Cyber Essentials — Issue #45 (07 Sep 2026)

AI agents, bug bounties and Langflow RCE put cyber risk back in the boardroom: push for AI-ready governance, budget control and Langflow exposure cleanup now

The SaaS Vendor AI Due Diligence Checklist: 13 Questions To Ask Before You Sign

A practical AI due diligence checklist for SaaS buyers. Thirteen questions you can realistically get answered, with the reasoning behind each one.

CISO Essentials Aug 30 2026 Chinese Chips, NIS2, & AI in war

This week’s AI security and compliance brief for boards and security leaders: cheap Chinese chips, slow regulation, shifting cyber cover and rising infra risk.

AI Governance: Demystifying the Essentials for Tech Leaders

A plain-English guide to what AI governance means, why it matters now, the core principles, and how organisations can put it into practice.

What Is the NIS2 Directive? Scope, Requirements and Deadlines Explained

The NIS2 Directive raises the EU's cybersecurity baseline across 18 sectors, makes senior management personally accountable, and puts hard clocks on incident reporting. Here is what it requires, who it applies to, and how to prepare.

Shadow AI: The New Blind Spot for CISOs

Shadow AI is quietly eroding AI security, compliance, and data governance. This article breaks down what it really is, why it’s worse than shadow IT, and how CISOs can take back control.

Ox Alpha Benchmarks on OpenRouter: Provider Setup to Pac-Man Clone in 30 Minutes

Ox Alpha appeared on OpenRouter on August 20, 2026. No flashy launch. No big tech logo. Just a ‘reasoning model for coding, long-horizon agentic work, and production workloads.

CISO Essentials Aug 24 2026 Stealth LLM, AI Act & Shadow AI

This issue connects a stealth new LLM, messy enterprise AI usage, looming EU transparency rules and fragile agent sandboxes into one pragmatic CISO threat picture.

AI audit readiness: a practical checklist for CISOs

AI is already in your estate. The only question is whether you discover it in an AI audit or an incident report.

Self Hosted AI vs ChatGPT: Why Governance Teams Choose Local LLMs

This article breaks down five reasons governance teams are pivoting to self hosted models over ChatGPT style APIs, and two alternatives most overlook: SaaS with BYOK AI backends, and regional providers that satisfy residency requirements.

AI Sovereignty Starts at the Inference Layer not the Border

Swiss banks understood the risks of foreign infrastructure. AI now shows why data sovereignty must cover inference, not just storage.

ISO 42001 vs EU AI Act for CISOs

A practical guide to where ISO 42001 helps, where the EU AI Act bites, and how to use both without building two separate programs.

LiteLLM Supply Chain Attack Tests Detection Time

Malicious LiteLLM releases reached PyPI for about 40 minutes. Here is what the incident reveals about dependency security and detection time.

CISO Essentials Aug 17 2026 xAI Bot, Watermarks & GLM 5.3

OpenAI's gated cyber model, GLM-5.3's CyberGym lead, real agent breakouts, EU watermarking rules, and Grok Bot's "coworker" beta—plus what to watch next.

Z.AI's GLM-5.3 Model and the Automated Vulnerability Pipeline

GLM-5.3’s CyberGym result points to faster vulnerability discovery, but we still need human oversight

The Irony of Banking: Finding Flaws in a Legacy Java Framework with a Bank‑Built AI Harness

Two new Apache Struts CVEs show how a bank‑built AI harness for Claude Opus 4.8 can find real, unauthenticated DoS flaws in the legacy Java frameworks powering global banking.

Cursor Coding agent Deletes a Production Database

A Cursor coding agent wiped a production database and its backups through a valid API call. Traditional DLP could not catch it.

The CRA’s 24-hour reporting deadline is here

The EU Cyber Resilience Act mandates 24-hour reporting for actively exploited vulnerabilities from September 2026

OpenAI's Daybreak Solved Vulnerability Discovery. Who Will Validate the Results?

From OpenAI's Daybreak to Anthropic's Glasswing: AI Has Accelerated the Wrong Half of Security

The Claude Code Source Leak

How a 60MB .map File Exposed Half a Million Lines of TypeScript — and What Happened Next

Your SME doesn’t build AI, but it desperately needs an AI security strategy

In the rush to "go AI," most small and medium-sized enterprises (SMEs) share a common misconception: “We aren’t tech developers, so we don’t need an AI strategy".

The Swiss Guide to the EU AI Act

Staying Compliant from Outside the Union

You Just Hired an AI Agent but Nobody Told HR

AI agents can read your email, browse the web and execute code. Most small teams have no rules around any of it

Europe Wants Sovereign Cloud

But Sovereignty Is Still Mostly in American Hands