Special Highlights · New Series
Upskilling & Conferences →
Decoding Stablecoin Payments
A five part, plain-language series on how stablecoin payments really work. From the technology stack, through the rails, into the risks, the rules, and the governance that holds it all together.
New This Week · Policy Series
All upskilling articles →
Parul Sharma · Luxembourg
Cybersecurity knowledge
that prepares you
for what's real
Exam preparation for CISSP, CISM and CC, GRC case studies grounded in actual incident patterns, and upskilling content for professionals across Luxembourg, Benelux, and Europe.
New · Regulations
EU Regulations, in plain language
Plain-language explainers of the rules that shape financial and digital risk in Europe. Starting with the AI Act, MAR and DORA, more on the way.
Exam Preparation
All exam prep →ISC² Certification
CISSP
Certified Information Systems Security Professional. The gold standard for senior security roles. Eight domains, deep GRC weight, management-level thinking.
Exam prep articles
ISACA Certification
CISM
Certified Information Security Manager. Governance, risk, programme management, and incident response. Built for security managers and directors.
Exam prep articles
ISC² Entry Certification
CC
Certified in Cybersecurity. The ISC² entry credential covering security principles, access controls, and incident response fundamentals.
Exam prep articles
CISM Exam Prep
All CISM articles →CISM · Domain Blueprint
CISM Exam Information: The Blueprint of Domains
Domain weightage, structure, and how to allocate effort without wasting weeks on low-yield material.
Read article →
CISM · Exam Strategy
Last-Minute Preparation for the CISM Exam
Final days: stop consuming new material, train judgment with questions, and answer like a security manager under pressure.
Read article →
CISM · Exam Day
CISM Exam Day Tips
Room setup, proctor process, break strategy, and how to manage mental fatigue across 150 questions over four hours.
Read article →
Upskilling Articles
All upskilling →Policy Series · Article 2 · New
Information Security Policy — The Foundation of Everything Your Organisation Protects
How business objectives become a policy. Why the same derivation produces different policies for a hospital and a bank. What it must contain to be enforceable.
Read article →
Policy Series · Article 3 · New
Data Classification Policy — Knowing What You Have Before You Can Protect It
Classification levels, the mature vs starting organisation distinction, how classification differs by sector, and what belongs in the policy vs the asset register.
Read article →
Policy Series · Article 4 · New
Access Control Policy — Deciding Who Gets In and Who Does Not
Least privilege, segregation of duties, MFA, and accountability. How access control requirements differ across hospitals, banks, government facilities, and small businesses.
Read article →
Policy Series · Article 1
Understanding Cybersecurity Policies — Why They Exist and How to Build Them
Policy hierarchy, the difference between a policy and a standard, ownership, versioning, and the ten core domains every ISMS must cover.
Read article →
DORA Series · Article 1 of 3
What is DORA? The Digital Operational Resilience Act Explained
What DORA is, who it applies to, and why it is binding law — not a framework you can selectively adopt.
Read article →
DORA Series · Article 2 of 3
Why DORA Matters More Than Institutions Realise
Five pillars, binding law, board accountability, and why ISO 27001 is not a substitute for DORA compliance.
Read article →
GRC Case Studies
All case studies →GRC Case Study · Supply Chain
Shai-Hulud Rides the Supply Chain Bike
A logistics company hit by an npm supply chain worm. The board call, scope of compromise, and the decisions made under pressure.
Read case study →
GRC Case Study · Technical Deep-Dive
Shai-Hulud: The Supply Chain Worm That Rode the npm Ecosystem
How the incident was contained, investigated, and remediated. Sourced technical analysis of the npm supply chain attack vector.
Read deep-dive →
GRC Case Studies
More Case Studies
New GRC case studies published regularly — real incident patterns across financial services, healthcare, critical infrastructure, and technology.
View all →
