Cross-sector

56 articles

February 2020

1. Week of 24 February 2020

   Buildings intact, workforce gone: the scenario continuity plans skipped

   As markets fell and federal health officials warned of community spread, most continuity plans still assumed the loss of a building. A pandemic removes people, suppliers and remote capacity at once, and plans had to be rebuilt and tested around those three losses.

   • Cross-sector
   • Operations & Workforce
   • 5 min read

April 2020

1. Week of 20 April 2020

   Zoom 5.0 fixed the vendor layer; configuration and records stayed yours

   Zoom’s April 2020 release improved encryption and tightened defaults after weeks of scrutiny. For banks, health systems and agencies, most compliance risk sat in two layers no vendor release could fix: how the platform was configured, and what meeting content had to be kept.

   • Cross-sector
   • Security & Resilience
   • 5 min read

July 2020

1. Week of 13 July 2020

   Schrems II and the case for deciding where data lives first

   The EU’s highest court invalidated the EU-US Privacy Shield on July 16, 2020, and made standard contractual clauses depend on case-by-case assessment. Organizations that settled data location and key control first found the legal paperwork easier, and survived later swings in the law.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

2. Week of 20 July 2020

   The control system map most operators did not have

   The NSA and CISA alert of July 23, 2020, urged immediate action to protect control systems. Its first and hardest request was an accurate map of what was actually connected, which municipal utilities, hospitals and data center operators rarely had.

   • Cross-sector
   • Security & Resilience
   • 5 min read

September 2020

1. Week of 28 September 2020

   From crisis call to compliance record: OFAC’s ransomware advisory

   Treasury’s October 1, 2020 advisories did not ban ransom payments. They attached strict sanctions liability to victims and the firms that help them pay, which moved the decision from the crisis room into a governed, documented compliance process.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

October 2020

1. Week of 12 October 2020

   Why one phone call beat Twitter’s login controls

   New York’s report on the Twitter hack described a phone call and a fake login page, not an exploit. With staff dispersed, the people who verify callers and reset credentials were a control most organizations had never designed, staffed or measured as one.

   • Cross-sector
   • Operations & Workforce
   • 5 min read

2. Week of 19 October 2020

   Antitrust moves in years; vendor dependency is set at signing

   The Justice Department’s search case opened a long fight over platform power. For regulated buyers it offered no relief on their own concentration risk, which is decided in contracts, architecture and tested exit plans on a timeline no court can match.

   • Cross-sector
   • Economics & Procurement
   • 5 min read

November 2020

1. Week of 2 November 2020

   Exempt institution, covered data: what Proposition 24 meant for banks and hospitals

   Proposition 24 created the first U.S. regulator dedicated to privacy. Banks and health systems that assumed federal law exempted them found that California exempts data governed by GLBA or HIPAA, not institutions, and that the remainder needed operational plumbing.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

February 2021

1. Week of 15 February 2021

   Why working from home failed when Texas froze

   A year into the pandemic, many continuity plans answered every site outage with remote work. Winter Storm Uri removed power, water, roads and home connectivity together, showing that a single fallback fails when failures are correlated across people, sites, networks and suppliers.

   • Cross-sector
   • Operations & Workforce
   • 5 min read

April 2021

1. Week of 19 April 2021

   How the AI Act proposal tied risk to the use, whatever the model

   The European Commission’s April 2021 AI Act proposal regulated what AI is used for, not how it is built. Its four tiers sorted banks’, hospitals’ and agencies’ AI by business process, which put compliance ownership with process owners as much as data scientists.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

June 2021

1. Week of 28 June 2021

   Kaseya and the most privileged system nobody on site runs

   REvil’s attack through Kaseya VSA reached hundreds of businesses through the tools their IT providers used to manage them. Clients had outsourced the work but kept the risk, and three gaps decided their exposure: privilege, concentration and contract.

