Insights

Articles, blog & news

Perspectives on Agentic Assurance, NCSC CAF programmes, product updates, and the evolving practice of evidence-led cyber assurance.

Layered illustration of essential services, technical controls and governance connected by data flows, with an orange resilience path highlighted through the stack

Article4 November 202612 min read

The UK's New Cyber Security Law Changes the Question: Can You Prove Resilience?

The Cyber Security and Resilience Bill signals a significant development in UK cyber regulation. But beyond the expanded scope and reporting requirements lies a more fundamental challenge for organisations: demonstrating that their security controls actually deliver the resilience they claim.

Futuristic illustration of organisational assets flowing into a central assurance hub and out as evidenced reports, charts and challenged findings

Article22 September 202614 min read

Who Assures the Assurer? Why Cyber Security Is Rediscovering Independent Testing

Policies, dashboards and self-assessments can tell an organisation what it believes about its security. This article explains why effective assurance increasingly requires evidence that those beliefs can survive independent challenge — from declared and evidenced controls through to adversary simulation and independently testable conclusions.

Analyst in a night-time command centre with a holographic evidence pipeline turning fragmented cyber data into a timed, decision-ready assurance report

Article14 September 202612 min read

The 24-Hour Cyber Clock Has Started: Can You Prove What You Knew, When You Knew It — and What You Did?

Cyber regulation is beginning to measure organisations in hours rather than audit cycles. This article explains why incident response plans alone cannot meet 24-hour reporting clocks, why evidence relationships and provenance matter, and how decision-ready assurance turns evidence into a defensible answer before the clock runs out.

Illustration of chaotic cyber evidence documents flowing through an analysis pipeline into a verified assurance checkmark

Article7 September 202614 min read

You Have Evidence. But Does It Prove the Control Works?

Cyber security teams rarely lack evidence — policies, screenshots, reports and more. This article explains why evidence of existence is not evidence of effectiveness, how CAF 4.0 makes that distinction explicit, and how CyConex helps assessors reason across evidence to form defensible assurance conclusions.

CyConex AI assurance and governance platform diagram showing agent authority, controls, observability and defensible evidence for autonomous AI agents

Article26 August 202616 min read

Your AI Agent Has Credentials, Tools and Autonomy. Can You Prove It Is Under Control?

The NCSC’s 20 August 2026 agentic AI guidance asks organisations to prove autonomous agents operate within understood boundaries. This article explains why credentials define blast radius, why autonomy is a risk decision, and how CyConex builds defensible Agent Assurance Records.

CyConex recovery assurance diagram showing disruption and uncertain priorities flowing into evidence-based minimum viable operations

Article16 August 202614 min read

When Cyber Attacks Stop the Business: Can You Prove What Must Be Restored First?

The NCSC’s 28 July 2026 recovery guidance asks organisations to restore minimum viable operations, not just systems. This article explains why backup is not recoverability, how business outcomes should drive recovery sequencing, and how CyConex turns continuity artefacts into a defensible resilience position.

CyConex AI Assurance Platform diagram showing AI adoption gaps flowing into evidence-based governance and a ready AI Assurance Pack

Article6 August 202614 min read

The EU AI Act Is Now Enforceable: Can You Prove Your AI Is Governed?

On 2 August 2026, applicable EU AI Act provisions became enforceable. This article explains why UK organisations still need evidence-based AI governance, how obligations depend on context and classification, and how CyConex supports the full AI Act compliance lifecycle with a defensible Assurance Pack.

CyConex Evidence Analysis and Assurance Engine turning unsupported vendor claims into a defensible Assurance Pack

Article2 August 202612 min read

Secure by Design Is Not Enough: Can Your Software Vendor Prove It?

Secure by design is the right principle, but a promise is not proof. This article explains how the UK Software Security Code of Practice and NCSC claims shift the focus to evidenced assurance, and how CyConex turns fragmented vendor artefacts into a defensible Assurance Pack.

Assessor reviewing a holographic flow from fragmented compliance evidence through CyConex risk logic to verified business outcomes

Article15 July 202612 min read

Beyond Compliance: Can You Prove Your Cyber Controls Protect What the Business Cannot Afford to Lose?

A green compliance dashboard can hide weak assurance. This article explains the difference between compliance and assurance, why unacceptable losses should guide cyber evidence, and how CyConex connects controls, evidence and risk appetite into board-level confidence.

Illustration contrasting a frozen annual audit with a live continuous CAF assurance dashboard and timeline

Article12 July 20268 min read

CAF as a Continuous Programme, Not a Point-in-Time Audit

Most organisations still treat NCSC CAF as a once-a-year deliverable. This article explains why continuous assurance is a better fit for how cyber risk actually behaves, and how scheduled runs, an assurance history, and shareable live posture turn CAF into a programme you run rather than an event you survive.

