Ancveirs — publicationshttps://ancveirs.lv/en/articles/Cybersecurity, digital governance, FinTech, RegTech and responsible AI.enTue, 06 Oct 2026 00:00:00 GMTElection resilience starts before the incident: what I proposed to the CEC and what Latvia's 2026 election showedhttps://ancveirs.lv/en/articles/election-resilience-before-the-incident/https://ancveirs.lv/en/articles/election-resilience-before-the-incident/Before the election I submitted a resilience checklist to Latvia’s CEC. Election week showed why fallback modes, readiness evidence and feedback loops matter.Tue, 06 Oct 2026 00:00:00 GMTGood-Faith Security Research in Europe: Where Is the Authorization Boundary?https://ancveirs.lv/en/articles/good-faith-security-research-europe/https://ancveirs.lv/en/articles/good-faith-security-research-europe/Where does good-faith vulnerability research stop being permitted testing? NIS2, cybercrime law, CVD and a documented Latvian case study.Sat, 26 Sep 2026 00:00:00 GMTCVD, Bug Bounty and Penetration Testing Are Not the Same Thinghttps://ancveirs.lv/en/articles/cvd-bug-bounty-penetration-testing-differences/https://ancveirs.lv/en/articles/cvd-bug-bounty-penetration-testing-differences/CVD, VDPs, bug bounties, penetration tests and red teams differ in purpose, authority, scope, incentives, coverage and stop conditions. A practical European comparison.Sat, 26 Sep 2026 00:00:00 GMTWhen Vulnerability Research Exposes Personal Data: Evidence, GDPR and the Point to Stophttps://ancveirs.lv/en/articles/personal-data-vulnerability-research/https://ancveirs.lv/en/articles/personal-data-vulnerability-research/What to do when vulnerability validation exposes personal data: researcher roles, lawful basis, minimum evidence, storage, reporting, deletion and breach boundaries.Sat, 26 Sep 2026 00:00:00 GMTFrom Vulnerability Backlogs to Defensible Decisions: What Should Organisations Fix First?https://ancveirs.lv/en/articles/vulnerability-prioritisation-cvss-epss-kev/https://ancveirs.lv/en/articles/vulnerability-prioritisation-cvss-epss-kev/A practical European approach to vulnerability prioritisation that keeps CVSS severity, EPSS forecasts, known exploitation and local asset context distinct.Sat, 26 Sep 2026 00:00:00 GMTCRA reporting: 24 hours, 72 hours and the risk of simplifying the lawhttps://ancveirs.lv/en/articles/cra-reporting-24-72-hours-legal-meaning/https://ancveirs.lv/en/articles/cra-reporting-24-72-hours-legal-meaning/A practical analysis of CRA Article 14 reporting: AEVs, severe incidents, 24/72-hour deadlines, final-report clocks, the SRP and common simplification errors.Sat, 26 Sep 2026 00:00:00 GMTCybersecurity Certification Should Prove Effectiveness, Not Just Activityhttps://ancveirs.lv/en/articles/cybersecurity-certification-control-effectiveness/https://ancveirs.lv/en/articles/cybersecurity-certification-control-effectiveness/Cybersecurity certification should prove scope, operating effectiveness, retesting and reassessment after material change—not merely that a control exists.Sat, 26 Sep 2026 00:00:00 GMTCan Public-Sector ICT Prove What Was Approved, Built and Actually Deployed?https://ancveirs.lv/en/articles/public-ict-traceability-approval-to-production/https://ancveirs.lv/en/articles/public-ict-traceability-approval-to-production/How public-sector ICT can prove what was approved, accepted and actually deployed without creating another central evidence warehouse or compliance document.Sat, 26 Sep 2026 00:00:00 GMTCybersecurity in Public ICT Procurement: From Contract Clauses to Verifiable Outcomeshttps://ancveirs.lv/en/articles/cybersecurity-public-ict-procurement-verifiable-outcomes/https://ancveirs.lv/en/articles/cybersecurity-public-ict-procurement-verifiable-outcomes/How to turn cybersecurity requirements in public ICT procurement into verifiable outcomes through evidence, acceptance, remediation and lifecycle