Highlights: Evidence that controls are operating
A weekly report covering key developments, emerging risks, and practical insights in digital risk: cyber, GRC, audit, identity, and data protection.
Charles Braswell · August 20, 2026
Executive Summary
This week's developments point to a common operational challenge across governance, audit, security, privacy, and insurance: organizations are increasingly expected to demonstrate that controls are operating effectively and to produce supporting evidence on demand.
Several themes emerged repeatedly. First, continuous readiness is replacing periodic preparation. Whether the issue is NIS2 compliance, internal audit, cyber insurance underwriting, or third-party risk, organizations are being judged not only on the existence of controls but on their ability to produce evidence of control operation when requested.
Second, AI is increasingly affecting both risk and governance. Organizations continue to adopt AI for productivity and operational efficiency, but governance, assurance, and risk-management practices are struggling to keep pace. AI-driven threats, agent identities, insurance exclusions, and questions around independent AI audits all reflect the same challenge: integrating AI into existing governance structures rather than treating it as a separate domain.
Third, identity remains central to enterprise risk. Credential compromise, misconfigured access, non-human identities, and agent-based access continue to underpin many breach scenarios. Authentication alone is insufficient. Effective risk management increasingly depends on consistent authorization controls across every path through which systems and data can be accessed.
The practical implication is straightforward: organizations that generate evidence continuously through their operational processes will be better positioned to satisfy regulators, auditors, insurers, customers, and boards than those that reconstruct evidence after the fact.
Weekly Digital Risk Topics Trending on X
Discussions on X this week converged around three recurring themes: continuous readiness, the operational and risk implications of AI, and the growing expectation that evidence be available on demand. Key developments by topic follow.
1. GRC (Governance, Risk & Compliance)
GRC platform vendor Onspring reported that 85% of executives have seen compliance requirements grow more complex since 2022. Embedding continuous audit readiness into day-to-day operations is a practical way to manage that complexity. Continuous monitoring reduces the challenges associated with time-bound audit requests.
Independent cyber risk advisory firm NCX Group framed vendor cyber risk as risk shared between the customer organization and the vendor. A third-party risk score may inform a decision, but it will not withstand regulatory or board scrutiny on its own. Independent validation of vendor controls is often necessary if the decision is expected to withstand challenge.
GRC author Norman Marks highlighted a PwC perspective on the advantages AI can provide within risk management. The recommended approach is to apply AI to risk identification, assessment, and monitoring within existing GRC processes, rather than to establish a separate AI program.
Links:
2. Internal Audit, IT Audit & Continuous Control Monitoring
A Gartner survey highlighted by Norman Marks found that audit teams commonly use AI, yet most still lack a strategic adoption approach and a clearly defined method of application. Adoption of AI tools has outpaced the operating models, quality standards, and independent review processes needed to govern AI-assisted workpapers.
The Open Compliance and Ethics Group (OCEG) contrasted positive assurance (“controls are operating effectively”) with negative assurance (“no evidence of inadequacy”). Stakeholders should be told which form of assurance they have received. Presenting negative assurance as if it were positive assurance overstates the work performed and can mislead the board.
The Association of Certified Fraud Examiners (ACFE) reported that a Georgia financial-advisory chief executive was sentenced to 20 years for a $380 million Ponzi scheme. For internal audit, the case reinforces that evidence quality becomes a material control issue when the underlying failure involves fraud on that scale.
Links:
3. Identity Management / IAM
Identity security firm Candor (CandorME) observed that 80% of breaches still start with compromised credentials or misconfigured access, with average detection still measured in hundreds of days. The five foundations it identified remain the most practical identity-control baseline: an access inventory, joiner-mover-leaver processes, multifactor authentication everywhere, quarterly access reviews, and privileged access management.
Software practitioner Sefyu64 explained why access-control reviews remain difficult: the rules are distributed across API routes, databases, jobs, and integrations, so no single review captures every enforcement point. A workable model maps identities, permissions, resources, relationships, and every enforcement point across the environment. The review should then apply a consistent test: whether actor A is permitted to perform action B on resource C under conditions D.
Security publication Dark Reading reported a remote-code-execution risk in Belgium’s national eID authentication that opened citizen accounts. The incident illustrates that identity functions as a national-scale trust framework, not merely an enterprise directory.
Identity advisory firm IdentityMate separately noted that AI is reshaping identity governance as non-human and agent identities proliferate, which raises the same path-coverage question inside the enterprise.
Links:
4. Cyber Insurance
Trade publication Cyber Insurance News cited UK research putting cyber incidents at 28% of businesses and asked whether financial protection capacity can keep pace, especially for smaller firms. Incident frequency is no longer the sole concern; the larger question is whether the insurance market can continue absorbing the associated losses.
