CyberCQR: papers, briefings and case studiesIndependent cyber security insight for boards and leaders. Reduce complexity, improve security, cut cost.https://cybercqr.com/feed.xml2026-10-25T08:00:00ZNeil BradyShrinking the PCI zone: card payment compliance by isolationhttps://cybercqr.com/papers/case-study-pci-isolation/2026-10-25T08:00:00Z2026-10-25T08:00:00ZHow organisations taking card payments in person and by phone reached PCI DSS compliance by isolating payment equipment, keeping card data out of everyday systems and out of call recordings. (Version 1.2)Neil Brady Securing the New Perimeter: Modern Identity Securityhttps://cybercqr.com/papers/securing-new-perimeter-identity/2026-01-02T08:00:00Z2026-10-25T08:00:00ZFrom castle-and-moat to identity as the perimeter: real breaches, Zero Trust controls, phishing-resistant sign-in and a 24-month roadmap. (Version 1.2)Neil Brady Secure mobilisation at scale: from the office network to cloud identityhttps://cybercqr.com/papers/case-study-secure-mobilisation/2026-10-25T08:00:00Z2026-10-25T08:00:00ZHow tens of thousands of users at a large UK financial services organisation moved to secure remote working on cloud identity, and how the approach scaled down to under 1,000 seats. (Version 1.1)Neil Brady Ransomware Preparedness: 10 Actions Before an Attackhttps://cybercqr.com/papers/threat-top10-ransomware-preparedness/2026-10-25T08:00:00Z2026-10-25T08:00:00ZThe ten things a board should have in place before a ransomware attack, with the UK and industry evidence for each. (Version 2.0)Neil Brady Incident Response: Top 10 Actions for Boardshttps://cybercqr.com/papers/board-top10-incident-response-planning/2026-01-05T08:00:00Z2026-10-25T08:00:00ZThe board's role when an incident is under way, from first call to recovery. (Version 1.1)Neil Brady Identity and Access Management: Top 10 Must-Do Actionshttps://cybercqr.com/papers/identity-top10-must-do-actions/2026-10-25T08:00:00Z2026-10-25T08:00:00ZThe ten identity controls to put in place first, from MFA for everyone to testing, with the evidence for each. (Version 2.0)Neil Brady Identity and Access Management: Top 10 Common Mistakeshttps://cybercqr.com/papers/identity-top10-common-mistakes/2026-10-25T08:00:00Z2026-10-25T08:00:00ZTen identity mistakes that attackers rely on, the evidence for each, and how to fix it. (Version 2.0)Neil Brady Identity and Access Management in the Hyperconnected World (Part 1)https://cybercqr.com/papers/identity-wp-modern-iam-part1/2026-01-06T08:00:00Z2026-10-25T08:00:00ZWhy identity is now the perimeter, and how to compare sign-in methods from SMS codes to hardware keys. (Version 1.2)Neil Brady Cyber Resilience Planning: Top 10 Actions for Boardshttps://cybercqr.com/papers/board-top10-cyber-resilience-planning/2026-01-05T08:00:00Z2026-10-25T08:00:00ZWhat every board should make sure is in place before a cyber incident. (Version 1.1)Neil Brady Could we recover without paying?https://cybercqr.com/tools/infographic-ransomware-readiness/2026-10-25T08:00:00Z2026-10-25T08:00:00ZInteractive board self-assessment: ten actions to take before a ransomware attack, with UK evidence from 2025. (Version 1.0)Neil Brady Common Cyber Incident Mistakes Boards Makehttps://cybercqr.com/papers/board-top10-common-incident-mistakes/2026-01-05T08:00:00Z2026-10-25T08:00:00ZTen avoidable errors that turn an incident into a crisis, and what to do instead. (Version 1.1)Neil Brady Board Preparation for Cyber Incidentshttps://cybercqr.com/papers/board-gpg-cyber-incident-preparation/2026-01-05T08:00:00Z2026-10-25T08:00:00ZA governance framework for how the board prepares for, oversees and learns from a cyber incident. (Version 1.1)Neil Brady Board Member Identity Protectionhttps://cybercqr.com/papers/identity-gpg-board-member-identity-protection/2026-01-06T08:00:00Z2026-10-25T08:00:00ZWhy directors