Meet us at the Startup area, and at our workshop on Wednesday 7 October, 4:30 pm. Grimaldi Forum, a ten-minute pitch.
Book the workshopOur Assises workshopBY ROLE · CISO
Every Monday the same three questions arrive: are we exposed to the advisory in the news, which supplier can hurt us, and what did we accept and forget. Mindlapse answers from one register where every figure carries its evidence and its date.
Monday brief · Derogations with an expiry · A board pack from live data
Appetite No critical activity above residual 12 Approved by the executive committee · expires in 7 months
| Indicator | Value | Threshold | Trend | Snapshot |
|---|---|---|---|---|
| Critical activities above appetite Scope: Group Source: built-in feed | 1 of 8 | 0 , threshold breached | rising | yesterday |
| Overdue risk reviews Scope: Retail BU Source: built-in feed | 4 | ≤ 5 , approaching threshold | falling | yesterday |
| Derogations past expiry Scope: Group Source: built-in feed | 0 | 0 , within threshold | stable | yesterday |
| Critical suppliers below grade C Scope: Group Source: built-in feed | 2 | ≤ 2 , approaching threshold | stable | 2 days ago |
| Findings past their SLA Scope: Industrial BU Source: built-in feed | 4 | ≤ 10 , within threshold | falling | yesterday |
threshold breached: Breach alert sent to the risk owner · acceptance request opened
A KRI reads against the appetite the board approved; the daily snapshot is the date behind the number; a breach opens the acceptance request.
THE SITUATION
The posture lives in the SOC console, three spreadsheets and the auditor’s last report, and none of them agree.
Somebody accepted that risk in an email three years ago; nobody remembers who, why or until when.
Two evenings copying numbers into slides that are wrong by the time the board reads them.
A vulnerability in a product you run, and the first person to tell you is a journalist.
WHAT MINDLAPSE CHANGES
Surface: Risk Posture
Appetite statements with approval, expiry and breach alerts; acceptances signed on an authority ladder by residual band, so every accepted risk has a name and an end date.
Learn more
Surface: Action queue
Findings, remediation and derogations in one lifecycle with owners, deadlines and verified closure, and an escalation when a clock runs out.
Learn more
Surface: Mindlapse Trust Grade
Every critical supplier carries a Trust Grade computed from its assessment, its business impact and external ratings, weights in the open and recomputed overnight.
Learn more
Surface: Control Atlas
Every control carries dated, sourced evidence with its validation state; what has aged out is flagged before the auditor finds it.
Learn more
Surface: Cyber Cockpit
The board pack exports from the live register, in PDF or PowerPoint, and every figure opens on the risks, controls and evidence behind it.
Learn more
Surface: Risk Analysis
Likelihoods, scenarios and treatments proposed with a confidence level; accepting, correcting or rejecting is an explicit act, recorded with the person who made it.
Learn more
YOUR WEEK, YOUR QUARTER
Five moments a CISO recognises, and what the platform had already done when they arrived; then the three dates of the quarter that no longer start from a blank sheet.
Your week
alert: MON 08:40
Two advisories in the news, one supplier rating fell overnight.
The feeds matched both advisories to your systems; the one that matched moved a risk score and raised a finding.
Surface: Risk Register
TUE 11:00
A project asks to ship without MFA.
The request entered the derogation lane with compensating measures, an approver and an expiry.
Surface: Derogation lane
WED 15:30
The auditor asks for the access-review evidence.
It was on file: dated, sourced, verified.
Surface: Control Atlas
THU 09:00
A finding stalls past its SLA.
It escalated on its own to the next owner.
Surface: SLA scoreboard
verified: FRI 16:00
The COMEX slot.
Three decisions with owners and deadlines; the pack exported from the register.
Surface: Cyber Cockpit
Your quarter
WEEK 2
Risk review with the owners.
Overdue reviews surfaced on their own, with the owner and the last score.
Surface: Risk Register
WEEK 7
Supplier re-assessments.
They fired on expiring attestations, not on a calendar.
Surface: Supplier Hub
WEEK 12
The board pack.
Exported from the live register, PDF or PowerPoint, every figure one click from its evidence.
Surface: Cyber Cockpit
Illustrative week: the moments are fictional, the surfaces are the product’s.
FROM THE FIELD
CYBER COLLECTIVE LAB · Edition 4
What a CISO keeps after leaving the role: the edition that interviewed a former luxury-sector CISO turned Chief Data & Analytics Officer, on what a defensible posture looks like from the other side of the table.
Measured with our design-partner CISOs, figures under continuous validation.
UNDER THE HOOD
FAQ
The Risk Posture and the Action queue: advisories matched to your systems overnight, supplier ratings that moved, derogations expiring this month, findings past their SLA. Nothing is pulled from your telemetry: evidence is uploaded or connected, AI-validated and human-reviewed.
Not today: no cloud, identity or EDR connector is live yet. Security ratings, Slack and Microsoft Teams are available; the ticketing and procurement connectors, and CrowdStrike Falcon Cloud Security and Spotlight, are in the catalog with activation to come. Evidence is uploaded, AI-validated and human-reviewed, and coverage grows with your integrations.
From the Cyber Cockpit: exposure by business activity against the appetite the board approved, the decisions pending with their owners, and the cyber-risk policy the management body approved, published, versioned and attested by the people it binds. An Article 20 posture in business language, not in CVEs.
Yes. ISO/IEC 27005, EBIOS RM or NIST scoring run in the same register with scales per organization, and your existing frameworks import into the Control Atlas. The ISMS becomes verifiable rather than replaced.
Whoever the authority ladder names for that residual band: the required authority is frozen when the request is submitted, the acceptance is justified, owned and time-bound, and it expires.
Read it next
The register of information as living data, concentration on the chain, one control set for DORA and NIS2.
Learn more
Plants as entities, products under the CRA, OEM questionnaires answered from the atlas.
Learn more
One verified control set for the supplier, the buyer and the manufacturer you are at once.
Learn more
Also by outcome
GLOSSARY
POSTURE, VERIFIED
A live session on your structure: risks, exceptions, suppliers, the pack.
Our host’s audience measurement (Vercel) uses no cookies and is not covered by this choice. Google Analytics and marketing trackers stay off until you say otherwise. Read the cookie policy