   • Cross-sector
   • Platforms & Architecture
   • 6 min read

August 2021

1. Week of 16 August 2021

   Data stayed in China and still left: PIPL’s remote access problem

   China’s Personal Information Protection Law, adopted in August 2021, pushed multinationals to store data in-country. Storage was the easy half. Personal information still left through three paths a data center map does not show: copies, remote views and derived outputs.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

September 2021

1. Week of 6 September 2021

   Vaccination status was the easy record; exemptions were the hard one

   Biden’s September 2021 vaccination plan sent employers scrambling to collect proof. Of the three capabilities it demanded, status records, weekly testing and exemption decisions, the third carried the lasting legal risk and was the one most organizations under-built.

   • Cross-sector
   • Operations & Workforce
   • 5 min read

October 2021

1. Week of 18 October 2021

   BlackMatter’s reach was set by the directory, not the malware

   The October 2021 BlackMatter advisory described attackers arriving with stolen credentials and using Active Directory to find everything worth encrypting. How far one credential could travel was decided by identity design made years earlier.

   • Cross-sector
   • Security & Resilience
   • 5 min read

December 2021

1. Week of 6 December 2021

   Log4Shell was a search problem before it was a patching problem

   The Log4j flaw disclosed in December 2021 was easy to exploit and easy to fix. The crisis was finding it, and the difficulty differed for software an organization builds, software it buys and software it consumes as a service.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

January 2022

1. Week of 3 January 2022

   After the FTC’s Log4j warning, the response record was the defense

   The FTC’s January 2022 warning tied Log4j remediation to its reasonable-security standard. Reasonableness is judged later, from records, so the decisive work was documenting the response while it happened, including what vendors said and when.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

February 2022

1. Week of 21 February 2022

   Shields Up had no end date, so vigilance needed a staffing plan

   When Russia invaded Ukraine, CISA asked every US organization to raise its guard, with no date to lower it. Sustaining a heightened posture for months was a management problem: who watches, who decides, and what work stops to pay for it.

   • Cross-sector
   • Operations & Workforce
   • 5 min read

March 2022

1. Week of 7 March 2022

   Describe your board’s cyber oversight in a filing, and you have made a promise

   The SEC’s March 2022 proposal is remembered for its four-day incident clock. Its governance disclosures reached further: every public company would describe how management and the board handle cyber risk, and that text would become a standard others could test.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

May 2022

1. Week of 23 May 2022

   An acquisition announcement is a free option on your exit plan

   Broadcom’s agreement to buy VMware gave customers eighteen months before anything changed. The organizations that came out best treated that window as an option to buy cheaply: a priced exit path, kept alive with small investments, and exercised on evidence at renewal.

   • Cross-sector
   • Economics & Procurement
   • 5 min read

June 2022

1. Week of 6 June 2022

   Your carrier’s routers belong in your threat model

   A joint advisory described state actors working through network devices to get inside telecom and network service providers. For enterprises that buy those services, it meant treating the provider’s network as untrusted transport, its administrators as privileged users, and its silence as a monitoring gap.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

July 2022

1. Week of 18 July 2022

   Necessary and proportionate: the ADPPA test that outlived the bill

   The federal privacy bill that cleared committee 53 to 2 never reached the floor. Its minimization test did outlast it, and banks and hospitals were more exposed to that test than their sector carve-outs suggested.

   • Cross-sector
   • Data & AI
   • 5 min read

2. Week of 25 July 2022

   Chip policy ran on a decade’s clock; IT backlogs ran on a quarter’s

   The CHIPS and Science Act passed while switches and servers sat on back order. It addressed where chips would be made in the 2030s. IT leaders needed separate answers, on separate clocks, for the backlog, the refresh plan and provenance.

   • Cross-sector
   • Economics & Procurement
   • 5 min read

August 2022

1. Week of 22 August 2022

   LastPass and the first-draft problem in vendor breach notices

   LastPass’s August 2022 notice reported stolen source code and safe customer data. The attacker’s next stage was already under way. Customers needed to read the notice for what it enabled, know what their vaults exposed, and be ready to rotate.

