CyphrQAI Agents Escaped Test Environments: OpenAI, Hugging Face, Anthropic
In July 2026 OpenAI's test agents reached Hugging Face's systems. What each company reported, what was affected, and the sandbox controls to check.
Security · Quantum · AI · Blockchain · Resilience
Use AI boldly. Stay secure. Be ready for Q‑Day.
AI trends, tools, security and privacy for the quantum age. Plain answers for everyone, technical depth for the people who defend systems.
Breach map
What a data breach costs, region by region, from the published IBM/Ponemon studies. Pick one year or several; every figure links to its source.
Losses (bars) Complaints (line)
Ransomware and data-breach complaints from critical-infrastructure sectors, 2024 (number of complaints, not money)
Ransomware Data breach
About this data
Complaints to the FBI IC3 from organisations in 14 US critical-infrastructure sectors (2024 report, p.12). The 2025 report names the most-hit sectors but gives no counts. Source: FBI IC3 Internet Crime Report 2024.
Ransom received per group (USD millions)
Ransom payments received, as stated by officials. Figures cover different periods and aren't comparable totals.
About this data
Each bar is one official statement; bar length uses its leading number only. Quotes and sources are on the Threat groups page.
About this data and sources
What victims told the FBI they lost to cybercrime each year, from the annual reports of its Internet Crime Complaint Center (IC3). It counts every kind of cybercrime, not only data breaches: investment and romance fraud, business email compromise, ransomware and more. Most complaints come from the US. Read it as a floor: many victims never report, and no organisation publishes a worldwide total for breaches alone. 2012 and 2014 are missing because those reports give the total only inside a chart.
Sources
Average cost per data breach by industry (USD millions)
2026 2025
About this data
IBM/Ponemon, Cost of a Data Breach Report 2026, Figure 4. Earlier reports show industry costs only as chart images, so only 2026 and 2025 are listed. Source: IBM Cost of a Data Breach Report 2026.
Victims per group (number of organisations, not money)
Victims stated by officials (as-of dates differ)
About this data
Each bar is one official statement; bar length uses its leading number only. Quotes and sources are on the Threat groups page.
About this data and sources
The average cost of one breach across the organisations IBM/Ponemon studied that year. A single global average was first published with the 2014 study; earlier studies were country by country.
Sources
| Year | North America | Latin America | Europe | Middle East & North Africa | Asia | Australia & New Zealand | Sub-Saharan Africa |
|---|---|---|---|---|---|---|---|
| 2026 | USD 8.35M ▲ above global average | USD 3.03M ▼ below global average | USD 4.93M ▼ below global average | USD 8.00M ▲ above global average | USD 3.64M ▼ below global average | USD 2.96M ▼ below global average | USD 3.04M ▼ below global average |
| 2025 | USD 7.53M ▲ above global average | USD 2.52M ▼ below global average | USD 4.32M ▼ below global average | USD 7.29M ▲ above global average | USD 3.28M ▼ below global average | USD 2.55M ▼ below global average | USD 2.37M ▼ below global average |
| 2024 | USD 7.01M ▲ above global average | USD 2.76M ▼ below global average | USD 4.93M ▲ above global average | USD 8.75M ▲ above global average | USD 3.26M ▼ below global average | USD 2.78M ▼ below global average | USD 2.78M ▼ below global average |
| 2023 | USD 7.30M ▲ above global average | USD 2.46M ▼ below global average | USD 4.21M ▼ below global average | USD 8.07M ▲ above global average | USD 3.25M ▼ below global average | USD 2.70M ▼ below global average | USD 2.79M ▼ below global average |
| 2022 | USD 7.54M ▲ above global average | USD 2.09M ▼ below global average | USD 4.01M ▼ below global average | USD 7.46M ▲ above global average | USD 3.25M ▼ below global average | USD 2.92M ▼ below global average | USD 3.36M ▼ below global average |
| 2021 | USD 7.23M ▲ above global average | USD 1.82M ▼ below global average | USD 4.08M ▼ below global average | USD 6.93M ▲ above global average | USD 3.20M ▼ below global average | USD 2.82M ▼ below global average | USD 3.21M ▼ below global average |