controls.Sat, 26 Sep 2026 00:00:00 GMTWhen a Digital Service Cannot Operate Normally: Designing a Safe Degraded Modehttps://ancveirs.lv/en/articles/safe-degraded-mode-digital-services/https://ancveirs.lv/en/articles/safe-degraded-mode-digital-services/A practical model for degraded digital-service operation: minimum service, dependency failure, manual fallback, reconciliation and controlled return to normal.Sat, 26 Sep 2026 00:00:00 GMTAnti-Fraud Network APIs in Europe: Why Common Syntax Is Not Enoughhttps://ancveirs.lv/en/articles/anti-fraud-network-apis-europe-interoperability/https://ancveirs.lv/en/articles/anti-fraud-network-apis-europe-interoperability/Anti-fraud network API interoperability needs more than a common schema: semantics, provenance, freshness, unknown states, privacy and clear legal-effect boundaries.Sat, 26 Sep 2026 00:00:00 GMTWho Is Really Calling? Caller ID, Spoofing and Verifiable Fraud Signalshttps://ancveirs.lv/en/articles/caller-identity-spoofing-verifiable-fraud-signals/https://ancveirs.lv/en/articles/caller-identity-spoofing-verifiable-fraud-signals/Caller ID is not identity proof. Separate number control, call-origin consistency and fraud risk without turning a “verified” label into a false safety promise.Sat, 26 Sep 2026 00:00:00 GMTData Sovereignty Is Not Data Location: Measuring Real Control Over Digital Infrastructurehttps://ancveirs.lv/en/articles/data-sovereignty-not-data-location/https://ancveirs.lv/en/articles/data-sovereignty-not-data-location/A practical way to assess data sovereignty through identity, keys, control planes, logs, backups, supply chains, portability, recovery and tested provider exit.Sat, 26 Sep 2026 00:00:00 GMTProof Beats Prose: A Minimum Standard for AI-Assisted Vulnerability Reportshttps://ancveirs.lv/en/articles/proof-beats-prose-ai-assisted-vulnerability-reports/https://ancveirs.lv/en/articles/proof-beats-prose-ai-assisted-vulnerability-reports/A practical evidence standard for AI-assisted vulnerability reports: scope, reproduction, PoC, demonstrated impact, severity, data minimisation and accountability.Sat, 26 Sep 2026 00:00:00 GMTThe Ethical Hacker After Generative AI: Discovery Is Cheap, Accountability Is Nothttps://ancveirs.lv/en/articles/ethical-hacker-after-generative-ai/https://ancveirs.lv/en/articles/ethical-hacker-after-generative-ai/Generative AI accelerates recon, hypotheses and reporting, while scope judgment, validation, impact analysis and accountable disclosure remain human responsibilities.Sat, 26 Sep 2026 00:00:00 GMTAI Slop Is Not a Content Problem. It Is a Verification-Cost Problem.https://ancveirs.lv/en/articles/ai-slop-verification-cost-problem/https://ancveirs.lv/en/articles/ai-slop-verification-cost-problem/Generative AI makes plausible claims, code and submissions cheap to produce. The deeper problem is what happens when verification still consumes scarce human time.Sat, 26 Sep 2026 00:00:00 GMTWhat Does an AI Benchmark Score Actually Prove?https://ancveirs.lv/en/articles/what-ai-benchmark-score-proves/https://ancveirs.lv/en/articles/what-ai-benchmark-score-proves/How to interpret AI benchmark results without overclaiming: test scope, data provenance, language coverage, uncertainty, reproducibility and intended-use evidence.Sat, 26 Sep 2026 00:00:00 GMTThe CSDD Security Research Case: What It Actually Says About Vulnerability Disclosure in Latviahttps://ancveirs.lv/en/articles/csdd-security-research-case-latvia/https://ancveirs.lv/en/articles/csdd-security-research-case-latvia/A documented Latvian case study on vulnerability discovery, reward demands, disclosure threats, extortion, clemency and safer coordinated disclosure.Sat, 26 Sep 2026 00:00:00 GMTNIS2 and Vulnerability Researchers: Coordination Is Harmonised More Than Legal Protectionhttps://ancveirs.lv/en/articles/nis2-legal-position-vulnerability-researchers/https://ancveirs.lv/en/articles/nis2-legal-position-vulnerability-researchers/NIS2 