   • Cross-sector
   • Security & Resilience
   • 5 min read

December 2022

1. Week of 5 December 2022

   Rackspace kept running old Exchange for clients, and kept its old risks

   The Rackspace ransomware incident showed that paying a provider to run an aging platform transfers the work, not the platform’s exposure. Customers needed three things the contract rarely described: a patch path, an exit path and a recovery path they controlled.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

February 2023

1. Week of 6 February 2023

   One console, every server: what ESXiArgs exposed about the hypervisor

   ESXiArgs exploited a flaw patched two years earlier, but its damage came from where it struck. At the virtualization layer, one compromise encrypts every server, sits below most security tooling, and can take the backups with it.

   • Cross-sector
   • Security & Resilience
   • 5 min read

April 2023

1. Week of 24 April 2023

   Four regulators, no new law: the AI statement put the buyers of models on the hook

   The April 2023 joint statement created no rules. By saying existing lending, employment, housing and consumer protection law already reached automated systems, it made the organization using a model answerable for its data, its opacity and its use, whoever built it.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

June 2023

1. Week of 5 June 2023

   Most MOVEit victims never ran MOVEit

   MOVEit reached thousands of organizations through payroll, pension and contractor firms that ran the software for them. Those clients had nothing to patch. Their exposure turned on finding affected vendors fast, settling who notified whom, and how much data they had sent.

   • Cross-sector
   • Security & Resilience
   • 5 min read

2. Week of 12 June 2023

   Why the AI Act’s obligations follow your role, not your sector

   The European Parliament’s June 2023 position drew headlines for generative AI. Its durable feature for banks, health systems and agencies was structure: duties attach to whether an organization builds a system, deploys one, or builds on a general-purpose model, and many hold all three roles.

   • Cross-sector
   • Data & AI
   • 5 min read

3. Week of 26 June 2023

   Two privacy laws on, one rulebook paused: compliance by capability map

   Colorado and Connecticut switched on their privacy laws while a California court paused new regulations a day before enforcement. When effective dates move this much, a privacy program should be organized around four standing capabilities, with each new law mapped onto them.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

July 2023

1. Week of 24 July 2023

   Under the SEC’s final cyber rule, the clock starts at a decision, so the decision needs a record

   The SEC’s July 2023 rule started its four-business-day clock at the materiality determination, not at discovery. That made the determination itself the thing to govern: who makes it, what record it leaves, and how it lines up with every other notification clock.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

September 2023

1. Week of 18 September 2023

   Cisco’s Splunk deal and the case for owning your security logs outside the SIEM

   A SIEM changing owners exposed where lock-in actually sits: years of logs that retention rules require, detection rules written in one vendor’s query language, and the integrations around them. Each can be moved out of the platform’s exclusive control before the next deal.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

November 2023

1. Week of 20 November 2023

   Why the useful response to OpenAI’s board crisis was a days-to-switch number

   No third-party risk questionnaire could have predicted OpenAI’s November 2023 board crisis. What regulated buyers controlled was the cost of moving away from any one model provider, set by three things: their contracts, their architecture and their fallbacks.

   • Cross-sector
   • Economics & Procurement
   • 5 min read

December 2023

1. Week of 25 December 2023

   Someone else’s lawsuit, your contracts: how the Times case reached regulated AI buyers

   Banks, health systems and agencies were not parties to The New York Times’s December 2023 suit against OpenAI and Microsoft. It still reached them three ways: through the indemnities they relied on, the content they published, and the prompts their vendors kept.

   • Cross-sector
   • Economics & Procurement
   • 5 min read

January 2024

1. Week of 22 January 2024

   Test tenants are production when their apps can reach production

   Midnight Blizzard reached Microsoft’s executive mailboxes through a test tenant account and an old OAuth app. Whether any non-production identity is a production risk turns on three properties: who can log in to it, what it can reach, and who would notice it acting.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

February 2024

1. Week of 26 February 2024

   CSF 2.0’s biggest addition was the one a security team could not deliver

   NIST’s new Govern function looked like a security framework update. Its six categories assign work to executives, HR, procurement and boards. Organizations that treated it as a mapping exercise for the CISO missed what had changed.