| 2020 | USD 6.57M ▲ above global average | USD 1.40M ▼ below global average | USD 4.17M ▲ above global average | USD 6.52M ▲ above global average | USD 2.97M ▼ below global average | USD 2.15M ▼ below global average | USD 2.14M ▼ below global average |
| 2019 | USD 6.31M ▲ above global average | USD 1.35M ▼ below global average | USD 4.33M ▲ above global average | USD 5.97M ▲ above global average | USD 2.73M ▼ below global average | USD 2.13M ▼ below global average | USD 3.06M ▼ below global average |
Average total cost of a data breach as published in IBM/Ponemon "Cost of a Data Breach" reports, by report year, in US dollars. Early studies published only in local currency are left out, not converted. Each region is the average of the markets that year’s study reports for it (North America: United States, Canada; Latin America: Latin America, Brazil; Europe: United Kingdom, Germany, Benelux, France, Italy, Scandinavia; Middle East & North Africa: Middle East; Asia: Japan, India, ASEAN; Australia & New Zealand: Australia; Sub-Saharan Africa: South Africa); hover a figure to see which. Years with no published figure are left out (the series starts in 2006); "Not in report" means that year’s study did not cover the region, not that it had no breaches. Averages are not added up across years: selecting several years on the map shows their average. Map colours run from yellow (lower cost) to dark red (higher cost), relative to the regions shown. ▲ / ▼: above or below that year’s global average cost per breach.
AI Browsers Explained: What They Do and the Settings to Check
AI browsers explained: sidebar assistants vs agent modes that click and fill forms, what they can see, and the privacy settings worth checking.
Read the article · 11 minAlso new
- Cyber Security › Vulnerabilities & CVEsHow to Read a CVE Record and NVD Entry (and the 2025 Funding Scare)
- Breaches › AI Breaches & IncidentsAI Agents Escaped Test Environments: OpenAI, Hugging Face, Anthropic
- Research › Security ResearchDARPA AI Cyber Challenge Results: What AI Found and Fixed in 2025
- Research › AI ResearchAI in Scientific Research: What AlphaFold and AI Discovery Have Shown
Breaches
Data breaches and regulatory penalties by region, with every figure linked to its official source.
DeepSeek Data Leak: What Wiz Found and How Regulators Reacted
In January 2025 Wiz found an open DeepSeek database with over 1 million log entries. What was exposed, what regulators did, and what IT teams should check.
McKinsey Lilli Security Test: What a Red-Team Agent Reached
In 2026 CodeWall's AI agent tested McKinsey's Lilli chatbot under its disclosure policy. What it reported, what McKinsey said, and what to check.
Medibank Data Breach 2022: What Happened and the OAIC's Court Case
How the 2022 Medibank data breach happened, who was affected, what the OAIC alleges in its Federal Court case, and what security teams should check.
Meta's €1.2 Billion GDPR Fine Explained: DPC, EDPB and US Data Transfers
Meta's 2023 €1.2bn GDPR fine: what Ireland's DPC decided, why the EDPB stepped in, and what it means for EU-US data transfers.
Optus Data Breach Penalty: The OAIC and ACMA Court Cases Explained
What Optus said about its 2022 cyberattack, what the OAIC and ACMA allege in Federal Court, the penalty limits, and what security teams should check.
VentureRock 2023 ADGM Data Breach Case: One Hijacked Mailbox, No Fine
How a hijacked Microsoft 365 mailbox led ADGM's data regulator to reprimand VentureRock in 2023, why there was no fine, and what to check in your estate.
302.ai Data Leak: 17.6 Million Files in an Open Azure Bucket
Cybernews says AI aggregator 302.ai left 17.6 million files, including chat logs, in a public Azure bucket. What is confirmed and what to check.
Change Healthcare Ransomware Attack 2024: Facts, Costs, OCR Role
The 2024 Change Healthcare ransomware attack: what happened, people affected, UnitedHealth's disclosed costs, and what is known of HHS OCR's response.
Equifax Data Breach Settlement: What Happened and What It Cost
The 2017 Equifax breach exposed data on about 147 million people. How attackers got in, what the 2019 settlement cost, and what to check in your estate.
ChatGPT Data Breach? What OpenAI Has Disclosed, 2023 to 2025
What OpenAI says happened in the March 2023 ChatGPT bug and the 2025 Mixpanel incident, what data was exposed, and what to ask your AI vendors.
