NIS2 Directive increases cybersecurity resilience in the Netherlands, requiring organizations to manage supplier risks. While essential, it imposes administrative burdens on clients and suppliers, potentially exceeding their readiness by the 2026 deadline. Preparing involves suppliers standardizing security documentation and clients assessing supplier risks.
https://ioplus.nl/en/posts/nis2-much-needed-but-also-more-work-pressure
Syncro and CyberDrain launched a free security assessment tool for Microsoft 365, aimed at Managed Service Providers (MSPs). This tool allows MSPs to quickly and easily evaluate security postures without risk or complex setup. It provides actionable insights and executive-reports on security gaps, fostering sales conversations. Immediate access is available, with future updates planned. A webinar is scheduled for December 12, 2025, for live demonstrations.
AI adoption in organizations is widespread but governance is lacking, with only 13% of firms monitoring AI data handling. A report highlights that two-thirds of respondents noticed AI tools over-accessing sensitive data, and many have insufficient real-time controls. Autonomous AI agents are particularly vulnerable, with limited oversight. Just 7% of organizations have a dedicated AI governance team, indicating significant gaps in regulatory readiness. The report advocates for a shift to data-centric oversight of AI to secure sensitive information effectively.
AI adoption is widespread (83%), but oversight is lacking (only 13% have strong visibility). This creates risks with autonomous agents acting beyond control, as 76% find them hardest to secure. Governance is weak, with only 7% having dedicated AI teams. The report highlights the need for better monitoring and identity management for AI within enterprises.
https://www.cybersecurity-insiders.com/portfolio/2025-state-of-ai-data-security-report-cyera/
CISO roles have evolved: cybersecurity is now a business imperative, with increased personal liability for executives. Accountability issues arise as CISOs lack control over security processes, leading to blind spots and breaches. To rectify this, organizations need shared visibility and a true system of record. Collaborative risk management spreads responsibility, enhancing cyber resilience and compliance. Transparency builds trust and positions security as an organizational priority, reducing risks and potential liabilities.
https://www.scworld.com/perspective/shared-accountability-the-new-foundation-of-cyber-leadership
TLDR: Cybersecurity budgets are slowing as economic concerns grow, despite a significant rise in AI spending. Cybersecurity spending increased 4% in 2025, down from previous years. The outlook for 2026 shows potential growth in overall cybersecurity expenditures surpassing $520 billion, yet budgets may be constrained due to financial pressures. Effective budgeting practices are crucial to navigate these challenges.
Digital resilience will become crucial in 2026 due to increased regulatory scrutiny and evolving cyber threats. Organizations must prioritize critical services and enhance incident response capabilities. Legal obligations will expand, particularly in finance, healthcare, and essential sectors, driven by legislation like the UK’s CSR Bill and the EU’s NIS2 Directive. Burgeoning supply chain risks highlight the need for rigorous supplier assessments. AI presents both opportunities for improving resilience and new vulnerabilities. Effective governance, proactive risk management, and clear communication will distinguish resilient organizations in a complex threat landscape.
A healthy relationship between the CISO and CIO is key to organizational security and success, but common warning signs of trouble include undiscussed disagreements, exclusion from planning, undermining, lack of direct communication, and technology overlap. These strains often stem from unclear roles, conflicting priorities, and insufficient collaboration, leading to increased risk and operational misalignment. To fix this, both sides should align on risk and business goals, clarify responsibilities, maintain regular communication, and focus on collaborative business enablement.
Zero trust adoption steps: Jonathan Edwards outlines practical zero trust implementation in stages, emphasizing multi-factor authentication, access control improvement, and context in access decisions. He includes cleanup tasks, continuous monitoring, and metrics, stressing alignment with business goals for success.
https://www.helpnetsecurity.com/2025/12/01/incremental-zero-trust-adoption-video/
Compliance frameworks in cybersecurity, like NIST, HIPAA, and PCI DSS, are often viewed as burdens, but in reality, they drastically reduce breach risk, costs, and damage. These frameworks establish concrete controls that address predictable weaknesses, enforce accountability, require robust incident response planning, and strengthen supply chains by holding vendors to higher standards. While compliance is not a guarantee against all attacks, it creates discipline, closes security gaps, and should be treated as a baseline for security, not an endpoint. Organizations that embrace compliance as a strategic asset, rather than a box-checking exercise, outperform less structured competitors and help protect broader society.
