Insights for cybersecurity leaders

ISMS Tool in Practice: When SharePoint and 47 Excel Files Count as a Solution

"Show me your ISMS tool." What follows is often sobering: a SharePoint folder with dozens of Excel files. When does an ISMS tool truly deliver value? And how can you tell the difference?

CISO vs. ISO: Two Titles, Two Roles and Why the Difference Matters for NIS2

The Fastest Way to Fail at NIS-2: Trying to Do Everything at Once

Why parallel workstreams fail in NIS-2 implementation and how a pragmatic prioritization approach gets mid-sized companies to their goals faster.

Starting NIS-2 Pragmatically: Why Parallel Workstreams Fail and What Helps Instead

12 people at the table, 5 workstreams, zero prioritization. The classic NIS-2 kick-off. And the fastest route to failure. What distinguishes a pragmatic start and how priorities are set.

Crisis Organization When It Counts: When No One Knows What to Do Now

In a crisis exercise, the team lead's first words were: "Wait, where does it say what I'm supposed to do?" Crisis organization is not a PDF. Either it works or it does not exist.

Business Crisis Drills: When the Team Leader Asks What to Do

Crisis organization on paper is not real crisis organization. What a team leader's question during a drill reveals about operational readiness, and what this means for NIS-2-obligated businesses.

Backup Is Not Recovery: What Mid-Sized Businesses Need for Real Business Continuity

There are two types of companies: those with backups, and those that have actually tested recovery. What separates real business continuity from a backup illusion.

"Security? We've Implemented It": Four Routines for Real Cyber Resilience

A CEO says "Security? We've implemented it." Three questions later, silence. Why cybersecurity without ongoing cadence fails, and which four routines ensure real sovereignty.

Data Masking in the AI Era: Why Copy-Paste Is the Biggest Security Risk

The most common AI mistake in companies is not a prompt engineering problem, but it is the unreflective copy-paste reflex. Why data masking is the crucial safety mechanism for AI usage.

Clinejection: When AI Automation Becomes an Attack Surface

The Clinejection case demonstrates how prompt injection via GitHub Issues can manipulate AI agents to inject malicious code into release workflows. Automation without security-by-design creates dangerous new attack vectors.

NIS2 and True Resilience: Why Compliance Alone Is Not Enough

Many companies treat NIS2 as a tick-box exercise. But compliance is not the same as resilience. The Cross-Border Cybersecurity Tour #2 in Saarbrücken made it clear: a functioning security operation outweighs any tool collection.

NIS-2 Ownership: When Everyone Is Responsible, No One Is

NIS-2 does not fail at technical gaps. It fails at unresolved ownership. What it means to anchor responsibility concretely.