Resources
Resources.
Checklists, daily field notes and one article, published by Velinor.
Readiness checklists
- DCC readiness checklistTwelve questions on which Defence Cyber Certification level your contracts require.Checklist · 12 questionsOpen DCC readiness checklist
- CAF readiness checklistTwelve questions on where your NCSC CAF evidence stands.Checklist · 12 questionsOpen CAF readiness checklist
Picket field notes
One useful thing a day about what is exposed and what to fix first.
- 69,615 CVEs published this year. About one in 450 is known exploited.One number · 4 Oct 2026Open 69,615 CVEs published this year. About one in 450 is known exploited.
- 283 vendors appear in the KEV catalogue. 77% of entries are not Microsoft.One number · 3 Oct 2026Open 283 vendors appear in the KEV catalogue. 77% of entries are not Microsoft.
- A local vulnerability is not a low priority oneThe misread · 2 Oct 2026Open A local vulnerability is not a low priority one
- 91 added to KEV since July. 15 are tools that build or run software.Exploited this week · 1 Oct 2026Open 91 added to KEV since July. 15 are tools that build or run software.
- An accepted risk needs an owner and an expiry date.Method · 30 Sep 2026Open An accepted risk needs an owner and an expiry date.
AI Assurance
- What is AI governance?The leadership discipline that keeps AI safe, transparent and accountable, and why it is now a board-level obligation.James A. Lang · March 2026Open What is AI governance?