Risk Management

The Identity Lifecycle Gaps Nobody’s Talking About Every security program talks about access control. Most have onboarding frameworks. Some have offboarding procedures. What almost nobody has is a system that actually handles the identity in between. The one that’s still in your systems six months after someone left. The one nobody formally revoked. The one sitting there with standing privilege. This post is about why identity lifecycle management fails at scale and what it costs when it does. ...

There Is No Offboarding Process for the Dead Modern security programs are built around lifecycle management. Identities are created, granted access, monitored, and eventually revoked. This model works because it assumes something fundamental. At some point, identity ends. Artificial intelligence is quietly breaking that assumption. As AI systems recreate voices, personalities, conversations, and even memories of people who no longer exist, identity no longer has a natural termination point. What emerges is not just an ethical question, but a governance and security failure. ...

Shadow AI: The New Shadow IT For years, organizations have struggled with shadow IT—unapproved systems, tools, or cloud services deployed outside normal governance. In 2025, that problem quietly evolved into something far more complex and far more dangerous: Shadow AI. Employees are now spinning up unapproved AI agents, connecting them to sensitive data, granting them excessive permissions, or even embedding them into workflows without the organization’s knowledge. And because AI is both powerful and opaque, many of these risks remain invisible until something goes wrong. ...

Securing the Future: A First Look at SANS Critical AI Security Controls v1.1 Introduction Artificial intelligence is no longer experimental—it’s embedded in production workflows, critical infrastructure, and high-stakes decision-making. But while AI evolves rapidly, security practices have struggled to keep pace. Enter the SANS Critical AI Security Controls (v1.1)—a new framework aiming to establish foundational, adaptable, and actionable controls for securing AI systems. This blog breaks down the key components of the SANS draft, explains their relevance, and suggests first steps organizations can take today. ...

Cybersecurity Compliance in 2025: What You Need to Know and How to Prepare Introduction Cybersecurity compliance isn’t just for auditors and policy writers anymore—it’s now a strategic priority for every organization. With new regulations taking effect, major frameworks being updated, and cloud services under growing scrutiny, 2025 is a pivotal year for compliance professionals, IT leaders, and security practitioners alike. In this post, we’ll walk through: Key compliance updates for 2025 The role of frameworks like NIST and FedRAMP Emerging enforcement trends A hands-on checklist to evaluate your current posture Whether you’re building from scratch or refining a mature program, this guide will help you stay ahead. ...

Building an AI-Powered Cybersecurity Risk Matrix: From Logs to Actionable Risk Scores Introduction Risk matrices are foundational to cybersecurity—helping organizations assess and prioritize threats based on likelihood and impact. But what if we could take that a step further? What if a system could analyze raw security logs, evaluate key attributes of an event, and automatically score risk without needing human triage every time? In this blog, we’ll build a lightweight simulation of an AI-powered risk matrix engine, using basic Python and rule-based logic (you could extend it with machine learning later). This project is perfect for cybersecurity students, professionals, and educators wanting to make risk management concepts more tangible. ...