and senior executives are prime targets, and how to protect their digital and physical identity. (Version 1.1)Neil Brady Automation without blind trust: testing and guarding AI before it runs the joiner, mover, leaver processhttps://cybercqr.com/papers/case-study-ai-automation-guardrails/2026-10-25T08:00:00Z2026-10-25T08:00:00ZHow a customer services organisation with high staff turnover put drift testing, input and output checks, guard rails and human approval around generative and agentic AI before automating onboarding and access changes. (Version 1.1)Neil Brady The breach you can't patch: JLR one year onhttps://cybercqr.com/papers/briefing-jlr-one-year-on/2026-10-19T08:00:00Z2026-10-24T08:00:00ZMost firms hit by the JLR attack were never breached. Customer concentration, cash runway, contracts and insurance: the board's exposure test. (Version 1.0)Neil Brady The Questions You Ask Are the Attack Surfacehttps://cybercqr.com/papers/questions-attack-surface/2026-04-20T08:00:00Z2026-10-24T08:00:00ZHow everyday questions to AI tools reveal strategy, security gaps and restructuring plans, even when no document is shared. (Version 1.1)Neil Brady The Quantum Threat to Encryptionhttps://cybercqr.com/papers/quantum-threat-encryption/2026-04-20T08:00:00Z2026-10-24T08:00:00ZHarvest now, decrypt later; the NIST post-quantum standards and NCSC timelines; and the board's plan for a multi-year migration. (Version 1.1)Neil Brady More tools, less securityhttps://cybercqr.com/papers/tool-sprawl-vs-consolidation/2026-10-24T08:00:00Z2026-10-24T08:00:00ZWhy doing more with the security tools you already own beats buying more, for firms of 500 to 2,000 people: the evidence, the limits and a board test. (Version 2.0)Neil Brady IPv6 Security: Risks, Controls and Best Practicehttps://cybercqr.com/papers/ipv6-security/2026-01-02T08:00:00Z2026-10-24T08:00:00ZWhat changes when NAT goes away: addressing, Neighbour Discovery and extension-header attacks, dual-stack risks and a best practice checklist. (Version 1.1)Neil Brady AI Data Leakage Through Context Exposurehttps://cybercqr.com/papers/ai-data-leakage-context-exposure/2026-01-19T08:00:00Z2026-10-24T08:00:00ZHow shared AI assistants surface documents to people who should not see them, and the guardrails, testing and board questions that prevent it. (Version 1.1)Neil Brady Your perimeter is a loginhttps://cybercqr.com/tools/infographic-iam-top10/2026-09-30T08:00:00Z2026-10-23T08:00:00ZInteractive board view of the ten identity controls that matter most. (Version 1.0)Neil Brady Would extortion still work on you?https://cybercqr.com/tools/infographic-ai-ransomware-evolution/2026-10-06T08:00:00Z2026-10-23T08:00:00ZInteractive board summary of how ransomware moved from locking files to stealing data and using AI. (Version 1.0)Neil Brady What can your AI tell the wrong person?https://cybercqr.com/tools/infographic-ai-data-leakage/2026-10-06T08:00:00Z2026-10-23T08:00:00ZInteractive board summary on AI assistants and over-shared company data. (Version 1.0)Neil Brady What can you no longer patch?https://cybercqr.com/tools/infographic-legacy-systems-security/2026-10-06T08:00:00Z2026-10-23T08:00:00ZInteractive board summary on old servers, factory machines and other systems that cannot be updated. (Version 1.0)Neil Brady Untangling the Language of Securityhttps://cybercqr.com/papers/untangling-language-of-security/2026-07-16T08:00:00Z2026-10-23T08:00:00ZSecure by Design, Zero Trust, Least Privilege, Defence in Depth and the other terms boards confuse, explained side by side. (Version 1.0)Neil Brady Understanding Zero Trust: History, Evolution, and Controversieshttps://cybercqr.com/papers/understanding-zero-trust/2025-01-13T08:00:00Z2026-10-23T08:00:00ZHistory of Zero Trust from Kindervag to NIST SP 800-207, with the main criticisms and implementation approaches. (Version 