Author: Kayne

If you build software or hardware with digital elements and you sell it into Europe, the EU Cyber Resilience Act (CRA) stops being a someday problem this Friday, September 11. That’s when the regulation’s reporting obligations start. It’s not a registration deadline and not a paperwork deadline. It’s the moment the duty to notify regulators…

In March 2023, LockBit demanded $10 million from MCNA Dental. Management refused, the attackers published 700 GB of stolen data two days later, and everyone moved on. That refusal tends to get framed as courage in breach retrospectives. It wasn’t. It was a capital allocation decision made without anyone pricing the alternatives, and the invoice…

On December 14, 2020, one day after the SolarWinds breach became public knowledge, monitoring software on a Honeywell network started firing alerts. Between 9:30 in the morning and midnight Central Time, it logged: A manager looked at the logs and concluded, “I don’t see anything concerning based on the available evidence.” The three-hour session with…

In August 2026, California’s Department of Financial Protection and Innovation (DFPI) ordered Academy Mortgage to pay $825,000 for failing to protect the personal information of 284,443 people. That penalty was the smallest line on a much larger invoice. My estimate, built from IBM’s 2026 Cost of a Data Breach benchmarks scaled to Academy’s size, puts…

Two things landed this week that got me checking back in on H.R. 9917, the AI Kill Switch Act that Reps. Ted Lieu and Nathaniel Moran introduced on July 23. The first was a CyberScoop op-ed arguing the bill repeats the Clipper Chip’s mistakes. The second was a PBS NewsHour segment I’d watched on AI…

The final round of bidding for the internal records of a dead airline came down to two companies. Google offered $10 million, and the runner-up, at $7.5 million, was Mercor, an AI training-data firm. Neither company flies planes, runs turnaround operations, or collects archives. Both train AI models. That auction happened on August 14 in…

Washington is home to Amazon, Microsoft, and one of the most data-dependent economies in the country. It doesn’t have a generally applicable consumer privacy law. Three attempts at one failed in 2019, 2020, and 2021, and each time the cause it failed was the same fight: the Senate wanted Attorney General-only enforcement, the House wanted…

On August 26, 2026, Bill Gates published a 6,000-word essay arguing that AI will either be “the greatest equalizer ever invented, or the worst source of injustice.” The Guardian, CBS News, and other outlets covered it extensively. Coverage focused on jobs, the Human Reserved concept, and Gates’ personal credibility (the Guardian reminded readers about those…

In August 2026, California’s Department of Financial Protection and Innovation (DFPI) ordered Academy Mortgage Corporation to pay $825,000 for failing to protect 284,443 people’s personal information. That penalty’s the smallest line item on a larger invoice. By my estimate, the total cost runs closer to $9.8 million once you add incident response, breach notifications, identity…

I sat through OpenAI’s Black Hat presentation earlier this month, and on August 20th I saw Alabama’s Attorney General Steve Marshall issue a subpoena against OpenAI under the state’s Deceptive Trade Practices Act. Not the Computer Fraud and Abuse Act, not a state computer crime statute, but a consumer protection law originally designed to go after deceptive business practices. And a…

An update dropped last week on a complex cyber insurance case that I’ve been following, and I took the weekend to read it. When ransomware hits and the insurer pays the claim, the insurer goes hunting for someone to blame. Threat actors are notoriously difficult to collect from, so insurers increasingly pursue the vendors who…

Occasionally my clients ask me for a more thorough explanation of why I’m recommending a given control. In addition to a formal write-up, I’m also sharing a version of that research here. In 2025, the FBI’s Internet Crime Complaint Center (IC3) recorded over three billion dollars in business email compromise (BEC) losses across 24,768 reported…