requires national CVD coordination but does not create a universal researcher safe harbour. What Article 12, Recital 60 and national cybercrime law actually mean.Sat, 26 Sep 2026 00:00:00 GMTCoordinated Vulnerability Disclosure in Practice: From Report to Verified Closurehttps://ancveirs.lv/en/articles/coordinated-vulnerability-disclosure-in-practice/https://ancveirs.lv/en/articles/coordinated-vulnerability-disclosure-in-practice/A practical CVD lifecycle covering intake, acknowledgement, triage, reproduction, ownership, remediation, retest, disclosure and evidence-based closure.Sat, 26 Sep 2026 00:00:00 GMTBug Bounty & Crowdsourced Security: What a Good Programme Actually Optimiseshttps://ancveirs.lv/en/articles/what-good-bug-bounty-programme-optimises/https://ancveirs.lv/en/articles/what-good-bug-bounty-programme-optimises/A good bug bounty programme allocates researcher attention, rewards useful novel signal fairly and converts validated findings into measurable remediation.Sat, 26 Sep 2026 00:00:00 GMTSecurity Assurance Under Pressure: Pentest, Red Team, CVD, Bug Bounty and TLPThttps://ancveirs.lv/en/articles/security-assurance-pentest-red-team-cvd-tlpt/https://ancveirs.lv/en/articles/security-assurance-pentest-red-team-cvd-tlpt/Pentesting, red teaming, purple teaming, CVD, bug bounty and TLPT produce different evidence. Combine them deliberately into layered security assurance.Sat, 26 Sep 2026 00:00:00 GMTSecure by Design Before Disclosure: What Organisations Must Do Firsthttps://ancveirs.lv/en/articles/secure-by-design-before-external-research/https://ancveirs.lv/en/articles/secure-by-design-before-external-research/CVD and bug bounty cannot replace a secure SDLC. Use threat modelling, secure defaults, code and dependency controls, release gates and finding feedback.Sat, 26 Sep 2026 00:00:00 GMTSecurity Research in Critical Systems: Open Reporting Does Not Mean Open Testinghttps://ancveirs.lv/en/articles/security-research-critical-systems/https://ancveirs.lv/en/articles/security-research-critical-systems/Critical systems need differentiated research models: public reporting, low-impact testing, registered researchers, vetted programmes and controlled testing.Sat, 26 Sep 2026 00:00:00 GMTPermission Is Not Participation: Building a Sustainable Security Researcher Ecosystemhttps://ancveirs.lv/en/articles/permission-is-not-participation-security-research/https://ancveirs.lv/en/articles/permission-is-not-participation-security-research/A legal right to report vulnerabilities is necessary but insufficient. Sustainable participation also needs trust, feedback, recognition, progression and closure.Sat, 26 Sep 2026 00:00:00 GMTCan Ethical Hacking Be a Form of Civic Participation?https://ancveirs.lv/en/articles/ethical-hacking-civic-participation/https://ancveirs.lv/en/articles/ethical-hacking-civic-participation/A governance model for treating some good-faith security research as operational civic participation — without turning public interest into a licence to test anything.Sat, 26 Sep 2026 00:00:00 GMTSecurity Research as a Layer of National Cyber Resiliencehttps://ancveirs.lv/en/articles/security-research-national-cyber-resilience/https://ancveirs.lv/en/articles/security-research-national-cyber-resilience/How independent security-research signals can connect to CVD, CSIRTs, remediation and vulnerability intelligence without outsourcing state responsibility.Sat, 26 Sep 2026 00:00:00 GMTSecurity Evidence & Accountability: Who Actually Accepts the Risk?https://ancveirs.lv/en/articles/security-evidence-accountability/https://ancveirs.lv/en/articles/security-evidence-accountability/A finding is not closed because a ticket says Done. Use risk ownership, residual risk, remediation evidence and verification to make decisions reconstructable.Sat, 26 Sep 2026 00:00:00 GMT