Analysis and viewpoints from Woodlands Advisory – for decision-makers who understand security as business strategy.
News from Woodlands Advisory: partnerships, conversations with security organisations and developments within the team.
Six areas organise every post. AI and governance come first, cybersecurity and compliance follow as the second line. Each area leads into the filtered archive.
Posts on using AI in the enterprise: control, accountability, governance, and what attackers do with the same tools.
NIS2, the Cyber Resilience Act and further obligations: what applies, who is liable and what to do.
Situation reports, attack patterns and supply chain risks in the DACH region.
Security as a leadership task: market developments, budgets and conversations with large security organisations.
Posts from our archive on cyber assessments in acquisition and investment processes.
Partnerships, conversations and news from the Woodlands Advisory team.
Search by keyword, filter by area and format, or sort by date and reading time.
Checking invoices, chasing missing receipts, answering enquiries: what an AI agent is, how it takes a case from arrival to result by itself, and where people still decide. With seven examples from everyday work in mid-sized companies.
Risk classes, labelling duties under Article 50, AI literacy and the postponement of high-risk obligations by the Digital Omnibus: the state of the AI Act in autumn 2026, explained for decision-makers in mid-sized companies.
23 million members. 37 companies. One CISO. Woodlands Advisory spoke with Ümit Kuşdoğan, CISO of ADAC, about the topics that actually move enterprise security in 2026 — AI in security operations, third-party risk with regulated suppliers, regulation arriving in the audit, and AI sovereignty. The common thread: security has arrived in the business. The scarce resource is no longer budget. It is judgment.
On 30 June, Woodlands Advisory sat down with Robert Henninger, Head of Information Security at 1&1 — a group with roughly 16 million customer contracts and responsibility for meaningful parts of Germany's critical telecommunications infrastructure. Why the conversation was less a meeting than a confirmation. And what the IBM 2025 figures, NIS2, the EU AI Act, the CRA and DORA mean for the next few quarters.
Nine months ago, she tried to place me into a job. Today, she took one at Woodlands instead.
On 11 September 2026, the CRA's reporting obligation goes live — 24-hour early warning, 72-hour full notification, 14-day final report. Germany's BSI becomes the market surveillance authority. What that means for manufacturers, software vendors and M&A buyers in the DACH mid-market — and where the traps sit.
On a €120M target, a properly run cyber due diligence moves €2.4–9.6M of purchase price in expectation. Verizon–Yahoo cost 7.25% of EV. Marriott–Starwood showed what the missing DD costs. An analytical framing with the primary sources behind the claim.
In November 2025, Russell Reynolds reported that 72 percent of all PE firms in the US and Europe had a serious cyber incident inside a portfolio company within three years — averaging $3.4 million per incident. RSM, working from the consultant side, points to the underlying cause: a lack of visibility across the portfolio. For DACH operating partners, these are not US stories — they are an instruction for the next 24 months.
