Kovrr

Two more capabilities added to Kovrr's CRQ platform! 🚀🚀🚀 Scenario Intelligence is a new dedicated section of the platform that surfaces the latest cyber incidents and lets you filter for what's hitting organizations like yours then add them directly to your risk register. Scenario templates in the cyber risk register let teams build new scenarios faster, starting from real-world events like SolarWinds or MOVEit, or from common pre-defined scenario types. Both capabilities deepen the connection between Kovrr's real-world incident intelligence and the day-to-day work of managing cyber risk. The threat landscape is always moving, and now your risk register can keep up. Read the blog and dive into the details >> https://lnkd.in/dk7-4qxN #cyberrisk #cyberriskquantification #CRQ #riskregister #GRC #scenarioplanning #CISO

Our quarterly newsletter is now live🚨 Q2 was all about turning AI risk into action, from shadow AI discovery and EU AI Act readiness to board-level AI risk and new CRQ capabilities, we focused on what leaders need most: visibility, clarity, and decisions they can act on.

Shadow AI isn’t a future risk, it’s already embedded across the enterprise. From marketers using generative tools to developers experimenting with APIs, AI is being adopted faster than governance can keep up. The challenge? Most of it operates without visibility, oversight, or risk assessment. In this blog, we break down: * What actually counts as shadow AI (it’s more than just ChatGPT) * Where it hides, from SaaS features to browser extensions * The real costs, spanning data exposure, regulatory risk, and security incidents One key takeaway: blocking AI tools doesn’t solve the problem. Visibility and smart governance do. If you don’t know what AI is running in your environment, you’re already carrying risk you didn’t choose. Read more: https://lnkd.in/d_e-Mub9 #shadowAI #cyberrisk #AIrisk

$409 million. For a governance failure that boiled down to a few questions that nobody could answer. Who had access to what, and why? But also, let’s be real...How many organizations could answer that question today (with the necessary granularity) if a regulator came knocking? South Korean regulators fined Coupang 𝟔𝟐𝟒.𝟗 𝐛𝐢𝐥𝐥𝐢𝐨𝐧 𝐰𝐨𝐧 last week after a former employee retained a stolen cryptographic signing key, exposing approximately 𝟑𝟑 𝐦𝐢𝐥𝐥𝐢𝐨𝐧 𝐜𝐮𝐬𝐭𝐨𝐦𝐞𝐫 𝐫𝐞𝐜𝐨𝐫𝐝𝐬. The Korea Personal Information Protection Commission's investigation found that the controls governing data access were insufficient. The penalty is the 𝐥𝐚𝐫𝐠𝐞𝐬𝐭 𝐝𝐚𝐭𝐚-𝐩𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐟𝐢𝐧𝐞 in South Korean history. The technical failure here was unremarkable. The financial consequence? Anything but. PLUS, it landed in the same week as two other events that tell the same story from different angles. ➊ The US government issued export controls on Anthropic's most advanced AI models, citing national security concerns. ➋ The White House signed NSPM-12, establishing new inventory and compliance requirements for systems handling classified information. Three events. Three days. One main takeaway. ☝️ AI capability has outpaced the governance infrastructure meant to contain it, and the consequences of that mismatch are now being quantified in very concrete terms. Every general counsel presenting #AIrisk to a board will now reference the Coupang number. Every CISO defending governance investment will (should) use it as a baseline. The question the Coupang investigation asked is the same one every organization should be preparing to answer right now Are the people and systems accessing sensitive data doing so under documented, defensible authorization??? The Coupang fine has turned a governance conversation into a concrete balance sheet event. The organizations that internalize that before their own moment arrives are the ones investing in the infrastructure to answer that question today. Kovrr's AI Governance and Security Platform was built to provide that infrastructure. Happy to connect with anyone ready to make that investment. https://hubs.li/Q03SN0-n0 #AIgovernance #AIsecurity #AIrisk #dataprivacy #GRC #riskmanagement #Coupang #cyberrisk #AIcompliance #boardgovernance

One vulnerability. More than 2,000 organizations compromised. An estimated $12 billion in losses. The #MOVEit breach wasn't a targeted attack. It was technogenic risk: exposure buried inside a third-party tool that thousands of companies relied on without knowing it was there. In a new piece for SupplyChainBrain, our CEO, Yakir Golan breaks down what drives this hidden class of supply chain cyber risk, why static severity scores like CVSS miss it, and why forecasting and quantifying it in financial terms has become essential to resilience. Read it here: https://lnkd.in/diUfXp-W #CyberRisk #SupplyChain #RiskQuantification

We're in Lisbon this week for the 10th CISO 360 Global Congress, and Kovrr is proud to sponsor. The theme says it all: "Securing the Age of AI: Innovation with Resilience." That's our world, helping teams turn cyber and AI risk into numbers the board can act on. At the Palácio Estoril? Come find our team. We'd love to talk. Pulse Conferences #CISO360 #CyberRisk #AIGovernance

