|
By Kovrr
The Model Context Protocol states plainly that it cannot enforce these security principles at the protocol level, and that implementors should follow best practices in their integrations. Every control an organization gets therefore comes from where it places the gateway and what it does there. The protocol publishes its own security best practices document, currently at revision 2026-07-28, naming the attacks a deployment has to handle.
|
By Kovrr
Monitoring has to happen on the device, because three categories of AI use never reach the network in a form anything can inspect. Local models run without leaving the machine. Desktop applications that pin their certificates sit on an inspection bypass list by design. A laptop on a home connection routes through nothing the organization operates at all. The uncomfortable part is that the first two are deliberate. Somebody approved the bypass, and the approval was correct on its own terms.
|
By Kovrr
A model built on industry data produces an industry answer. The obvious next step is to calibrate it to the specific environment, and the obvious place to start is the threat picture, because every organization believes its own is distinctive. It is the wrong parameter to start with. Some inputs should stay general, some must be local, and the ones that must be local are the harder ones to observe, which is why they get left at a default.
|
By Kovrr
Plenty of material explains what ISO/IEC 42001 contains. Clause by clause, control by control, with a checklist of documents to prepare. The standard itself is a management system specification rather than a control catalogue, and the distinction is where audit preparation goes wrong. The checklists share one omission.
|
By Kovrr
The usual case for governance return is that it speeds up enterprise sales, because buyers ask security questions and a prepared answer closes faster. It is true and it is the weaker argument. The stronger one is loss avoidance, and almost nobody makes it, because it needs a loss figure that most governance programs do not have. What makes it affordable is a distinction between two kinds of evidence.
|
By Kovrr
A correlation rule can be tuned. The window can be widened, the join key improved, a source promoted from optional to required. Each of those is a parameter with a defensible setting. What remains after all of it is the residual, meaning the events that would produce a finding if a source existed for them, which is a form of residual risk expressed in detection terms. Naming it is the question an auditor asks after being shown a detection, and the answer is not a tuning exercise.
|
By Kovrr
A quantification exercise reports a one-in-hundred-year loss and the figure travels well. It sounds precise, it sounds severe, and everybody in the room believes they understand it. Most of them do not. The phrasing describes an annual probability and it reads as a statement about timing, and the two produce different decisions from the same number.
|
By Kovrr
AI governance evidence is usually prepared for a neutral reader. A regulator with no stake in the market, an auditor with no competing product, an examiner who gains nothing from what the documentation contains. In securities and derivatives markets that assumption does not hold. Exchanges and clearing organizations register as self-regulatory organizations, and most of them operate the market while regulating its participants. The reader of your evidence is also an operator.
|
By Kovrr
An exposure figure is produced once and read three times. The audit committee sees it, the risk committee sees it, and the board sees it, and each is answering a different oversight question. The figure travels well and the reasoning behind it does not. What arrives at the third reading is a number with no assumptions attached, and by then it reads as a fact.
|
By Kovrr
Compliance content answers the question of when an obligation starts. For the serious incident reporting duty in the AI Act, the honest answer is that it is disputed, and the dispute is not a failure of research. Two readings of the text point in different directions, neither is obviously wrong, and no authority has resolved it. What follows is the reasoning on both sides and what to do without picking one.
AI is merging into the modern workplace at roughly the pace computers did in the 1980s, and the risks are evolving just as fast. IBM and Ponemon found that 97% of organizations hit by an AI-related security incident lacked basic access controls, and 63% had no AI governance policy at all. In this video, Yakir breaks down the seven categories of AI risk every GRC leader needs to understand, and what separates knowing you have a control gap from knowing what it will cost you.
Ransomware has shut down hospitals and data breaches have exposed millions of patient records. But healthcare organizations still struggle to manage cyber risk, because decisions get made on compliance checklists and generic threat scores that reveal nothing about real business impact. In this video, Kovrr breaks down how cyber risk quantification turns healthcare threats into financial terms, and why that changes the conversation between CISOs, compliance leads, and the board.
AI adoption inside the enterprise has outpaced the governance built to contain it — 57% of employees have used AI tools for work without telling their manager. Policies get written and committees get formed, but exposure keeps accumulating, because data governance, AI oversight, and security are almost always run as three separate programs. In this video, Kovrr breaks down the three pillars that need to connect, and what separates a durable AI governance program from a documented one.
By now, most organizations have invested in AI governance. Far fewer have solved the problem that makes governance possible in the first place: knowing what AI they are actually running — and with 57% of employees using AI tools at work without telling their manager, the gap is wider than most inventories admit. In this video, Kovrr breaks down what an AI asset inventory actually is, why traditional asset management never catches shadow AI, and what it takes to keep the record accurate.
For years, security and risk managers have relied on spreadsheets to track their cyber risk. But as regulatory expectations tighten and threats grow more sophisticated, manual tracking cannot keep up. In this video, Kovrr walks through what a modern cyber risk register looks like when cyber risk quantification is built into its foundation. We cover.
