Blog

Roughly a million Americans had their names, mailing addresses, financial account numbers, and Social Security numbers (SSNs) removed from a computer network belonging to a company most of them had never heard of. Their credit unions knew Doxim well enough to hand over member data for document management and customer communications, which is how a…

In February, I wrote about how AI agents could fit into SOC 2 Type II audits and concluded that the Trust Services Criteria could stretch to cover them. The framework is technology-neutral on purpose, and nothing in CC6 or CC8 says “human.” Seven months later, I’m revising my thinking because the criteria haven’t changed. The…

On June 2, 2024, threat actors broke into Roseland Community Hospital Association’s systems and walked off with data on 101,354 patients, including names, addresses, medical diagnoses, health insurance details, and Social Security numbers for a subset of the group. Twenty-five months later, the hospital agreed to pay $650,000. That number sounds small until you run…

On September 28, 2026, a federal judge in Trenton sentenced Daniel Rhyne to 32 months in prison for attacking and trying to extort his own employer, the industrial gases company Messer North America. The judgment ordered $302,450.13 in restitution, three years of supervised release, and a $200 special assessment. The fine was waived, which nearly…

Apollo Information Systems Corp. sells dark web intelligence. The company runs more than 1,000 undercover personas through criminal marketplaces, feeds what those personas collect into a data lake and a proprietary platform called CTOS, and employs analysts to make sense of the haul. Its entire business depends on that tradecraft staying hidden from the criminals…

In Raine v. OpenAI, the wrongful death case now sitting in California’s coordinated AI litigation, both sides have built their case on documents called system cards. These documents describe how OpenAI’s models perform, what risks they carry, and what testing preceded release. The plaintiffs cite them as proof that OpenAI knew its safety testing was…

A prospect sends over their vendor security questionnaire, and buried between “MFA policy” and “vendor management” sit three checkboxes sales can’t explain. SOC 2, ISO 27001, and the Cybersecurity Maturity Model Certification (CMMC). Are they the same thing? Interchangeable? A scam? None of the above. All three show up in questionnaires because procurement teams keep…

…and other lessons from modern incident response Somewhere between the ransom note arriving in your inbox and opposing counsel eyeing your forensic report, your incident stopped being a technical problem. A ransomware crew posts your data, and a reporter calls before your security team has finished figuring out which accounts were compromised. At that point…

Two consulting firms ran surveys about AI in the workplace this year and, read together, they describe organizations at war with themselves. FTI Consulting polled 1,600 senior decision-makers at large companies across seven markets and found that 60% had slowed, paused, or pulled back a planned AI deployment in the past twelve months. Deloitte, in…

On May 5, 2024, Palomar Health Medical Group (PHMG) found a ransom note sitting on its network alongside encrypted systems. Threat actors had been inside since April 23, copying files for twelve days. By September 4, 2025, the final tally stood at 1,132,116 people whose Social Security numbers, medical histories, payment card data, and in…

Almost every large US company has an AI governance policy, and nearly half of them ignore it when deployment speed matters more. That’s the headline finding from the inaugural EY US AI Risk and Governance Survey, which polled 202 senior AI decision-makers at publicly traded companies with at least $1 billion in annual revenue. Ninety-eight…

On April 30, 2025, Clearlake Capital finalized a majority investment in Modernizing Medicine (“ModMed”), valuing the specialty healthcare software-as-a-service (SaaS) company at $5.3 billion. Ten weeks later, on July 9, an unauthorized party accessed two servers inside ModMed’s infrastructure. These weren’t production systems powering the electronic health records (EHR) used by 40,000 providers. They were…