English
The Usual Suspects
For twenty years, software dependency security rested on a tolerable fiction: public databases were imperfect, but nobody could afford verification at scale. Two publications from April 2026 describe what happens when that cost disappears.
English
The Leopard
The Cyber Resilience Act demands a 24-hour report for an actively exploited vulnerability but sets no remediation deadline, while exploitation now measures in hours. Four flaws run through the text. Compliance changes shape; Europe's condition of dependency stays the same.
English
Status: clean
In one month, an AI found over ten thousand critical flaws. 75 were fixed. Everyone draws the same lesson: patch faster. It is the wrong one. The rate does not move, the volume doubles, and the measuring instrument goes blind at the same time.
English
The Thing That Should Not Be
ATLAS copies ATT&CK for AI. Four attacks in two months, same identifiers, no shared mechanism. The framework names techniques without arming defenders. The industry adopts it because it looks like ATT&CK. The resemblance is the trap.
English
Pitch Black
Eight degradation vectors are striking NIST. Europe built its compliance on NIST standards, from the NVD to the CISSP. It is building alternatives on one level only. It has no system.
English
The Prestige
D3FEND was supposed to be ATT&CK's defensive mirror. I examined all 267 techniques — their provenance, their distribution, their operational content. What I found does not match the stated ambition. Fourteenth in the series.
English
Now You See Me
Enterprise SIEMs cover 21% of MITRE ATT&CK techniques. Five years, no progression. 90% false positives, 62% of alerts ignored, 74% of breaches had generated alerts that were ignored. The closer you look, the less you see.
English
Ghost in the Binary
The CRA assesses source code conformity. The compiler modifies the binary. The regulator doesn't see the difference. When European regulation declares a product compliant that it has no means to verify.
English
The Sting
The February 5 circular makes sovereignty the top criterion for government digital procurement. It refers to a decree missing for eighteen months. Five security layers depend on infrastructure Europe doesn't control. No enforceable text covers them.
English
Soylent Green
Magic Quadrant "Leaders" are not ordinary companies. 80% of Israeli cyber founders come from military intelligence. A security strategy should start from the business. The radar proposes the opposite: a universal model.
English
They Live...
The 2026 CISO radar lists 150 topics. Ten items represent $5 to $15 million over three years. The math doesn't work, anywhere. Everyone follows the same path, same building blocks, same order. For an attacker, one map to learn.
English
The Digital Hawks
A vulnerability is a flaw to be fixed. That's what we're taught.
An Atlantic Council report says the opposite: it's a strategic asset to be exploited. And its authors know what they're talking about — their funders manufacture the weapons that depend on it.
English
Lord of Cyber War
The last American letter of marque dates back to 1812. Two centuries later, Congress considers reviving the instrument. To fight cybercrime, they say. The explanation does not hold. Something else is being prepared.
English
The Last Channel
"The intelligence was genuine. That was the beauty of it." On January 7, the US withdrew from three cyber cooperation forums. On January 9, CISA closed ten Emergency Directives. Less like maturation than a constrained trade-off.
English
I Am Altering the Deal
On January 7, 2026, the United States withdrew from the Hybrid CoE, the Freedom Online Coalition and the GFCE. Three Western cyber forums abandoned. European dependencies remain intact.
English
Final report, 2026. Third officer reporting.
600 million records exposed. 50 major organizations compromised. EDR in place, SOC operational, compliance achieved. They were still breached. 2025 in review.
