Blog
Research papers
Readings of standards and papers that change how operators quantify cyber loss exposure: method, assumptions, and what the document does not prove.
Who Can Send as the S&P 1500? Mapping the SPF Supply Chain of 1,210 Public Companies
A passive measurement of the SPF supply chain of 1,210 S&P Composite 1500 companies: sender concentration, shared address space, dynamic delegation, permanent errors and a dangling-authorization check. Measured October 7, 2026.
What Open FAIR actually standardizes — and what a PE operator still decides
The Open Group’s Open FAIR Body of Knowledge is a taxonomy and an analysis process, not a loss number. Read it that way and the IC conversation gets shorter.