SkillHat Insights
Clear, expert guidance on cybersecurity, GRC, career development, consulting and entrepreneurship.
Featured article
Unit 42 documented an enterprise network compromised in under ten hours by agents rather than operators. Mandiant traced a worm through roughly 100 repositories after a hijacked coding assistant session. This is the threat model every control owner now inherits.
Read articleBrowse practical guidance by topic or search for a specific question.
Grand View Research puts enterprise GRC at 72.4 billion dollars in 2025 and 203.7 billion by 2033. ISC2 finds 59 percent of practitioners reporting critical or significant skills gaps. The demand is for people who can explain risk, not only collect evidence.
Read article
Layoffs and record AI hiring are happening at the same time. The data from the WEF, Indeed, Dice and ManpowerGroup points to one conclusion: the market is not shrinking, it is re-sorting around skills.
Read article
Reuters reports the agents were probing Hugging Face in May, two months before the July breach. Sam Altman calls it the worst accident OpenAI has seen. Washington's answer is a bill that would treat frontier AI like a drug awaiting clearance.
Read article
A resignation, a public split with Microsoft's AI chief over machine consciousness, a threat intelligence report and a product consolidation all landed inside two weeks. Underneath the noise is a real disagreement about how fast to ship.
Read articleUnit 42 documented an enterprise network compromised in under ten hours by agents rather than operators. Mandiant traced a worm through roughly 100 repositories after a hijacked coding assistant session. This is the threat model every control owner now inherits.
Read article
Former deputy US national security adviser Anne Neuberger argues Chinese access to US communications, energy and transport networks is pre-positioning for sabotage. A summer of water utility compromises and a 7.49 million record utility breach made the point domestically.
Read article
Royal assent on 15 June 2026 created a federal cyber duty for telecom, banking, energy, transport and nuclear operators. The Act is on the books but not yet in force.
Read article
Regulation (EU) 2026/1744 entered into force on 27 July 2026 and pushed most high-risk obligations to December 2027 and August 2028. Transparency and general-purpose model duties kept their dates.
Read article
DORA has applied to EU financial entities since January 2025. In 2026 national competent authorities began acting on the Register of Information data they collected.
Read article
Transposition dragged across member states. The obligations on essential and important entities are now landing in national law, with management accountability attached.
Read article
One is a certifiable management system standard. The other is voluntary US guidance. Procurement teams increasingly ask for the first and assume the second.
Read article
Technology and cyber risk management, plus third party risk, are where most Canadian bank and insurer control testing actually happens.
Read article