# Kayne McGladrey, CISSP > Cybersecurity Advisor • Author of the GRC Maturity Model • Senior IEEE Member • Virtual CISO ## Posts - [The AI Cyberattack Threat Is Real. The “Lock It in a Lab” Story Isn’t.](https://kaynemcgladrey.com/blog/the-ai-cyberattack-threat-is-real-the-lock-it-in-a-lab-story-isnt/): There's a new RAND paper out where Michael Sulmeyer argues that artificial intelligence is about to unlock strategic cyber capabilities that have been stuck at... - [Turning Vulnerability Scans Into Budget Approvals](https://kaynemcgladrey.com/resources/turning-vulnerability-scans-into-budget-approvals/): Rather watch this on YouTube instead? Security teams live in a world of numbers where a scanner runs, finds a hole, and gives you a score. That score is... - [Pentagon Pulls Emergency Brake on CMMC Phase II Certification](https://kaynemcgladrey.com/blog/pentagon-pulls-emergency-brake-on-cmmc-phase-ii-certification/): The Department of War hit pause on CMMC Phase II third-party certification requirements on July 13, 2026. The November 10, 2026 deadline is suspended... - [Quantum Won’t Break Your Encryption Tomorrow, But the Bill Is Already Coming Due](https://kaynemcgladrey.com/blog/quantum-wont-break-your-encryption-tomorrow-but-the-bill-is-already-coming-due/): Quantum computing's having a moment this summer. France's cybersecurity agency ANSSI announced it'd stop certifying security products lacking quantum-resistant... - [The Productivity Gap Is a Data Quality Gap](https://kaynemcgladrey.com/blog/the-productivity-gap-is-a-data-quality-gap/): "Workflow integration was an underestimated challenge early in our AI adoption journey. While a lot of processes looked simple on paper, there are many... - [Stop Treating AI Like Magic and Start Treating It Like a Vendor](https://kaynemcgladrey.com/blog/stop-treating-ai-like-magic-and-start-treating-it-like-a-vendor/): On the evening of June 12, 2026, Anthropic disabled its two most capable models, Claude Fable 5 and Mythos 5, for every customer on the planet. Not because of... - [Manufacturing Keeps Getting Hit While Everyone Watches AI Zero-Days](https://kaynemcgladrey.com/blog/manufacturing-keeps-getting-hit-while-everyone-watches-ai-zero-days/): "The notion of a criminal ransomware group retaining lawyers fully versed in international data requirements is absurd -- until you realize the 'lawyer' is an... - [Security Governance Maturity Assessment Without the Guesswork](https://kaynemcgladrey.com/resources/security-governance-maturity-assessment-without-the-guesswork/): Security Governance Maturity Assessment Without the Guesswork So many words! Wouldn't you rather just watch this on YouTube? Most organizations can't answer a... - [The Hiring Funnel Is Leaking And Criminals Are Profiting](https://kaynemcgladrey.com/blog/the-hiring-funnel-is-leaking-and-criminals-are-profiting/): It's mid-July 2026, and the domestic job market isn't exactly improving, based on a set of IOCs (indicators of compromise) that a friend sent me yesterday. Job... - [78% Already Got Hit. Half Still Haven’t Funded the Fix.](https://kaynemcgladrey.com/blog/78-already-got-hit-half-still-havent-funded-the-fix/): 78% of organizations reported experiencing AI-related security incidents or identifying AI-related vulnerabilities. — DigiCert AI Trust Outlook I guess it's... - [Why Breach Cover-Ups Are Killing Trust](https://kaynemcgladrey.com/blog/why-breach-cover-ups-are-killing-trust/): If you ask security leaders whether they've ever been told to keep a breach quiet (we did), more than half will say yes. BitDefender's out with their 2026... - [Washington Had the Playbook and the Polling. It Passed on Almost None of It](https://kaynemcgladrey.com/blog/washington-had-the-playbook-and-the-polling-it-passed-on-almost-none-of-it/): "AI systems that are deployed for high-risk decision making should be subject to enhanced oversight, transparency, and accountability measures to mitigate... - [Opportunity Cost Analysis: The Security Tool Your CFO Actually Wants to See](https://kaynemcgladrey.com/resources/opportunity-cost-analysis-the-security-tool-your-cfo-actually-wants-to-see/): Opportunity Cost Analysis: The Security Tool Your CFO Actually Wants to See So many words, wouldn't you rather just watch this? Every