Standard
EU directive (2022/2555) setting cybersecurity risk-management and incident-reporting rules for critical infrastructure and other essential/important entities.
Modat and the Dutch cyber agency NCSC-NL found 8,547 internet-facing wind and solar control systems in 35 countries that were never meant to be online. One turbine page offers Start, Stop and Reset to anyone with a browser.
Reality
EU Cyber Resilience Act rules have required connected-product makers to report exploited flaws through ENISA within 24 hours since 11 September 2026. One incident can also start DORA, NIS2 and GDPR clocks, so runbooks need a triage step that splits into parallel filings.
Reality
Fleuret AI raised EUR 4 million in a pre-seed round led by RAISE Ventures to automate penetration testing with AI agents. The money backs a bet that NIS2's demand for demonstrable security will move buyers from periodic audits to tests that rerun whenever their systems change.
Reality
Keyorix SL released an open-source secrets manager that runs as one binary on a company's own servers with no internet connection. Air-gapped and NIS2- or DORA-bound teams get a self-hosted option, described so far mainly by its maker.
Reality
Two exploited Citrix NetScaler zero-days and a CVSS 9.8 Cisco SD-WAN Manager flaw top a weekly DACH OT risk bulletin. For many operators, both products enforce segmentation into OT, so an attacker who takes one over is standing in front of the control systems.
Reality
Attackers using two NetScaler zero-days since early September left webshells that patching to 14.1-73.37 or 13.1-64.23 does not remove. Operators have to search every appliance for those traces, patched or not, and move OT remote access onto a jump host of its own.
Reality
From 11 September 2026, an actively exploited vulnerability starts a 24-hour early warning, a 72-hour notification and a 14-day final report, all timed from awareness. The artifact that decides whether you make it is your SBOM archive.
Reality
Altman and OpenAI's energy policy lead have taken the Daybreak programme to America's biggest electric utilities. The obstacle in that room is a cost recovery rule, and model capability is irrelevant to it.
Reality
Nozomi Networks is selling industrial operators the argument that their remediation backlog is a bookkeeping problem. Compass is the product it wants holding the asset record, the approvals and the audit evidence.
Reality
A Pulumi panel recorded on 3 September collects ten questions about US legal reach, EU regions and self-held keys, and the two answers it publishes are about migration economics and the price of staying portable.
Reality
ENISA says in a July 2026 assessment that the research-and-develop delay defenders implicitly count on is disappearing as automated systems take over the attacker's work, with the remaining window measured in minutes.
Reality
The Cyber Resilience Act does not fully apply until December 11, 2027, yet its Article 14 early warning binds 15 months earlier, starting from the moment a manufacturer is reasonably certain a product is being exploited.
Reality