Latest Posts

Patching Regulations Development [January, 2023]

This is our fourth edition of the proposed periodic update on regulatory changes in security requirements including patching and liability relating to security breaches.

We appreciate any contribution to this newsletter based on your own research or internal enterprise discussions.

The pdf version of the newsletter can be downloaded here.

Jan 24, 2023 4 min read
Patching Regulations Development [December, 2022]

This is our third edition of the proposed periodic update on regulatory changes in security requirements including patching and liability relating to security breaches.

We appreciate any contribution to this newsletter based on your own research or internal enterprise discussions.

The pdf version of the newsletter can be downloaded here.

Dec 20, 2022 4 min read
Patching Regulations Development [November, 2022]

This is our second edition of the proposed periodic update on regulatory changes in security requirements including patching and liability relating to security breaches.

We appreciate any contribution to this newsletter based on your own research or internal enterprise discussions.

The pdf version of the newsletter can be downloaded here.

Nov 30, 2022 4 min read
Patching Regulations Development [October, 2022]

This is our first edition of the proposed periodic update on regulatory changes in security requirements including patching and liability relating to security breaches.

We appreciate any contribution to this newsletter based on your own research or internal enterprise discussions.

The pdf version of the newsletter can be downloaded here.

Oct 15, 2022 4 min read
What It Is All About

A core assumption underlying organizational security practices is that defenders are able to remediate known vulnerabilities in their systems in a timely fashion. Otherwise, attackers can just follow the breadcrumbs laid out by security advisories and exploit known weaknesses. This is indeed what happens in many large breaches. While progress has been made at the level of consumers, with automatic updates and default patching settings, this does not translate to enterprises. They face a painful dilemma: patch too soon and incur potential downtime and failures; patch too late and get compromised by attacks. As a result, organizations take a long time to patch even critical security vulnerabilities. The central objective of the project THESEUS is to empower organizations to patch much faster. It aims to achieve this by radically changing the risk governance of patching.
Oct 15, 2021 8 min read
What It Is All About