Assessing infrastructure readiness for cyberattacks: beyond compliance
Building real enterprise cyber resilience in the NIS2 era, avoiding paper audit traps, and protecting infrastructure through Security by Design.
Yuriy Syvytsky 7 min read
CONTROLLED FINANCE
Information Security
Practical guidance on management accounting, budgeting, treasury, period close, financial controls and evidence-based AI.
Choose a topic
61 publications
Yuriy Syvytsky 7 min read
Secure IIoT integration: bridging IT and OT
Industrial IoT provides production data for analytics and predictive maintenance, but it also exposes OT systems to new risks. A practical approach involves standardizing data exchange via OPC UA, building cybersecurity based on ISA/IEC 62443, and never treating any protocol as a substitute for netw
Mykhailo Vyhovsky 8 min read
AI-Native System Architecture: Ensuring 'Keepalive' Quality and AI Risk Management
AI-native system architecture demands an integrated approach to quality and AI risk management. We examine frameworks, security platforms, and organizational factors.
Serhiy Balashuk 7 min read
Geopatriation and Sovereign Cloud: When to Move Workloads Closer to Jurisdiction
Geopatriation and sovereign cloud are emerging as responses to regulatory requirements and cyber risks. This article explains when relocating workloads is justified.
Anton Marrero 7 min read
Confidential Computing in the Cloud: Where TEE Justifies Complexity
Confidential computing, leveraging TEEs, justifies its complexity for banks by protecting data in the cloud during processing from cyber threats and regulatory risks.
Anton Marrero 7 min read
Zero Trust for Hybrid Infrastructure: Where the Network Perimeter No Longer Works
The transition to hybrid infrastructures has rendered the traditional network perimeter obsolete. Oleh Kravchenko explains why the Zero Trust model is critically important for protecting resources in modern environments where trust in any user or device is absent by default.
Serhiy Balashuk 6 min read
From compliance to proactive cybersecurity for the public sector
CERT-UA warns of the activation of UAC-0057 with new tools OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES, requiring public organizations to strengthen their cyber defenses.
Yuriy Syvytsky 5 min read
Enterprise developer: from code to AI system management
AI-native development is transforming the role of the enterprise developer in 2026-2027, shifting focus from writing code to managing AI systems, security, and domain-specific models.
Mykhailo Vyhovsky 7 min read
Oracle PeopleSoft vulnerability exploited in university data breach
A critical zero-day vulnerability, CVE-2026-35273, in Oracle PeopleSoft has been exploited by the ShinyHunters group to compromise educational institutions, highlighting the ongoing risks associated with legacy ERP systems.
Yuriy Syvytsky 5 min read
CERT-UA: New UAC-0057 Toolkit and Countermeasures
CERT-UA has reported on new tooling used by the UAC-0057 group. We examine the technical aspects of OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES, along with practical recommendations for defense.
Anton Marrero 9 min read
Microsoft 365 Token Theft on Android: Lessons for Zero Trust and NIS2 Compliance
A vulnerability in Microsoft 365 Android apps allows account token theft via a residual debug flag, necessitating immediate security measures and NIS2 compliance.
Yuriy Syvytsky 5 min read
Cyber threats to critical infrastructure: defending against new attacker tactics
CERT-UA warns of intensified cyberattacks targeting critical infrastructure. We examine new attacker tactics and effective defense strategies based on Zero Trust architecture.
Yuriy Syvytsky 7 min read