Research library
Search all security rules and defense guides. Search runs in your browser from a file on our own server; nothing you type is sent anywhere.
Search results
Security rules
Great Britain: RTS security and annual audits
RTS section 4 built on ISO/IEC 27001:2022, the annual independent security audit, and the five-working-day duty to report security breaches.
Ontario: AGCO security standards
What the AGCO Registrar's Standards require on IT frameworks, monitoring and independent assessments, and the immediate notification rule for breaches.
US states: security audits and incident notice
Annual independent security assessments in New Jersey, Pennsylvania and Michigan, and Nevada's 24-hour cyber incident notice rule.
Europe: GDPR and NIS2 for gambling
GDPR's 72-hour breach notification, NIS2's sector lists (gambling is not one), and where national gambling regulators add technical rules.
Breach notification deadlines compared
One table of who to tell and how fast after a security incident: gambling regulators and data protection authorities in GB, Ontario, the US and the EU.
PCI DSS v4.0.1 for gambling operators
Where PCI DSS stands in 2026, the dates that matter, and how card data security fits with gambling regulators' audits.
Defense guides
Account Takeover: Detection and Response
Layered defenses against account takeover, the signals worth combining, and a response sequence that protects player funds.
Credential Stuffing Defense for iGaming Accounts
Why reused passwords are the main route into gambling accounts, and the layered controls OWASP, NIST and the ICO recommend.
Session Security and Account Recovery
Session identifiers, cookie flags, timeouts and recovery flows that resist hijacking without locking out real players.
Bot Abuse and Automated Traffic Defense
Which OWASP automated threats hit gambling platforms, from fake account creation to odds scraping, and how to separate bots from real players.
API Security for iGaming Integrations
The OWASP API Security Top 10 applied to gambling platforms: wallets, game aggregators, payment providers and odds feeds.
Security Incident Response Playbook for iGaming Teams
A practical playbook built on NIST SP 800-61 Rev 3 and CSF 2.0, with the reporting deadlines gambling operators face.
Third-Party Security and Vendor Risk
How to assess game, payment, identity and hosting suppliers using the NCSC's 12 supply chain principles and NIST guidance.
Threat Intelligence for iGaming Platforms
Turning threat information into decisions: which sources to trust, how to map threats to controls, and why unverified alerts do harm.
Platform Security Baseline
A baseline built from OWASP Top 10:2025, the ISO/IEC 27001:2022 controls behind regulators' audits, and UK Cyber Essentials.
Identity Verification and Data Security
How to protect identity documents and verification data, and what Pennsylvania's 2026 fines show about weak KYC controls.
Payment Security and Fraud Signals
Keeping card data out of scope, defending against card testing, securing payment pages and protecting payouts.
Fraud Signal Governance and Human Review
How to run fraud rules and risk scores that stop abuse without unfair friction: ownership, human review, testing and documentation.
Fraud Investigation Evidence and Privacy Controls
Collecting evidence that holds up, from logs to account history, while respecting data protection limits.