ARTICLES

DORA and NIS2 now put personal liability for cyber risk oversight on management bodies. This piece sets out why compliance is not a substitute for a real decision framework, and what such a framework has to contain.

Cyber risk decisions rest on information shaped by every actor who passes it along. This piece maps the incentive architecture that produces that distortion, and what it takes to see through it.