Shamoon and Saudi Aramco 2012: What the Wiper Destroyed
What the Shamoon wiper did to Saudi Aramco in 2012, how destructive malware works, what Aramco says it learned, and the controls to check.
Costa Rica Ransomware Attack 2022: Conti and the National Emergency
How Conti's April 2022 ransomware attack hit Costa Rica's customs and tax systems, why a national emergency followed, and what to check.
INSS Data Breach: Why Brazil's ANPD Sanctioned It Without a Fine
In 2022, valid credentials ran 90M+ queries on Brazil's INSS benefits system. What ANPD found, the sanction, and what to check in your own estate.
South Africa Justice Department Ransomware and the R5m POPIA Fine
Ransomware hit South Africa's Justice Department in 2021. The regulator found lapsed security licences and later issued a R5 million POPIA fine.
SK Telecom USIM Breach 2025: What Was Taken and the PIPC Fine
What was stolen in SK Telecom's 2025 USIM breach, how many subscribers were affected, what Korea's regulators found, and the PIPC's 134.8 billion won fine.
SingHealth Data Breach 2018: How It Happened and What PDPC Fined
The 2018 SingHealth data breach hit about 1.5 million patients. How attackers got in, the S$1 million PDPC penalties, and lessons for IT teams.
British Airways Data Breach Fine: What Happened and Why It Cost £20m
How attackers skimmed British Airways card data in 2018, why the ICO fined £20m not £183.39m, and the controls the ICO says were missing.
Chat & Ask AI Data Leak: 300 Million Messages, One Firebase Error
A researcher says a Firebase error left about 300 million Chat & Ask AI messages readable. What is confirmed, what is not, and what to check.
How Attackers Misuse AI Models, According to Anthropic and Google
What Anthropic and Google's threat reports say about AI model misuse: four cases, what the companies did, and what defenders should log and ask.
Hugging Face Spaces Breach 2024: What Happened and What to Change
What Hugging Face said about unauthorised access to Spaces secrets in May 2024, what is unknown, and how AI teams should handle tokens and CI/CD secrets.
AI
New AI tools explained from official sources, and how AI systems get attacked and defended.
CI/CD for LLM Applications: How to Ship AI Features Safely
How to ship LLM features safely: version prompts and model IDs, gate releases on evals and red-team tests, secure the model supply chain, and roll back.
MCP Security Explained: Tool Poisoning, Token Risks and Controls
What the Model Context Protocol is, how MCP servers and tools get abused, real CVEs, and the fixes: allowlists, pinned versions, narrow scopes, approval.
OpenAI Security Explained: Model Safeguards, Data Rules and Gaps
How OpenAI secures frontier models and business data: Preparedness Framework, SOC 2 and ISO scope, retention, ZDR, and what isn't verified.
AI Agent Security Architecture: Seven Layers and Their Controls
A layer-by-layer map of an AI agent's attack surface, from prompt to credentials, with the controls, OWASP and ATLAS IDs and logs each layer needs.
AI Coding Assistant Security: Data, Admin Controls and Code Review
What Claude Code, Continue, Cursor and GitHub Copilot send out, the admin controls that limit them, and the repo rules that still need a human.
AI Model Routers Explained: What Gateways See, Store and Route
An AI model router puts one API in front of many models. What Bedrock, Azure, Vertex AI, OpenRouter and LiteLLM see, keep, and where your data goes.
Anthropic Security: How It Protects Its Models and Customer Data
Anthropic security from its own pages: ASL-3 weight protection, ISO and SOC 2 claims, data retention, zero data retention, and what's unverified.
AI Agent Security Risks at Work: The Guardrails That Matter
What an AI agent is, why letting AI act brings new security risks, and the guardrails, vendor questions and 10-point checklist a manager needs.
On-Device AI Privacy: What Stays on Your Phone and What Doesn't
What on-device AI means, why it helps privacy, and when Apple, Microsoft, Google and local AI apps still send your data to the cloud.
Prompt Injection Explained: What It Is and How to Protect Your Team
Prompt injection in plain language: how hidden instructions trick AI tools, why AI agents raise the stakes, and five defences any manager can use.
