Practitioner-grade threat intelligence and enterprise risk analysis.
The Rogue Risk Analysis Group produces a quarterly advisory written and curated by practitioners with careers spanning federal law enforcement, intelligence community engagement, corporate security executive leadership, and enterprise risk governance.
Each advisory is structured around the Nexus of Risk framework: the intersecting domains of cyber, physical, and human capital risk that constitute the unified consequence chain every enterprise must govern. RRAG does not produce vendor-neutral product reviews or compliance checklists. It produces strategic intelligence for leaders who need to make resource and governance decisions under conditions of genuine uncertainty.
Quarterly. Each advisory covers a 90-day risk horizon with forward-looking indicators for the subsequent quarter.
Written advisory delivered digitally. Structured for executive review and team distribution within the purchasing organization.
Purchase publications individually through the catalogue.
Purchase individual Risk Advisories ($295) and White Papers ($750).
Browse the catalogueRisk Advisory
Cyber insurance policies may exclude attacks linked to state actors, leaving organizations exposed to threats they are most likely to face.
The advisory explains how attribution can affect coverage and recommends reviewing policies, closing gaps that could support a denial, and strengthening incident response plans.
Risk Advisory
On 21 October 2026 the U.S. Secret Service National Threat Assessment Center released its first behavioral threat assessment guidance written for employers rather than for law enforcement or schools. The guidance is free and public, which changes the standard a small or midsize employer is held to: "we did not know how" is now a materially weaker position in litigation and before regulators.
The harder question the guide does not answer is ownership. NTAC's study of 173 mass attacks found that most attackers had already alarmed the people around them. In a 200-person organization those concerns land with HR or a line manager who has no process for weighing them, no clinical or legal advisor on call, and no threshold for escalating.
This Advisory sets out who should own behavioral threat assessment in an organization without a security department, how to stand up a three-seat team with a bypass reporting channel, which advisors to retain before you need them, and a 90-day build path. It situates the exposure across the Physical, Operational, Reputational, Financial and Strategic risk domains of the Nexus of Risk framework.
Risk Advisory
China's export controls on rare earths and strategic minerals have moved from expanded rules into active enforcement, administered through a non-automatic licensing regime with fixed whitelists and per-shipment approvals.
For most mid-market firms the exposure sits two to four tiers below their direct suppliers and is therefore unmeasured. The operative risk is not price. It is a supplier who cannot commit to a delivery date and will not say why, which converts a bounded cost variable into an unbounded schedule variable.
This Advisory sets out the licensing mechanics that matter, where the exposure actually sits in a mid-market bill of materials, and the five questions a leadership team should be able to answer about it.
A Risk Briefing is forty-five minutes with a senior practitioner. You leave with a straight answer on the fastest path forward, whether or not it runs through us.
Request a Risk Briefing