56 articles · Cross-sector · page 1 of 3
Articles
Week of 7 September 2026
Europe’s 24-hour vulnerability clock reports to regulators first and customers second
From September 11, 2026, Europe’s Cyber Resilience Act gave manufacturers 24 hours to warn authorities when attackers exploit a flaw in their products. Customers must be told too, but on no fixed clock, so buyers still need their own way to hear about it.
Week of 10 August 2026
Post-quantum signatures are still being chosen, so build PKI to switch twice
Digital signatures had moved up the post-quantum to-do list, yet two years after NIST’s first standards the choice of signature scheme was still open. Sort signatures by how long they must stay trustworthy, and design each group to change twice.
Week of 3 August 2026
Article 50 kept its date, and it lands on the chat window
The EU pushed back its high-risk AI obligations weeks before August 2, 2026, but the transparency duties arrived on time. For banks, insurers, hospitals and agencies serving Europeans, the work now sits in chat windows, content pipelines and publishing sign-off.
Week of 15 June 2026
The client-certificate deadline that moved, and the certificate authorities that didn’t wait
Chrome pushed back its deadline for using public web certificates to prove a client’s identity, to March 2027. Certificate authorities kept their own, earlier schedules. For any system-to-system link that relies on one, the real deadline belongs to whoever issues the certificate.
Week of 23 March 2026
The tool that checked for supply-chain risk was the supply-chain risk
Hackers turned a trusted security scanner into a password thief, then used what it stole to poison a popular AI gateway. Exposure came down to three things: which tools held the keys, where keys were pooled, and how long stolen keys stayed valid.
Week of 2 February 2026
Vendors repriced in a day, contracts run for years: the buyer’s side of the software selloff
In February, investors dumped software stocks on fears that AI agents would upend the business. Buyers in banks, hospitals and agencies faced a slower-moving problem: contracts priced per human user, locked for years, closed to automation and hard to exit.
Week of 29 December 2025
The 2026 state privacy laws split institutional exemptions from data exemptions
Many banks and health systems answer state privacy laws with one line: “GLBA or HIPAA exempts us.” Three laws that took effect on January 1, 2026 showed why that line needs a citation, and why exempting an organization differs from exempting its data.
Week of 6 October 2025
Cl0p’s Oracle campaign: an attack on the systems security teams did not run
Cl0p’s Oracle E-Business Suite extortion wave worked because the finance system sat with finance, not security. Closing that gap takes three decisions: who can pull the plug in an emergency, what faces the internet, and how much old data the system keeps.
Week of 29 September 2025
How the lapse of a 2015 law put counsel in the threat-sharing loop
The 2015 law protecting cyber threat sharing expired as the October 2025 shutdown began, and sharing did not stop. But every warning sent outside the building picked up a legal question, and teams without written rules found analysts waiting on lawyers.
Week of 25 August 2025
OAuth integrations make their vendors custodians of your credentials
The Salesloft Drift data theft began inside a vendor, not inside any customer’s Salesforce. Approving an integration hands that vendor a standing key to your data, and most vendor reviews never asked how the key was kept.
Week of 30 June 2025
State AI law after the 99-to-1 vote: build for notice, explanation and human review
The Senate stripped a proposed federal moratorium, and AI compliance stayed with the states. Across their many laws, one durable core kept recurring: notice, explanation, human review and records. Organizations that built that core first could absorb everything else that kept shifting.
Week of 14 April 2025
How the CVE contract scare exposed the public plumbing under every patching policy
For one day in April 2025, the program that gives every software flaw its name looked set to switch off. The scare showed that patching policies and audit evidence rest on three public layers, each with its own way of failing.
Week of 27 January 2025
DeepSeek arrived in three forms in one week, and each needed a different control
Within days, the same DeepSeek model reached organizations as a phone app, a developer service and freely downloadable files running on U.S. clouds. Blanket bans treated them as one risk. They were three, each owned by a different team.
Week of 2 December 2024
The CFPB’s data broker proposal exposed a provenance gap that AI programs inherit
A federal plan to regulate many data brokers like credit bureaus was withdrawn within six months. The question it asked, where did this personal data come from and what may we do with it, now follows every AI program.
Week of 25 November 2024
Blue Yonder put process-running vendors at the top of the risk register
A ransomware attack on Blue Yonder left baristas and warehouse staff waiting on schedules and pay, and exposed a blind spot. Most vendor checks ask who holds your data. The better question is whose failure would stop your work.
Week of 4 November 2024
After the 2024 election, a rule’s legal form predicted its survival better than its topic
Election week changed no rule, but it changed the odds for many. The best guide to which obligations would last was not their topic but their legal form: a statute, a rule still inside the Congressional Review Act window, or guidance and executive orders.
Week of 19 August 2024
National Public Data turned the Social Security number into a lookup key
One broker’s leaked files tied names, addresses, birth dates and Social Security numbers together. Those facts could still find a customer’s record but no longer prove who was asking, and sign-up, account recovery and risky changes each needed their own fix.
Week of 12 August 2024
Post-quantum priority starts in the records retention schedule
NIST’s first post-quantum standards settled what to move to. Deciding what to move first is harder, and for banks, health systems and agencies the answer sits in a surprising place: the records retention schedule.
Week of 22 July 2024
Why North Korea’s fake remote hires succeed in the gaps between HR, IT and security
KnowBe4 hired a remote engineer who turned out to be a North Korean IT worker. The scheme worked by slipping through four hand-offs owned by different teams. It fails when one verified identity follows the hire from interview to daily work.
Week of 15 July 2024
Channel File 291 measured every recovery plan in hands per device
One faulty CrowdStrike update turned millions of remotely managed Windows computers into a hands-on repair job. How fast each organization recovered came down to three things few plans covered: access to recovery keys, people at keyboards, and the order of repair.