Skip to content
AI R&D for your audit work, without building a team of your own. Become a Design Partner.Become a Design Partner.Apply to joinApply
Prufy
Login

Insights

Analysis.

Analysis of what an audit team reviews, tests and decides on technology, risk and regulation.

Audit effort does not follow the risk. Where to look before closing the plan.

Risk in Focus 2027 puts cybersecurity in 86% of plans and corporate governance in 13%, yet governance receives the fourth-highest level of audit effort. What to do with that mismatch.

3 min read

NIS2 is still not law in Spain. Your supply chain already applies it.

The European Commission referred Spain to the Court of Justice on 8 July and is asking for daily fines until it transposes. While the law waits, the obligation travels through contracts and lands in the audit plan.

3 min read

The shortage is of judgement, not headcount. What that means for the audit team.

The shortage that stalls an audit function is not of people, it is of judgement to read new situations. Where the judgement you already have is being spent today.

3 min read

The organisation slows down in August. Access does not.

In quiet periods sophisticated attacks do not increase, the time nobody is watching does. Four access checks that fit in one morning and leave evidence behind.

2 min read

Ransomware comes in through what nobody patched. Almost half of breaches run through a third party.

Ransomware appears in 48% of confirmed breaches and vulnerability exploitation is now the leading entry point. Another 48% of breaches involve a third party. What the auditor tests.

2 min read

What takes effect under the AI Act on 2 August and what doesn't.

Much of what is being published this week announces high-risk obligations for 2 August that the Digital Omnibus moved to December 2027. What actually applies that Sunday, and to whom.

3 min read

The Hugging Face breach. The first major incident executed by an AI agent, read by an auditor.

An autonomous agent penetrated Hugging Face's production infrastructure, harvested credentials and executed thousands of actions with no human operator. What this incident demands from an audit program.

3 min read

Governing AI agents. Shadow AI, the AI Act and the auditor's agenda.

Agentic AI is being deployed faster than audit plans incorporate it, employees already use AI on their own, and the EU AI Act already sets the calendar, even after the Digital Omnibus delay. The practical agenda.

3 min read

Generative AI in internal audit, the auditor's paradox.

The function that examines the whole organisation's technology is among the least technology-enabled in its own work. Where the real value is and which line it should not cross.

2 min read

Your audit intelligence belongs to you.

Request a demo

Designed around ISO/IEC 27001, ISO/IEC 42001 and SOC 2 and ready for certification.