The Nexus Signal #01: the four shifts driving security roadmaps in 2026

Welcome to The Nexus Signal. One email a week, four short sections, written for people who have to act on security news rather than forward it. Here is the format, and the state of play as we start.

Signal — what is actually changing

Four shifts are doing most of the work in security roadmaps right now, and none of them are a single vulnerability.

• AI systems became in-scope assets. Models, prompts, retrieval corpora and agent tools are now things a security team owns. The OWASP Top 10 for LLM Applications and MITRE ATLAS give the field its first shared vocabulary for talking about them.
• Identity is the control plane. Zero Trust and SASE programs succeed or fail on whether the organisation can say which identities should reach which applications. Most cannot, which is why so many programs stall before the first purchase.
• Compliance is becoming machine-readable. FedRAMP 20x and its Key Security Indicators point at a future where evidence is produced continuously by the system rather than written annually by a consultant.
• Product regulation arrived. The EU Cyber Resilience Act turns secure development, vulnerability handling and update support into market-access conditions for connected products.

Regulation watch

• EU AI Act — obligations phase in over time by risk tier. The work that pays off now is classification: knowing which of your systems are high-risk before someone asks.
• HIPAA Security Rule — the proposed modernisation moves encryption, MFA, asset inventory and segmentation away from being treated as optional. Practices that implement early convert a deadline into completed work.
• ISO 27001:2022 — transition deadlines have passed for most certified organisations; surveillance audits are now testing the Annex A 2022 structure in earnest.
• CMMC — self-assessment scores in SPRS are increasingly checked rather than assumed. Optimistic scoring is now a contract risk.

Fix of the week

Pick one namespace in your Kubernetes cluster and apply a default-deny ingress NetworkPolicy, then add explicit allow rules until the workload works again. It takes an afternoon in a staging cluster and it produces something valuable beyond the policy itself: an accurate list of what that workload actually talks to. Almost nobody has that list, and almost everybody assumes it is shorter than it is.

Learning path

If the AI section landed closest to your week, start with the OWASP LLM Top 10 and work it hands-on rather than reading it. If it was the compliance section, the highest-leverage document in your organisation is probably the one nobody has read end to end — the Statement of Applicability, the System Security Plan, or the risk analysis. Read it and see whether it describes the company you actually work at.

That is the format: Signal, Regulation watch, Fix of the week, Learning path. Every Wednesday, and never longer than this.