Insights

Notes for CISOs and risk leaders

Regulator-facing and operating-model pieces for CISOs and risk leaders. More articles publish as they ship.

What RBI actually expects from your VAPT programme — and where banks fall short

A practical reading of RBI’s Cyber Security Framework, Master Directions, and where bank VAPT programmes still fall short of continuous assurance.

Continuous exposure validation vs. annual penetration testing: what changes for a CISOUpcoming

How the operating model shifts when findings must be validated, tracked to closure, and prevented from recurring — not just delivered as a PDF once a year.

From finding to fix: why the Mobilise stage of CTEM is the one that mattersUpcoming

Discovery and validation are table stakes. The hard part is turning a validated exposure into a closed incident with evidence an auditor will accept.