52 articles
January 2025
Week of 6 January 2025
Under FDA’s change-control model, the AI device a hospital validates will not stay the one it runs
FDA’s January 2025 draft on AI-enabled devices, read with its December change-control guidance, assumed devices keep changing after purchase. Hospitals face three kinds of post-purchase change, pre-authorized updates, updates needing new review, and shifts in their own environment, and each needs a different control.
Week of 13 January 2025
DORA’s register of information made every bank a data supplier to EU oversight of its vendors
DORA’s register of ICT third-party arrangements looked like paperwork. It was a dataset supervisors would aggregate to find concentration and designate critical providers, so its quality rested on three data problems most vendor programs had never solved: identity, dependency and depth.
Week of 20 January 2025
Revoking the AI executive order could not revoke the AI inventory, because Congress had written it
On inauguration day the 2023 AI executive order was revoked, and replacement guidance was weeks away. Agency AI programs could sort their work by legal footing: what rested only on the order, what rested on OMB memoranda awaiting revision, and what statute required regardless.
Week of 27 January 2025
DeepSeek arrived in three forms in one week, and each needed a different control
Within days, the same DeepSeek model reached organizations as a consumer app, a developer API and open weights on U.S. clouds. Blanket bans treated them as one risk. They were three: shadow use, data jurisdiction and model behavior, each owned by a different team.
February 2025
Week of 3 February 2025
In the Treasury payment access dispute, “read-only” was a claim until the records proved it
Setting the politics aside, the fight over new access to Treasury’s payment systems played out in sworn filings about who had which permissions. It showed that privileged access governance rests on four separate controls, and that each must be provable, not just stated.
Week of 10 February 2025
With the CFPB paused, banks lost the outside signals their customer programs relied on
The February 2025 stop-work order did not change consumer law. It removed three things the Bureau had supplied to firms almost for free: exam deadlines that forced fixes, published findings about peers, and federal follow-up on complaints. Firms had to replace each themselves.
Week of 17 February 2025
Bybit’s signers approved what their screens showed, which was not what they signed
The largest crypto theft on record defeated multi-signature approval without breaking it, by altering the interface the signers trusted. Banks approving payments through software face the same risk at four points: how the interface is built, what approvers see, how payments are verified, and recovery.
Week of 24 February 2025
The House budget vote signaled Medicaid churn, a cost hospitals pay at the front desk
The February 2025 budget resolution started the path to the year’s Medicaid changes. Beyond lost revenue, more frequent eligibility checks and work requirements would raise the cost of knowing who is covered, at registration, in enrollment support and in the revenue cycle.
March 2025
Week of 3 March 2025
HHS’s end of voluntary comment periods hit grantees hardest and Medicare providers least
By rescinding the Richardson Waiver, HHS stopped offering notice and comment where the law did not require it. The loss of warning fell unevenly: heavily on grant recipients, moderately on contractors, and lightly on Medicare providers, whose statute still requires comment.
Week of 10 March 2025
Medusa showed that a clinic’s remote-support software is its ransomware attack surface
The March 2025 Medusa advisory read like a catalog of the remote-access and management products hospitals and clinics depend on. Defending against it means governing those tools at three points: entry, movement and evasion.
Week of 17 March 2025
23andMe’s bankruptcy turned a privacy policy into a term of sale
Once 23andMe entered Chapter 11, its privacy promises stopped being a disclosure and turned into a condition that courts, states and bidders had to price. Anyone holding or sharing health-adjacent data should write contracts with that ending in mind.
Week of 24 March 2025
Why the Signal group chat was a channel design failure before it was a leak
A journalist in a senior officials’ chat made the headlines. For agencies at every level, the durable failure was a sanctioned channel that could not set content boundaries, verify participants and keep the record at the same time.
Week of 31 March 2025
Lighter rules, heavier contracts: OMB’s April 2025 AI memos handed governance to the buyer
OMB’s April 2025 memos trimmed internal AI process but asked contracts to carry more of the load. Agencies that treated each stage of the contract as a governance control kept bargaining power that review boards alone could not provide.
April 2025
Week of 7 April 2025
Supervisory correspondence: a bank’s most candid file, held in a system it cannot assess
The OCC’s email breach showed that a bank’s frankest account of its own weaknesses sits with a regulator it cannot audit or replace. Banks still control what they write, how it travels, and how they respond to a breach.
Week of 14 April 2025
How the CVE contract scare exposed the public plumbing under every patching policy
For a day in April 2025, the program that names software flaws looked set to stop. It revealed that patching policies and audit evidence rest on three public layers, identification, enrichment and prioritization, each with its own failure mode.
Week of 21 April 2025
A new SEC chair rewrites the agenda, not the compliance calendar
Paul Atkins arrived at the SEC promising a lighter touch. For broker-dealers and advisers, what mattered was each rule’s legal status: proposals could vanish quickly, adopted rules kept their dates, and examinations kept running.
Week of 28 April 2025
Iberia’s blackout put payment resilience back at the shop counter
When the Iberian grid failed in April 2025, bank systems largely held and customers still could not pay. Payment resilience is set at the terminal, the network link, the offline rules and the cash fallback, and banks can shape all four.
