Threat analysis, guidance and product news
Practical reads on cyber risk, compliance and threat intelligence from the FortaRisks team.
RSS feed- Threat Intelligence
CCQ: fifteen days without services for an entire industry, and what the recovery teaches
Intrusion on 24 August, website back on 2 September, data theft confirmed on the 4th, full restoration on the 8th. Qilin claims the data of 350,000 people. Five continuity and governance lessons from a cyberattack the whole Quebec construction industry lived through, and five actions for this week.
September 14, 2026 · 5 min read - Compliance
Cyber Resilience Act: as of this morning, you have 24 hours to report an exploited flaw
On 11 September 2026, Article 14 of the EU regulation enters into application. Twenty-four hours for the early warning, 72 hours for the notification, and a transitional clause that pulls your entire catalogue into scope, including products you sold ten years ago. What it changes for a Canadian manufacturer, and for the buyer you also are.
September 11, 2026 · 10 min read - Threat Intelligence
The cyber week, risk lens: the patch now arrives after the attacker
Week of 7 September 2026. Twelve actively exploited flaws added to KEV in one week, including a Cisco firewall console exploited by Qilin affiliates and a Sandworm-adjacent actor, MikroTik routers hijacked the day before the patch, a Magento zero-day exploited four days before the hotfix, and 966 Microsoft fixes in a single Tuesday. In Quebec, Qilin claims 350,000 records from the CCQ. And 8.8 million travellers exposed by an API key left in a website's code for four years.
September 11, 2026 · 11 min read - AI
AI security: the risks specific to large language models
Direct and indirect prompt injection, data leakage through the context window, hallucinations in production. Why your usual application controls see none of it, and the four controls that actually hold.
September 10, 2026 · 8 min read - Threat Intelligence
The cyber week, risk lens: your AI toolchain is now a target
Week of 31 August 2026. CISA adds seven actively exploited flaws and the pattern is impossible to miss: AI gateway, workflow orchestrator, artifact repository. Then two chained SonicWall zero-days, an OpenAI model that finds zero-days, 153 million driver's licences for sale and a fake acquisition worth 626,000 euros.
September 4, 2026 · 8 min read - AI
AI security: who answers for AI in front of leadership?
Roles, committee and a one-page usage policy. The minimum viable governance model for AI: who decides, who approves, who answers, and the four decisions to settle before writing anything.
September 3, 2026 · 6 min read - Third-Party Risk
Quebec and Ontario breaches in August: six incidents, five findings that should change your plan
CCQ, xPayrience, Senvest, Waterloo, MOSAID, CMHA: what the incidents reported in Quebec and Ontario since August 1 actually show. In half the cases the organization affected is not the one that was attacked, and almost nobody learned it from their vendor.
August 31, 2026 · 8 min read - Threat Intelligence
The cyber week, through a risk lens: when the attack targets your operations, not your data
Week of August 24, 2026. Boston Scientific unable to ship, a UK power facility down for four days, a Winnipeg hospital without its doors and ventilation, Cl0p emptying Windchill vaults. Then three facts that change how you manage: Citrix exploited eight weeks after the patch, AI-written exploits against Siemens PLCs, and Nova Scotia Power unable to explain why thirty years of data was never deleted.
August 28, 2026 · 8 min read - AI
AI security: map shadow AI before it becomes your next incident
A 5-day playbook to inventory every AI use in your organization: where to look, what to record, how to triage. Includes the minimal 6-column register.
August 27, 2026 · 4 min read
Get AI Thursday
One signal, our take, one method to apply: adopt AI without losing control, every Thursday in your inbox.
30 minutes to know what to fix first.
A member of our team walks you through FortaRisks on threats relevant to your sector, and you leave with your priorities.