security leader knows the... - [When the Load-Bearing Wall Comes Down](https://kaynemcgladrey.com/blog/when-the-load-bearing-wall-comes-down/): Key quote: Max Schrems: "Given that there are no independent authorities in the US anymore, we call on the European Commission to orderly withdraw the adequacy... - [Your AI Governance Program Can’t Stop Anything](https://kaynemcgladrey.com/blog/your-ai-governance-program-cant-stop-anything/): Key quote: A fire alarm is not a fire department. You can wire every room in your house, dutifully change the battery of every smoke detector annually, and... - [When Vendors Fail, Everyone Pays](https://kaynemcgladrey.com/blog/when-vendors-fail-everyone-pays/): Key quote: Importantly, there is no current evidence that PII or payment and financial account information was accessed, including credit card or banking... - [When AI Strategies Collide with Real Bills](https://kaynemcgladrey.com/blog/when-ai-strategies-collide-with-real-bills/): Key quote: "AI is a powerful force multiplier, but the judgment, relationships and accountability remain human, and that won't change." Thompson-Reuters is out... - [Why California Law Just Went Global for HR Tech](https://kaynemcgladrey.com/blog/why-california-law-just-went-global-for-hr-tech/): Key quote: Holding business-entity agents like Workday liable for their own discriminatory conduct within the scope of the FEHA is consistent with public... - [The Risk Acceptance Decision Framework: Stop Guessing and Start Owning Your Exposure](https://kaynemcgladrey.com/resources/the-risk-acceptance-decision-framework-stop-guessing-and-start-owning-your-exposure/): The Risk Acceptance Decision Framework: Stop Guessing and Start Owning Your Exposure Rather just watch this on YouTube? Most organizations treat risk... - [Your Cloud Bill Goes Up, Your Compliance Gap Goes Public](https://kaynemcgladrey.com/blog/your-cloud-bill-goes-up-your-compliance-gap-goes-public/): Key quote: "This new vision represents a paradigm shift where over-engineered regulations designed for paperwork and compliance are replaced with streamlined... - [What’s a 280-Point Difference Between Friends?](https://kaynemcgladrey.com/blog/whats-a-280-point-difference-between-friends/): Key quote: On October 13, 2021, LOGZONE submitted to DoD in SPRS a perfect self assessment score of 110 for its implementation of NIST SP 800-171 security... - [Using the Business Impact Analysis Maturity Assessment Checklist](https://kaynemcgladrey.com/resources/using-the-business-impact-analysis-maturity-assessment-checklist/): Using the Business Impact Analysis Maturity Assessment Checklist You could just watch this on your phone, you know. Security teams love talking about... - [Five Eyes Finally Says The Quiet Part Out Loud](https://kaynemcgladrey.com/blog/five-eyes-finally-says-the-quiet-part-out-loud/): Key quote: Unsupported systems are easy targets. They are not just technical debt, they are strategic liabilities. Why it matters: Five Eyes is awfully chatty... - [When Regulators Become Delivery Systems for Stock Fraud](https://kaynemcgladrey.com/blog/when-regulators-become-delivery-systems-for-stock-fraud/): Key quote: "We have no knowledge of any recent legitimate data breach reports from either VRChat or Discord." Why it matters: The Maine Attorney General's... - [What California’s ADS Report Gets Wrong](https://kaynemcgladrey.com/blog/what-californias-ads-report-gets-wrong/): Key quote: Turnitin acknowledges that detection of AI writing is an evolving and imperfect science. External studies have found false positive rates,... - [Stop Speaking Gibberish to Your Board When Discussing Cyber Risks](https://kaynemcgladrey.com/resources/stop-speaking-gibberish-to-your-board-when-discussing-cyber-risks/): Stop Speaking Gibberish to Your Board When Discussing Cyber Risks But I don't wanna read this, I just want to watch it on YouTube! Most security leaders don't... - [Who Owns Liability in AI Hiring?](https://kaynemcgladrey.com/blog/who-owns-liability-in-ai-hiring/): Key quote: "It makes no sense for a Texas employer with a Texas applicant who will perform work in Texas, I don't think there is any dispute that that employer... - [Construction Security Demands Operational