Author: Kayne

I was preparing for a call with the board of a post-quantum cryptography (PQC) company and, as a part of preparing, reviewed all my prior research into PQC. I’m sharing my thoughts here – not about the specific company – but rather what CISOs should do, because we’re going to keep hearing the PQC drumbeat….

It’s been a long week of AI news, so I want to step back and put the Hugging Face / OpenAI incident into the larger context. As a reminder, I’m not an attorney and this isn’t legal advice. In case you missed it, on July 16, 2026, Hugging Face disclosed that autonomous AI agents had…

If you’re a CISO building your 2027 budget, you already know the old axiom: never let a good cybersecurity incident go to waste. Two incidents from this year have hit the mainstream media, law journals, and finance journals – and you’re going to be tempted to work them into next year’s budgetary planning exercise. On…

On July 16, 2026, Hugging Face disclosed a security incident unlike anything in their history where their production infrastructure had been compromised by an autonomous AI agent system executing thousands of actions across a swarm of short-lived sandboxes. On July 22, OpenAI admitted they were the attacker. This timeline raises immediate questions about why OpenAI…

The FBI’s Internet Crime Complaint Center just released a Public Service Announcement updating an earlier alert about scammers impersonating IC3 personnel. The update was necessary because the scam’s changed; criminals aren’t just cold-calling your grandmother. They’ve moved on to building fake FBI infrastructure complete with AI-generated videos of senior Bureau leadership, spoofed .gov websites, and…

Every security survey released in 2026 has told roughly the same story: AI adoption’s moving fast while governance crawls behind, and executives see things differently from practitioners. The question worth asking isn’t whether this pattern holds. It’s whether any single report actually adds insight beyond repeating what we already know. Matt Bromiley’s July 2026 SANS…

It’s Friday, and instead of my usual regulatory/legal analysis, I thought some Hollywood stunt hacking might be a nice change of pace. For example, a device designed to clean your floors can drive through your bedroom at 3am while streaming live video to a stranger. Researcher tokay0 published a full writeup on July 16, 2026…

There’s a new RAND paper out where Michael Sulmeyer argues that artificial intelligence is about to unlock strategic cyber capabilities that have been stuck at the tactical level for two decades. If you buy his premise, the policy implication follows neatly: governments should restrict frontier AI models the way they restrict advanced semiconductors. The trouble…

The Department of War hit pause on CMMC Phase II third-party certification requirements on July 13, 2026. The November 10, 2026 deadline is suspended indefinitely, leaving 120,000 small businesses who were supposed to undergo assessment – either self-assessment or third-party audit – stuck in limbo while a 60-day review determines what comes next. For anyone…

Quantum computing’s having a moment this summer. France’s cybersecurity agency ANSSI announced it’d stop certifying security products lacking quantum-resistant encryption starting in 2027, with full procurement compliance expected by 2030. Around the same time, Pitchbook reported that global quantum computing funding hit $3.9 billion in 2025, with Q4 alone pulling in $1.5 billion. And earlier…