1.0)Neil Brady Understanding GDPR: A Guide to Data Protection in the UKhttps://cybercqr.com/papers/understanding-gdpr-uk/2024-05-30T08:00:00Z2026-10-23T08:00:00ZOverview of UK GDPR, the Data Protection Act 2018, individual rights and post-Brexit data transfers. (Version 1.1)Neil Brady Third-Party and Supply Chain Ransomwarehttps://cybercqr.com/papers/third-party-supply-chain-ransomware/2026-09-30T08:00:00Z2026-10-23T08:00:00ZAttack vectors, kill chains and resilience for organisations that rely on outsourced IT, facilities and software suppliers. (Version 1.0)Neil Brady The VPN Trap: Why Legacy Remote Access Is a Board-Level Riskhttps://cybercqr.com/papers/vpn-trap-zero-trust-access/2026-05-05T08:00:00Z2026-10-23T08:00:00ZHairpinning, split-tunnelling, encrypted blind spots and ransomware access brokers, and the alternatives that work. (Version 1.6)Neil Brady The Route to Livehttps://cybercqr.com/papers/route-to-live/2026-08-11T08:00:00Z2026-10-23T08:00:00ZEnvironment controls, data protection and the deployment pipeline as a security discipline, written for boards and senior executives. (Version 1.0)Neil Brady The Evolution of Authentication: From Local Passwords to Hardware-Backed Identityhttps://cybercqr.com/papers/evolution-of-authentication/2026-05-29T08:00:00Z2026-10-23T08:00:00ZStandards-referenced technical history of authentication, from local passwords and RADIUS to federation, passkeys and device-bound credentials. (Version 3.0)Neil Brady The AI-Accelerated Evolution of Ransomwarehttps://cybercqr.com/papers/ai-ransomware-evolution-whitepaper/2026-01-04T08:00:00Z2026-10-23T08:00:00ZTechnical paper on ransomware's move from encryption to exfiltration to AI-assisted extortion, mapped to MITRE ATT&CK. (Version 1.1)Neil Brady Temporary and Test Account Strategy for Entra IDhttps://cybercqr.com/papers/entra-test-accounts/2026-10-07T08:00:00Z2026-10-23T08:00:00ZDisabled-by-default test accounts, enabled on request through an access package and Logic App. (Version 1.0)Neil Brady Security Standards, Compliance Frameworks and Governance Bodieshttps://cybercqr.com/papers/security-standards-frameworks-catalogue/2026-09-16T08:00:00Z2026-10-23T08:00:00ZCross-jurisdictional reference catalogue for the UK, EU, USA and Canada, with the international standards beneath them. (Version 1.0)Neil Brady Just-in-Time Privileged Access Strategyhttps://cybercqr.com/papers/jit-privileged-access/2026-10-07T08:00:00Z2026-10-23T08:00:00ZReplacing standing admin rights with Entra PIM, plus on-premises, multi-cloud and PAM product options. (Version 1.0)Neil Brady Is your VPN the way in?https://cybercqr.com/tools/infographic-vpn-zero-trust-access/2026-10-06T08:00:00Z2026-10-23T08:00:00ZInteractive board summary of The VPN Trap: ten actions for safer remote access. (Version 1.0)Neil Brady Is a password still your front door?https://cybercqr.com/tools/infographic-modern-iam-authentication/2026-10-06T08:00:00Z2026-10-23T08:00:00ZInteractive board summary on sign-in: why longer passwords no longer help and what to change first. (Version 1.0)Neil Brady How would they actually get in?https://cybercqr.com/tools/infographic-threat-modelling/2026-10-06T08:00:00Z2026-10-23T08:00:00ZInteractive board summary of threat modelling and the risk register it should produce. (Version 1.0)Neil Brady From STRIDE to MITRE ATT&CKhttps://cybercqr.com/papers/threat-modelling-stride-attack/2026-07-16T08:00:00Z2026-10-23T08:00:00ZSix-step method from data flow diagram to a scored, owned risk register, with a worked Conditional Access example. (Version 1.0)Neil Brady Don't be the easiest door on the streethttps://cybercqr.com/tools/infographic-local-locksmith/2026-09-30T08:00:00Z2026-10-23T08:00:00ZInteractive guide for small and medium-sized firms: what a passing attacker sees, and how to look less inviting. (Version 1.0)Neil Brady