From the Field
Tradecraft, career advice and research notes written by the same red team that teaches our courses. No fluff, no recycled news.
Data Privacy
GDPR Principles Explained for Businesses
A clear breakdown of the seven GDPR principles — what they mean, what they require, and how your organisation can build processing activities that comply.
Data Privacy
Global Data Protection Regulations: An Overview
A structured comparison of the world's major data protection laws — GDPR, CCPA, LGPD, PDPA, PIPEDA, and more — covering scope, key obligations, and enforcement.
Enterprise Cyber Risk
Cyber Risk Assessment Methodology: A Step-by-Step Guide
A step-by-step cyber risk assessment methodology aligned with NIST SP 800-30, covering scoping, asset identification, threat analysis, likelihood and impact scoring, and risk register output.
Enterprise Cyber Risk
Cybersecurity Risk Management for Business Leaders
An executive-focused guide to cybersecurity risk management — what board members and senior leaders need to understand about risk appetite, financial exposure, governance obligations, and asking the right questions.
Enterprise Cyber Risk
Cyber Risk Quantification vs Qualitative Risk Assessment
A clear comparison of cyber risk quantification and qualitative risk assessment — when to use each approach, how FAIR works, and how to build a hybrid program that serves both operational and executive needs.
Enterprise Cyber Risk
Cyber Risk Register: What It Should Include
A complete guide to what a cyber risk register should include — fields, ownership, treatment status, residual risk, and review cadence — with a practical template you can adapt.
Enterprise Cyber Risk
Building an Enterprise Cyber Risk Management Framework
A practical guide to designing an enterprise cyber risk management framework, covering governance structure, risk assessment cycles, controls mapping, and executive reporting.
GRC
Cybersecurity GRC Framework Comparison
A detailed comparison of the major cybersecurity GRC frameworks — NIST CSF 2.0, ISO 27001, COBIT, CIS Controls, and ISO 31000 — covering scope, audience, certifiability, and when to use each.
GRC
Governance vs Risk vs Compliance Explained
A clear explanation of the differences between governance, risk, and compliance in cybersecurity — what each discipline does, where they overlap, and why treating them as one thing causes GRC programs to underperform.