GRCOPILOT Insights

Insights, guidance and product updates on cybersecurity, GRC and compliance.

Browser and extension security: the endpoint everyone forgot
Security Practices

Browser and extension security: the endpoint everyone forgot

Work happens in the browser, and extensions can read every page in it - including your SaaS applications. A permission model most organisations have never reviewed.
Data loss prevention: why most deployments end in monitoring mode forever
Security Practices

Data loss prevention: why most deployments end in monitoring mode forever

DLP promises to stop data leaving and usually delivers an alert queue nobody reads. What it can genuinely do, why blocking is so rarely enabled, and how to get value without the theatre.
Cloud permission sprawl: the identities nobody is reviewing
Security Practices

Cloud permission sprawl: the identities nobody is reviewing

Cloud estates accumulate thousands of roles and machine identities that quietly outnumber humans. Why access reviews miss them entirely, and how to cut effective permissions without breaking production.
Threat intelligence: turning feeds into decisions
Security Practices

Threat intelligence: turning feeds into decisions

Most threat intelligence programmes buy feeds, ingest indicators and change nothing. What intelligence is actually for, the three levels worth distinguishing, and how to tell whether yours is working.
DDoS resilience: the attack you cannot patch your way out of
Security Practices

DDoS resilience: the attack you cannot patch your way out of

Volumetric floods are largely a solved commercial problem. Application-layer attacks that look like real traffic are not. What actually keeps a service up, and why the expensive failure is usually your own origin.
Phishing defence beyond awareness training
Security Practices

Phishing defence beyond awareness training

Blaming users for clicking is a strategy that has failed for two decades. What actually reduces phishing risk: technical controls that stop delivery, a reporting path people use, and processes that survive a successful click.
MFA bypass and session token theft: why “we have MFA” is no longer the answer
Security Practices

MFA bypass and session token theft: why “we have MFA” is no longer the answer

Adversary-in-the-middle phishing kits steal the session, not the password - so MFA completes normally and the attacker inherits the authenticated session. What actually stops it.
Attack surface management: the assets you forgot you had
Security Practices

Attack surface management: the assets you forgot you had

Forgotten subdomains, a staging environment left public, an old marketing site on an unpatched CMS. Attackers enumerate your external surface continuously; most organisations look once a year.
Detection engineering: why your SIEM alerts on everything and catches nothing
Security Practices

Detection engineering: why your SIEM alerts on everything and catches nothing

Buying a SIEM and enabling default rules produces thousands of alerts nobody reads. Treating detections as engineered, tested, version-controlled artefacts is what turns logs into detection.
Container and Kubernetes security: where the real exposure is
Security Practices

Container and Kubernetes security: where the real exposure is

Image scanning is the part everyone does and the smallest part of the problem. Cluster RBAC, admission control, network policy and workload identity are where clusters are actually compromised.
Secrets management: the credentials already in your git history
Security Practices

Secrets management: the credentials already in your git history

Hardcoded keys, tokens in CI variables, credentials in config files and .env on laptops. Why rotation matters more than detection, and what to do about the secrets already committed.
Threat modelling: finding design flaws before you build them
Security Practices

Threat modelling: finding design flaws before you build them

Penetration testing finds what you built wrong. Threat modelling finds what you were about to build wrong, at a fraction of the cost. Four questions, when to do it, and why most programmes die of ceremony.
Certificate lifecycle management: the outage you schedule yourself
Security Practices

Certificate lifecycle management: the outage you schedule yourself

Expired certificates cause more self-inflicted downtime than most attacks. Why manual tracking always fails eventually, what an inventory must capture, and how shortening lifetimes forces the fix.
Post-quantum readiness: what to actually do now, and what to ignore
Security Practices

Post-quantum readiness: what to actually do now, and what to ignore

A cryptographically relevant quantum computer does not exist yet, but harvest-now-decrypt-later makes some data a present-day problem. The genuinely useful preparation is a cryptographic inventory and crypto-agility - not buying anything.
Password and MFA policy: what changed, and what auditors still expect
Security Practices

Password and MFA policy: what changed, and what auditors still expect

Forced 90-day rotation and complexity rules are now advised against by the standards that popularised them. What modern guidance says, why not all MFA is equal, and how to justify the change to an assessor.
Change management: satisfying auditors without reinstating the CAB
Security Practices

Change management: satisfying auditors without reinstating the CAB

Auditors want authorisation, testing, segregation and traceability for every production change. None of that requires a weekly committee - and modern pipelines evidence it better than a meeting ever did.
Vulnerability management: prioritising when everything is critical
Security Practices