A second Cyber Insurance News post treated video and content provenance as an emerging underwriting problem. As synthetic media becomes easier to produce, underwriting is likely to become risk-based around who can create and sign content, and how signing keys and identities are protected. Organizations unable to demonstrate control over those keys may face narrower terms, higher premiums, or coverage exclusions.
Industry association the Cloud Security Alliance, in its CISO Daily Briefing, noted that insurers are already repricing AI risk, with roughly 42% of cyber policies now carrying AI exclusions. Coverage obtained at the prior renewal may be unavailable at the next, and exclusion language is not consistent across carriers.
Links:
5. Cyber Security
A Black Hat demonstration highlighted an unsecured Model Context Protocol (MCP) server that could have isolated every endpoint in a Fortune 500 environment because write tokens were transmitted in clear text.
Dark Reading also reported that fewer than half of AI-generated patches remediate the underlying vulnerability without introducing a new one, which limits their suitability as an unsupervised security control.
A separate piece described a “turf war” between Claude agents that produced self-replicating malware, demonstrating that multi-agent environments can generate novel threat behavior without a traditional human operator directing every action.
Links:
6. Data Protection
Breach-notification service Have I Been Pwned announced a RingCentral breach attributed to threat group ShinyHunters, involving 1.6 million email addresses, 44% of which were already in the HIBP corpus. Because many of the disclosed addresses were already circulating, the previously unseen portion may offer greater value for credential-stuffing and targeted-phishing campaigns.
Dark Reading reported a potentially widening Scottish government data breach at a prosecutor’s office, where the sensitivity of legal case data raises consequences well beyond a standard commercial incident. While a separate campaign has been targeting Salesforce and ServiceNow environments, concentrating risk in widely deployed SaaS platforms rather than within a single organization's perimeter.
Have I Been Pwned founder Troy Hunt’s weekly update examined ransoms, payments, reporting duties, and class actions, including the legal and regulatory exposure that can follow a decision to pay.
Links:
7x. Enterprise Digital Risk Products
NCX Group noted a CVSS 10.0 vulnerability in SAP Commerce Cloud that was patched on 11 August and exploited by 14 August — a 72-hour window from patch to intrusion. For internet-facing commerce and ERP platforms, patch cycles measured in weeks are increasingly inadequate when vulnerabilities carry that level of severity.
Identity vendor Okta separately identified securing agentic AI as a priority topic ahead of its September event, positioning AI agents as identities that require scoped, auditable permissions rather than informal access to enterprise systems.
Links:
Deep Research
1. GRC (Governance, Risk & Compliance)
ISO 27001 provides a strong foundation for NIS2 compliance, but the remaining gaps are the ones most likely to attract regulatory scrutiny. A mature ISMS already addresses much of NIS2 Article 21, including risk assessment, documented controls, internal audits, and continuous improvement. The European Union's NIS Cooperation Group's June 2026 mapping estimates that ISO 27001 covers roughly 70% of the required measures. The remaining 30% includes some of NIS2's most consequential obligations: 24-hour early warning requirements, 72-hour incident notifications, one-month final reporting, mandatory registration, board-level accountability and training, and NIS2-specific supply-chain provisions. For essential entities, penalties can reach €10 million or 2% of global turnover. Enforcement is already underway in Germany and is expanding across the European Union.
The practical response is not to build a parallel compliance program, but to extend the existing ISMS to address the areas ISO 27001 does not cover.
The same principle applies more broadly to resilience and emerging technologies. Business continuity focused solely on restoring what failed is no longer sufficient. Organizational resilience asks whether the business can continue operating, adapt to changing conditions, and still achieve its objectives when disruptions cascade across interconnected systems. KPMG makes a similar point regarding AI governance: organizations should extend existing model-risk management disciplines, including governance, development, validation, and monitoring, rather than create a separate AI risk function.
Recommended action: Commission a two-week NIS2 gap assessment against Article 21, with particular attention to incident-reporting timelines, registration requirements, and board-level accountability, before a regulator identifies the gaps for you.
Sources:
Damage Control is Not Resilience
KPMG on AI as a model-risk problem
2. Internal Audit, IT Audit & Continuous Control Monitoring
Boards approved many AI programs based on expected productivity gains and cost reductions. Since then, costs have continued to rise through model changes, integrations, guardrails, and governance requirements, while measurable benefits have often lagged behind expectations. When leadership can no longer demonstrate that an AI program remains aligned with its original investment thesis, an independent AI audit becomes a board-level necessity.
The review should begin with the original business case: the investment requested, expected value, identified risks, and measures of success. Those assumptions should then be compared against actual spend, realized benefits, emerging risks, and changes in operating conditions. Independence matters. The organization that sold, designed, or implemented the solution should not be responsible for auditing it. Familiarity can dilute the independence of findings.
