Cybervize
Cybervize Blog

Insights for cybersecurity leaders

Practical analysis on NIS-2, ISMS, AI governance and mid-market cybersecurity. From our client work and from OdySecure, the security platform by Cybervize.

New articles by email

We send you an email whenever a new article is published. Only the new article, no advertising. You can unsubscribe at any time via the link in every email.

You will first receive a confirmation email. By subscribing you also consent to our email service Brevo recording whether you open the emails and click links in them. Details are in our privacy policy.

Topic
Does DORA require a permanently employed CISO?
LatestComplianceCyber GovernanceRisk Management

Does DORA require a permanently employed CISO?

Under Article 6(4) DORA, financial entities other than microenterprises and outside the simplified framework need a control function for ICT risk with an appropriate level of independence. BaFin calls it the ICT risk control function. DORA mentions neither a CISO nor any form of employment. Whether an external CISO can perform the function depends on the mandate, on independence and on the outsourcing rules of MaRisk or MaGo.

AI attacks this week: Hijacked AI access can cost a company more than 100,000 US dollars in a single day (week 45/2026)
Artificial IntelligenceIT Security

AI attacks this week: Hijacked AI access can cost a company more than 100,000 US dollars in a single day (week 45/2026)

Based on its own investigations, Google describes how attackers hijack other companies' access to language models and run up charges on the victims' accounts. In some cases this cost a company more than 100,000 US dollars in a single day. Most cases began with exposed or stolen cloud credentials. In New York, three men have been charged with stealing about 129 million US dollars by imitating the voices of company CEOs. A reported AI attack on WorkOS turned out to be a research agent that got loose. At Binance, an internal AI tool was part of the attack path.

Agentic testing: how we test ISMS software in a simulated company
Artificial IntelligenceInnovationSME

Agentic testing: how we test ISMS software in a simulated company

In agentic testing, an AI receives an assignment in everyday language and no predefined path, and it operates the software itself, the way a person would. We test OdySecure this way in addition to unit tests and scripted UI tests. In a simulated company, 24 people act across 253 steps with a fixed check rule, and an AI persona finds its own way. This is how we find defects that sit between the functions.

AI attacks this week: Arrest in Seoul after break-ins at about 60 companies using AI (week 44/2026)
Artificial IntelligenceIT Security

AI attacks this week: Arrest in Seoul after break-ins at about 60 companies using AI (week 44/2026)

Police in Seoul have arrested a suspected hacker who allegedly broke into about 60 companies in 44 days using the AI attack tool ARTEX. This week CrowdStrike, Google and the registrar 123 Reg reported the same tool being used in espionage, extortion and data theft. Also: more break-ins at platforms for AI developers and a tampered Claude Code extension.