Vulnerability management: prioritising when everything is critical

A scanner produces thousands of findings and a team that can fix dozens. How to set remediation SLAs you can meet, prioritise by exploitability rather than raw severity, and evidence the programme to an auditor.
Physical and environmental security: the domain the cloud did not remove
Security Practices

Physical and environmental security: the domain the cloud did not remove

"Everything is in the cloud" does not close this section. Offices, laptops, home working, visitors and paper are still yours - and the controls are cheap, testable, and routinely forgotten.
Secure configuration baselines: hardening that survives contact with production
Security Practices

Secure configuration baselines: hardening that survives contact with production

Adopting a benchmark is easy. Keeping a fleet on it is the hard part. How to pick a baseline, handle the exceptions that are genuinely necessary, and detect drift before an auditor does.
Network segmentation: containing the breach and shrinking the audit
Security Practices

Network segmentation: containing the breach and shrinking the audit

Segmentation limits how far an intruder gets, and it is one of the few security controls that also reduces what you have to certify. How to segment without a rebuild, and how to prove it works.
SPF, DKIM and DMARC: stopping people from sending mail as you
Security Practices

SPF, DKIM and DMARC: stopping people from sending mail as you

Three DNS records that decide whether anyone on the internet can send email from your domain. What each one does, how to reach enforcement without blocking your own invoices, and why business email compromise beats ransomware on losses.
Backups: the 3-2-1 rule, immutability, and the test nobody runs
Security Practices

Backups: the 3-2-1 rule, immutability, and the test nobody runs

Backups succeed nightly and fail on the one day they matter. What ransomware changed about backup design, why immutability is now the point, and how to test restores in a way that actually proves something.
Joiner, mover, leaver: the identity lifecycle auditors sample first
Security Practices

Joiner, mover, leaver: the identity lifecycle auditors sample first

Provisioning gets built properly. Movers get ignored, and that is where privilege accumulates. How to run the full lifecycle, and why the mover case causes more findings than joiners and leavers combined.
Ransomware readiness: the controls that decide the outcome
Security Practices

Ransomware readiness: the controls that decide the outcome

Ransomware outcomes are determined long before the ransom note. The controls that prevent it, the backup properties that survive it, and the decisions to make in advance rather than under pressure.
Logging and monitoring: collecting logs is not the control
Security Practices

Logging and monitoring: collecting logs is not the control

Frameworks do not ask whether you have logs. They ask what you log, how long you keep it, whether it is tamper-resistant, and who reviews it. The last one is where most programmes fail.
How to run a tabletop exercise that finds real problems
Security Practices

How to run a tabletop exercise that finds real problems

A tabletop that everyone passes was a waste of an afternoon. How to design scenarios that expose gaps, who to include, how to inject pressure, and what to record so it counts as audit evidence.
Penetration testing vs vulnerability scanning: what auditors expect
Security Practices

Penetration testing vs vulnerability scanning: what auditors expect

They answer different questions, and substituting one for the other is a common audit finding. How each works, what frameworks actually require, and how to scope a test that produces value rather than a PDF.
Encryption and key management: the part auditors actually probe
Security Practices

Encryption and key management: the part auditors actually probe

Enabling encryption is easy. Managing keys is where programmes fail. What frameworks require, the key lifecycle, who should hold keys, and the questions that expose weak implementations.
Insider threat: the risk your perimeter controls do not address
Security Practices

Insider threat: the risk your perimeter controls do not address

Most insider incidents are negligent rather than malicious, and most malicious ones happen around departure. How to build a proportionate programme without turning your workplace into a surveillance operation.
API security: why authorisation flaws beat every scanner
Security Practices

API security: why authorisation flaws beat every scanner

APIs now carry most application traffic and most application risk. Why broken authorisation dominates, how shadow and zombie APIs appear, and the controls that actually reduce exposure.
Secure SDLC and DevSecOps: making the pipeline your evidence
Security Practices

Secure SDLC and DevSecOps: making the pipeline your evidence

Auditors sample changes; fast teams deploy constantly. How to satisfy secure development and change management requirements without slowing delivery - by making the existing workflow produce the records.
Software supply chain security: SBOMs and why they matter
Security Practices

Software supply chain security: SBOMs and why they matter

Most of your codebase was written by someone else. How to know what is in your software, secure the build, and answer "are you affected?" in hours rather than weeks.
Privileged access management: removing standing admin rights
Security Practices

Privileged access management: removing standing admin rights

Privileged accounts are the target of nearly every serious intrusion. What counts as privileged, why just-in-time elevation beats permanent rights, and how to handle the service accounts everyone forgets.
© 2026 GRCOPILOT