Briefings. Short reads on the problems on your desk.
Written for the people running technology, finance, security, and compliance at mid-market companies. Filter by your role or by problem. Each briefing is a short analysis of a question executives are being asked.
Show
Or by your role
Or filter by problem
A penetration test is not a risk number: what finance can and cannot take from the report.
A penetration test report lists what a tester found, not what a breach would cost. What a CFO can take from it, and what to ask the tester and IT lead.
Briefing Technology Cost · FinanceIT budget vs. total technology cost: why they never match and how a CFO reconciles them.
Why the IT budget and total technology cost don’t reconcile at budget time, where the difference sits, and the questions a CFO can ask to close it.
Briefing IT Leadership · FinanceShould IT report to the CFO? What a CFO owns when there is no CIO.
What a CFO is left owning at a mid-market company with no CIO, five things to ask for this quarter, and who signs for risk.
Briefing AI · GovernanceWhat the board should be asking about AI before approving the budget.
Microsoft is promoting Copilot, and other software vendors have AI offers of their own. These reach the board as a budget line. A short list of questions helps the board decide.
Briefing Healthcare · SecurityRC4 Kerberos in healthcare: HIPAA, cyber insurance, and clinical systems.
RC4 Kerberos raised HIPAA, cyber insurance, and clinical device questions for healthcare organizations. This briefing covers each, including where legacy systems prevented full enforcement.
Briefing AIAI readiness and AI maturity are not the same thing.
AI readiness is whether your data, access controls, and policies can support AI safely. AI maturity is how far you have taken its use. Many organizations buy tools before they check readiness.
Briefing Security · Cyber InsuranceRC4 Kerberos and cyber insurance: what underwriters may ask for.
Insurers can ask for evidence of specific controls at underwriting and renewal, and some asked about RC4 Kerberos encryption. Requirements vary by carrier and policy. What underwriters may ask for, and what evidence can answer it.
Briefing Compliance · SecurityOld Kerberos encryption (RC4) could create a compliance finding, whatever Microsoft's 2026 dates.
Whether active RC4 usage in Active Directory is a finding depends on which framework applies to you: HIPAA, PCI DSS, SOC 2, NIST 800-53, or CMMC. That did not depend on Microsoft's July 14, 2026 enforcement date.
Briefing AI · GovernanceAI governance for Microsoft 365: what has to be true before you deploy Copilot.
Copilot respects the permissions you already have. Over-shared SharePoint sites, weak sensitivity labels, and gaps in data loss prevention policies carry straight into what Copilot can surface.
Briefing SecurityIf you delayed or rolled back the April 2026 Kerberos patch: what it meant.
Some IT teams delayed or rolled back the April 2026 Windows update after Kerberos failures. This briefing covers what each choice left exposed and the remediation sequence that followed.
Briefing SecurityWhat the April 14, 2026 Windows update changed on domain controllers.
The April 14, 2026 update changed how domain controllers issue Kerberos tickets. The mechanism, the failure modes, and why a rollback did not fix every failure.
A note in your inbox when each one publishes.
We send a short note when a new briefing is published.