Blog

Yesterday I sat on a Bolster AI panel about brand impersonation and AI-enabled fraud alongside Rod Schultz, Bolster’s CEO, and Hamza Zaman, head of information security at Numerix. Attackers have worked out that hacking a company is optional when impersonating it pays just as well, and the targets are your customers, your executives, and your…

In February 2023, with 115,940 breach notification letters fresh in the mail, the chairman of the Jefferson County Health Department’s board of trustees told the local paper that the department “does have insurance for this kind of situation.” The only out-of-pocket cost, Dennis Diehl said, would be the deductible. Three and a half years later,…

Chris Clymer had me on his show to talk about my book, Cyber Risk is a Myth, and somewhere after the intro, we stopped talking about the book and started talking about four organizations that prove its thesis the hard way. I’ve spent nearly three decades in this field watching the same pattern repeat, and…

Judge Francis Mathew’s order hit the wire on October 21, 2026, and the number attached to it was hard to process. Meta owes New Mexico $25 billion for violating the state’s Unfair Practices Act, a figure the New Mexico Department of Justice called one of the largest ever levied against a US corporation, and Reuters…

Most software purchases end the same way. Someone runs a security questionnaire, the vendor sends a SOC 2 Type 2 report, legal redlines the data protection and uptime terms, and procurement signs. That routine works because conventional software fails in ways the paperwork anticipates, like outages and breaches. An agentic system clears that gate without…

ARcare, the Augusta, Arkansas health network, used its April 2022 notice to patients to describe an incident as involving “a limited amount” of personal and medical information, and framed the mailing as something it was doing “out of an abundance of caution.” The press release went up on April 25, 2022, but it didn’t say…

Government websites across Europe went dark on October 21, their operators pulling systems offline within hours of a PHP security release that fixed two critical remote-code-execution bugs. The patch was public within hours of the disclosure, which means somebody competent did the hard work in advance and handed everyone else a tested fix. Plenty of…

A story plays out on r/soc2 every few weeks. A company has been handing every prospect a SOC 2 report, things are going fine, and then a customer’s finance team comes back asking specifically for a SOC 1. Panic spreads through the company’s Slack channels, followed by a post asking what the difference even is….

When Senior Judge Sidney Fitzwater signed off on AT&T’s $177 million data breach settlement on October 2, 2026, the actual numbers from the Memorandum Opinion and Order got lost in the headlines promising payments “up to $7,500.” The real numbers put most claimants in line for between $6.50 and $8.10. Two Breaches, One Bill The…

Cyber insurance rates have now fallen four years in a row, down roughly 5% year to date in 2026 after a 13% drop in 2025, according to Insurance Journal. If you’re renewing a policy this quarter, congratulations, you have the upper hand on price. Now the bad news. Over that same period, average claim severity…

Brockton Neighborhood Health Center runs a network of clinics serving about 39,000 patients around Boston, with roughly $84 million in annual revenue and about 830 employees. In November 2024, a ransomware crew called Interlock got in and took what it wanted. Six weeks later, Brockton sent letters to 97,488 current and former patients (the active…

On October 6, I wrote up Judge P. Casey Pitts’s decision denying most of a motion to dismiss Apollo Information Systems Corp.’s claims, arguing the ruling deserved a busy security leader’s attention. The case looks different today. In Document 83, the defendants answer the complaint, concede most of the facts Apollo alleged, and then sue…