Blog
Blog
Board Briefing — September 2026: patched is not the same as safe
Remote-access gateways were exploited for weeks before a fix existed. Plus: new EU reporting duties with a 24-hour clock, and a record quarter for ransomware.
Why reporting rate beats click rate in phishing simulations
Click rate is the metric everyone reports and the one that matters least. Here is the case for optimising how fast your people report instead.
Introducing the SpectrumSec blog
Why we are publishing, what you can expect here, and how this blog is built and maintained.