The Non-Human Identity Crisis: Securing Machines in a Zero Trust World

Supply Chain Attacks: The Hidden Threat in Your Software Dependencies

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) starts applying in January 2025, but Article 26 — the threat-led penetration testing obligation — is the one most incident-response teams underestimate. A DORA TLPT is not a bigger pentest. It is an adversary emulation with three seated parties, regulator-visible scope, and a report that reads like a post-incident forensics deliverable.

The regulatory technical standards, drawn largely from TIBER-EU, require named participants in three distinct roles. The red team executes the attack. The blue team is the in-house security operation, uninformed about the exercise. The white team — usually the CISO office and the compliance function — knows about the test, controls its safety envelope, and speaks to the regulator. If any of the three is missing, the exercise is not a TLPT for Article 26 purposes; it is a pentest with an ambitious brief.

Threat intelligence must precede the exploit

Article 26 is explicit that the emulated adversary must be justified by threat intelligence relevant to the entity. In practice that means a targeted-threat-intelligence provider produces a document that names the actor cluster, the campaigns modelled, the TTPs derived from ATT&CK for Enterprise v14, and the initial access vector selected. This document is delivered to the regulator with the final report; skipping it means the report does not qualify.

The final dossier is not a bullet list of findings. Each attack path in scope receives a narrative — reconnaissance, initial access, execution, persistence, lateral movement, exfiltration — with the timestamps, the payloads, the C2 infrastructure, and the blue-team detection posture at each hop. Every technique gets its ATT&CK identifier, every finding a CVSS 4.0 vector, every remediation an owner and an ETA. The regulator reads it. It is signed.

Confirm your competent authority accepts your TLPT provider — some national regulators publish a shortlist.

Write the white-team RACI in month one, not month five. Everything downstream stalls without it.

Budget for threat intelligence separately. It is a distinct deliverable and materially affects the report.

Run at least one tabletop with the blue team before authorising initial access. The exercise value is limited if defenders are simply overwhelmed.

Reserve calendar days after the test for the debriefs required by Article 26(6) — the point of the exercise lives in the closeouts.

A TLPT is not an assurance exercise. It is a controlled failure exercise. If nothing fails, the emulator did not push hard enough — or the intelligence was too soft.

For an engagement brief that maps to DORA Article 26 deliverables from scoping through closeout, use the intake at /engagement/nda. We work with an in-house threat-intelligence function and, on request, with a client-nominated provider.

Threat-led penetration testing under DORA is not a rebranded pentest. It is a controlled adversary emulation with regulator-visible scope, red-team + blue-team + white-team roles, and a dossier that reads like an incident report.

DORA Article 26: what threat-led penetration testing actually asks for

When we shipped stripes and bundles, the first internal argument was about the refund window. A common industry pattern is a 7-day satisfaction guarantee for digital-learning content, or nothing at all beyond the statutory 14-day EU withdrawal right. We picked 60 minutes on top of the statutory right, worldwide. This post is why.

The 14-day right is fine, but it is not the point

Under Article 16(m) of Directive 2011/83/EU, the 14-day withdrawal right for digital content is extinguished the moment the learner starts consuming the material, provided they consented to that consequence at enrolment. So in practice, the statutory right protects a learner who paid and did not open the platform. It does very little for the learner who opened the first chapter, realised the format is not for them, and closed the tab.

Sixty minutes is enough time to open the first chapter, skim the second, and know whether the pace and voice suit you. It is not long enough to complete a chapter and its assessment, so a bad-faith buyer cannot use the window to harvest the content. In our early testing with a small cohort, refund requests inside the sixty-minute window were dominated by "wrong programme, wanted the stripe, not the base tier" — a genuine confusion, and one that the window resolves cleanly.

Corporate purchase orders sit differently

Consumer-protection directives cover natural persons acting outside their trade. A purchase order signed by an organisation is not a consumer transaction, so the statutory withdrawal right does not apply. We still extend the sixty-minute goodwill window to enterprise buyers by default — a company that just realised the seat was assigned to the wrong person deserves the same recovery path a solo learner has. Where a bespoke engagement letter carries different terms, those govern.

Refund after a credential in the enrolment has been earned. The credential remains valid on its own terms; refunding the fee that produced it would let a graduate reclaim the training their credential attests to.

Refund partial completions on the "I only got halfway" pattern. Halfway is the majority of the learning value; the assessment is where the credential lives, and the assessment is the same size regardless of pace.

