Briefings

This 12-page briefing explains why bug bounty programs miss what matters, drown in bad reports, and leave findings unfixed, and what actually closes the gap they've opened.

This guide is for security and risk leaders at US financial institutions with EU operations or EU financial clients. It shows how DORA reaches US firms, where your domestic compliance program stops covering you, and how to find the gap before an EU supervisor does.

This guide is for security and compliance leaders at UK and EU regulated financial institutions. It shows where DORA compliance exists on paper but not in practice, and how to prove resilience before a regulator or an attacker tests it for you.

How attackers exploit psychological triggers, why security awareness training keeps failing, and what to do about it. Written by Jayson E. Street, who has walked into banks and government facilities on five continents without getting stopped.

A CISO’s first 90 days. Why successful CISOs map the P&L before they map the network, find the risks nobody has written down, and walk into the boardroom with evidence instead of opinion.

A December 2025 briefing on what AI-assisted threat activity meant for CISO strategy. Our offensive team assessed Anthropic’s 2025 report on an AI-orchestrated espionage campaign, separated the hype from the real threat, and set out a 30 and 90 day action plan.

How to prepare for the social engineering playbook that has become a growing concern for UK retail. A realistic attack simulation, an attack map and purple team test cases you can run against your own defenses.