Writing

OWASP LLM Top 10 2025, for buyers

All ten 2025 categories in plain language, the question to ask a vendor about each, and the edition trap that makes half the reports you will be shown hard to compare.

OWASP Top 10 2025

The category numbers changed, two categories are new, and most published guidance still cites the old list. What that means for a test scope and a control mapping.

CVSS, EPSS and KEV

Severity, likelihood and known exploitation answer different questions. How to use all three, and your own asset list, to decide what gets fixed first.

NIST AI RMF and the GenAI Profile

A voluntary framework nobody issues a certificate against, its four functions described as work, and why the version number belongs in every sentence that names it.

NIST CSF 2.0 in plain terms

The six CSF 2.0 functions in a sentence or two each, what changed from 1.1, and profiles and tiers without the jargon.

Cyber risk appetite statement

What a cyber risk appetite statement is, why cyber needs its own, and three worked tolerance statements that connect to the risk register and KRIs.

ATT&CK coverage mapping

Why a fully green ATT&CK heat map misleads, and how to map and report coverage against the techniques your likely adversaries actually use.

PCI DSS 4.0.1 for small merchants

PCI DSS 4.0.1 added no requirements, but 4.0’s future-dated ones are now in force. Which SAQ fits, what the script rules mean, and what to do first.

CPCSC for defence suppliers

What CPCSC requires of Canadian defence suppliers, when each level reaches contracts, how it lines up with CMMC, and what to do first.

OSFI B-13 for suppliers

B-13 binds federally regulated financial institutions, not their suppliers. It reaches you anyway, through B-10 contract terms and due diligence.

ISO 42001 vs NIST AI RMF

One path ends in a certificate with an issuer, the other in your own documented practice. Which your customer is asking for, and where the preparation work overlaps.

SOC 2 vs ISO 27001

Two different artifacts, from two different kinds of issuer. What a customer actually accepts, and how much of the preparation work is shared.

SOC 2 Type 1 vs Type 2

A Type 1 shows controls were designed; a Type 2 shows they ran. Why buyers want the second, and when the first is still worth having.

Red teaming vs safety evaluation

One asks whether an attacker can make your system do something harmful to you; the other asks whether the model behaves acceptably. Telling them apart in a proposal.

Pentest vs vulnerability scan

Three activities sold under overlapping names. What each finds, what each misses, and how to tell which one a contract or an insurer means.

vCISO vs CISO vs MSSP

Two of these are leadership and one is operations. What each covers, what falls between them, and the signals that you have outgrown your current arrangement.

BIA vs risk assessment

A BIA measures consequence over time; a risk assessment weighs likelihood. What each one produces, and why the BIA usually comes first.

Choosing a GRC platform

Enterprise GRC suites, compliance-automation tools and a well-built spreadsheet, compared on fit and effort rather than feature lists.

Splunk vs Sentinel vs Elastic vs Graylog

Four SIEM options compared by fit, licensing shape and the work it takes to keep each one useful. Written by a practice that sells none of them.

Scoping a penetration test

The scope document decides the value of the result before anyone tests anything. What to provide, which decisions matter, and how to make two quotes comparable.

What an AI security assessment covers

What is in scope, how the method works, what the written deliverable has to contain, and the four questions that separate a real review from an automated scan.

Penetration test cost drivers

Price follows effort, and scope sets the effort. The drivers that move a quote, why two quotes rarely describe the same work, and how to lower the cost without lowering the value.

Answering the AI security questionnaire

The questions that actually get asked, the artifact behind each answer, how to say no without losing the deal, and the answer patterns that cost them.

Vendor questionnaires that work

Tier first, then ask. Sixteen questions that carry the signal, how to ask for evidence, and when a SOC 2 or ISO 27001 report is enough.

Cyber insurance application questions

The seven controls cyber insurance applications ask about, what each question really means, and how to answer it honestly with evidence you can produce.

Cyber KRIs for the board

A metric counts activity; a KRI shows a risk moving against appetite. Eight indicators with thresholds, what to drop from the pack, and how to show trend.

SOC 2 phases and timeline

SOC 2 runs in phases, and most of the calendar is yours, not the CPA firm’s. What happens in each phase and what actually decides the timeline.

Cyber due diligence in M&A

What to check before signing, what can wait until after close, and how findings reach the deal through counsel.

What insurers check at claim time

At claim time the insurer compares your application with what the investigation finds, and checks you followed the policy’s own rules. How to be ready for both.

Finding shadow AI

Where unsanctioned AI use actually shows up, how to triage what you find, and why a sanctioned alternative works better than a ban.

Clinics handling health data

A short list of controls carries most of the risk in a small health organization. Which instrument reaches you, and what follows from it.

HIPAA for Canadian SaaS

Handle health data for a US customer and you are likely a business associate. What the BAA, the Security Rule and breach notice mean for you.

SaaS selling to enterprise

An enterprise security review is a documentation problem sitting on top of a real engineering problem. What to build, what to write down, and in which order.

Credit unions and insurers

Which regulator reaches you, what OSFI B-13 and B-10 expect, and what examiners and boards look for in a credit union or insurer.

