Insights · Looking Back
Economics & Procurement
The Looking Back articles seen through economics & procurement, across every sector, in order.
55 articles
January 2020
June 2020
Week of 1 June 2020
UCSF’s ransom decision was shaped long before the attack
The NetWalker attack on servers at UCSF’s School of Medicine, and the university’s decision to pay, show that a ransom choice is largely settled in advance. Backups, data placement, insurance terms and advisers on retainer decide how much room leaders have.
Week of 15 June 2020
What due diligence cannot outsource, as Wirecard’s partners found
Wirecard had audited accounts, licenses and blue-chip clients, and €1.9 billion of its cash probably never existed. Partners relying on those signals learned that three checks cannot be delegated: where the money comes from, whether customer funds are visible, and how to leave.
August 2020
October 2020
November 2020
Week of 16 November 2020
Permission to donate cybersecurity arrived without the money to run it
New fraud-and-abuse protections let hospitals give cybersecurity to physician practices without cost sharing. The rule removed a legal obstacle; whether anything changed depended on donor economics, recipient capacity and who would operate the tools year after year.
Week of 30 November 2020
Congress regulated connected devices by deciding what agencies may buy
The IoT Cybersecurity Improvement Act set no rules for manufacturers. It set rules for one very large customer. That shifted vulnerability-handling duties onto contractors and exposed an older problem: agencies cannot apply device rules to devices they have not inventoried.
March 2021
June 2021
July 2021
September 2021
October 2021
November 2021
Week of 15 November 2021
A cyber grant with a rising match is a sustainment test
The infrastructure law’s State and Local Cybersecurity Grant Program paired $1 billion with a cost share that grew every year. That design asked states and localities what they would keep paying for once the federal money stopped.
Week of 29 November 2021
Inflation’s first casualty in bank IT was the change budget
When the Fed dropped “transitory” in late November 2021, bank and credit union technology budgets faced a quiet squeeze. Run costs rose automatically through contracts, wages and usage pricing, so the money for modernization absorbed the difference.
December 2021
May 2022
July 2022
August 2022
September 2022
October 2022
November 2022
Week of 7 November 2022
Who checked the people who moved FTX’s money
FTX’s banks, investors and partners had studied its growth. Few had asked three plain governance questions: who can move the money, who checks them, and whose money it is. Financial institutions can ask those questions of every fast-growing counterparty.
Week of 21 November 2022
Banned from the market, still on the wall: the FCC’s equipment order and the installed base
The FCC’s November 2022 order stopped new authorizations for Huawei, ZTE and, for security uses, Hikvision, Dahua and Hytera gear. It said nothing about devices already installed, so the agency’s inventory, not the market, became the enforcement point.
December 2022
Week of 19 December 2022
The quantum law asked for a price tag agencies could only get from their vendors
The Quantum Computing Cybersecurity Preparedness Act asked OMB for a funding estimate. Most of the cost sat in products agencies did not build, so the honest answer depended on vendor roadmaps, contract terms and refresh cycles.
Week of 26 December 2022
Section 524B gave hospitals a baseline to buy against
The device cybersecurity provisions in the December 2022 spending law regulated manufacturers, not hospitals. Their value to health systems was a federal baseline they could cite in selection and contracts, while leaving the installed base exactly where it was.
January 2023
March 2023
Week of 6 March 2023
SVB’s depositors learned their bank was an unassessed supplier
Silicon Valley Bank is remembered as a liquidity and supervision failure. For the fintechs, broker-dealers and companies that banked there, it was a supplier failure: cash, payment flows and dependent services all ran through one provider nobody had assessed as critical.
Week of 27 March 2023
Why the spyware order put the burden on acquisition staff
Executive Order 14093 did not ban commercial spyware. It barred operational use of tools that posed security risks or had been misused abroad, which made classification, vendor diligence and post-award oversight inside agencies the places where the policy would succeed or fail.
May 2023
July 2023
August 2023
Week of 7 August 2023
After Moody’s downgrades, regional bank technology had to argue in unit costs
Moody’s August 2023 rating actions confirmed that the spring’s bank stress would become a lasting earnings squeeze. Regional bank technology budgets had to be defended in the CFO’s terms: cost per account, faster liquidity data, and vendor contracts priced for a smaller margin.
Week of 28 August 2023
Medicare’s negotiated prices would reach hospital pharmacies as refunds, and refunds have float
When CMS named the first ten drugs for negotiation in August 2023, health systems with their own pharmacies faced three exposures with different owners: the cash gap a refund creates, the overlap with 340B, and the reconciliation systems neither problem could be managed without.
October 2023
November 2023
December 2023
March 2024
April 2024
June 2024
Week of 3 June 2024
Synnovis put a price on pathology consolidation that no contract carried
The ransomware attack on Synnovis showed that consolidating a region’s pathology into one partner saves money every year and concentrates a rare, very large loss. The business case counted the savings. Nobody’s contract, budget or insurance carried the loss.
Week of 10 June 2024
Why banking-as-a-service margins never covered the cost of knowing whose money it was
The Fed’s order against Evolve showed that sponsor-bank revenue grew with balances while the costs of reconciliation, oversight and partner failure grew with the number of programs. Banks that priced only the first side carried the second.
Week of 17 June 2024
Old ban, new deadline: Kaspersky’s exit reached the governments Washington’s 2017 order never covered
Federal agencies had dropped Kaspersky years earlier. The June 2024 Commerce determination reached counties, school districts, utilities and contractors with a fixed date, and showed that replacing a security product is a procurement project with three costs most public budgets had never estimated.
September 2024
November 2024
December 2024
January 2025
February 2025
May 2025
August 2025
Week of 4 August 2025
Cheap to license, slow to permit: federal AI’s bottleneck moved to the CISO’s desk
GSA’s August 2025 agreements made leading AI tools nearly free for agencies. The price did not grant the three permissions that decide real use: a security authorization, a ruling on what data may go in, and an owner for the records and oversight duties.
Week of 18 August 2025
How a fee question pulled open banking off the rulebook and onto the rate card
By asking whether banks may charge for data access, the CFPB’s August 2025 notice shifted open banking terms from regulation into contracts. Large banks could set prices, smaller institutions would inherit them through vendors, and data users would have to redesign around them.
November 2025
December 2025
February 2026
Week of 2 February 2026
Vendors repriced in a day, contracts run for years: the buyer’s side of the software selloff
The February selloff was a bet on software vendors. Regulated buyers faced a different exposure: agreements priced per human seat, locked for years, closed to automated access and hard to leave. Each needed renegotiating before the next renewal.
Week of 23 February 2026
What a supply chain label on a U.S. AI vendor asked of agencies and contractors
When the administration moved to exclude Anthropic, agencies and contractors could not wait for the courts. The workable response scoped three things: which instrument applied, whom and which contracts it reached, and which uses of the model it covered.