Insights

Notes for CISOs and risk leaders

Regulator-facing and operating-model pieces. The first three titles are scheduled; pages publish when the full article ships.

What RBI actually expects from your VAPT programme — and where banks fall shortUpcoming

A practical reading of the RBI Cyber Security Framework for Indian banks: periodic VAPT, continuous monitoring, and incident timelines — without pretending a report equals ongoing assurance.

Continuous exposure validation vs. annual penetration testing: what changes for a CISOUpcoming

How the operating model shifts when findings must be validated, tracked to closure, and prevented from recurring — not just delivered as a PDF once a year.

From finding to fix: why the Mobilise stage of CTEM is the one that mattersUpcoming

Discovery and validation are table stakes. The hard part is turning a validated exposure into a closed incident with evidence an auditor will accept.