Threat analysis, guidance and product news
Practical reads on cyber risk, compliance and threat intelligence from the FortaRisks team.
RSS feed- Guidance
Your security tools are part of your attack surface
Email gateways, remote access appliances, network consoles, EDR agents: the tools bought to reduce risk have become prime targets. Why every tool you add is also a door to guard, a method to inventory and govern them, and a thirty-minute test to see where you stand.
October 14, 2026 · 8 min read - Guidance
Risk register: name the scenarios that would stop the business
A vulnerability backlog tells you what is vulnerable; a risk register tells you what could stop the business, and who answers for it. How to write your first ten risk scenarios starting from business processes, and a thirty-minute test to see where you stand.
October 11, 2026 · 7 min read - Threat Intelligence
The cyber week, through a risk lens: your trusted tools became the way in
28 September to 6 October 2026. A FortiMail email gateway exploited with no patch available yet, three NetScaler flaws exploited in a week, antivirus switched off in two hours before ransomware, and the FBI dropping a contractor over a patch that was never applied. In Canada, a northern Ontario hospital claimed, a mortgage lender and a small Quebec distributor on leak sites. On the AI side, an autonomous agent reaches root in seconds.
October 9, 2026 · 11 min read - AI
AI security: ISO 42001 or the NIST AI RMF, where to start
Two frameworks come up as soon as AI governance does: one helps you understand and treat AI risk, the other proves it is managed. How to sequence them, what to do in the first 30 days, and the test that tells you whether you are ready.
October 8, 2026 · 6 min read - AI
AI security: offensive AI, and the one control that still holds
Phishing without typos, cloned voices, a video call where everyone is fake: AI has erased the tells we trained people to spot. What has really changed in attacks, what has not, and the fifteen-minute test to run on your four most exposed requests.
October 1, 2026 · 5 min read - Third-Party Risk
Master of Malt, Cooksongold, the Nepal Stock Exchange: three incidents, no direct hack
An API key held by an app on a platform, an unredacted log at a payment provider, a data centre shared by 72 of 90 brokers. Three organizations had to notify customers or suspend operations this week without being attacked themselves. What it changes for your third-party register, and five actions for this week.
September 29, 2026 · 6 min read - Guidance
Thank you for visiting us at GoSec 2026
Two days at the Palais des congrès in Montreal, full of conversations, opportunities and concrete evidence of how cyber risk gets reduced. Thank you to everyone who stopped by the FortaRisks booth. The conversation continues.
September 28, 2026 · 1 min read - Third-Party Risk
The 5 questions to ask any vendor at a cyber trade show
Three hours in the aisles, fifteen business cards, and back at the office nothing tells them apart. Five questions that flip the conversation, what a real answer contains, and the three lines that should worry you.
September 22, 2026 · 6 min read - Threat Intelligence
The cyber week, risk lens: the code you run is not the code you approved
Week of 14 September 2026. CrowdSec discovers that 170 of its private repositories were copied back in May, through the account of a departed employee that was never revoked. Plugin4Shell defeats commit pinning across all four major AI coding agents. An abandoned CDN domain was re-registered, and thousands of sites still call it. On the infrastructure side, two Cisco products exploited in three days, vCenter picked up by ransomware crews, and five Canadian organizations claimed in one week.
September 18, 2026 · 14 min read
Get AI Thursday
One signal, our take, one method to apply: adopt AI without losing control, every Thursday in your inbox.
30 minutes to know what to fix first.
A member of our team walks you through FortaRisks on threats relevant to your sector, and you leave with your priorities.