Read an issue before you subscribe.

Acting-CISO week: a survey commissioned by Sophos (a security vendor) reports MSPs estimate 46% of customers rely on them as CISO, only a third say they are completely confident in continuous compliance documentation, and the six-step weekly cadence (our proposal).

Nobody-asked-it week: Veracode’s 2026 numbers with their conditions, the showcase scan and the Moltbook disclosure, OWASP A01, and the one-afternoon pre-launch review for an AI-built app.

Due-date week: CISA’s exploited-vulnerabilities catalog publishes no severity score — it publishes a deadline, binding on federal civilian agencies only. Twenty CVEs got three days, eight got fourteen, all ten security and remote-management products landed in the short pile — and the week’s Pulse.

Exposed-edge week: why CISA stopped sorting federal patching by severity, the four discovery routes, the four-field tag that is free to copy, and the quarterly delta that turns a list into a control.

Alert coverage week: the five events that must never happen quietly, the three-question test per event, the generate-and-watch drill that shows whether anything actually fires, and the week’s Pulse.

Offboarding week: the identity hunt for your last five leavers — SSO, local, vendor and service accounts, verified rather than assumed — the revocation log that turns “it was done” into evidence, and the week’s Pulse.

Login-surface week: the 12-category door inventory, the per-door MFA matrix, the legacy-path kill list, the help-desk script — and the week’s Pulse.

Management-plane week: the five RMM architecture questions, the patch verification log that turns “we’re patched” into evidence, the four session tells, and the week’s Pulse.

Restore-test week: the 45-minute drill that turns “backups are fine” into four signed numbers, the no-fear board script, and the week’s Pulse.

Incident readiness week: the 60-minute ransomware tabletop — three injects, the PTO test, and the after-action page that answers “has your plan been tested?” — plus the week’s Pulse.

Vendor risk week: the three questions that surface real third-party exposure, the contract-clause checklist, and the tabletop breach drill — plus the week’s Pulse.

Compliance-as-a-Service week: the 12-question scoping worksheet, the three-tier service menu, and the margin math for productizing the work — plus the week’s Pulse.

Shadow AI: the three questions that surface every unapproved tool in your org — plus a 1-page acceptable-use policy to hand them, and the week’s Pulse.

Break-in to encryption with no human at the keyboard — what it changes for your controls, plus a free evidence tracker.

The launch issue: three sections, twelve minutes — The Pulse, The Hardened Stack, and The Boardroom Bridge.