Blog
Field notes on risk,
compliance, and AI.
Practical writing from the team building Scarlet Risk. No filler, no thought-leadership theater.
CMMC Level 1 for SMB suppliers: clear the bar without theater
Clear CMMC Level 1 by mapping asks to controls you already run — Confirmed, Partial, Gap — no costume CISO required.
Read article →What buyers actually ask vs what compliance dashboards show
Buyers ask for evidence that matches claims. Dashboards show scores. Bridge the gap with a living risk picture.
Read article →MSP angle: client AI tools that show up on the next questionnaire
Client AI tools will appear on the next security questionnaire. How MSPs inventory them before buyers ask.
Read article →Shadow AI inventory for teams without a compliance hire
Inventory AI tools that touch customer data in under 20 minutes — tool, data class, owner, review date. Governance without theater.
Read article →Five Cyber Awareness actions MSPs can run with every client this month
Five practical Cyber Awareness Month actions MSPs can run across every client — checklists you finish before lunch, not awareness cosplay.
Read article →ScreenConnect hit KEV again — the MSP insurer checklist that isn’t panic
ScreenConnect on CISA KEV is a habit cue. Four remote-access checks MSPs can prove for insurers — version, MFA, sessions, evidence.
Read article →How MSPs answer client security questionnaires without starting over
Stop rewriting every client security and cyber-insurance questionnaire. A reusable MSP playbook with evidence next to claims.
Read article →The one-page vendor risk questionnaire small businesses actually send
Skip the 200-question SIG. A 10–12 question vendor risk page SMBs and MSPs can finish before lunch — with evidence next to every yes.
Read article →Better Together: Scarlet Risk Partners with Qualiex
Scarlet Risk and Qualiex partner to connect AI risk intelligence with quality management, helping businesses manage risk, compliance, and quality together.
Read article →When AI Agents Move at Machine Speed: Rebuilding the Incident Response Playbook
Machine-speed AI agents compress reconnaissance, credential use, and lateral movement into hours. CISOs need pre-authorized, bounded, observable, and human-governed incident response.
Read article →Shadow AI Is the Risk Nobody's Tracking
Employees adopted AI before your company had a policy. Here is how small and midsize businesses discover shadow AI use, judge the exposure, and turn findings into documented decisions.
Read article →Beyond the Audit Checklist: Why AI Agent Governance Requires Real-Time Visibility
Point-in-time audits cannot govern autonomous AI agents. Why AI agent governance needs continuous behavioral visibility, tested kill switches, and real-time risk monitoring.
Read article →ISO 42001 vs. SOC 2 vs. NIST AI RMF: Which AI Governance Framework Fits Your Business?
Compare ISO/IEC 42001, NIST AI RMF, and SOC 2 to determine the right AI governance framework for your organization, risk profile, and customer assurance needs.
Read article →Pay-As-You-Go Security Tools, Shadow AI Governance, and Agent Mode: Everything Scarlet Risk Shipped Today
Scarlet Risk launched a pay-as-you-go Store (phishing simulator, offboarding sweeper, risk reports), the Scarlet Governance shadow AI module, four new guides, and Agent Mode waitlists.
Read article →CIRCIA's Final Rule Is Coming: Are You a Covered Entity?
CISA's CIRCIA rule would require 72-hour incident reporting and 24-hour ransomware payment reporting. A practical readiness guide for healthcare and defense organizations.
Read article →Why Your Startup Needs a Foundational Security Stack, Not Just a SOC 2 Checklist
SOC 2 automation tools document controls — they don't create them. Why startups should build a foundational security stack before buying a compliance platform.
Read article →Beyond the Checklist: Why Your SOC 2 Readiness Assessment Is Missing the Point
Most SOC 2 readiness assessments audit your paperwork, not your security. Here's why foundational controls — not document collection — determine real audit readiness.
Read article →CMMC Phase 2 Is Suspended — Here's What SMB Defense Contractors Should Actually Do Now
On July 13, 2026, the DoD paused mandatory third-party CMMC Phase 2 certification. Self-assessment obligations are still live. Here's what SMB defense contractors need to do now — and what changes if the pause lifts.
Read article →State Privacy Law Grace Periods Are Disappearing: What SMBs Must Do Before They Get Fined
State privacy law cure periods that let SMBs fix violations before fines are expiring in 2026 — turning quiet compliance gaps into $2,500 to $20,000 per-record exposure. Exactly what to fix before regulators come calling.
Read article →The Preparedness Gap: Only 34% of Small Businesses Have a Written Incident Response Plan
Only 34% of SMBs have a written incident response plan. The gap between feeling prepared and being prepared is where breaches turn into business-ending events — and it isn't a knowledge problem.
Read article →AI Just Ran a Ransomware Attack Without a Human at the Keyboard. SMBs Should Pay Attention.
JadePuffer is the first documented end-to-end, LLM-driven ransomware attack — an AI agent ran the entire kill chain in seconds. Here's why SMBs are the most exposed.
Read article →Autonomous AI Ransomware Is Here: What SMBs Need to Know About the JADEPUFFER Attack
Sysdig reported JADEPUFFER, the first autonomous AI ransomware attack. Here's why SMBs can no longer rely on 'too small to target' — and what to do instead.
Read article →Compliance Automation vs. Risk Intelligence: What SMBs Actually Need
Compliance automation tools like Vanta, Drata, and Sprinto get you audit-ready. Risk intelligence tells you what's actually putting your business at risk. Here's the difference — and which one SMBs need first.
Read article →AI Jailbreak Risk Framework: What SMBs Must Know About Anthropic's New Severity Scoring
Anthropic's new AI jailbreak severity framework is a step forward — but it's also the labs grading themselves. Here's what SMBs should actually do with it, from vendor risk to operational planning.
Read article →CMMC 2026 Deadlines: What DoD Contractors Must Do Before October 31
CMMC hits every new DoD solicitation on October 31, 2026, and Level 2 requires C3PAO certification starting November 10. With ~80,000 contractors chasing fewer than 100 assessors, here's what to do now.
Read article →What the FTC's AI-Accuracy Policy Statement Means for SMBs Deploying AI
The FTC's July 2026 proposed policy statement on AI accuracy isn't just a big-lab problem. Here's what it means for SMBs and MSPs marketing AI-powered products — and why certification won't save you.
Read article →"Shadow AI" Is Now the Most Expensive Thing in an SMB Breach
Shadow AI is now the most expensive variable in an SMB breach — costing $670,000 more on average. Here's what it is, why it matters, and how to govern it before it costs you.
Read article →CMMC Phase 2 Deadline: What SMB Defense Contractors Must Do Before November 2026
With ~80,000 defense contractors needing CMMC Level 2 certification and only ~80 C3PAOs available, SMBs that wait past summer 2026 will miss the window entirely. Here is what to do now.
Read article →How to Get Audit-Ready in 30 Days Without Hiring a Consultant
A practical 30-day roadmap for SMBs to get audit-ready for SOC 2, ISO 27001, or HIPAA without a consultant or a massive budget. Step by step, AI-assisted.
Read article →Vendor Risk Management for Small Businesses: A 30-Minute Setup Guide
How small businesses can stand up a credible third-party risk program in 30 minutes — what to track, which vendors actually matter, and the questionnaire you can copy today.
Read article →ISO 27001 vs SOC 2 for SMBs: Which Certification Should You Pursue First?
A plain-English comparison of ISO 27001 and SOC 2 for small and mid-sized businesses — costs, timelines, what auditors actually check, and how to decide which one your buyers care about.
Read article →