Words matter. Especially when organisations are making strategic decisions. One of the biggest problems across cyber security, governance, risk, resilience and quantum isn't technology. It's language. Different vendors define the same term differently. Standards use different terminology. Consultants invent new phrases. Boards are expected to make decisions using inconsistent vocabulary. That creates confusion before the real work even starts. To address that, we've made the

Cyber threats evolve rapidly. Institutions in the Gulf Cooperation Council (GCC) face increasing risks. These risks target critical infrastructure, financial services, government operations, and healthcare systems. Strengthening cyber resilience is no longer optional. It is essential for survival and growth. I explore effective cyber resilience strategies tailored for GCC institutions. I provide practical insights and actionable steps to enhance security posture and operation

SITG-Consulting delivers specialized expertise in cyber security, quantum technology, and regulatory compliance. The firm supports global enterprises, financial services, critical infrastructure, government, and healthcare sectors. SITG Consulting helps organizations build resilience and achieve sustainable transformation. The focus lies on forensic insight and strategic governance. This approach prepares clients for future risks and evolving threats. Core Competencies of SIT

How “The Machine Doesn’t Exist” Became a Strategy for Doing Nothing PQC denial doesn’t look like a typical internet conspiracy theory. It doesn’t scream on dark web forums; it wears a tailored suit, speaks with a polished executive drawl, and masquerades as "reasonable, pragmatic risk management." It sounds like someone who has read a few academic papers, knows the current hardware constraints, and wants you to believe quantum risk is just a sci-fi distraction cooked up by ve

𝐘𝐎𝐔 𝐇𝐀𝐕𝐄𝐍'𝐓. 𝐅𝐅𝐒. Every few weeks someone announces the next revolution. AI Governance. Quantum Governance. Sovereign Intelligence. Machine-Layer Authority. Algorithmic Governance. No. You've discovered a new technology, a new risk profile or a new application. You haven't discovered a new discipline. So let me ask one question. 𝐖𝐡𝐲 𝐝𝐨 𝐲𝐨𝐮 𝐭𝐡𝐢𝐧𝐤 𝐲𝐨𝐮'𝐯𝐞 𝐬𝐮𝐝𝐝𝐞𝐧𝐥𝐲 𝐟𝐨𝐮𝐧𝐝 𝐭𝐡𝐞 𝐜𝐮𝐫𝐞 𝐟𝐨𝐫 𝐞𝐯𝐞𝐫𝐲𝐭𝐡𝐢𝐧𝐠 𝐠𝐨𝐯𝐞𝐫𝐧𝐚𝐧𝐜𝐞 𝐡

Brian Couzens Founder & CEO, SITG-Consulting | Forensic Strategist | Cyber Resilience, Quantum Risk & Governance | Transformation, ERM & Independent Validation | Writer | White Paper Author | Evidence-Based Decision Making June 29, 2026 This week featured an unusually dense cluster of consequential announcements across PQC governance, quantum hardware, capital formation, and infrastructure standardisation. The United States signed two executive orders simultaneously on 22 Jun

For years, agencies have discussed preparing for the quantum threat. Most of that discussion remained in strategy and long-term planning. That changed when OMB released M 26 15. This memo is not a discussion document. It is an operational order. It mandates every civilian agency to begin the transition to post-quantum cryptography now. It defines the work, sets deadlines, and assigns responsibilities across leadership teams. The quantum threat is no longer a future scenario.

When the President issued the Executive Order on Securing the Nation Against Advanced Cryptographic Attacks earlier this week, the internet and linked was flooded with high-level hot takes most of which was nonsense. And high-level mandates don't secure networks. Operational playbooks do. The EO gave the Office of Management and Budget (OMB) up to 90 days to issue official guidance. Instead, the federal government moved in an unprecedented 48-hour turnaround, dropping Memoran

Technology is becoming more complex. Regulatory expectations continue to increase. Boards are expected to make critical decisions based on information that is often fragmented, inconsistent or unsupported by evidence. SITG-Consulting exists to solve that problem. We are an independent transformation, governance and assurance consultancy that helps organisations establish control across complex technology, cyber security, regulatory and cryptographic environments. Our work sup

Science is doing exactly what science is supposed to do. A new peer-reviewed critique published in Nature has challenged aspects of Microsoft's Majorana-based quantum computing research, arguing that the evidence may not conclusively demonstrate the physics the company claims. Microsoft strongly disagrees and maintains its roadmap remains on track. This is not a story about Microsoft "failing." It is a reminder that extraordinary scientific claims invite extraordinary scienti

NIST CSF 2.0 may be one of the most important Quantum Readiness frameworks available today. Not because it contains a section on quantum computing. It doesn't. Not because it tells organisations which algorithms to deploy. It doesn't do that either. What CSF 2.0 does provide is something far more important. Governance. The 2024 update elevated governance to a core function, recognising that cybersecurity is no longer solely a technology challenge. It is a board, executive and