Discipline](https://kaynemcgladrey.com/blog/construction-security-demands-operational-discipline/): Key quote: Commercial, industrial, and large-scale residential construction sectors in regions relying on imported digital security systems such as North... - [When the Algorithm Cancels Your Coverage Before You Know It](https://kaynemcgladrey.com/blog/when-the-algorithm-cancels-your-coverage-before-you-know-it/): Key quote: Consumers deserve transparency and fairness throughout the insurance process, especially when losing coverage can leave someone unknowingly... - [Stop Wasting Money on Reports Nobody Reads – The Business Impact Translation Matrix](https://kaynemcgladrey.com/resources/stop-wasting-money-on-reports-nobody-reads-the-business-impact-translation-matrix/): Stop Wasting Money on Reports Nobody Reads - The Business Impact Translation Matrix Rather watch this than read this? Neat. Security reports die in inboxes... - [What happens when police let an algorithm do the investigating](https://kaynemcgladrey.com/blog/what-happens-when-police-let-an-algorithm-do-the-investigating/): Key quote: What looks like a second, independent identification is in fact the same algorithmic error surfacing twice, creating an illusion of confirmation... - [The Role-Based Risk Awareness Program Template](https://kaynemcgladrey.com/resources/the-role-based-risk-awareness-program-template/): The Role-Based Risk Awareness Program Template Why read when you can watch this instead? Most security training fails because it treats everyone the same. You... - [Cox Media Group Sold Fake Voice Listening Tech](https://kaynemcgladrey.com/blog/cox-media-group-sold-fake-voice-listening-tech/): Key quote: Voice Data means any full or partial audio file of an individual's voice, voice communications, or audio communications, as well as any transcripts... - [Fake It Till You’re Indicted](https://kaynemcgladrey.com/blog/fake-it-till-youre-indicted/): Key quote: The requested stay would prejudice no party to this civil action; would prevent the circumvention of important statutory limitations on criminal... - [11% of CXOs say they’re ready for 1,661 AI agents, I’m sure that’s fine](https://kaynemcgladrey.com/blog/11-of-cxos-say-theyre-ready-for-1661-ai-agents-im-sure-thats-fine/): Key quote: "The most critical architectural capability is integration. We don't know what's coming next, so the foundation must support constant change." Why... - [CISOs Need To Stop Treating MCP Security Like Software Bugs](https://kaynemcgladrey.com/blog/cisos-need-to-stop-treating-mcp-security-like-software-bugs/): Key quote: "MCP itself cannot enforce these security principles at the protocol level." Why it matters: I finally had time to sit and read the NSA's most... - [The Resume Isn’t Just a Resume Anymore](https://kaynemcgladrey.com/blog/the-resume-isnt-just-a-resume-anymore/): Key quote: China's military intelligence services ultimately seek to acquire privileged military, political and economic intelligence that can provide China... - [Privilege Wins the Round, But the AI Discovery War Just Got Messier](https://kaynemcgladrey.com/blog/privilege-wins-the-round-but-the-ai-discovery-war-just-got-messier/): Key quote: Here, Workday has represented that its attorneys curated the data it used in the bias testing, the overall purpose of the testing was to provide... - [Why Shell vs. CLF Could Change Your AI Governance Program](https://kaynemcgladrey.com/blog/why-shell-vs-clf-could-change-your-ai-governance-program/): Key quote: A producing party's good-faith averment of nonexistence resolves a production dispute. Why it matters: Welp, I'm *not* an attorney, but I'm tracking... - [Why EU Compliance is Leaving Water and Rail Behind](https://kaynemcgladrey.com/blog/why-eu-compliance-is-leaving-water-and-rail-behind/): Key quote: The risk zone includes sectors with lower-than-average maturity and criticality that exceeds their maturity. Its composition changes over time as... - [Why Your MCP Integrations Are Probably a Legal Nightmare](https://kaynemcgladrey.com/blog/why-your-mcp-integrations-are-probably-a-legal-nightmare/): Wait, what? Original research on a Friday? I was chatting with a friend recently, and they started asking about the "risks of MCP." And I wasn't sure if they... - [Your Expert’s AI Logs Are Now