DISC Infosec blog https://blog.deurainfosec.com/ Dedicated to information security assurance Information Security subject matter with related items Mon, 08 Jun 2026 16:28:31 +0000 en-US hourly 1 https://wordpress.org/?v=6.1.10 https://blog.deurainfosec.com/wp-content/uploads/2023/05/disc-logo-144x144.jpg DISC InfoSec blog https://blog.deurainfosec.com/ 32 32 7400975 GRC at Machine Speed: Four Anchors Reshaping Governance in the Cloud and AI Era https://blog.deurainfosec.com/grc-at-machine-speed-four-anchors-reshaping-governance-in-the-cloud-and-ai-era/ https://blog.deurainfosec.com/grc-at-machine-speed-four-anchors-reshaping-governance-in-the-cloud-and-ai-era/#respond Mon, 08 Jun 2026 16:11:51 +0000 https://blog.deurainfosec.com/?p=35795 GRC at Machine Speed: Four Anchors Reshaping Governance in the Cloud and AI Era For most of its history, Governance, Risk, and Compliance has run at the speed of paper. Spreadsheets tracked controls. Evidence arrived by email the week before an audit. Risk registers were reviewed quarterly, if that. The whole discipline was built around […]

The post GRC at Machine Speed: Four Anchors Reshaping Governance in the Cloud and AI Era appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/grc-at-machine-speed-four-anchors-reshaping-governance-in-the-cloud-and-ai-era/feed/ 0 35795 AI Can Pentest Your Network Now. That’s Not the Risk You Should Worry About https://blog.deurainfosec.com/ai-can-pentest-your-network-now-thats-not-the-risk-you-should-worry-about/ https://blog.deurainfosec.com/ai-can-pentest-your-network-now-thats-not-the-risk-you-should-worry-about/#respond Fri, 05 Jun 2026 20:04:16 +0000 https://blog.deurainfosec.com/?p=35769 Two Open-Source AI Pentesting Tools, One Governance Question: What METATRON and PentestSwarm Mean for SMEs Frontier AI has removed that friction from both sides of the table simultaneously. The same reasoning capability that lets a model chain reconnaissance, classify findings, and suggest exploit paths is now available in open-source tooling that an SME can run […]

The post AI Can Pentest Your Network Now. That’s Not the Risk You Should Worry About appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/ai-can-pentest-your-network-now-thats-not-the-risk-you-should-worry-about/feed/ 0 35769 GRC at Machine Speed: How AI Is Reshaping Governance, Risk, and Compliance https://blog.deurainfosec.com/grc-at-machine-speed-how-ai-is-reshaping-governance-risk-and-compliance/ https://blog.deurainfosec.com/grc-at-machine-speed-how-ai-is-reshaping-governance-risk-and-compliance/#respond Thu, 04 Jun 2026 15:28:43 +0000 https://blog.deurainfosec.com/?p=35749 AI is not simply another technology that GRC teams will govern — it will fundamentally reshape how GRC is practiced, measured, and delivered. From an AI governance perspective, the biggest shift over the next few years is that GRC will move from periodic, documentation-heavy activities toward continuous assurance. Traditional models built around annual assessments, point-in-time […]

The post GRC at Machine Speed: How AI Is Reshaping Governance, Risk, and Compliance appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/grc-at-machine-speed-how-ai-is-reshaping-governance-risk-and-compliance/feed/ 0 35749 Building AI Governance That Actually Works: From Ethics to the Exam Room https://blog.deurainfosec.com/building-ai-governance-that-actually-works-from-ethics-to-the-exam-room/ https://blog.deurainfosec.com/building-ai-governance-that-actually-works-from-ethics-to-the-exam-room/#respond Wed, 03 Jun 2026 17:02:18 +0000 https://blog.deurainfosec.com/?p=35686 Below is the HTML format of our post. Click to view it in a separate window Four risks, three frameworks, and what real-world mapping across ISO 27001, ISO 42001, and NIST 800-53 Rev. 5 actually looks like The AI Governance Quick-Start: Defensible in 10 Days, Not 4 Quarters DISC InfoSec is an active ISO 42001 […]

The post Building AI Governance That <em>Actually Works</em>: From Ethics to the Exam Room appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/building-ai-governance-that-actually-works-from-ethics-to-the-exam-room/feed/ 0 35686 Corporate Visibility as an Attack Surface: Managing Risk in the AI Era https://blog.deurainfosec.com/corporate-visibility-as-an-attack-surface-managing-risk-in-the-ai-era/ https://blog.deurainfosec.com/corporate-visibility-as-an-attack-surface-managing-risk-in-the-ai-era/#respond Tue, 02 Jun 2026 16:12:28 +0000 https://blog.deurainfosec.com/?p=35634 Corporate visibility has become a business requirement rather than a marketing choice. Organizations publish employee profiles, leadership pages, technical blogs, social links, and recruiting content to build trust, attract talent, and improve customer confidence. However, every piece of public information expands the organization’s attack surface and creates intelligence opportunities for adversaries. The challenge is no […]