Shadow AI at Work: How to Find the AI Tools Your Team Already Uses
Shadow AI at work is AI your team uses without approval. How to find it in consent, network and expense records, and what to offer instead.
Cyber Security
The scams and threats people and organisations actually face, and the defences that stop them.
How to Read a CVE Record and NVD Entry (and the 2025 Funding Scare)
Read a CVE record and an NVD entry field by field, with a real example, and learn what the 2025 CVE funding scare and NVD backlog mean for defenders.
The Data Breach Lifecycle: From First Access to Notification
How a data breach unfolds, from initial access and dwell time to containment and notification, with 2026 figures from IBM, Mandiant and Verizon.
Infostealers and Session Cookie Theft: Why MFA Isn't Enough
Infostealer malware can copy a logged-in session and skip MFA. How session cookie theft works, and the controls that make a stolen token useless.
Insider Threat Program: Types, Warning Signs and Privacy Limits
How to build an insider threat program: CISA's insider types, warning signs, least privilege, logging and DLP, HR and legal roles, and lawful monitoring.
php2shell (CVE-2026-109618): Two Critical PHP RCE Flaws and How to Patch Them
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution. Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35. What to do now.
Ransomware Decryption Tools: What No More Ransom Can and Can't Do
Free ransomware decryptors exist for some families only. What No More Ransom offers, why paying guarantees nothing, and the backups that matter more.
How Ransomware Attacks Work, and the Controls That Stop Them
How ransomware attacks unfold, from first access to encryption and extortion, and the backup, identity and patching controls that break the chain.
SIEM vs SOC: The Tool, the Team, and Which One You Need
A SIEM is a log platform; a SOC is the team that acts on it. Build, buy or hybrid, which logs to collect first, how long to keep them, and staffing.
CVSS vs EPSS vs KEV: Which Vulnerabilities to Patch First
CVE, CVSS, EPSS and KEV explained in plain language, with a Log4Shell worked example and a simple order for deciding which patches come first.
AI Phishing Protection for Small Business: The 30-Day Plan
AI made phishing fluent, personal and cheap. What protects a small business now, in order of impact, from passkeys to payment rules, with a 30-day plan.
Deepfake Scams: How to Spot Them When Your Eyes and Ears Can't
How deepfake voice and video scams work today, why the old visual tells no longer hold, and the verification habits that protect families and businesses.
Red Team vs Blue Team vs Purple Team: Who Needs Which, and When
Red, blue and purple teaming explained, regulator-led tests such as CBEST, TIBER-EU and DORA TLPT, how to scope one, and what a good report contains.
ZTNA vs VPN: Why Remote Access Gateways Get Breached
Why VPN appliances are a favourite way in, what zero trust network access changes, the order to migrate in, and what ZTNA does not fix.
Fileless Malware and Living off the Land: How to Detect It
Fileless attacks run through tools already on your systems, such as PowerShell and WMI. Why antivirus misses them, and how to detect and respond.
API Security Breaches: How Data Leaks Through APIs and How to Stop It
How attackers pull data out through APIs, mapped to the OWASP API Security Top 10 2023, two documented cases, and the controls that work.
Breach Detection Tools Explained: EDR, XDR, NDR, MDR and SIEM
What EDR, XDR, NDR, MDR, SIEM and deception tools each see, what they miss, and the telemetry and staff they need. With CISA and NIST sources.
What Is the Dark Web? How It Works, Who Uses It and the Risks
The dark web explained: how it differs from the deep web, who uses it, what stolen data is sold there, and what to do if your company data shows up.
Privacy
Where your data goes, who can see it, and what the law says about it.
AI Meeting Notetaker Privacy: Consent, Recordings and Transcripts
Who is told when Zoom, Teams, Google Meet or a bot takes notes, where transcripts are stored and for how long, and what hosts and attendees can do.
Data Breach Notification Deadlines by Country: Comparison Table
Who must be told about a data breach, and by when: GDPR, UK, Australia, Brazil, Canada, the SEC and NIS2 side by side, each linked to its source.
India DPDP Rules 2025: Timeline, Duties, Rights and Penalties
What India's DPDP Act 2023 and DPDP Rules 2025 require: the 12- and 18-month timeline, 72-hour breach reports, 90-day rights, ₹250 crore cap.