May 2025
Week of 5 May 2025
Why the air traffic control rebuild started with the wires
The Newark outages that preceded Washington’s May 2025 air traffic control plan failed in the links between facilities. For agencies modernizing systems that cannot stop, the transport layer, the cutover and the workforce deserve as much planning as the applications.
Week of 12 May 2025
Cheap contracts, valuable access: the market behind Coinbase’s bribed agents
Coinbase’s May 2025 disclosure showed criminals buying data from outsourced support staff who could already see it. Insider risk in support operations behaves like a market, and financial institutions set its terms through how they buy and govern outsourced labor.
Week of 19 May 2025
The scammers’ window: patient communication when a hospital goes dark
Within days of Kettering Health’s May 2025 ransomware outage, criminals were phoning its patients for card payments. Outage communication is a security control, and it has to exist before the attack: surviving channels, ready answers, anti-impersonation rules and clear authority.
Week of 26 May 2025
How ConnectWise’s breach tested small practices’ business associate agreements
A nation-state intrusion at a remote access vendor in May 2025 sat two contracts away from most physician practices. Their services and business associate agreements are the only controls they hold, and most say too little about tools, access, notice and cost.
June 2025
Week of 2 June 2025
Once FDA read with AI, sponsors’ inconsistencies got cheaper to find
FDA’s Elsa gave reviewers a fast tool for searching and comparing submissions. Sponsors needed three disciplines in response: dossiers a machine reader cannot trip over, an evidence trail that corrects misreadings quickly, and validation records for their own AI.
Week of 9 June 2025
Google Cloud’s June outage moved bank cloud diligence from uptime to change safety
Google Cloud’s June 2025 outage started with a routine policy update that reached every region at once. Banks learn more from asking how a provider releases code and configuration than from its uptime commitment.
Week of 16 June 2025
Why Scattered Spider’s turn to insurers should have set a deadline for the rest of finance
When a group that works one industry at a time reached U.S. insurers in June 2025, threat intelligence turned into a date. Institutions needed a pre-agreed surge mode: a named trigger, tighter help-desk rules for weeks, and containment planned around compromised identity.
Week of 23 June 2025
One alert, three threats: how local agencies should have read the June 2025 Iran warning
After U.S. strikes on Iran, federal warnings described one heightened threat. For cities, counties and utilities it was three: hacktivist noise, opportunistic attacks on exposed control systems, and patient state operations. Each has a different owner, timescale and fix.
Week of 30 June 2025
State AI law after the 99-to-1 vote: build for notice, explanation and human review
The Senate’s removal of a federal moratorium left AI compliance to the states. The durable core across their laws was notice, explanation, human review and records. Programs that built that core first could absorb shifting assessment and disclosure rules.
July 2025
Week of 7 July 2025
How the DOJ’s bulk data rule made reach, not storage, the health data test
When the Justice Department’s grace period ended on July 8, 2025, health systems and life sciences firms faced a rule that asks who could reach their data, not how well it is protected. That puts procurement, research administration and HR on the front line.
Week of 14 July 2025
An escort who cannot read the command is not a security control
ProPublica’s report on Microsoft’s digital escorts showed that a cloud authorization says little about who actually operates a system. Agencies need personnel terms they can test: who can touch the system, how that work is checked, and what evidence reaches them.
Week of 21 July 2025
ToolShell made patching the easy part of a SharePoint emergency
Attackers exploiting the July 2025 SharePoint zero-day stole the keys that let them return after the patch. For agencies running collaboration servers on premises, the response split into three jobs with different owners: patch, evict, and decide whether the server should exist.
Week of 28 July 2025
Why the CMS patient app pledge depends on the registration desk
The July 2025 health tech ecosystem pledge promised patients their records in apps of their choice. The data pipes largely existed. What decides success is front-office work: proving who the patient is, matching the right records, and handling consent and proxies.
August 2025
Week of 4 August 2025
Cheap to license, slow to permit: federal AI’s bottleneck moved to the CISO’s desk
GSA’s August 2025 agreements made leading AI tools nearly free for agencies. The price did not grant the three permissions that decide real use: a security authorization, a ruling on what data may go in, and an owner for the records and oversight duties.
Week of 11 August 2025
Secrets in a public docket: the court filing breach and where the sensitive tier ends
The federal courts already had a separate path for their most sensitive documents when the 2025 CM/ECF breach widened. The trouble was the boundary. Agencies holding dangerous records inside general systems need a tier defined by consequence, not by label.
Week of 18 August 2025
How a fee question pulled open banking off the rulebook and onto the rate card
By asking whether banks may charge for data access, the CFPB’s August 2025 notice shifted open banking terms from regulation into contracts. Large banks could set prices, smaller institutions would inherit them through vendors, and data users would have to redesign around them.
Week of 25 August 2025
OAuth integrations make their vendors custodians of your credentials
The Salesloft Drift data theft started in a vendor’s environment, not in any customer’s Salesforce org. Approving an integration hands a vendor a standing credential, and most third-party reviews never asked how that credential was kept.
