Resources
What we're working out in the open.
Featured · Regulation
Compliance is the floor. Here’s how to set the ceiling.
NIS2 tells you the minimum. It cannot tell you what your business is willing to lose, and that is the number your security programme should be sized against.
No articles published yet.
Nothing published under this topic yet.
Compliance is the floor. Here’s how to set the ceiling.
NIS2 tells you the minimum. It cannot tell you what your business is willing to lose, and that is the number your security programme should be sized against.
Cyber threats do not skip small and medium enterprises
One in four Dutch SMEs has already been hit. The reasons they are targeted are the same reasons the defenses are thin.
Supply chain attacks: when someone else’s weakness becomes yours
Attackers do not need a way into your estate if they already have a way into your supplier's. The trust in between is the target.
Six cybersecurity themes every Dutch business should act on
From a hundred sessions at Cybersec Netherlands, six themes kept coming back. Here is what each one means for your next two quarters.
Your personal data gets leaked. Here is what to do.
Data from 700,000 women in Dutch population screening was exposed. Organizations have playbooks for this. Individuals rarely do.
Cybersecurity debt: the hidden risk that gets more expensive over time
Unresolved exposures do not sit still. They accumulate, and the longer the backlog is carried the more the eventual incident costs.
Why applying a framework well beats chasing the next one
ISO 27001, NIST CSF and ISO 31000 overlap more than they differ. The gap is never the framework. It is the application.
The exposure bandwidth model
A short paper on setting security requirements between the compliance floor and your risk appetite.
On its way.
The paper is in your inbox within a few minutes. Check spam if it is not.
From reading to measuring
Reading about exposure is not measuring it.
Everything here argues the same thing: the floor is not the target. Two weeks tells you where your estate actually sits between them.
Prefer to talk first? 20 minutes with a founder →
Two weeks · one business service · EU-hosted, deleted after 30 days
Example extract · the bandwidth paper
Static example. The paper ships with the assessment too.