Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Kroll Named in Forrester Cybersecurity Incident Response Services Landscape as It Launches Enhanced Retainer. An organization’s ability to respond to a cyber incident depends on decisions made long before an incident occurs. Investigating a breach, containing a threat and meeting legal and regulatory requirements remain essential. But effective incident response must also support a broader business objective: long-term resilience.

How Kroll and CrowdStrike Are Turning Innovation into Value for Customers At Fal.Con 2026 in Las Vegas, Kroll Managing Director Robb Mayeski joined CrowdStrike Vice President of Global Scale Partnerships Dan Danielli for a live interview with theCUBE, SiliconANGLE. The discussion explores how Kroll and CrowdStrike are helping organizations defend against AI-accelerated threats while adopting AI in a way that delivers measurable business value and strengthens cyber resilience.

By Rob Horne and Parul Dahl, Kroll Cyber Risk EMEA Security Advisory Kroll recently published a series of articles examining governance challenges associated with specific AI implementations, particularly agentic AI and the data, risk and compliance considerations that accompany autonomous decision-making. However, many organizations are now facing a broader challenge.

Every year in the Data Breach Outlook, Kroll reviews its breach data to identify the hardest-hit industry and the trends shaping risk across sectors. Our analysis ran from June 2025 to June 2026 and found the most breached industry was financial services. This year, Kroll also examined how many individuals were affected by the breaches Kroll handled to better understand their overall scale.

Why Traditional Data Governance Fails in the Age of Autonomous Agents—and What Replaces It.

Our View from the Front Lines of Technical Assessments Kroll analyzed five years of penetration testing data. Of the trends that emerged, we focus on three in this report: the static application security testing (SAST)/software composition analysis (SCA) plateau, the need for more attention around authentication and authorization, and the security health divergence, which shows that regulation is not a reliable predictor of attack surface health.

When Mythos launched, headlines warning of its potential dangers were prolific. For security risk leaders, it felt like a watershed moment, one that signaled that AI had arrived, but simultaneously raised widespread concern about risk. Many wanted to understand how real the risk was for their organization and what should be done about it.

Despite their complexities, cyber incidents often start in a very similar manner. There is a helpdesk ticket that appears routine, a slightly unusual login attempt or a system that might just need a restart. By the time an organization formally declares an incident, the attacker has likely already been inside for hours, sometimes longer, moving quietly through cloud platforms, SaaS applications and identity systems long before anyone notices the warning signs.

From September 11, 2026, any manufacturer, importer or distributor of hardware and software products with digital elements made available on the EU market must comply with the Cyber Resilience Act (CRA). The harmonized standards under the CRA are still being drafted, and the first will not be finalized before manufacturers need to act.

On August 18, 2026, the SEC proposed Regulation Crypto Assets1, a new regulatory framework intended to create a tailored registration exemption regime for certain crypto asset offerings while maintaining core investor protection requirements. The proposal represents a significant evolution in the SEC's approach to digital assets and could provide the clearest pathway to date for crypto issuers seeking to raise capital in the United States.