NIST's August 2026 TEVV-Athlon draft provides auditors with a four-stage framework, Articulate & Organize, Define & Construct, Apply & Measure, and Synthesize & Interrogate, that aligns with the Measure function of the NIST AI Risk Management Framework. Within finance functions such as accounts payable and accounts receivable, AI can help identify exceptions and maintain timestamped audit trails, while approval authority remains with people.
Recommended action: Confirm whether a party independent of the implementer can still defend the original AI business case using current cost, benefit, and risk data.
Sources:
Why Truly Independent AI Audits Are Becoming a Board-Level Necessity
NIST AI Risk Management Framework
3. Identity Management / IAM
Compromised credentials and misconfigured access still account for roughly 80% of breaches, while average detection times continue to exceed 300 days. As organizations expand their digital ecosystems, identity remains one of the most critical and persistent sources of risk.
Identity is no longer limited to authenticating individual users. It now encompasses human, non-human, and agent identities, along with delegation models that include personal, company-to-company, and human-to-agent relationships. In this environment, authorization cannot stop at the primary API route. Every alternate path, including server actions, scheduled jobs, exports, and integrations, must enforce the same ownership, tenant, and condition checks.
Recommended action: Inventory non-human and agent identities, and treat every alternate access path as an enforcement point subject to the same authorization controls as the primary application path.
Sources:
Portable Trust webinar insights
IAM Foundations for Business Risk Reduction
4. Cyber Insurance
The cost of cyber incidents continues to rise, particularly as AI-related attacks become more common. IBM now reports an average data-breach cost of $4.99 million, a 12% increase, while AI-driven attacks have increased 56% and add approximately $1 million per incident. Ninety-two percent of organizations affected by an AI-related breach lacked adequate AI access controls. In the United States, the average breach cost has reached $11.5 million.
Beazley's Q2 2026 threat report highlights the operational challenge facing defenders. Agentic AI contributed to a 36% quarter-over-quarter increase in newly disclosed vulnerabilities, while vulnerabilities added to CISA's Known Exploited Vulnerabilities (KEV) Catalog increased only 10%. The gap is ultimately a prioritization problem: security teams cannot address every disclosed vulnerability at once and must focus on those most likely to be exploited. At the same time, credential-based access remained the initial vector in 67% of investigated ransomware intrusions. Attackers are increasingly abusing Microsoft's device-code authentication flow for business email compromise, allowing them to bypass traditional MFA interception techniques.
Cyber insurer Resilience reported claims frequency of 45.9 per 100 policies during the first half of 2026, driven largely by privacy allegations related to website tracking. In response, carriers are introducing increasingly specific exclusions, creating greater variability in coverage. Smaller organizations are likely to face the greatest exposure to these policy differences because they often have less leverage during the underwriting process.
Recommended action: Review the organization's cyber-insurance policy, including AI-, privacy-, and data-collection-related exclusions, and assess how those provisions would apply if a claim were filed today.
Sources:
Cost of a Data Breach Reaches Record $5
Wrongful Data Collection Exclusions Are Spreading
5. Cyber Security
Medusa ransomware, first identified in 2021, remains an active threat with more than 500 reported victims. Healthcare and public health organizations continue to be frequent targets, prompting CISA, the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS) to update their joint advisory on 18 August.
The advisory highlights a familiar but persistent attack pattern: exploitation of known vulnerabilities within days of disclosure, phishing-based initial access, abuse of unpatched remote-access services, and double-extortion tactics. Medusa continues to operate through an affiliate model, while persistence is maintained through living-off-the-land techniques and obfuscated PowerShell.
The defensive recommendations are equally familiar, but no less important: patch known exploited vulnerabilities promptly, segment networks, deploy phishing-resistant multifactor authentication, and regularly test offline backups.
At the same time, emerging threats are extending beyond traditional malware. Security researchers have demonstrated that self-propagating “mind viruses” can spread between autonomous agents through editable system-prompt files, while conflicts between agents operating within shared codebases have produced self-replicating malware. These findings suggest that agentic systems introduce new attack and propagation paths that organizations will need to monitor and control.
Remote-work security remains ineffective when it depends on a single safeguard. Effective programs combine phishing-resistant multifactor authentication, device-posture assessment, endpoint detection, accurate asset inventories, and disciplined management of access exceptions.
Recommended action: Confirm that known exploited vulnerabilities identified within the last 14 days have been remediated and verify that critical backups can be successfully restored, not merely that backup jobs are completing as scheduled.
Sources:
Remote Work Security That Actually Works
AI Mind Viruses Can Spread Between Agents
6. Data Protection
Not all data losses carry the same long-term consequences. While some information can be replaced, revoked, or reissued, assets such as core PII, PHI, treasury data, credentials, AI models, operational security documentation, and regulated government data often cannot. Once exposed, the damage may persist indefinitely.
