GRCOPILOT Insights

Insights, guidance and product updates on cybersecurity, GRC and compliance.

How to prepare for NIS2 in 30 days: a week-by-week plan
EU & UK

How to prepare for NIS2 in 30 days: a week-by-week plan

A realistic four-week sprint for entities that have just discovered they are in scope: determine status and register, close the reporting gap, get board approval on record, then evidence the ten measures.
EDR, XDR and MDR compared: what the categories actually mean when buying
Comparisons

EDR, XDR and MDR compared: what the categories actually mean when buying

Three acronyms that overlap heavily and are used inconsistently by vendors. What each genuinely denotes, which problem each solves, and the questions that cut through the marketing.
Business email compromise: designing the process that stops it
Guides

Business email compromise: designing the process that stops it

BEC causes larger aggregate losses than ransomware and almost never involves malware. It exploits a process, not a system - which means the fix is a process, not a product.
Browser and extension security: the endpoint everyone forgot
Security Practices

Browser and extension security: the endpoint everyone forgot

Work happens in the browser, and extensions can read every page in it - including your SaaS applications. A permission model most organisations have never reviewed.
Firewall rule review: finding the any-any rule from 2019
Audit

Firewall rule review: finding the any-any rule from 2019

Rule bases grow, never shrink, and eventually nobody knows what half of them are for. What a review should look for, how to remove rules safely, and why this is an audit finding waiting to happen.
Ransomware recovery: the decisions you make in the first 48 hours
Guides

Ransomware recovery: the decisions you make in the first 48 hours

Readiness is about preventing and preparing. Recovery is about the choices under pressure - rebuild or restore, pay or refuse, what to tell customers - most of which should be decided before the day arrives.
OT incident response: when you cannot just isolate the system
Sectors

OT incident response: when you cannot just isolate the system

IT incident response says contain first. In an operational environment, disconnecting a controller can be a safety event. What changes about detection, containment, forensics and the authority to act.
CVSS, EPSS and SSVC compared: prioritising when everything is critical
Comparisons

CVSS, EPSS and SSVC compared: prioritising when everything is critical

CVSS tells you how bad a vulnerability could be in theory. EPSS estimates whether anyone will exploit it. SSVC asks what you should do. Using the wrong one produces a queue ordered by fiction.
Vulnerability disclosure policy: what to publish before a researcher finds something
Guides

Vulnerability disclosure policy: what to publish before a researcher finds something

Someone will eventually find a flaw in your product and try to tell you. Whether that ends well depends almost entirely on decisions you make beforehand. What a VDP must contain, and why safe harbour is the clause that matters.
The HIPAA security risk analysis: the requirement most often failed
US & Americas

The HIPAA security risk analysis: the requirement most often failed

It is explicitly mandated, it underpins every other decision in the Security Rule, and enforcement actions repeatedly cite its absence or inadequacy. What a defensible analysis has to contain.
Cybersecurity for non-profits: doing this on a real budget
Sectors

Cybersecurity for non-profits: doing this on a real budget

Charities hold donor and beneficiary data, run on volunteers and constrained budgets, and are targeted precisely because attackers expect weak defences. What actually matters when you cannot buy your way out.
Insurance sector cybersecurity: legacy systems and very sensitive data
Sectors

Insurance sector cybersecurity: legacy systems and very sensitive data

Insurers hold health, financial and behavioural data across systems that are often decades old, distributed through a broker network they do not control. What that combination demands.
© 2026 GRCOPILOT