Security awareness tips, industry news, and product updates.
In eight days, the EU Cyber Resilience Act reaches its first hard deadline: manufacturers of products with digital elements must report actively exploited vulnerabilities within 24 hours of awareness. The reporting platform is ready. The question is whether your people are.
October's Cybersecurity Awareness Month is won or lost in September. A practical four-week preparation plan covering goals, a baseline phishing simulation, the content calendar, executive sponsorship and how you will measure success.
HHS has pushed final action on the proposed HIPAA Security Rule overhaul to July 2027, and more than 100 hospital systems want it withdrawn entirely. But the current rule remains actively enforced, including its security awareness training requirement. Relaxing now is the wrong lesson.
On November 10, 2026, CMMC Phase 2 begins: DoD contracts involving CUI can require third-party Level 2 certification instead of self-assessment. With roughly 80,000 companies needing certification and only about 80 authorized assessors, the countdown is very real.
For the first time, UK managed service providers face statutory security duties and a two-stage incident reporting regime. The Cyber Security and Resilience Bill has cleared the Commons and is progressing through the Lords. Here is what MSPs should be doing now.
Before SSO or automated onboarding can trust an email domain, empowsec asks you to prove you own it - with a DNS TXT record or a hosted verification file, checked in seconds from the settings page.
The European Supervisory Authorities have published the first annual report on major ICT incidents under DORA: 3,383 reports in 2025, most from the credit and payments sectors. Here is what the numbers show, and why the 4-hour reporting clock depends on people as much as process.
NYDFS has told regulated financial entities, in writing, to train staff against help-desk vishing attacks. Combined with the fully effective Part 500 amendment and a record enforcement run, targeted social-engineering training is now a supervisory expectation in New York.
Germany's new BSIG makes cybersecurity training a personal, non-delegable duty for the management of regulated entities, backed by personal liability for oversight failures. The BSI has now spelled out what the training must cover and recommends an annual cadence.
Every other EU AI Act headline in 2026 has been about delay, but the Article 4 AI-literacy duty was never postponed. It has applied since February 2025, and from early August 2026 national authorities gain the powers to enforce it. Here is how to build a defensible program.
The BSI's final grace deadline for NIS2 registration expired on 31 July 2026 with thousands of in-scope German entities still unregistered. Germany's NIS2 regime now enters its enforcement phase, and registration failures alone can draw fines of up to EUR 500,000.
empowsec lets company admins build custom roles with granular permissions, renders a dashboard with only the tabs each user may see, and gives reseller teams an equivalent permission system - so nobody needs full admin access just to do one job.