campaign, the cloud instance of a closed project, a tool bought by one department, a server that lost vendor support: the most dangerous exposure is often the one nobody owns. How to find it, give it an owner and decide its fate, and a twenty-minute test to measure the gap.
October 17, 2026 · 7 min read - Threat Intelligence
The cyber week, through a risk lens: the equipment nobody managed
10 to 15 October 2026. Refrigeration in some 700 French supermarkets sabotaged remotely through end-of-life controllers exposed to the internet, an Ivanti exploit chain that beats a fully patched appliance, a Cisco email gateway and Palo Alto firewalls exploited, more than 1,400 Microsoft fixes in one month. In Canada, a Winnipeg hospital, a university and a school district. On the AI side, hundreds of thousands of exposed tools and agents that walk in through overly broad access.
October 16, 2026 · 12 min read - AI
AI security: an AI agent is a privileged account, so treat it like one
An assistant answers, an agent acts: it reads your email, calls your tools, changes your systems. Its own identity, least privilege, human approval, logging and a kill switch: six rules to secure an AI agent before it does something serious on its own, and a test to see where you stand.
October 15, 2026 · 7 min read
Get AI Thursday
One signal, our take, one method to apply: adopt AI without losing control, every Thursday in your inbox.
30 minutes to know what to fix first.
A member of our team walks you through FortaRisks on threats relevant to your sector, and you leave with your priorities.