Cybersecurity insights and guidance

In my previous paper, I asked a deceptively simple question: How much cybersecurity is enough? It's a question that Boards, CEOs, CFOs and CISOs have wrestled with for decades. Yet despite the enormous progress made in cybersecurity, many organisations still struggle to justify their cyber investment decisions with confidence. Why? It certainly isn't because our profession lacks knowledge. Today we have more cybersecurity standards, frameworks, methodologies and guidance than

Twenty years ago, I had the privilege of working with the eminent Jack Jones during the early development of the FAIR cyber risk quantification methodology. At the time, I was working on risk modelling and the inspirational Chris Carlson, then Head of Cyber Risk at Boeing, who knew of my work, graciously put me in touch with Jack. I flew to Columbus, Ohio One day, Jack told me the story that ultimately led him to develop FAIR. He had been dis cussing the need to purchase a ne

Cyber risk is no longer just an IT issue. For Management Companies, weak controls can quickly become failures in governance, operational resilience and client protection.

On 2 April 2026, STORM Guidance hosted the inaugural Cyber Resilience Leadership Forum (CRLF 2026) in Moka, Mauritius. With TrendAI and FRCI, the forum convened executives, regulators and specialists to reinforce one truth: cyber resilience is defined by leadership decisions before, during and after an incident.

Ahead of the inaugural CRLF 2026, STORM Guidance has been featured across leading Mauritian business and news titles, highlighting why cyber resilience is now a board-level priority for Mauritius.

A detailed look at how M&S and Co-op responded to cyberattacks — what businesses can learn, what could have gone wrong, and what affected customers should do.

Cybercrime in 2026 won’t hinge on a single new exploit—it will look like systemic business failure. Expect multi-vector extortion, AI-powered deception that targets processes, widening OT/IoT exposure, underperforming government efforts, and a softening insurance market. The difference maker isn’t tooling—it’s governance, accountability, and real resilience.

A systemic incident analysis of a Salesforce disruption: causes, impact, controls, and lessons learned. Practical actions for operational resilience and third-party risk.

Interfaces connect systems, teams and suppliers - and often expose unseen risk. Learn how to identify, assess and control interface risk to strengthen cyber resilience.

A detailed look at how M&S and Co-op responded to cyberattacks — what businesses can learn, what could have gone wrong, and what affected customers should do.

Attackers are manipulating Google search to trick users into downloading malware. Learn how SEO poisoning works and how to stay protected.

Cobalt Strike is a powerful post-exploitation tool used by attackers. Learn how it works, and how to detect and defend against it.

Cybercriminals are using online ads to deliver malware to businesses. Learn how malvertising works and how to defend against it.

Cybercriminals are using fake browser and software updates to spread malware. Learn how these attacks work and how to protect your business.

Explore real-world examples of LOTL attacks and learn practical detection tips to help your business spot stealthy cyber threats before damage is done.

Learn how initial access brokers sell entry into business systems, the risks they pose, and how your company can defend against this growing threat.

credential stuffing, account takeover prevention, business login attacks, cyber defence, threat intelligence, STORM Guidance, password security, identity protection, cyber attack mitigation

credential stuffing, account takeover prevention, business login attacks, cyber defence, threat intelligence, STORM Guidance, password security, identity protection, cyber attack mitigation

Learn how fake Chrome and browser updates are tricking employees into installing malware — and how your business can defend against drive-by attacks.

Learn how cybercriminals use trusted system tools to hide attacks, avoid detection, and move across networks — and how to defend your business.