Compliance programs in Saudi organizations rarely fail for lack of budget or intent. They fail in predictable patterns: the same eight, over and over. I have watched most of these from both sides of the
Read PostCybersecurity & GRC Notes
Live watch list
On the radar this week
Blog
Where ICS Went When It Left the ECC
August 1, 2025 NCA
If you have been reading the ECC-2:2024 control list looking for the industrial control systems domain, stop looking. It is not there. ECC-1:2018 had five domains. ECC-2 has four: governance, defense, resilience, third party and
Read Post
The NCA published ECC-2 in October 2024, superseding ECC-1:2018. Two years and an assessment cycle in, the change list is settled. The question now is which changes have practical effect.
Read Post
AI Behavior Concerns: Unpacking the Recent Anthropic Incident and Its Impact on AI Safety
May 24, 2025 Uncategorized
What happened In the Claude Opus 4 system card published in May 2025, Anthropic reported that in a deliberately constructed fictional test scenario, the model tried to prevent its own replacement. Playing an assistant at
Read Post
The Quantum Threat: How to Secure Encryption in the Face of Quantum Computing
October 26, 2024 Uncategorized
Quantum computing has moved out of science fiction and into engineering. The promised breakthroughs in healthcare, AI and logistics get most of the attention, but for security teams the interesting part is what it breaks.
Read Post