The post Corporate Visibility as an Attack Surface: Managing Risk in the AI Era appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/corporate-visibility-as-an-attack-surface-managing-risk-in-the-ai-era/feed/ 0 35634 GRC Engineering Is the Future of Cloud Compliance https://blog.deurainfosec.com/grc-engineering-is-the-future-of-cloud-compliance/ https://blog.deurainfosec.com/grc-engineering-is-the-future-of-cloud-compliance/#respond Mon, 01 Jun 2026 19:41:47 +0000 https://blog.deurainfosec.com/?p=35611 Most GRC material stays stuck at the policy and framework level. This book is one of the few that actually tries to push the discipline into something the industry has been struggling with for years: engineering governance, risk, and compliance as a system—not a documentation exercise. GRC ENGINEERING FOR AWS: A Hands-On Guide to Governance, […]

The post GRC Engineering Is the Future of Cloud Compliance appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/grc-engineering-is-the-future-of-cloud-compliance/feed/ 0 35611 Four risks, three frameworks, and what real-world mapping across ISO 27001, ISO 42001, and NIST 800-53 Rev. 5 actually looks like https://blog.deurainfosec.com/four-risks-three-frameworks-and-what-real-world-mapping-across-iso-27001-iso-42001-and-nist-800-53-rev-5-actually-looks-like/ https://blog.deurainfosec.com/four-risks-three-frameworks-and-what-real-world-mapping-across-iso-27001-iso-42001-and-nist-800-53-rev-5-actually-looks-like/#respond Mon, 01 Jun 2026 16:52:13 +0000 https://blog.deurainfosec.com/?p=35506 Your Risk Register Is Probably Built Backwards Four risks, three frameworks, and what mapping ISO 27001, ISO 42001, and NIST 800-53r5 actually looks like in practice. Most risk registers are built backwards. Someone exports a control list from a framework, generates a row for each control, and reverse-engineers a “risk” to justify it. The result […]

The post Four risks, three frameworks, and what real-world mapping across ISO 27001, ISO 42001, and NIST 800-53 Rev. 5 actually looks like appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/four-risks-three-frameworks-and-what-real-world-mapping-across-iso-27001-iso-42001-and-nist-800-53-rev-5-actually-looks-like/feed/ 0 35506 The Bus Factor Just Inverted: Governing the Agents Your Engineers Leave Behind https://blog.deurainfosec.com/the-bus-factor-just-inverted-governing-the-agents-your-engineers-leave-behind/ https://blog.deurainfosec.com/the-bus-factor-just-inverted-governing-the-agents-your-engineers-leave-behind/#respond Thu, 28 May 2026 15:56:21 +0000 https://blog.deurainfosec.com/?p=35521 Earning Cybersecurity Confidence in the Age of Agentic AI — A Practitioner’s Read Hrvoje Englman, CISO at Span, used his keynote at the Span Cyber Security Arena to describe a defender’s job that has been rewritten in roughly twenty-four months. Engineering teams are now writing their own software with AI coding assistants, spinning up agents […]

The post The Bus Factor Just Inverted: Governing the Agents Your Engineers Leave Behind appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-bus-factor-just-inverted-governing-the-agents-your-engineers-leave-behind/feed/ 0 35521 ISO 42001 Just Got Easier to Prove: Anthropic Opens Claude to 28 Security and Compliance Tools https://blog.deurainfosec.com/iso-42001-just-got-easier-to-prove-anthropic-opens-claude-to-28-security-and-compliance-tools/ https://blog.deurainfosec.com/iso-42001-just-got-easier-to-prove-anthropic-opens-claude-to-28-security-and-compliance-tools/#respond Wed, 27 May 2026 16:09:23 +0000 https://blog.deurainfosec.com/?p=35469 As enterprise adoption of generative AI accelerates, the operational gap between “AI as productivity tool” and “AI as governed enterprise application” has widened. Anthropic has moved to close that gap by introducing 28 integrations with security and compliance tools that allow IT and security teams to manage Claude in the same way they manage other […]

The post ISO 42001 Just Got Easier to Prove: Anthropic Opens Claude to 28 Security and Compliance Tools appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/iso-42001-just-got-easier-to-prove-anthropic-opens-claude-to-28-security-and-compliance-tools/feed/ 0 35469 Modern GRC Maturity: Connecting Governance, Risk, Controls, and Technology https://blog.deurainfosec.com/modern-grc-maturity-connecting-governance-risk-controls-and-technology/ https://blog.deurainfosec.com/modern-grc-maturity-connecting-governance-risk-controls-and-technology/#respond Tue, 26 May 2026 15:27:25 +0000 https://blog.deurainfosec.com/?p=35431 The Six Layers of a Mature GRC Operating Model In today’s rapidly evolving business environment, Governance, Risk, and Compliance (GRC) can no longer operate as disconnected activities managed by separate teams and spreadsheets. Organizations facing cyber threats, AI risks, regulatory pressure, and operational complexity need a unified GRC operating model that connects governance, risk management, […]

