52 articles · 2025 · page 2 of 3
Articles
Week of 11 August 2025
Secrets in a public docket: the court filing breach and where the sensitive tier ends
The federal courts already had a separate path for their most sensitive documents when their filing system was breached in 2025. The trouble was where its boundary sat. Agencies holding dangerous records in general systems need a tier defined by consequence, not label.
Week of 4 August 2025
Cheap to license, slow to permit: federal AI’s bottleneck moved to the CISO’s desk
GSA’s August 2025 deals made leading AI tools nearly free for federal agencies. A $1 price grants none of the three permissions that decide real use: a security sign-off, a ruling on what data may go in, and an owner for records and oversight.
Week of 28 July 2025
Why the CMS patient app pledge depends on the registration desk
In July 2025, more than 60 organizations promised patients their medical records in the apps they choose. The data pipes mostly existed. Whether it works for a real patient depends on the registration desk: proving identity, matching records, and handling consent and proxies.
Week of 21 July 2025
ToolShell made patching the easy part of a SharePoint emergency
Attackers exploiting on-premises SharePoint in July 2025 stole the keys that let them come back after the patch. For agencies running collaboration servers in-house, the response became three jobs with different owners: patch, evict, and decide whether the server should exist at all.
Week of 14 July 2025
An escort who cannot read the command is not a security control
ProPublica’s report on Microsoft’s “digital escorts” showed that a cloud authorization says little about who actually runs a system. Agencies need personnel terms they can test: who can touch the system, how that work is checked, and what evidence reaches them.
Week of 7 July 2025
How the DOJ’s bulk data rule made reach, not storage, the health data test
The Justice Department’s grace period ended on July 8, 2025, leaving health systems and life sciences firms facing a rule that asks who could reach their data, not how well it is protected. That puts procurement, research administration and HR on the front line.
Week of 30 June 2025
State AI law after the 99-to-1 vote: build for notice, explanation and human review
The Senate stripped a proposed federal moratorium, and AI compliance stayed with the states. Across their many laws, one durable core kept recurring: notice, explanation, human review and records. Organizations that built that core first could absorb everything else that kept shifting.
Week of 23 June 2025
One alert, three threats: how local agencies should have read the June 2025 Iran warning
After U.S. strikes on Iran, federal warnings described one heightened threat. For cities, counties and utilities it was really three: hacktivist noise, opportunistic attacks on exposed control systems, and patient state operations. Each needs a different owner, a different clock and a different fix.
Week of 16 June 2025
Why Scattered Spider’s turn to insurers should have set a deadline for the rest of finance
A hacking group known for working through one industry at a time reached U.S. insurers in June 2025, and a warning became a deadline. Financial firms needed a pre-agreed surge mode: a clear trigger, tighter help-desk rules and containment planned around stolen identities.
Week of 9 June 2025
Google Cloud’s June outage moved bank cloud diligence from uptime to change safety
Google Cloud’s June 2025 outage began with a routine policy update that reached every region at once. For banks, asking how a provider releases code and settings reveals far more than its promised uptime figure.
Week of 2 June 2025
Once FDA read with AI, sponsors’ inconsistencies got cheaper to find
FDA gave its reviewers Elsa, an AI assistant for searching and comparing documents, and the inconsistencies in drug submissions became cheaper to find. Sponsors need consistent dossiers, a fast way to correct misreadings, and proof their own AI works.
Week of 26 May 2025
How ConnectWise’s breach tested small practices’ business associate agreements
In May 2025 a nation-state intrusion hit ConnectWise, a maker of remote access software that sits two contracts away from most physician practices. Their IT services and business associate agreements are their only real controls, and most say too little.
Week of 19 May 2025
The scammers’ window: patient communication when a hospital goes dark
Within days of ransomware knocking Kettering Health offline in May 2025, criminals were phoning its patients for card payments. Talking to patients during an outage is a security control, and it has to be built before the attack.
Week of 12 May 2025
Cheap contracts, valuable access: the market behind Coinbase’s bribed agents
Coinbase’s May 2025 disclosure showed criminals simply buying customer data from outsourced support staff who could already see it. Insider risk in support operations behaves like a market, and financial institutions set its terms through how they buy and govern outsourced labor.
Week of 5 May 2025
Why the air traffic control rebuild started with the wires
The Newark outages that preceded Washington’s May 2025 air traffic control plan broke in the links between buildings, not in the radar screens. For agencies modernizing systems that cannot stop, the wires, the switchover and the people deserve as much planning as the software.
Week of 28 April 2025
Iberia’s blackout put payment resilience back at the shop counter
The Iberian grid failed in April 2025 and bank systems largely held, yet customers still could not pay for groceries. Payment resilience lives at the terminal, the network link, the offline rules and the cash fallback, and banks can shape all four.
Week of 21 April 2025
A new SEC chair rewrites the agenda, not the compliance calendar
Paul Atkins arrived at the SEC promising a lighter touch. What mattered to broker-dealers and advisers was each rule’s legal status: proposals could vanish quickly, adopted rules kept their dates, and the examiners kept knocking.
Week of 14 April 2025
How the CVE contract scare exposed the public plumbing under every patching policy
For one day in April 2025, the program that gives every software flaw its name looked set to switch off. The scare showed that patching policies and audit evidence rest on three public layers, each with its own way of failing.
Week of 7 April 2025
Supervisory correspondence: a bank’s most candid file, held in a system it cannot assess
The OCC’s email breach showed that a bank’s most candid account of its own weaknesses sits with a regulator it can neither audit nor replace. Banks still control what they write, how it travels and how they respond when the holder is breached.
Week of 31 March 2025
Lighter rules, heavier contracts: OMB’s April 2025 AI memos handed governance to the buyer
OMB’s April 2025 memos lightened internal AI process but asked contracts to carry more of the weight. Agencies that treated every stage of a contract as a governance tool kept bargaining power that review boards alone could not give them.