https://firrisk.ai/tags/internal-controls/Recent content in Internal Controls on FIR Risk Advisory | Risk Intelligence. Engineered.Hugoen-usWed, 28 Oct 2026 00:00:00 +0000https://firrisk.ai/intel/intel-42-the-first-email-asks-for-nothing/Wed, 28 Oct 2026 00:00:00 +0000https://firrisk.ai/intel/intel-42-the-first-email-asks-for-nothing/<h2 id="the-intel" class="heading ">The INTEL<a href="#the-intel" aria-labelledby="the-intel"> <!-- <i class="fas fa-link anchor"></i> --> <svg class="svg-inline--fa fas fa-link anchor" fill="currentColor" aria-hidden="true" role="img" viewBox="0 0 576 512"><use href="#fas-link"></use></svg>&nbsp; </a> </h2> <p><strong>Microsoft detected more than 46 million business impersonation attacks in 12 months, and almost none of them opened by asking for money. By June 2026, just 3% of first messages contained a financial or document request, down from 17% in October 2025. The rest said things like &ldquo;Are you at your desk?&rdquo; or &ldquo;Do you have a moment?&rdquo;</strong></p>https://firrisk.ai/tuesday/e95-the-labs-agree/Tue, 27 Oct 2026 00:00:00 +0000https://firrisk.ai/tuesday/e95-the-labs-agree/<h2 id="when-the-builders-write-the-warning-label" class="heading ">When the builders write the warning label<a href="#when-the-builders-write-the-warning-label" aria-labelledby="when-the-builders-write-the-warning-label"> <!-- <i class="fas fa-link anchor"></i> --> <svg class="svg-inline--fa fas fa-link anchor" fill="currentColor" aria-hidden="true" role="img" viewBox="0 0 576 512"><use href="#fas-link"></use></svg>&nbsp; </a> </h2> <p>Last week, in <a href="https://firrisk.ai/tuesday/e94-shift-in-the-physics-of-cyber-risk/">E94</a>, Microsoft told boards that no AI agent should run without a human who answers for it. This week we went to the source: the AI labs that build the agents. We read what OpenAI, Anthropic and Google have each published on securing agents, and checked it against OWASP&rsquo;s two independent Top 10 lists, one for AI applications and one for agents.</p>