Refund for reasons that are not the product — a change in the buyer's budget after two months of use, a role change three chapters in.

A short window that we honour cleanly is worth more than a long window with an argument at the end of it.

Full policy at /stripe-terms. If you think a specific situation should qualify and does not, write to support@cyber-protocol.org with your order reference — we read every message and answer within a business day.

The stripe & bundle terms carry a 60-minute discretionary refund window in addition to the statutory 14-day EU withdrawal right. Here is why that number, and how the two rights interact.

Why the refund window is exactly sixty minutes

Post-quantum cryptography stopped being a research topic when NIST published FIPS 203, 204, and 205 in August 2024. ML-KEM, ML-DSA, and SLH-DSA are federal standards; agencies are on the clock to migrate; industry follows about eighteen months behind. The question your CISO will be asked in the next board pack is not whether you have a plan, but how far into it you are.

Five chapters. The first sets the ground: what a quantum computer of the size described in the NIST call breaks (Shor against RSA-2048 and P-256), what it does not (AES-256 remains meaningful, symmetric primitives lose about half their security margin under Grover). The second walks FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA) with the actual parameters and their implications for message sizes, signature sizes, and code footprint.

Chapter three is the hybrid-TLS chapter — the one your platform team will care about most. It covers the current IETF drafts for hybrid key exchange in TLS 1.3, the reasoning for hybrid over pure-PQC in the transition years, and the operational cost of longer key material inside a TLS handshake. Chapter four is the harvest-now-decrypt-later chapter — the risk model, the assets that qualify as high-value, and the migration prioritisation that survives contact with a hostile CFO.

Chapter five is the migration project chapter. Cryptographic agility as a concept, an inventory of the places long-lived symmetric keys already exist in your estate, the vendor-management conversations that have to happen, and the memo that justifies the budget line to the audit committee.

A cryptography engineer, a platform lead, or a security architect at an organisation with a ten-year data-sensitivity horizon: finance, defence, health, critical infrastructure. If your organisation stores nothing an adversary would want to decrypt in 2033, the stripe is over-specified. If you do — and the definition catches a wider net than the average CIO expects — the stripe is the fastest way to reach a defensible migration position.

The mathematics of lattices, ring-LWE, or hash-based signatures at graduate level. The stripe explains why the primitives are believed hard; it does not derive the proofs.

Hardware implementations. FPGA and ASIC integration is a separate discipline.

Quantum key distribution. QKD is a different product with a different threat model and is not covered here.

The board question next quarter will be operational: "How far are we along?" The right answer is not a promise; it is an inventory, a plan, and a first row already migrated.

Enrolment and bundle pricing at /stripe/post-quantum-cryptography. Requires CCPP as a prerequisite.

A walk-through of what the CCPP · Post-Quantum Cryptography stripe covers, in the same voice the curriculum is written in — NIST FIPS 203/204/205, hybrid TLS, and the harvest-now-decrypt-later risk your CISO is already being asked about.

Reading the CCPP Post-Quantum Cryptography stripe from the outside

2026 Cybersecurity: Securing Cookie Consent and Analytics Infrastructure

AI-Driven Supply Chain Attacks: The New Frontier of Cybersecurity Risk

Why AI Code Audits Fall Short: The Limits of Automated Security Reviews

Blockchain Evolution: Strengthening Enterprise Security in 2026

The Trace is a single wave that runs across every hero image, every article thumbnail, and every empty state on this site. It is authored as an SVG, tuned per programme, and rendered inline so it stays crisp at any screen density. We use it as fil-rouge — the through-line the reader's eye follows without noticing.

Calm is a low-amplitude sine — the system at rest. Steady is an ECG rhythm with periodic pulses — watchful, responsive, the CCPP character. Acute is a sawtooth with tight peaks — the system under stress, the ECCIS character. Governance is a slow deliberate swell — the strategic sea, the EMSCG character. Ascend is a flat curve rising into an earned trajectory. Halftone is the same wave, sampled as dots instead of a stroke, for use as a signature band along the top edge of thumbnails.

The choice is deliberate and semantic. A learner arriving at the CCPP page should feel a rhythm — the practitioner tier is about muscle memory, and rhythm reads as muscle memory. A learner arriving at the ECCIS page should feel the pressure — nation-state adversaries and physical-consequence tabletops deserve a wave that spikes. An executive arriving at the EMSCG page should feel the swell — board-level governance moves slowly and with force, and Governance moves slowly and with force.

