Blog

Walk into a CFO’s office and announce that you’ve got a 9.8 on the Common Vulnerability Scoring System (CVSS) for a production server, and watch what happens. Nothing happens. The CFO has eleventy billion other things to think about and no way to judge whether a 9.8 is a five-alarm fire or a rounding error….

If you’re job hunting in security right now, the market has fewer doors to knock on than at any point in the past four years. The CyberSN Jobs Report counted 235,786 US cybersecurity job postings between January and September 2026, a 26.4% drop from the 320,210 posted over the same nine months of 2025. Eight…

Roughly a million Americans had their names, mailing addresses, financial account numbers, and Social Security numbers (SSNs) removed from a computer network belonging to a company most of them had never heard of. Their credit unions knew Doxim well enough to hand over member data for document management and customer communications, which is how a…

In February, I wrote about how AI agents could fit into SOC 2 Type II audits and concluded that the Trust Services Criteria could stretch to cover them. The framework is technology-neutral on purpose, and nothing in CC6 or CC8 says “human.” Seven months later, I’m revising my thinking because the criteria haven’t changed. The…

On June 2, 2024, threat actors broke into Roseland Community Hospital Association’s systems and walked off with data on 101,354 patients, including names, addresses, medical diagnoses, health insurance details, and Social Security numbers for a subset of the group. Twenty-five months later, the hospital agreed to pay $650,000. That number sounds small until you run…

On September 28, 2026, a federal judge in Trenton sentenced Daniel Rhyne to 32 months in prison for attacking and trying to extort his own employer, the industrial gases company Messer North America. The judgment ordered $302,450.13 in restitution, three years of supervised release, and a $200 special assessment. The fine was waived, which nearly…

Apollo Information Systems Corp. sells dark web intelligence. The company runs more than 1,000 undercover personas through criminal marketplaces, feeds what those personas collect into a data lake and a proprietary platform called CTOS, and employs analysts to make sense of the haul. Its entire business depends on that tradecraft staying hidden from the criminals…

In Raine v. OpenAI, the wrongful death case now sitting in California’s coordinated AI litigation, both sides have built their case on documents called system cards. These documents describe how OpenAI’s models perform, what risks they carry, and what testing preceded release. The plaintiffs cite them as proof that OpenAI knew its safety testing was…

A prospect sends over their vendor security questionnaire, and buried between “MFA policy” and “vendor management” sit three checkboxes sales can’t explain. SOC 2, ISO 27001, and the Cybersecurity Maturity Model Certification (CMMC). Are they the same thing? Interchangeable? A scam? None of the above. All three show up in questionnaires because procurement teams keep…

…and other lessons from modern incident response Somewhere between the ransom note arriving in your inbox and opposing counsel eyeing your forensic report, your incident stopped being a technical problem. A ransomware crew posts your data, and a reporter calls before your security team has finished figuring out which accounts were compromised. At that point…

Two consulting firms ran surveys about AI in the workplace this year and, read together, they describe organizations at war with themselves. FTI Consulting polled 1,600 senior decision-makers at large companies across seven markets and found that 60% had slowed, paused, or pulled back a planned AI deployment in the past twelve months. Deloitte, in…

On May 5, 2024, Palomar Health Medical Group (PHMG) found a ransom note sitting on its network alongside encrypted systems. Threat actors had been inside since April 23, copying files for twelve days. By September 4, 2025, the final tally stood at 1,132,116 people whose Social Security numbers, medical histories, payment card data, and in…