357 articles · page 4 of 18
Articles
Week of 1 September 2025
The CAT’s retirement freed the framework and orphaned the risk profile
Regulators retired the tool community banks had used for a decade to check their cybersecurity on August 31, 2025. Most banks quickly picked a new framework. Fewer noticed they had also lost the step that told them how much security their business needed.
Week of 25 August 2025
OAuth integrations make their vendors custodians of your credentials
The Salesloft Drift data theft began inside a vendor, not inside any customer’s Salesforce. Approving an integration hands that vendor a standing key to your data, and most vendor reviews never asked how the key was kept.
Week of 18 August 2025
How a fee question pulled open banking off the rulebook and onto the rate card
By asking whether banks may charge for customer data access, the CFPB’s August 2025 notice moved open banking’s rules from regulation into contracts. Big banks could set prices, smaller ones would inherit them through vendors, and fintechs would redesign around them.
Week of 11 August 2025
Secrets in a public docket: the court filing breach and where the sensitive tier ends
The federal courts already had a separate path for their most sensitive documents when their filing system was breached in 2025. The trouble was where its boundary sat. Agencies holding dangerous records in general systems need a tier defined by consequence, not label.
Week of 4 August 2025
Cheap to license, slow to permit: federal AI’s bottleneck moved to the CISO’s desk
GSA’s August 2025 deals made leading AI tools nearly free for federal agencies. A $1 price grants none of the three permissions that decide real use: a security sign-off, a ruling on what data may go in, and an owner for records and oversight.
Week of 28 July 2025
Why the CMS patient app pledge depends on the registration desk
In July 2025, more than 60 organizations promised patients their medical records in the apps they choose. The data pipes mostly existed. Whether it works for a real patient depends on the registration desk: proving identity, matching records, and handling consent and proxies.
Week of 21 July 2025
ToolShell made patching the easy part of a SharePoint emergency
Attackers exploiting on-premises SharePoint in July 2025 stole the keys that let them come back after the patch. For agencies running collaboration servers in-house, the response became three jobs with different owners: patch, evict, and decide whether the server should exist at all.
Week of 14 July 2025
An escort who cannot read the command is not a security control
ProPublica’s report on Microsoft’s “digital escorts” showed that a cloud authorization says little about who actually runs a system. Agencies need personnel terms they can test: who can touch the system, how that work is checked, and what evidence reaches them.
Week of 7 July 2025
How the DOJ’s bulk data rule made reach, not storage, the health data test
The Justice Department’s grace period ended on July 8, 2025, leaving health systems and life sciences firms facing a rule that asks who could reach their data, not how well it is protected. That puts procurement, research administration and HR on the front line.
Week of 30 June 2025
State AI law after the 99-to-1 vote: build for notice, explanation and human review
The Senate stripped a proposed federal moratorium, and AI compliance stayed with the states. Across their many laws, one durable core kept recurring: notice, explanation, human review and records. Organizations that built that core first could absorb everything else that kept shifting.
Week of 23 June 2025
One alert, three threats: how local agencies should have read the June 2025 Iran warning
After U.S. strikes on Iran, federal warnings described one heightened threat. For cities, counties and utilities it was really three: hacktivist noise, opportunistic attacks on exposed control systems, and patient state operations. Each needs a different owner, a different clock and a different fix.
Week of 16 June 2025
Why Scattered Spider’s turn to insurers should have set a deadline for the rest of finance
A hacking group known for working through one industry at a time reached U.S. insurers in June 2025, and a warning became a deadline. Financial firms needed a pre-agreed surge mode: a clear trigger, tighter help-desk rules and containment planned around stolen identities.
Week of 9 June 2025
Google Cloud’s June outage moved bank cloud diligence from uptime to change safety
Google Cloud’s June 2025 outage began with a routine policy update that reached every region at once. For banks, asking how a provider releases code and settings reveals far more than its promised uptime figure.
Week of 2 June 2025
Once FDA read with AI, sponsors’ inconsistencies got cheaper to find
FDA gave its reviewers Elsa, an AI assistant for searching and comparing documents, and the inconsistencies in drug submissions became cheaper to find. Sponsors need consistent dossiers, a fast way to correct misreadings, and proof their own AI works.
Week of 26 May 2025
How ConnectWise’s breach tested small practices’ business associate agreements
In May 2025 a nation-state intrusion hit ConnectWise, a maker of remote access software that sits two contracts away from most physician practices. Their IT services and business associate agreements are their only real controls, and most say too little.
Week of 19 May 2025
The scammers’ window: patient communication when a hospital goes dark
Within days of ransomware knocking Kettering Health offline in May 2025, criminals were phoning its patients for card payments. Talking to patients during an outage is a security control, and it has to be built before the attack.
Week of 12 May 2025
Cheap contracts, valuable access: the market behind Coinbase’s bribed agents
Coinbase’s May 2025 disclosure showed criminals simply buying customer data from outsourced support staff who could already see it. Insider risk in support operations behaves like a market, and financial institutions set its terms through how they buy and govern outsourced labor.
Week of 5 May 2025
Why the air traffic control rebuild started with the wires
The Newark outages that preceded Washington’s May 2025 air traffic control plan broke in the links between buildings, not in the radar screens. For agencies modernizing systems that cannot stop, the wires, the switchover and the people deserve as much planning as the software.
Week of 28 April 2025
Iberia’s blackout put payment resilience back at the shop counter
The Iberian grid failed in April 2025 and bank systems largely held, yet customers still could not pay for groceries. Payment resilience lives at the terminal, the network link, the offline rules and the cash fallback, and banks can shape all four.
Week of 21 April 2025
A new SEC chair rewrites the agenda, not the compliance calendar
Paul Atkins arrived at the SEC promising a lighter touch. What mattered to broker-dealers and advisers was each rule’s legal status: proposals could vanish quickly, adopted rules kept their dates, and the examiners kept knocking.