Blog
Trends, News, Guides, and Our Expertise
Insights and expert knowledge on Digital Transformation, Risk Management, Information Security, and Regulatory Compliance
ChatGPT Lockdown Mode Bypassed: How Entire Chats Could Leak Without a Click
Check Point Research bypassed ChatGPT's Lockdown Mode. Via the HTML preview, entire chat histories could leak, with zero clicks in ChatGPT Classic. OpenAI has fixed it. What happened and what enterprises should learn from it.
Phil Hansen
November 11, 2026
Claude Code Leak: 31,088 Passwords and API Keys Exposed on GitHub
One click on "don't ask again" makes Claude Code store passwords and API keys in plaintext. GitGuardian counts 31,088 secrets on GitHub, 5,343 valid. What happened, how to check your repositories, and what enterprises should do now.
Phil Hansen
November 11, 2026
CoSnitch (CVE-2026-24301): How Microsoft Copilot Gave Away Its Own Flaw
CoSnitch (CVE-2026-24301) is a vulnerability in Microsoft Copilot Personal, the consumer assistant at copilot.microsoft.com, disclosed by Varonis Threat Labs. A single click on a crafted link was enough to read data from the victim's connected services, such as Gmail, Google Drive and Calendar, inside their signed-in session. Microsoft rates the flaw critical with a CVSS score of 8.8, while the NVD scores it 7.5. Microsoft fixed it server-side on 18 August 2026. No user action is required and there is no evidence of exploitation in the wild. According to Microsoft, enterprise Microsoft 365 Copilot was not affected.
Phil Hansen
November 03, 2026
AI Week Frankfurt 2026: ADVISORI at Booth 18
26–30 October 2026: meet ADVISORI at booth 18, see Boris Friedrich and Sarah Richter, and explore Synthara AI Studio and the AI Use Case Suite.
October 21, 2026
Trustworthy AI Framework: The BSI A5 Core Module in Practice
New EU requirements are turning trustworthy AI into a precondition that has to be demonstrated. With the BSI A5 Horizontal Trustworthiness Core Module, a cross-technology, cross-sector trustworthy AI framework is now available for the first time. This article sorts the 55 test criteria for AI systems by governance, data quality, transparency, fairness and security, explains the provider and deployer obligations under the EU AI Act, and shows in five phases how to establish AI governance in your organization, embed AI risk management and work towards EU AI Act compliance.
Dr. Helge Thiele
September 21, 2026
Real-Time Credit Risk Monitoring: The Five Components That Make It Work
Real-time credit risk monitoring is the continuous surveillance of credit engagements — data processed as it arrives, so a deteriorating exposure shows up in hours rather than at the next quarterly review. It rests on five components: data integration, processing and analysis, dashboards, notifications and scenario analysis. Here is what each one has to deliver, where each typically fails, and what the EBA Guidelines on Loan Origination and Monitoring expect on top.
Dr. Helge Thiele
September 18, 2026
Internal Credit Risk Rating: What are the Benefits for Banks?
Internal credit risk rating touches nearly everything a bank does — how much capital it holds, which loans it writes, what it charges, and how supervisors judge its management. Run well, it surfaces trouble in the loan book long before that trouble reaches the income statement. Here is what a strong rating function actually delivers.
Dr. Helge Thiele
September 17, 2026
EBA Draft RTS on Operational Risk Management Framework: What Article 323 CRR Now Requires of Institutions
Published on 26 August 2026 as EBA/CP/2026/18, the EBA draft RTS on operational risk management framework converts long-standing supervisory expectation into binding minimum requirements under Article 323(2) CRR. This article works through governance, the management process and the assessment system, and shows how much of the work turns on a single figure: the EUR 750 million business indicator threshold.
Dr. Helge Thiele
September 16, 2026
The EU AI Act for Banks: What 13 Years of BCBS 239 Are Really Worth in the Age of AI
The EU AI Act finds banks on familiar ground: data quality, data lineage, model risk management, and human oversight are disciplines that BCBS 239 has required since 2013 and that the ECB has tightened in its RDARR Guide. The head start is real, but limited. Three requirements have no equivalent in the current framework: bias and fairness controls, the explainability of model decisions, and the fundamental rights impact assessment under Article 27. An assessment that identifies specific areas requiring action.
Dr. Helge Thiele
September 04, 2026
AI-Ready Data: Assessing Your Data – The Data Quality Dimensions That Determine AI Success
AI readiness is decided earlier than most organizations expect — at the level of the data itself. This article sets out the data quality dimensions that make data AI-ready, places data readiness for AI within the regulatory framework from the EU AI Act to BCBS 239, and explains why the four classic quality dimensions are not sufficient for AI models.
Dr. Helge Thiele
September 03, 2026
The CRA Single Reporting Platform (SRP): status, registration and what to prepare
The Single Reporting Platform (SRP) is how manufacturers report under the Cyber Resilience Act from 11 September 2026. Till now it is not live, there is no API, and cross-border sharing is manual. What you can prepare regardless.
Boris Friedrich
August 31, 2026
AI Governance for Banks: Connecting Data, Models, and Internal Structures
AI governance does not replace what banks already do well. It builds on it. This article shows how data governance, model governance, and internal governance combine into a framework that satisfies supervisors and enables AI at scale: from dataset suitability and continuous monitoring to accountability across the three lines of defense.
Dr. Helge Thiele
July 30, 2026
Your strategic success starts here
Our clients trust our expertise in digital transformation, compliance, and risk management
Ready for the next step?
Schedule a strategic consultation with our experts now
Book Strategy Session30 Minutes • Non-binding • Immediately available
For optimal preparation of your strategy session:
Prefer direct contact?
Direct hotline for decision-makers
Strategic inquiries via email
Detailed Project Inquiry
For complex inquiries or if you want to provide specific information in advance