This week I read the best description of how to measure success against quantum risk. It comes from a recent Department of War (DoW) strategy document, and it is a breath of fresh air. 𝐈 𝐪𝐮𝐨𝐭𝐞: "Quantum resistance is not achieved when PQC is rolled out, but when quantum-vulnerable solutions are deprecated." Let's dissect what that means because it cuts straight through the marketing theatre dominating cybersecurity right now. 𝐃𝐞𝐟𝐢𝐧𝐞:"Quantum-Vulnerable" Any algor

We built a digital society on a promise we never had the means to keep. Quantum computing is not the threat. The breach of that promise is. --- For two decades, boards have governed cryptographic risk as though it were an accounting category. If the balance sheet survives, the regulator is satisfied, and the insurance renewal clears, the assumption is that the risk has been managed. Quantum computing destroys that assumption. Not because it introduces a new cost line, but bec

The DoW just gave us a document worth promoting - my favourite line is 𝐐𝐮𝐚𝐧𝐭𝐮𝐦 𝐫𝐞𝐬𝐢𝐬𝐭𝐚𝐧𝐜𝐞 𝐢𝐬 𝐧𝐨𝐭 𝐚𝐜𝐡𝐢𝐞𝐯𝐞𝐝 𝐰𝐡𝐞𝐧 𝐏𝐐𝐂 𝐢𝐬 𝐫𝐨𝐥𝐥𝐞𝐝 𝐨𝐮𝐭, 𝐛𝐮𝐭 𝐰𝐡𝐞𝐧 𝐪𝐮𝐚𝐧𝐭𝐮𝐦-𝐯𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐥𝐞 𝐬𝐨𝐥𝐮𝐭𝐢𝐨𝐧𝐬 𝐚𝐫𝐞 𝐝𝐞𝐩𝐫𝐞𝐜𝐚𝐭𝐞𝐝. The Department of War’s Post-Quantum Cryptography Strategy landed just a day or so ago, but it deserves far more attention than it’s getting. In my view, it is much more relevant and operationally impor

The #EO isn’t a genesis point - it is a compliance hammer. There is an immense amount of noise surrounding the newly issued Executive Order 14409, "Securing the Nation Against Advanced Cryptographic Attacks." Many commentators treat it as a sudden wake-up call that magically creates a post-quantum cryptography (PQC) migration strategy out of thin air. Before making that claim, look at what already existed. Federal policy did not start on 22 June 2026. Agencies have been opera

Brian C Founder & CEO, SITG-Consulting | Forensic Strategist | Cyber Resilience, Quantum Risk & Governance | Transformation, ERM & Independent Validation | Writer | White Paper Author | Evidence-Based Decision Making June 23, 2026 The week of 15–21 June 2026 was defined by the simultaneous arrival of sovereign standards architecture, capital deployment, legislative governance, and market formation across four continents. No single country dominated; the signals ran in paralle

That should concern every board, regulator, CISO and risk committee still treating post-quantum cryptography as a distant technology problem. The United States has issued a new Executive Order accelerating PQC migration requirements. Notably: • PQC key establishment for High Value Assets by 31 December 2030 • PQC digital signatures for High Value Assets by 31 December 2031 This is the second major shift in federal timing expectations. That matters. Governments do not compress

𝐈𝐍𝐓𝐄𝐋𝐋𝐈𝐆𝐄𝐍𝐂𝐄 𝐁𝐑𝐈𝐄𝐅 ISO/IEC 18033-2:2006/Amd 2:2026 has published. Three post-quantum KEMs now sit inside one of the principal international standards for asymmetric encryption: ML-KEM, Classic McEliece and FrodoKEM. Read that again. Not one algorithm. Three. From three different mathematical families. Why this matters before the detail. A standards body had a choice. It could have ratified the market's preferred answer, ML-KEM, and closed the question. It did

Is it just me, or has the World become one giant credential parade? I am going to try and make this a regular feature. The working title is: **The Sunday Slop** *Another week. Another guru.* Former Navy SEAL. Former Secret Service. Former MI6. Former Commando. Former Special Operations. Former Intelligence Officer. Former Special Agent. Former Operator. Former Tactical Something. Former Strategic Something Else. At this point I am beginning to wonder whether LinkedIn has a mi

The disclosure of 73,932 compromised Fortinet firewall URLs is not just another VPN incident. It is a cryptographic governance failure at global scale and a perfect illustration of why organisations must treat HNDL (Harvest Now, Decrypt Later) and HNFL (Harvest Now, Forge Later) as present-tense operational risks rather than abstract quantum-era hypotheticals. The incident was empirically documented by Volodymyr "Bob" Diachenko, who discovered the attacker-controlled server c