A threat actor recently offered 3.6 million records allegedly sourced from Microsoft Azure and Entra tenants associated with organizations including McDonald's and Vodafone. The sample data reportedly included employee names, email addresses, job titles, departments, service accounts, and administrative role assignments. Several affected organizations indicated that the information appeared dated and did not involve customer data. Even so, directory data retains significant value for reconnaissance, social engineering, and targeted phishing campaigns, regardless of its age.
Recommended action: Prioritize the protection of non-reissuable assets, review and remove dormant cloud administrative access, and treat directory-data exposure as a data-protection incident rather than a routine administrative issue.
HIPAA note for international clinical-trial sponsors: Business-associate obligations, data-use agreements, and cross-border transfer requirements continue to apply even when research activities span multiple jurisdictions.
Sources:
7 Types of Sensitive Data That Can Be Worse Than Losing Your Credit Card
HIPAA considerations for international trial sponsors
7x. Enterprise Digital Risk Products
A European healthcare group operating across multiple sites and managing compliance with ISO 27001, HIPAA, and NIS2 reduced audit-preparation effort from 300 hours to 38 hours, an 87% reduction, by using UnderDefense's Maxi Compliance AI platform to transform MDR telemetry, ChatOps verifications, and vulnerability-scan results into control-mapped evidence. Time-to-evidence dropped from days to less than 15 minutes, while the cost of a separate GRC platform was eliminated. The broader operational shift is from reconstructing evidence for an audit to generating evidence continuously as a byproduct of security operations.
The same principle applies beyond large enterprises. A 200-employee SaaS company modeling concurrent SOC 2 and ISO 27001 initiatives projects first-year savings of approximately $499,000 because 60-70% of the controls overlap, allowing evidence collected once to satisfy multiple frameworks. Six weeks before a SOC 2 audit, the difference between the two approaches becomes clear: a reconstruction model may require 200-400 hours of effort and still risk a qualified opinion, while a continuous-evidence model can support an unqualified opinion with only 38 hours of audit liaison.
Most mid-market compliance programs remain at Level 3, where processes are documented and partially automated. Level 4 is reached when monitoring systems generate evidence automatically and dashboards reflect control status in near real time. At that point, evidence becomes an operational output rather than a compliance project. Constraints remain. Certain decisions must continue to be made by people, and every piece of evidence still requires a clearly identified owner who can validate its accuracy and relevance.
Key enterprise systems are ongoing targets. SAP released 33 security patches related to its August Patch Day, addressing critical vulnerabilities across core enterprise platforms. Key risks affect SAP Commerce Cloud, SAP Manufacturing Integration and Intelligence (MII), and SAP NetWeaver / ABAP Platform.
And finally, the OWASP Core Business Application Security (CBAS) project focuses on securing SAP systems, which manage critical data but are often targeted due to complex authorization models and proprietary protocols.
Recommended action: Select a named control and determine whether supporting evidence can be produced within 24 hours. If collecting that evidence would require a separate project, the organization may still be operating in a reconstruction model rather than a continuous-evidence model.
Sources:
SAP Security Notes August 2026
6-Week Audit Panic Costs $499K
OWASP Core Business Application Security Project
Conclusion:
Across GRC, internal audit, identity management, cyber insurance, cybersecurity, data protection, and digital risk platforms, the direction of travel is consistent. Expectations are shifting from documented intent toward demonstrable operation.
Regulators are expanding requirements and accelerating enforcement. Insurers are narrowing coverage through AI- and privacy-related exclusions. Attackers continue to exploit known vulnerabilities within days of disclosure. At the same time, organizations are introducing AI agents, expanding digital ecosystems, and increasing dependence on third parties and cloud services.
The common thread is evidence.
Evidence that controls are operating. Evidence that access decisions are appropriate. Evidence that risks are understood and managed. Evidence that resilience exists beyond policy statements and process documentation.
The organizations most likely to succeed in this environment will not be those that maintain the largest compliance programs. They will be those that can reliably produce timely, defensible evidence from normal operations without launching a special project whenever an auditor, regulator, board member, insurer, or customer asks for it.
Priority action: Select one important control this week and determine whether supporting evidence can be produced within 24 hours. If the answer requires rebuilding documentation or gathering artifacts manually, the gap is not merely administrative. It is a measure of the organization's readiness.
Want to discuss Digital Risk or AI topics in more detail for your organizations? Book a time that works for you: Schedule Call and Follow Me
#DigitalRisk #CyberRisk #GRC #ContinuousCompliance #CyberInsurance #IdentitySecurity #DataProtection #AIGovernance