Illustration of security evidence screened and sanitised before reaching a secure UK-hosted AI model

Article12 July 20267 min read

Is It Safe to Use AI on Security Evidence? How CyConex Screens and Sanitises

The most common objection to AI-assisted assurance is a reasonable one: nobody wants to hand their security policies to a black box. This article explains the real risks of pointing AI at security evidence, and how CyConex screens for prompt-injection, sanitises sensitive data before it reaches a model, and keeps everything auditable and in the UK.

Illustration of a maturity path from Cyber Essentials to NCSC CAF on one shared evidence platform

Article12 July 20267 min read

From Cyber Essentials to CAF: A Maturity Path

Cyber Essentials and NCSC CAF are often treated as separate worlds. This article shows how they fit on a single maturity path, and why starting with Cyber Essentials on the same platform you will later use for CAF saves rework, preserves evidence, and makes growth manageable.

Scattered cyber security evidence sources flowing into a structured, assessment-ready CyConex Assurance Pack

Article10 July 202611 min read

From Evidence to Assurance: Why Cyber Compliance Needs a Defensible Evidence Pack

Evidence on its own does not create assurance. This article explains why cyber compliance needs a defensible, traceable evidence pack that connects requirements to evidence, rationale, confidence and action, and how CyConex turns scattered evidence into a structured assurance asset.

Frozen paper-based audit records transforming into a live, continuous cyber assurance dashboard

Article8 July 202612 min read

The End of Point-in-Time Assurance

Cyber risk does not move in annual cycles. This article explains why periodic, document-heavy assurance is no longer enough, and how continuous, evidence-driven and risk-informed assurance gives boards a living view of whether controls remain sufficient for the risks they cannot accept.

Infographic showing evidence complexity flowing through CyConex AI-assisted assurance to CAF assessment readiness with objective coverage, gap analysis and confidence scoring

Article5 July 202620 min read

Understanding the NCSC CAF Assessment Process: From Evidence Collection to Assessment Readiness

How the NCSC Cyber Assessment Framework assessment process works, why evidence management matters, and how CyConex helps organisations prepare for CAF assessment with greater confidence and lower effort.

Infographic showing evidence inputs flowing through an Agentic AI Assurance Engine with human review to an Assessment Readiness dashboard with framework coverage, control gaps and risk heatmaps

Article2 July 202618 min read

Your Own Personal Assessor: How Agentic Assurance Changes Cyber Certification Preparation

What if every organisation could have its own personal cyber assurance assessor — an always-available companion that reviews evidence, identifies gaps, and helps you prepare with confidence long before the formal assessment begins?

Infographic showing unstructured evidence from SharePoint, email, GRC platforms and technical tools flowing through an Intelligent Assurance Engine to a structured assurance dashboard with framework coverage, control heatmaps and evidence mapping

Article30 June 202616 min read

Why Evidence Mapping Is the Hardest Part of Cyber Assurance

Most organisations already have evidence — policies, reports, risk registers, and technical outputs. The hard part is proving that the right evidence supports the right requirement, in the right framework, to the right level of confidence.

Illustration of CyConex CAF readiness workflow: evidence and critical infrastructure data flowing through a processing hub to a CAF Readiness dashboard showing objectives A through D

Article28 June 202618 min read

The NCSC Cyber Assessment Framework: Turning Cyber Resilience into Measurable Assurance

The NCSC Cyber Assessment Framework helps organisations move from general belief in security to evidence-based assurance of cyber resilience. CyConex accelerates CAF preparation by mapping scattered evidence to framework outcomes.

Infographic showing the agentic assurance workflow from evidence ingestion through AI analysis to human review, with review, challenge, justify, and validate steps

Blog26 June 202615 min read

Agentic Assurance Still Needs the Human Assessor

Agentic assurance can ingest evidence, map controls, and highlight gaps at scale — but it changes the role of the human assessor rather than removing it. Professional judgement, risk context, and accountability must remain with qualified assessors.

Diagram showing fragmented assurance evidence flowing through CyConex agentic AI processing to an Assessment Ready dashboard with evidence counts, control progress, gaps, and confidence scoring

Blog23 June 202614 min read

The Hidden Challenge of Assurance Assessments: Finding the Evidence, Understanding the Context, and Identifying the Gaps

Evidence usually exists — but it is scattered, hard to interpret, and disconnected from control requirements. Assurance preparation becomes a manual search exercise until teams can read, connect, and gap-assess evidence at scale.

Diagram of the Agentic Assessment Engine: evidence flows from policies and audit logs through AI analysis with human validation to control status, gap analysis, and audit readiness dashboards

Blog21 June 20268 min read

Introducing Agentic Assurance and Compliance Assessments

Compliance assessments are slow, manual, and resource intensive. Agentic assurance uses AI agents to interpret control requirements, review evidence, and explain whether requirements are met — transforming how organisations prepare for NCSC CAF, ISO 27001, and similar frameworks.

CyConex projects supporting multiple assurance frameworks

News20 June 20263 min read