Colleges and universities

Open networks, federated identity, research data and devolved IT. What actually reduces risk on a BC campus, and where FIPPA fits.

AIDA did not pass

The Artificial Intelligence and Data Act was part of a bill that was never enacted. What the parliamentary record actually shows, and what does bind a Canadian deployment.

BC public sector vendors

Most obligations sit on the public body and reach you through the contract, but section 25.1 reaches your staff directly. What the schedule asks for, and what to have ready before the bid.

Quebec Law 25 outside Quebec

Law 25 most often reaches an out-of-province company through a Quebec customer’s contract. What the Act requires, and what to do first.

Which Canadian privacy law applies

Four instruments, four different triggers. Most of the confusion comes from assuming there is one national rule.

EU AI Act for Canadian suppliers

Why an instrument written in Brussels can reach a company in British Columbia, what its security provisions actually say, and the preparation that does not depend on a date.

Canadian data residency

Residency is usually a contract term, not a statute. What PIPEDA, BC and Quebec require for transfers, and where a residency rule still applies.

When a BC public body needs a PIA

Section 69 of FIPPA in plain terms: what triggers a PIA, what changed in 2021, and who approves the assessment.

FIPPA information-sharing agreements

What an ISA is, when one is needed, the eight things it should contain, and the mistakes we see most often.

Security policy and unions

Monitoring, acceptable use, device rules and discipline, written so they hold up under a collective agreement and a grievance.

Meaningful consent

Consent is valid only if the people you address could reasonably be expected to understand what they agreed to. What the regulators expect, when implied consent is enough, and how BC deemed consent really works.

First 24 hours of an incident

The first decisions are about preserving your options rather than about fixing anything. What to do, and what not to do.

Preserving evidence after a breach

The first evidence decisions after a breach, in order: what not to do, what to capture first, and where counsel comes in.

Prompt injection incidents

The injection usually does not come from the user, and it looks like normal operation in your logs. What to capture before it happens, and how the reconstruction actually runs.

Police after a cyber incident

Who to report to, when, what police will and will not do, and why counsel should decide what evidence is handed over.

How to run a tabletop exercise

One objective, a plausible scenario, the people who really decide, five or six injects, and a report with owners and dates.

Should you pay a ransom?

Paying is not banned outright, and it is never simple. The factors that decide it, the Canadian lists that can make it an offence, and who makes the call.

BEC: the first hour

A payment went to the wrong account, or a mailbox is sending mail nobody wrote. The first hour, in order: the bank, the lock-out, the clean-up, the report.

Deepfake CEO fraud controls

Nobody can reliably hear or see a good fake, so the controls that work are process controls: verify on a second channel before money moves.

SPF, DKIM and DMARC

Three mechanisms, one policy, and a staged path that does not break your mail. Including the subdomain gap that leaves most estates half-done.

Securing AI-generated code

AI-generated code is as secure as the controls it passes through. Five checks to put in the path before it merges.

Gateway and guardrail patterns

Where the broker sits, what guardrails do and do not catch, why credentials must never reach a prompt, and the decisions that are expensive to change once features depend on them.

Database security checklist

The eight controls that decide whether a SQL Server or PostgreSQL database is hard to misuse, and the engine setting behind the main ones.

Secure SDLC with OWASP SAMM

SAMM is a map, not a checklist to complete. Take an honest baseline, pick two or three practices that match your real risk, and re-measure.

RAG tenant isolation

The index was built by an account that can read everything, and retrieval inherits that rather than the user’s permissions. Three designs, where each fails open, and how to test it.

Fine-tuning and training data security

Four ways fine-tuning goes wrong, and what to have in place before the first training run.

Zero trust without a product

Identity and MFA, device health, least privilege, segmentation and continuous verification, in that order, using what you already own.

Terraform security checklist

Seven checks that cover most Terraform security problems, from where state lives to how drift gets noticed, with a short note on each.

Securing a Mac fleet

Ten macOS settings worth enforcing through your MDM before anything else, each with a one-line reason.

AWS security baseline

Twenty settings that decide whether an AWS account can be taken over, and whether you would know. What to switch on first and why.

What a threat model looks like

Not a diagram somebody drew once. What the finished document contains, how the threats get enumerated, and how mitigations reach the backlog.

Incident response plan contents

The eight sections a usable incident response plan needs, the one most plans skip, and why a short rehearsed plan beats a long unread one.

What a pentest report contains

A report has two audiences and most reports serve neither. The sections that have to be there, and the four tells of an exported findings list.

Cyber risk register contents

The eight or nine columns a working cyber risk register needs, a worked example row, the failures that make registers useless, and a review cycle.

Records retention schedules

What a retention schedule contains, how it relates to a file plan, why keeping everything is a security risk, and what makes disposition defensible.

Reporting a breach in BC

BC PIPA carries no mandatory breach notification. PIPEDA does. FIPPA binds public bodies. Which one applies to you decides everything.

MFA and insurance

Insurance and vendor questionnaires turn on a handful of binary controls, and multi-factor authentication is the one that decides renewals.