Most companies can describe everything AI is doing for them. Far fewer can tell you what it's costing them in risk. That gap is the real challenge with enterprise AI. Every model deployed and every tool switched on adds efficiency, and it adds exposure across cybersecurity, supply chains, compliance, and operations. The instinct is to slow down. But the answer isn't less innovation. It's better measurement. When AI risk is quantified in financial terms, "move fast" and "stay resilient" stop being opposing goals and become part of the same decision. Our latest article breaks down where AI risk actually concentrates, and how data-driven AI risk quantification helps leaders prioritize what matters most and protect business continuity, without putting the brakes on growth. Read it here: https://lnkd.in/dDe9WFnY #AIRiskManagement #CyberRisk #AIGovernance #Resilience

Who owns AI governance at your company, and how did it end up with them? This is the million-dollar question everyone is trying to answer. In fact, this past week, I saw this question posed on Reddit....yet again. Unsurprisingly, the responses were all over the place. 😵💫 ➢ A compliance VP who left, and nobody picked it up. ➢ A CISO who inherited it because they asked one too many questions in a meeting. ➢ A privacy lead who absorbed it alongside an already full role. ➢ A head of product who took it on to accelerate sales into regulated industries. Every organization had a different answer. None of them sounded particularly intentional. The pattern tracks with what we're seeing at Kovrr, too, across our discussions with those interested in the platform. #AIgovernance ownership is still being figured out, and, to be fair, organizations deserve some grace on that front. It's a massive undertaking to institutionalize, and the playbook is still being written. That said, there was one consistent thread, or rule, that popped up in nearly every response. The organizations where governance was already functioning effectively had one thing in common. Whoever owned it had been given real authority to enforce it. The ability to approve or deny a tool. The ability to require documentation before deployment. The ability to say no and have it stick. 🦾🦾🦾 The department varied. The mandate did not. One commenter captured it well: "...the failure mode is identical when the role is advisory only. You write the policy, engineering ships around it, and you find out after the fact." See the thread here: https://lnkd.in/dv4SrvBW Authority is the prerequisite, of course, but authority without operational infrastructure is just a title with a veto stamp. The person owning governance also needs visibility into what is running, a way to track compliance across frameworks, and a data-driven way to prioritize initiatives based on where the exposure is most concentrated. If you're the person who ended up holding this, whether by design or by default, Kovrr's AI Governance and Security Platform was built to make sure you have the infrastructure to back up the authority. Happy to show you what it looks like. #AIgovernance #AIrisk #AIsecurity #GRC #riskmanagement #shadowAI #AIcompliance #AIvisibility #CISO

The information security team at Gebauer & Griller, a global manufacturer with operations spanning three continents, had a clear goal when they approached Kovrr. They wanted to shift from instinct based decision-making to a structured, risk-based security program supported by data. Partnering with us, they were able to migrate more than one hundred potential cyber risk scenarios into a centralized, CRQ-powered risk register, giving them something their spreadsheet-based approach never could: A clear, quantified picture of their full risk landscape, complete with financial exposure data, priority levels, and response plans. In the end, they had a board-ready presentation, two successful audits, and the groundwork for a truly risk based security program. Read the full case study to see how they did it >> https://lnkd.in/dE35QwMh #CyberRiskManagement #RiskRegister #CyberRiskQuantification #CRQ #CISO #RiskBasedDecisionMaking

"As much as the industrial revolution freed us from the constraints of the human muscle, AI will free us from the constraints of the human brain." That's what Argentine President Javier Milei wrote in the Financial Times last week as part of his proposal to create "non-human corporations." These would be legal entities entirely owned and operated by #AI, where human involvement is optional. In other words, in the business environment, the human brain would be obsolete. 🚫 🧠 The proposal also calls for zero #AIregulations and low taxes, designed to position Buenos Aires as the global destination for AI-driven enterprise. In response, acclaimed author Yuval Noah Harari raised the glaringly obvious questions: When an AI-run entity causes harm, who answers for it? Without someone accountable in the legal structure, the guardrails that keep corporate behavior in check disappear. Harari's concerns are grounded and urgent. But Milei's vision, as provocative as it sounds on first read, carries a kernel of truth that the industry would be wise to engage with rather than dismiss. The productivity potential of AI is enormous, and the instinct to avoid strangling innovation with premature, poorly designed regulation is one that resonates across the enterprise landscape. Where Milei goes wrong is in the conclusion he draws from that instinct. The answer to imperfect regulation is better regulation, not the absence of it. In fact, the same analogy he uses about the industrial revolution to argue for his case ends up contradicting it upon further inspection. While there were indeed unprecedented productivity gains, there was also a proliferation of labor laws and safety standards that made those gains sustainable. Nobody can argue that these regulations didn't slow progress down in the short term. But, likewise, no one can argue that governance did not make the ensuing productivity sustainable and scalable in the long term. AI is a revolution, too, and you better believe it's on the same trajectory. You can fully promote its transformative potential and still recognize that governing it responsibly is what makes that potential last. If you're working to strike that balance inside your organization, I'd be happy to chat about how we're approaching it at Kovrr. #AIgovernance #AIregulation #AIrisk #artificialintelligence #riskmanagement #GRC #responsibleAI #AIsecurity