The post Modern GRC Maturity: Connecting Governance, Risk, Controls, and Technology appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/modern-grc-maturity-connecting-governance-risk-controls-and-technology/feed/ 0 35431 The One Security Book That Got Louder With Every Passing Year https://blog.deurainfosec.com/the-one-security-book-that-got-louder-with-every-passing-year/ https://blog.deurainfosec.com/the-one-security-book-that-got-louder-with-every-passing-year/#respond Fri, 22 May 2026 18:05:58 +0000 https://blog.deurainfosec.com/?p=35435 The One Security Book That Got Louder With Every Passing Year Why Click Here to Kill Everybody by Bruce Schneier belongs on every CISO’s, CAIO’s, and board director’s shelf — in that order There are security books you read once and shelve. And then there is Bruce Schneier’s Click Here to Kill Everybody, which somehow […]

The post The One Security Book That Got Louder With Every Passing Year appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-one-security-book-that-got-louder-with-every-passing-year/feed/ 0 35435 Microsoft Just Made AI Agent Security a CI/CD Problem — Here’s Why That Matters https://blog.deurainfosec.com/microsoft-just-made-ai-agent-security-a-ci-cd-problem-heres-why-that-matters/ https://blog.deurainfosec.com/microsoft-just-made-ai-agent-security-a-ci-cd-problem-heres-why-that-matters/#respond Fri, 22 May 2026 15:16:06 +0000 https://blog.deurainfosec.com/?p=35354 Microsoft Just Open-Sourced the Missing Piece of AI Agent Security: A Practitioner’s Take on RAMPART and Clarity On May 20, Microsoft’s AI Red Team released two open-source tools that should be on every CISO’s and AI program owner’s reading list this week: RAMPART, a continuous testing framework for AI agents, and Clarity, a structured design-review […]

The post Microsoft Just Made AI Agent Security a CI/CD Problem — Here’s Why That Matters appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/microsoft-just-made-ai-agent-security-a-ci-cd-problem-heres-why-that-matters/feed/ 0 35354 Free AI Governance Maturity Calculator for Modern Enterprises https://blog.deurainfosec.com/free-ai-governance-maturity-calculator-for-modern-enterprises/ https://blog.deurainfosec.com/free-ai-governance-maturity-calculator-for-modern-enterprises/#respond Thu, 21 May 2026 20:54:16 +0000 https://blog.deurainfosec.com/?p=35364 AI adoption is accelerating — but most organizations still lack a clear way to measure whether their AI governance program is secure, compliant, and audit-ready. That’s why DISC InfoSec created the free AI Governance Maturity Calculator — a practical assessment tool designed to help organizations benchmark their AI governance capabilities against leading frameworks including ISO/IEC […]

The post Free AI Governance Maturity Calculator for Modern Enterprises appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/free-ai-governance-maturity-calculator-for-modern-enterprises/feed/ 0 35364 Why ISO 42001 Will Be the Next SOC 2 https://blog.deurainfosec.com/why-iso-42001-will-be-the-next-soc-2/ https://blog.deurainfosec.com/why-iso-42001-will-be-the-next-soc-2/#respond Thu, 21 May 2026 16:10:12 +0000 https://blog.deurainfosec.com/?p=35337 The Quiet Truth in the Gen AI Hype: Governance Is the Product I just finished Generative AI and LLMs For Dummies — a solid primer aimed at executives and non-technical leaders trying to understand what they’ve already bought into. Most of it is what you’d expect: foundation models, transformers, prompt engineering, RAG, vector embeddings. But […]

The post Why ISO 42001 Will Be the Next SOC 2 appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/why-iso-42001-will-be-the-next-soc-2/feed/ 0 35337 Managing AI Risk: A Practical Approach to Secure, Responsible, and Effective AI Adoption https://blog.deurainfosec.com/managing-ai-risk-a-practical-approach-to-secure-responsible-and-effective-ai-adoption/ https://blog.deurainfosec.com/managing-ai-risk-a-practical-approach-to-secure-responsible-and-effective-ai-adoption/#respond Wed, 20 May 2026 15:04:32 +0000 https://blog.deurainfosec.com/?p=35331 Managing AI Risk: A Practical Approach to Secure, Responsible, and Effective AI Adoption Artificial Intelligence is transforming how organizations operate, compete, and innovate. From automating business workflows to enhancing cybersecurity detection and accelerating decision-making, AI offers enormous opportunities. Yet alongside these benefits comes a rapidly expanding landscape of risks that organizations can no longer ignore. […]

The post Managing AI Risk: A Practical Approach to Secure, Responsible, and Effective AI Adoption appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/managing-ai-risk-a-practical-approach-to-secure-responsible-and-effective-ai-adoption/feed/ 0 35331