The Trace replaced a decorative header bar we ran through the site's first two versions. That bar was thin, forgettable, and looked like every other cyber-adjacent site. The Trace works because it changes across the site — the same motif read differently, page to page — so the reader's pattern-completion instinct starts to attach meaning to it. By the fourth or fifth page, the accent colour and the wave shape carry the programme identity without the reader consciously naming it.

For anyone building on the design system, the six archetypes and their tuned in-situ examples live on /design/trace. The React component accepts a plate="glow" prop that renders a soft accent-tinted halo behind the wave — that halo is what makes the same Trace read cleanly on any surface, without the hard rectangle backdrops the first iterations required.

A brand motif works when the reader stops seeing it and starts using it to orient. That is the bar we set for the Trace, and it is the bar we hold it to.

The site-wide fil-rouge motif carries a different meaning depending on where you find it. This is a short read on why Steady runs across CCPP, Acute across ECCIS, and Governance across EMSCG.

Press releases, incident briefs,
editorial from the operators.

2026 Cybersecurity: Securing Cookie Consent and Analytics Infrastructure

The Non-Human Identity Crisis: Securing Machines in a Zero Trust World

Supply Chain Attacks: The Hidden Threat in Your Software Dependencies

DORA Article 26: what threat-led penetration testing actually asks for

Why the refund window is exactly sixty minutes

Reading the CCPP Post-Quantum Cryptography stripe from the outside

AI-Driven Supply Chain Attacks: The New Frontier of Cybersecurity Risk

Why AI Code Audits Fall Short: The Limits of Automated Security Reviews

Blockchain Evolution: Strengthening Enterprise Security in 2026

The Evolved CISO: Moving Beyond Traditional Security to Strategic Leadership

Critical Infrastructure at Risk: Analyzing Iran-Israel Cyber Conflict Targets

The AI Replacement Trap: Why Your Best Cybersecurity Engineers Are Irreplaceable

Stuxnet: The Digital Weapon That Changed Cybersecurity Forever

2026 Cybersecurity Posture: Essential Updates for Modern Defense

Q3 2025 in review: deepfakes, identity abuse, and the new shape of cybercrime

Cyber resilience lessons from recent attacks

Cyberattack Disrupts Major European Airports: What Happened and How to Respond

The new iPhone 17 and why we need (more than ever) a Secure and Independent Mobile OS

Negotiating with Cybercriminals: The Comprehensive Playbook

Zero Trust: Why this cybersecurity model matters now more than ever

Is Google’s live voice translation opening the door to impersonation threats?

The Rise of Cybercriminality in Asia

Ransomware Groups Now Targeting Cloud Backups: Inside Their Playbook and Real-World Cases

Press releases, incident briefs,editorial from the operators.

2026 Cybersecurity: Securing Cookie Consent and Analytics Infrastructure

The Non-Human Identity Crisis: Securing Machines in a Zero Trust World

Supply Chain Attacks: The Hidden Threat in Your Software Dependencies

DORA Article 26: what threat-led penetration testing actually asks for

Why the refund window is exactly sixty minutes

Reading the CCPP Post-Quantum Cryptography stripe from the outside

AI-Driven Supply Chain Attacks: The New Frontier of Cybersecurity Risk

Why AI Code Audits Fall Short: The Limits of Automated Security Reviews

Blockchain Evolution: Strengthening Enterprise Security in 2026

The Evolved CISO: Moving Beyond Traditional Security to Strategic Leadership

Critical Infrastructure at Risk: Analyzing Iran-Israel Cyber Conflict Targets

The AI Replacement Trap: Why Your Best Cybersecurity Engineers Are Irreplaceable

Stuxnet: The Digital Weapon That Changed Cybersecurity Forever

2026 Cybersecurity Posture: Essential Updates for Modern Defense

Q3 2025 in review: deepfakes, identity abuse, and the new shape of cybercrime

Cyber resilience lessons from recent attacks

Cyberattack Disrupts Major European Airports: What Happened and How to Respond

The new iPhone 17 and why we need (more than ever) a Secure and Independent Mobile OS

Negotiating with Cybercriminals: The Comprehensive Playbook

Zero Trust: Why this cybersecurity model matters now more than ever

Is Google’s live voice translation opening the door to impersonation threats?

The Rise of Cybercriminality in Asia

Ransomware Groups Now Targeting Cloud Backups: Inside Their Playbook and Real-World Cases

Press releases, incident briefs,
editorial from the operators.