Cyber & AI Perspectives — Insights on Cybersecurity and AI Governance

Dejan Kosutic discusses whether security or compliance is more important and argues that this is the wrong question. He explains how compliance can support security through three “Bs”: acting as a booster by unlocking budgets when regulations or client requirements make security obligatory; providing a baseline via standards like ISO 27001 and technical security standards; and enabling a business...

Dejan Kosutic explains a common bias in cybersecurity: focusing on implementing controls but not managing them. Using backups as an example, he outlines why effective security requires planning (e.g., setting objectives like RPO and backup frequency), monitoring to ensure controls work in production, internal audits to verify tasks are performed, continual improvement to prevent recurring issues,...

Dejan Kosutic explains that while many companies believe they are prepared for disruptive incidents, their continuity and recovery plans alone are often insufficient. He argues that plans cannot replace missing resources such as redundant systems, properly secured backups, or replacement staff, and that unclear recovery time and data loss tolerances lead to misaligned preparations. He also notes t...

Dejan Kosutic explains how cybersecurity’s CIA Triad—confidentiality, integrity, and availability—has guided risk identification, prioritization, and control selection for decades, and argues that AI governance needs a similarly clear guiding principle: trustworthiness. Citing the OECD AI Principles, the EU AI Act, and the NIST AI Risk Management Framework, he describes trustworthiness as central...

Dejan Kosutic explains how cybersecurity can create a real competitive advantage and uses Apple as a key example. He notes many companies pursue ISO 27001 and similar certifications mainly for sales and market access, but questions whether certificates provide a lasting advantage since competitors can obtain them with relatively little time and money. He defines competitive advantage as having som...