The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 661 to 667 of 667 briefings

Tuesday 21 July

Breaches and Incidents21 Jul 2026

Ransomware playbooks keep failing at the same step: recovery

Ransom demands are collapsing and backups are working. Average recovery cost still rose 11% to $1.7m, and JLR lost five weeks of production for a modelled £1.9bn. The money moved from the ransom to the restore.

AI Security21 Jul 2026

Agentic browsers widen the prompt injection attack surface

Brave broke Perplexity Comet twice after it was declared fixed, then repeated the attack against three more agents. The vendors are not losing a patching race; the architecture composes trusted instructions with untrusted content in one context window.

Breaches and Incidents21 Jul 2026

Half of breaches now involve a third party. Every clock starts too late

A 72-hour clause is not a control, it is an accounting mechanism. The clock starts at the vendor's awareness, which is the one variable your contract cannot set.

Threat Intel21 Jul 2026

Credentials did not stop mattering. The DBIR headline was read wrong

Initial access changed. The attack path did not. Half of ransomware victims with a credential leak saw it within 95 days of the attack, a window long enough to act in, if anyone is looking.

Compliance and Regulation21 Jul 2026

The AI Act deadline landed on Sunday. Most people watched the wrong half

High-risk slipped sixteen months. Article 50 transparency did not move an inch and applied from Sunday. The obligation that actually landed is the one that got no attention.

AI Security21 Jul 2026

Model context protocols are quietly extending the enterprise perimeter

A poisoned tool description is a prompt injection that ships once and fires on every invocation, for every user, in every session. It is the same root cause as the browser attacks, with persistence added.

AI Security21 Jul 2026

58% of executives have had an AI incident. Nearly all are confident

Executive confidence in AI use is not correlated with anything measured. The organisations that had an incident and the ones that feel fine are largely the same organisations, because neither has an inventory.