Saudi PDPL Requirements: What Organisations Must Do Now
What Saudi Arabia's Personal Data Protection Law requires: scope, consent, 72-hour breach reports, transfers, registration, fines, and a checklist.
Is It Safe to Use ChatGPT at Work? 7 Things to Keep Out Before You Paste
Is it safe to use ChatGPT at work? Yes, with the right account and settings. Seven things to keep out, how to check data settings, and a team policy.
UAE Data Protection Law (PDPL) and AI Tools: What It Means in Practice
What the UAE Data Protection Law (PDPL) means for a business using AI tools: scope, consent, transfers, DIFC and ADGM, and a 7-question checklist.
Singapore PDPA Requirements: Duties, 3-Day Breach Rule, Penalties
What Singapore's PDPA requires: core duties, the 3-calendar-day breach notification rule, PDPC penalties up to 10% of turnover, and a checklist.
GDPR Requirements for Businesses: Bases, Rights, 72 Hours, Fines
GDPR requirements for businesses in plain language: lawful basis, people's rights, the 72-hour breach report, data transfers, fines, and a checklist.
Data Classification and DLP: Label First, Then Stop the Leaks
Data loss prevention fails without data classification. A four-level scheme, where DLP sits, why false positives stall projects, and AI chat uploads.
Audit
Governance, compliance and the evidence that proves controls work.
Chinese AI Data Security: What the Laws and Privacy Policies Say
China's AI rules, PIPL and Data Security Law, what DeepSeek, Kimi and Alibaba Cloud say about data location, and the questions to ask first.
EU AI Act Timeline: What Applies When and What to Do Now
The EU AI Act timeline from 2025 to 2028, including the 2026 AI Omnibus changes, and the practical steps an organisation should have in place today.
ISO/IEC 42001 Explained: Who Needs It and How Certification Works
ISO/IEC 42001 is the AI management system standard. What it covers, who should consider it, how audit and certification work, and how it differs from NIST.
NIS2 Requirements: Who Is in Scope and the 24-Hour Reporting Clock
Who NIS2 covers, the ten Article 21 security measures, the 24-hour, 72-hour and one-month incident reporting clock, fines, and a readiness checklist.
SOC 2 vs ISO 27001: What Each Is and How to Choose
SOC 2 is an auditor's report on controls; ISO/IEC 27001 is a certified management system. How audits and proof differ, and how to pick the right one.
SOC Regulatory Requirements: What NYDFS, SEC, PCI and HIPAA Demand
What NYDFS, the SEC, PCI DSS, HIPAA and CIRCIA require for monitoring, logging and incident response, and when that means a SOC or MDR.
Third-Party Risk Management: Tiering, Contracts, Monitoring and Exit
Third-party risk management in practice: tier vendors, run due diligence, write audit, breach-notice and exit clauses, monitor, and offboard cleanly.
IT General Controls Explained: Four Areas Auditors Test
What IT general controls (ITGCs) are, the four areas auditors test, and the evidence they ask for, with a real audit finding and a prep checklist.
Auditing User Access Reviews: How to Test Recertification Works
A user access review audit tests more than a signed spreadsheet. How to check the user list, spot rubber-stamping and test leavers.
SOC Requirements in the GCC and India: Logs, Monitoring, Retention
What Saudi NCA controls, the UAE IA Regulation and RBI's bank framework require for monitoring, log retention and incident reporting, compared.
SOC 1 vs SOC 2 vs SOC 3: Which Report You Need and What to Check
SOC 1 covers financial reporting controls, SOC 2 security and trust criteria, SOC 3 is the public summary. Plus Type 1 vs 2 and what to check.
Quantum
The quantum threat to encryption, and what quantum computers can really do.
Post-Quantum TLS Is Already Here: How to Check Your Own Systems
Hybrid X25519MLKEM768 key exchange is on by default in major browsers and libraries. See where it runs, where it's missing, and how to test your servers.
What Is Q-Day? A Calm Guide to Post-Quantum Readiness
Q-Day is when a quantum computer could break today's encryption. What it is, what NIST has standardised, and a practical checklist for you.