Discoverable](https://kaynemcgladrey.com/blog/your-experts-ai-logs-are-now-discoverable/): Key quote: An expert witness's methodology is fair ground for discovery, see, e.g., Macchia v. ADP, Inc., 711 F. Supp. 3d 162, 167-68 (E.D.N.Y. 2024), and... - [Georgia Draws the Line on Emotional AI](https://kaynemcgladrey.com/blog/georgia-draws-the-line-on-emotional-ai/): Key quote: "An operator shall not knowingly and intentionally cause or program an AI companion chatbot to make any representation that it is licensed,... - [Why Your “Safe” AI Might Just Be High-Stakes In The EU](https://kaynemcgladrey.com/blog/why-your-safe-ai-might-just-be-high-stakes-in-the-eu/): Key quote: The guidelines are intended to support providers, deployers and other relevant actors in determining whether an AI system falls within the high-risk... - [Your Chevy was Selling Your Secrets](https://kaynemcgladrey.com/blog/your-chevy-was-selling-your-secrets/): Key quote: "General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it... - [The Permanent Price of a Healthcare Breach](https://kaynemcgladrey.com/blog/the-permanent-price-of-a-healthcare-breach/): Key quote: Based on the review to date, the information involved varies by individual, the affected information may include one or more of the following,... - [3,800 Repos, One Extension, Zero Excuses](https://kaynemcgladrey.com/blog/3800-repos-one-extension-zero-excuses/): Key quote: 1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected... - [Liability Shifts, Hourly Nudges, and the Tobacco-Style Warning in Connecticut’s New AI Law](https://kaynemcgladrey.com/blog/liability-shifts-hourly-nudges-and-the-tobacco-style-warning-in-connecticuts-new-ai-law/): Key quote: The use of an automated employment-related decision technology, as defined in section 7 of this act, shall not be a defense against a complaint... - [The Community Bank Wake-Up Call](https://kaynemcgladrey.com/blog/the-community-bank-wake-up-call/): Key quote: Among the customer information the Bank has determined was disclosed are customer names, social security numbers and dates of birth. Why it matters:... - [The $9 Billion Market Built on Junk Science](https://kaynemcgladrey.com/blog/the-9-billion-market-built-on-junk-science/): Key quote: "There are -- I mean, literally, at this point -- hundreds and hundreds of studies involving thousands and thousands of people to show that when it... - [Regulators Are Blinking. Your AI Risks Aren’t Waiting.](https://kaynemcgladrey.com/blog/regulators-are-blinking-your-ai-risks-arent-waiting/): It was a pleasure joining Aashis Luitel and Tristan Ingold on Sprinto's webinar today. We covered a lot of ground in an hour, but here's what I keep coming... - [When Zero-Days Are Cheap, Attack Surface Is A Liability](https://kaynemcgladrey.com/blog/when-zero-days-are-cheap-attack-surface-is-a-liability/): I loved being a guest on today's Cyber Risk Alliance webinar with Adrian and wanted to share some of my additional notes and thoughts in case you missed the... - [AI Wins in Colorado Legislature](https://kaynemcgladrey.com/blog/ai-wins-in-colorado-legislature/): Key quote: The bill establishes consumer notice requirements, mandating that deployers provide clear and conspicuous notice to consumers at the point of... - [The EU AI Act Delay That Wasn’t a Loophole](https://kaynemcgladrey.com/blog/the-eu-ai-act-delay-that-wasnt-a-loophole/): Key quote: Today's agreement on the AI act significantly supports our companies by reducing recurring administrative costs. It ensures legal certainty and a... - [The High Cost of Consolidating Education on a Single Vendor](https://kaynemcgladrey.com/blog/the-high-cost-of-consolidating-education-on-a-single-vendor/): Key quote: "Update - Canvas is now available for most users. Canvas Beta and Canvas Test remain in maintenance." Why it matters: The May 2026 disruption... - [Compliance Paperwork Won’t Save You From a Vendor Breach](https://kaynemcgladrey.com/blog/compliance-paperwork-wont-save-you-from-a-vendor-breach/): Key quote: All of Marquis Software Solutions, Inc.'s deadlines in the above-captioned action are stayed pending the parties' mediation efforts. Why it matters:... - [The $20 Billion AI Black Box and the Data You Thought Was