For years, CISOs have walked into boardrooms with technical data dumps that don't land. In this video, Kovrr breaks down the 7 cybersecurity metrics that actually resonate with board directors, all framed in the financial and business terms they use to govern the enterprise. We cover: Generated with the help of AI.
live webinar with Aaron Turner, IANS Faculty, who presents findings from his recent IANS research, 7 Steps to Securing Multi-AI Deployments, and explain how security teams can apply proven principles to modern AI systems.
Kovrr’s new AI Risk Governance Suite gives enterprises the visibility, structure, and measurable control needed to manage GenAI responsibly across its full lifecycle. Join us for Office Hours: Part 1, where Or Amir will walk through the first three modules of the suite—showing how enterprises can gain real-time oversight and quantifiable insight into their AI landscape: Discover how these capabilities help enterprises align innovation with accountability—building a defensible foundation for responsible GenAI adoption.
In this session, Or Amir, Product Manager at Kovrr, showcases our new AI Risk Assessment and AI Risk Quantification modules — helping enterprises gain visibility, benchmark maturity, identify shadow AI, and turn exposure into measurable outcomes.
Explore Kovrr’s brand-new CRQ-Powered Cyber Risk Register — a first-of-its-kind solution that’s redefining the way organizations build cyber GRC programs and manage cyber risk. Led by Or Amir, Product Manager at Kovrr, this session will offer a hands-on deep dive into the risk register’s extensive capabilities and show you why moving beyond static, spreadsheet-based registers to a fully quantified, dynamic risk intelligence framework is necessary for achieving resilience in today’s landscape.
|
By Kovrr
By its nature, cyber risk is dynamic. New events happen and evolve all the time, making it difficult for enterprises to financially quantify their financial exposure to cyber attacks. Around two years ago, for example, distributed denial-of-service (DDoS) attacks were making headlines, and now ransomware has come into heightened focus. It's reasonable to believe that other types of attacks will emerge in another two years and continue to change thereafter.
|
By Kovrr
The number of data breaches reported in the first 6 months of 2022 has put this year on track to be the lowest year of reports in the last 5 years for large US corporations. By looking at the rate at which data breach events have been reported so far this year, we predict that the number of events reported is expected to be 15-20% of the number of breaches reported in 2021
|
By Kovrr
The 2022 Verizon Data Breach Investigations Report (DBIR), the fifteenth such report in as many years, leads off with a startling statistic: Credentials are the number one overall attack vector hackers use in data breaches. Use of stolen credentials accounts for nearly half the breaches studied by Verizon, far ahead of phishing and exploit vulnerabilities, which account for 19% and 8% of attacks, respectively. Botnets, the fourth most common entry path for hackers, represent a mere 1% of attacks.
- October 2026 (17)
- September 2026 (48)
- August 2026 (64)
- July 2026 (28)
- June 2026 (6)
- May 2026 (4)
- April 2026 (3)
- March 2026 (4)
- February 2026 (3)
- January 2026 (4)
- December 2025 (4)
- November 2025 (3)
- October 2025 (3)
- September 2025 (3)
- August 2025 (3)
- July 2025 (3)
- June 2025 (3)
- May 2025 (4)
- April 2025 (3)
- March 2025 (3)
- February 2025 (5)
- January 2025 (3)
- December 2024 (1)
- November 2024 (3)
- October 2024 (4)
- September 2024 (3)
- August 2024 (1)
- July 2024 (4)
- June 2024 (3)
- May 2024 (5)
- April 2024 (4)
- March 2024 (3)
- February 2024 (4)
- January 2024 (10)
- December 2023 (5)
- November 2023 (1)
- October 2023 (4)
- September 2023 (1)
- August 2023 (4)
- July 2023 (3)
- June 2023 (2)
- May 2023 (1)
- April 2023 (2)
- March 2023 (4)
- February 2023 (13)
- January 2023 (6)
- December 2022 (2)
- November 2022 (2)
- July 2022 (3)
- June 2022 (1)
- October 2020 (1)
Kovrr financially quantifies cyber risk on demand. Our technology enables decision makers to seamlessly drive actionable cyber risk management decisions.
Kovrr's Quantum Cyber Risk Quantification platform enables decision makers to understand and financially quantify the changing profile of their cyber risk exposure.
Cyber Risk Management Made Easy:
- Communicate Cyber Risk in Financial Terms: Enhance the board and C-Suite’s decision-making process by financially quantifying cyber risk.
- Cybersecurity Investment Optimization: Prioritize and justify cybersecurity investments based on business impacts and risk reduction.
- Measure Cyber Security Programs’ Effectiveness: Assess the ROI of your cybersecurity program and stress test it based on potential risk mitigation actions, thereby supporting better resource allocation.
- 3rd Party Vendors Cyber Risk Exposure Analysis: Financially quantify cyber risk within your supply chain. Gain insights Into 3rd and 4th party exposure.
- Regulatory Compliance and Governance Reporting: Meet increased demands from regulators to continuously quantify and manage cyber risk exposure.
- Cyber Insurance Coverage and Price Optimization: Identify gaps between risk mitigation impact versus risk cyber insurance spending and needed coverage for 1st party and 3rd party.
- Quantitatively Benchmark and Compare your Cyber Risk Exposure: Benchmark to your industry peers and internally compare between different business entities in a consistent, measurable and accurate way.
A cyber risk management platform to quantify custom cyber risk scenarios.