I, Robot + NIST AI RMF = Complete Guide on Preventing Robot Rebellion

Though major frameworks mandate periodic risk assessments, many organizations struggle to build the process. The author covers scoping, identifying threats, and quantifying impact and likelihood.

I attended the PCI-SSC community meeting this past week (September 22-24). There were three key issues discussed that showed that the PCI program is maturing and that a number of standards and regulations are converging (both in and outside the PCI world).

Bishop Fox unpacks NIST's move to prioritized CVE enrichment — KEV, federal software, and EO 14028 critical software first from April 15, 2026 — and argues for risk-based patch management.

Post-quantum crypto's main value isn't only quantum resistance: even without quantum computers, PQ standards bring resilience through problem diversity, modern design, and use-case flexibility.

Bishop Fox's password security guide: why mandatory complexity and 90-day rotation fail, what NIST 800-63B now recommends, and common attack techniques like spraying and cracking.

NIST's newly drafted digital identity guidelines analyzed: passwords checked against breach lists, dictionary words and context terms; SMS dropped as a single factor as push-based MFA gains ground.