Private](https://kaynemcgladrey.com/blog/the-20-billion-ai-black-box-and-the-data-you-thought-was-private/): Key quote: "Because no Defendant in this matter has served on Plaintiff either an answer or a motion for summary judgment as of the filing of this Notice,... - [Study on Business Use of Artificial Intelligence](https://kaynemcgladrey.com/blog/study-on-business-use-of-artificial-intelligence/): Strikingly, in Panel C we see employees are far more optimistic than executives on the impact of AI on future employment... In particular, employees predict... - [DFS Secures $2.25 Million Cybersecurity Settlement with Delta Dental](https://kaynemcgladrey.com/blog/dfs-secures-2-25-million-cybersecurity-settlement-with-delta-dental/): Key quote: "As cybersecurity threats continue to grow, the Department is committed to holding institutions accountable." Why it matters: The MOVEit zero-day... ## Pages - [How much does a vCISO engagement typically cost, and what should be included in the scope of work?](https://kaynemcgladrey.com/insights/how-much-does-a-vciso-engagement-typically-cost-and-what-should-be-included-in-the-scope-of-work/): How much does a vCISO engagement typically cost, and what should be included in the scope of work? If you're reading this, you already know what a virtual... - [Who are the best vCISO providers serving the western United States for small to medium companies?](https://kaynemcgladrey.com/insights/who-are-the-best-vciso-providers-serving-the-western-united-states-for-small-to-medium-companies/): A virtual Chief Information Security Officer (vCISO) provides the strategic leadership of a full-time executive without the six-figure salary and overhead. For... - [Who Are the Most Credible Cybersecurity Thought Leaders Brands Hire?](https://kaynemcgladrey.com/insights/who-are-the-most-credible-cybersecurity-thought-leaders-brands-hire/): Who Are the Most Credible Cybersecurity Thought Leaders Brands Hire? 95% of your ideal customers aren't looking for a new security vendor right now, despite... - [What are the biggest cybersecurity risks facing companies in the Pacific Northwest right now?](https://kaynemcgladrey.com/insights/pacific-northwest-cybersecurity-risks/): What are the biggest cybersecurity risks facing companies in the Pacific Northwest right now? Introduction The Pacific Northwest faces a distinct cybersecurity... - [How do cybersecurity vendors build credibility with CISO buyers through content marketing?](https://kaynemcgladrey.com/insights/cybersecurity-vendors-ciso-credibility/): How Cybersecurity Vendors Build Credibility with CISO Buyers Through Content Marketing Introduction Only 5% of organizations fully trust their cybersecurity... - [What Is a Virtual CISO and When Does a Mid-Sized Company Actually Need One?](https://kaynemcgladrey.com/insights/virtual-ciso-mid-sized-company/): Why Mid-Sized Companies Need a Virtual CISO Introduction A mid-sized manufacturing firm in Idaho recently realized their IT director, already managing servers... - [Insights](https://kaynemcgladrey.com/insights/): Strategic Cybersecurity Insights for Mid-Market Leaders & Founders This page hosts a collection of strategic analyses by Kayne McGladrey. The content... - [Blog](https://kaynemcgladrey.com/blog/): Blog - [Newsletter](https://kaynemcgladrey.com/newsletter/): Missed last week? - [Media & Partnership Opportunities](https://kaynemcgladrey.com/media-partnership-opportunities/): Media Partnerships and Thought Leadership Services  I'm a recognized leader in cybersecurity, risk management, and AI governance, ranked #1 on the... - [News](https://kaynemcgladrey.com/news/): Post Types Latest Press Coverage Alice in Supply Chains Podcast - TPCRM News Episode #19, July, 2026 Jul 16, 2026 Finally, Schrems III is nigh: with the US... - [Accessibility Statement](https://kaynemcgladrey.com/accessibility-statement/): Last Updated: December 18, 2024 At Kayne McGladrey’s website, I am committed to providing an accessible and inclusive experience for all visitors. I strive... - [Home](https://kaynemcgladrey.com/): Kayne McGladrey, CISSP – Cybersecurity Advisor, Author of the GRC Maturity Model, Virtual CISO I’m Kayne McGladrey, and I help organizations in... ## Full content For complete content, see [llms-full.txt](https://kaynemcgladrey.com/llms-full.txt)