September 2025
Week of 1 September 2025
The CAT’s retirement freed the framework and orphaned the risk profile
When the FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025, attention went to picking a replacement framework. The harder loss was the inherent risk profile, the step that told a bank how much security it needed.
Week of 8 September 2025
Why bank change control never saw the npm hijack
Malicious versions of widely used JavaScript packages were live for about two hours in September 2025. Bank change control approves code people write; this attack arrived in code the build pipeline fetched on its own, which nobody approves.
Week of 15 September 2025
Approval is easy, monitoring is hard: the Joint Commission’s AI guidance and the work after go-live
The September 2025 Joint Commission and CHAI guidance read like a governance checklist. Most of its weight fell after go-live, on monitoring and event reporting that depend on vendor contract terms few hospitals had negotiated.
Week of 22 September 2025
Persistence below the patch: what ED 25-03 asked agencies to prove about their firewalls
CISA’s Emergency Directive 25-03 described attackers who altered Cisco firewall boot firmware to survive reboots and upgrades. The burden shifted from applying a fix to proving that each device could be trusted, and that the fix was the right one.
Week of 29 September 2025
How the lapse of a 2015 law put counsel in the threat-sharing loop
When the Cybersecurity Information Sharing Act expired as the October 2025 shutdown began, sharing did not stop. Each outbound indicator acquired a legal question, and teams that had never written down who approves sharing found analysts waiting on lawyers.
October 2025
Week of 6 October 2025
Cl0p’s Oracle campaign: an attack on the systems security teams did not run
The Oracle E-Business Suite extortion wave succeeded because ERP sits with finance, not security. Closing the gap means settling emergency authority, shrinking what faces the internet and cutting what the application retains.
Week of 13 October 2025
Why Windows 10’s end of support split every hospital fleet in three
Hospital endpoints fell into machines IT controls, machines device makers control and machines nobody clearly controls. Reporting them as one migration hid where the residual risk sat, and only the first group had a simple answer.
Week of 20 October 2025
One region failed, many financial apps stalled: concentration risk sat in the dependencies
The October 2025 us-east-1 outage hit financial apps whose own designs looked resilient. The exposure lay in shared services and recovery backlogs, so the response is dependency mapping and tested degraded modes, not reflexive multi-cloud.
Week of 27 October 2025
NYDFS’s final Part 500 deadline put the asset inventory underneath every other control
New York’s last amended cybersecurity deadline, November 1, 2025, paired universal MFA with a maintained asset inventory. MFA drew the attention. The inventory was harder, and the executive certification made both personal.
November 2025
Week of 3 November 2025
For SNAP systems, paying less was harder than paying nothing
During the 2025 shutdown, court orders pushed states toward partial and then full November SNAP payments within days. Eligibility logic, EBT issuance and public communication were each built for benefits paid in full or not at all.
Week of 10 November 2025
CMMC’s first phase priced a signature, not a score
When CMMC requirements began appearing in Defense contracts on November 10, 2025, attention went to assessment levels. The senior official’s affirmation mattered more, because it turned security claims into dated representations with legal weight.
Week of 17 November 2025
For EU consumer lenders, the credit-scoring deadline that mattered was never the AI Act’s
The Commission’s proposal to delay high-risk AI obligations looked like relief for credit scoring. For consumer lenders, the binding constraints were the GDPR as the EU’s top court had read it and the Consumer Credit Directive’s November 2026 date.
Week of 24 November 2025
SitusAMC turned a mid-tier mortgage vendor into a top-tier bank exposure
The SitusAMC breach reached some of the largest U.S. banks through a real estate finance services provider. Vendor tiering built on spend and operational criticality missed a firm that held sensitive data for many institutions at once.
December 2025
Week of 1 December 2025
Under Regulation S-P, the firm that knows least about a breach tells the most customers
When the amended Regulation S-P took effect for larger firms on December 3, 2025, notice became the default. Whether a firm could notify narrowly depended on evidence it had to keep before any incident.
Week of 8 December 2025
Why the AI preemption order barely reached health care’s own AI rules
The December 2025 executive order aimed federal pressure at broad state AI laws. Most of the AI rules health systems actually follow sit in licensing, insurance and privacy law, where preemption arguments are weakest, so the order’s main risk lay with vendors.
Week of 15 December 2025
Crypto trust charters and community banks: the binding decision sits in the core
The OCC’s conditional charters made federally supervised digital-asset custodians a realistic option for smaller banks and credit unions. The harder decision was how any of it would reconcile to the general ledger, statements and reports their core platforms produce.
Week of 22 December 2025
Legal to fly, hard to replace: the FCC drone listing and public-safety fleets
The FCC’s December 22 action did not ground a single police or fire drone. It blocked new foreign-made models, which turned agency drone programs into a question of spares, software support and replacement budgets.
Week of 29 December 2025
The 2026 state privacy laws split institutional exemptions from data exemptions
Indiana, Kentucky and Rhode Island brought comprehensive privacy laws into force on January 1, 2026. For banks and health systems, exposure turned on whether each statute exempted the organization or only its regulated data, and that answer keeps changing.