Logical Qubits Explained: What Willow's Error Correction Proved
What a logical qubit is, why error correction matters, and what Google's Willow and other published milestones do and don't say about quantum risk.
How Many Qubits to Break RSA-2048? Gidney's 2025 Estimate
Gidney's 2025 paper estimates under 1 million noisy qubits and under a week to factor RSA-2048, down from 20 million. What it assumes and what to do.
Economy
How AI and technology are reshaping markets and economies, starting with the Gulf.
GCC Cloud Regions and Data Residency: Who Hosts Where
Which cloud providers list regions in the UAE, Saudi Arabia, Qatar and Bahrain as of 25 Oct 2026, and what local rules mean for where your data sits.
Stargate UAE and HUMAIN Explained: The Gulf's AI Build-Out
What the UAE's Stargate UAE campus and Saudi Arabia's HUMAIN announced, what is still a plan, and what it means for the Gulf's tech economy.
Will AI Replace Jobs? What the IMF, ILO and Usage Data Say
Will AI replace jobs? The IMF, the ILO and Anthropic's usage data measure different things. Here is what each number means and how to use it.
How Much Electricity Do AI Data Centres Use? What Official Data Shows
Official US and Irish statistics on data-centre electricity demand, what they say about AI, and what IT teams should plan for.
Finance
Security and risk in payments and banking technology.
UK APP Fraud Reimbursement Rules: What Is Covered, the £85,000 Limit
Since 7 October 2024, UK banks must reimburse most APP fraud on Faster Payments or CHAPS, up to £85,000. What is covered, the exceptions, and what to do.
DORA Requirements for Financial Entities: Five Pillars Explained
What DORA requires of EU financial entities since 17 January 2025: five pillars, the 4-hour and 24-hour incident clock and ICT provider oversight.
Cyber Insurance Coverage: What to Buy and What Gets Excluded
What cyber insurance covers: first- and third-party cover, business interruption, extortion, exclusions, underwriter questions and sizing a limit.
Cross-Border Payments Risk: Partner Exposure, Limits and Controls
Cross-border payment risk is partner and settlement risk as much as hacking: prefunding, open limits, maker-checker gaps, nostro breaks and sanctions.
Blockchain
Blockchain and crypto: security, digital assets and regulation, with every figure linked to its official source.
UAE Crypto Regulation for Businesses: VARA, ADGM, DIFC and Saudi
Who regulates crypto in the UAE and Saudi Arabia, what VARA's technology rulebook demands of firms, and which GCC rules I could not confirm.
India Crypto Tax and PMLA Rules: What Exchanges and Users Must Know
India's crypto rules for exchanges and users: PMLA coverage since March 2023, FIU-IND registration, the RBI's position, tax and safe-use checks.
GENIUS Act Stablecoin Law: What's in Force and What's Still Pending
The GENIUS Act is US stablecoin law: who can issue, 1:1 reserves, AML and OFAC duties, key dates, and which crypto market bills are still pending.
Bybit Hack 2025: How It Happened, the $1.5bn Loss and the FBI's Finding
How the 2025 Bybit hack happened: a compromised Safe{Wallet} developer machine, tampered web code, the FBI's North Korea attribution, and what to check.
MiCA Regulation Explained: What Applies to EU Crypto Firms and Stablecoins
MiCA is the EU's crypto rulebook. What applies since 2024, how CASP authorisation and the transition ended, the stablecoin rules, and what IT teams check.
Crypto Investment Fraud: What FBI IC3 Data Shows and How to Spot It
FBI IC3 data puts US crypto investment fraud losses at $7.2bn in 2025. How the scams work, who loses most, crypto ATM risks, and the controls that help.
Crypto Custody Security for Businesses: Wallets, Keys and Signing
How businesses keep crypto keys safe: hot, warm and cold wallets, multisig vs MPC, blind signing, key ceremonies, withdrawal controls and monitoring.
Research
New research in AI, security, quantum, energy, cars and defence that could change what comes next, each result linked to its source.
DARPA AI Cyber Challenge Results: What AI Found and Fixed in 2025
DARPA's AI Cyber Challenge final: AI systems found 54 of 63 planted bugs, patched 43, and found 18 real ones. What it shows and what it doesn't.
