354 articles · page 4 of 18
Week of 11 August 2025
Secrets in a public docket: the court filing breach and where the sensitive tier ends
The federal courts already had a separate path for their most sensitive documents when the 2025 CM/ECF breach widened. The trouble was the boundary. Agencies holding dangerous records inside general systems need a tier defined by consequence, not by label.
Week of 4 August 2025
Cheap to license, slow to permit: federal AI’s bottleneck moved to the CISO’s desk
GSA’s August 2025 agreements made leading AI tools nearly free for agencies. The price did not grant the three permissions that decide real use: a security authorization, a ruling on what data may go in, and an owner for the records and oversight duties.
Week of 28 July 2025
Why the CMS patient app pledge depends on the registration desk
The July 2025 health tech ecosystem pledge promised patients their records in apps of their choice. The data pipes largely existed. What decides success is front-office work: proving who the patient is, matching the right records, and handling consent and proxies.
Week of 21 July 2025
ToolShell made patching the easy part of a SharePoint emergency
Attackers exploiting on-premises SharePoint in July 2025 stole the keys that let them return after the patch. For agencies running collaboration servers on premises, the response split into three jobs with different owners: patch, evict, and decide whether the server should exist.
Week of 14 July 2025
An escort who cannot read the command is not a security control
ProPublica’s report on Microsoft’s digital escorts showed that a cloud authorization says little about who actually operates a system. Agencies need personnel terms they can test: who can touch the system, how that work is checked, and what evidence reaches them.
Week of 7 July 2025
How the DOJ’s bulk data rule made reach, not storage, the health data test
When the Justice Department’s grace period ended on July 8, 2025, health systems and life sciences firms faced a rule that asks who could reach their data, not how well it is protected. That puts procurement, research administration and HR on the front line.
Week of 30 June 2025
State AI law after the 99-to-1 vote: build for notice, explanation and human review
The Senate’s removal of a federal moratorium left AI compliance to the states. The durable core across their laws was notice, explanation, human review and records. Programs that built that core first could absorb shifting assessment and disclosure rules.
Week of 23 June 2025
One alert, three threats: how local agencies should have read the June 2025 Iran warning
After U.S. strikes on Iran, federal warnings described one heightened threat. For cities, counties and utilities it was three: hacktivist noise, opportunistic attacks on exposed control systems, and patient state operations. Each has a different owner, timescale and fix.
Week of 16 June 2025
Why Scattered Spider’s turn to insurers should have set a deadline for the rest of finance
When a group that works one industry at a time reached U.S. insurers in June 2025, threat intelligence turned into a date. Institutions needed a pre-agreed surge mode: a named trigger, tighter help-desk rules for weeks, and containment planned around compromised identity.
Week of 9 June 2025
Google Cloud’s June outage moved bank cloud diligence from uptime to change safety
Google Cloud’s June 2025 outage started with a routine policy update that reached every region at once. Banks learn more from asking how a provider releases code and configuration than from its uptime commitment.
Week of 2 June 2025
Once FDA read with AI, sponsors’ inconsistencies got cheaper to find
FDA’s Elsa gave reviewers a fast tool for searching and comparing submissions. Sponsors needed three disciplines in response: dossiers a machine reader cannot trip over, an evidence trail that corrects misreadings quickly, and validation records for their own AI.
Week of 26 May 2025
How ConnectWise’s breach tested small practices’ business associate agreements
A nation-state intrusion at a remote access vendor in May 2025 sat two contracts away from most physician practices. Their services and business associate agreements are the only controls they hold, and most say too little about tools, access, notice and cost.
Week of 19 May 2025
The scammers’ window: patient communication when a hospital goes dark
Within days of Kettering Health’s May 2025 ransomware outage, criminals were phoning its patients for card payments. Outage communication is a security control, and it has to exist before the attack: surviving channels, ready answers, anti-impersonation rules and clear authority.
Week of 12 May 2025
Cheap contracts, valuable access: the market behind Coinbase’s bribed agents
Coinbase’s May 2025 disclosure showed criminals buying data from outsourced support staff who could already see it. Insider risk in support operations behaves like a market, and financial institutions set its terms through how they buy and govern outsourced labor.
Week of 5 May 2025
Why the air traffic control rebuild started with the wires
The Newark outages that preceded Washington’s May 2025 air traffic control plan failed in the links between facilities. For agencies modernizing systems that cannot stop, the transport layer, the cutover and the workforce deserve as much planning as the applications.
Week of 28 April 2025
Iberia’s blackout put payment resilience back at the shop counter
When the Iberian grid failed in April 2025, bank systems largely held and customers still could not pay. Payment resilience is set at the terminal, the network link, the offline rules and the cash fallback, and banks can shape all four.
Week of 21 April 2025
A new SEC chair rewrites the agenda, not the compliance calendar
Paul Atkins arrived at the SEC promising a lighter touch. For broker-dealers and advisers, what mattered was each rule’s legal status: proposals could vanish quickly, adopted rules kept their dates, and examinations kept running.
Week of 14 April 2025
How the CVE contract scare exposed the public plumbing under every patching policy
For a day in April 2025, the program that names software flaws looked set to stop. It revealed that patching policies and audit evidence rest on three public layers, identification, enrichment and prioritization, each with its own failure mode.
Week of 7 April 2025
Supervisory correspondence: a bank’s most candid file, held in a system it cannot assess
The OCC’s email breach showed that a bank’s frankest account of its own weaknesses sits with a regulator it cannot audit or replace. Banks still control what they write, how it travels, and how they respond to a breach.
Week of 31 March 2025
Lighter rules, heavier contracts: OMB’s April 2025 AI memos handed governance to the buyer
OMB’s April 2025 memos trimmed internal AI process but asked contracts to carry more of the load. Agencies that treated each stage of the contract as a governance control kept bargaining power that review boards alone could not provide.