AI in Scientific Research: What AlphaFold and AI Discovery Have Shown
AI predicted protein structures, proposed new crystals and found faster algorithms. What the papers show, what they don't, and what to watch next.
Fusion Energy Progress: What NIF Ignition and ITER Actually Show
NIF has reached fusion ignition many times since 2022. Here is what that proves, what it doesn't prove about power plants, and what ITER's dates say.
Laser Weapons and Directed Energy: What Official Sources Confirm
DragonFire and US directed-energy programmes from official sources: the £10-a-shot claim, GAO's $1bn-a-year figure, and weather and range limits.
Perovskite Solar Cells: Efficiency Records, Durability and Storage
Perovskite cells pass 26% in the lab and a perovskite-silicon tandem reached 34.85%. Durability is the open question. What the records mean.
Solid-State Batteries for Electric Cars: Promise vs. Evidence
Solid-state batteries promise more range and safety for electric cars. What labs and companies have shown so far, what they haven't, and what to watch.
Quantum Sensing Explained: Clocks, Sensors and Quantum Networks
Quantum sensing and networking explained: NIST's record clock, a 35 km entanglement test in Boston, and why the UK NCSC backs PQC over QKD.
Knowledge
Standards and frameworks explained: what each covers, who it applies to, and a link to the official text.
ISO 22301 Business Continuity Explained: BIA, Recovery, Certification
ISO 22301 explained: what the business continuity standard covers, how a BIA and recovery objectives work, and how certification goes.
ISO/IEC 27701 Explained: Privacy Management, GDPR and 2025 Edition
ISO/IEC 27701 explained: the privacy management standard for controllers and processors, how it relates to GDPR, and what the 2025 edition changed.
NIST CSF 2.0 Explained: Six Functions, Profiles and Tiers
What NIST CSF 2.0 is, its six functions including the new Govern function, how Profiles and Tiers work, and why you cannot be certified.
ISO/IEC 27001 Explained: What It Requires and How Audits Work
ISO/IEC 27001 explained: what the ISMS standard requires, how certification and surveillance audits work, and what changed in 2022.
ISO 31000 Risk Management Explained: Principles and Process
ISO 31000:2018 is risk management guidance, not a certificate. What its principles, framework and process cover, and how it sits above ISO/IEC 27005.
COBIT 2019 Explained: Objectives, Design Factors and Audits
COBIT 2019 is ISACA's IT governance framework. What its 40 objectives and design factors are, whether you can be certified, and how auditors use it.
ISO/IEC 20000-1 Explained: IT Service Management, ITIL and Certification
ISO/IEC 20000-1 is the certifiable standard for IT service management. What it requires, how it differs from ITIL, and how certification works.
ISO/IEC 27035 Explained: Incident Management, NIST and Deadlines
ISO/IEC 27035 is guidance for handling security incidents. Its parts, lifecycle, how it compares with NIST SP 800-61, and reporting clocks.
What Does ENISA Do? The EU Cybersecurity Agency Explained
ENISA is the EU Agency for Cybersecurity. What it does under the Cybersecurity Act, how EU certification schemes (EUCC, EUCS) work, and its reports.
ISO 27017 vs 27018: Cloud Security and Privacy Standards Explained
ISO/IEC 27017 covers cloud security controls; ISO/IEC 27018 covers personal data in public clouds. What each adds and what to ask providers.
ISO/IEC 27002:2022 Explained: The Security Controls Guide
ISO/IEC 27002:2022 is guidance on security controls, not a certificate. How it relates to 27001 Annex A, its themes and attributes, and how to use it.
ISO/IEC 27005 Risk Management Explained: Process and Approaches
ISO/IEC 27005:2022 is guidance, not a certificate. What its risk process covers, event-based vs asset-based approaches, and how it supports ISO 27001.
CSA CCM and STAR Explained: How Buyers Vet Cloud Providers
The Cloud Security Alliance's CCM is a cloud control framework; STAR is the registry where providers publish proof. Levels, versions and reading an entry.
PCI DSS 4.0 Requirements Explained (v4.0.1): Scope and Assessments
PCI DSS v4.0.1 in plain terms: who it applies to, the 12 requirements, the 31 March 2025 deadline, and how SAQs, ROCs and merchant levels fit together.