   • Cross-sector
   • Operations & Workforce
   • 5 min read

April 2024

1. Week of 8 April 2024

   How the APRA draft moved privacy compliance to the customer’s side of the counter

   The American Privacy Rights Act draft never passed. Its distinctive features let individuals act directly, through requests, machine-readable opt-out signals and lawsuits. Those three channels, already arriving through state law, are where regulated organizations’ privacy programs are now judged.

   • Cross-sector
   • Customer & Citizen Experience
   • 5 min read

July 2024

1. Week of 15 July 2024

   Channel File 291 measured every recovery plan in hands per device

   The faulty CrowdStrike update turned remotely managed Windows estates into a field-service job. Recovery speed came down to three constraints most plans never modeled: access to recovery secrets, people at keyboards, and the order of repair.

   • Cross-sector
   • Operations & Workforce
   • 5 min read

2. Week of 22 July 2024

   Why North Korea’s fake remote hires succeed in the gaps between HR, IT and security

   KnowBe4’s account of hiring a North Korean IT worker showed a scheme built to pass four hand-offs, each owned by a different team. Controls work when one identity is carried from interview to offer, onboarding, device and daily work.

   • Cross-sector
   • Security & Resilience
   • 5 min read

August 2024

1. Week of 12 August 2024

   Post-quantum priority starts in the records retention schedule

   NIST’s first post-quantum standards said what to migrate to. For banks, health systems and agencies, the order of migration is set by how long data must stay secret, which makes the retention schedule the first planning document.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

2. Week of 19 August 2024

   National Public Data turned the Social Security number into a lookup key

   Once a single broker dataset linked names, addresses, birth dates and Social Security numbers, those facts could still find a customer’s record but could no longer prove who was asking. Enrollment, recovery and high-risk changes each needed a different fix.

   • Cross-sector
   • Customer & Citizen Experience
   • 5 min read

November 2024

1. Week of 4 November 2024

   After the 2024 election, a rule’s legal form predicted its survival better than its topic

   Election week changed no rule, but it changed the odds for many. The best predictor of which obligations would last was the instrument behind them: statute, a rule still inside the Congressional Review Act window, or guidance and executive orders.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

2. Week of 25 November 2024

   Blue Yonder put process-running vendors at the top of the risk register

   The Blue Yonder ransomware attack disrupted staff scheduling and pay at major retailers. Vendor risk programs built around data protection miss suppliers whose failure stops work, and classifying vendors by what their failure costs changes diligence, contracts and contingency spending.

   • Cross-sector
   • Economics & Procurement
   • 5 min read

December 2024

1. Week of 2 December 2024

   The CFPB’s data broker proposal exposed a provenance gap that AI programs inherit

   The proposal to treat many data brokers as consumer reporting agencies was withdrawn within six months. Its underlying question, where personal data came from and what it may be used for, applies to data entering, leaving and being repurposed inside every AI program.

   • Cross-sector
   • Data & AI
   • 5 min read

January 2025

1. Week of 27 January 2025

   DeepSeek arrived in three forms in one week, and each needed a different control

   Within days, the same DeepSeek model reached organizations as a consumer app, a developer API and open weights on U.S. clouds. Blanket bans treated them as one risk. They were three: shadow use, data jurisdiction and model behavior, each owned by a different team.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

April 2025

1. Week of 14 April 2025

   How the CVE contract scare exposed the public plumbing under every patching policy

   For a day in April 2025, the program that names software flaws looked set to stop. It revealed that patching policies and audit evidence rest on three public layers, identification, enrichment and prioritization, each with its own failure mode.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

June 2025

1. Week of 30 June 2025

   State AI law after the 99-to-1 vote: build for notice, explanation and human review

   The Senate’s removal of a federal moratorium left AI compliance to the states. The durable core across their laws was notice, explanation, human review and records. Programs that built that core first could absorb shifting assessment and disclosure rules.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

August 2025

1. Week of 25 August 2025

   OAuth integrations make their vendors custodians of your credentials

   The Salesloft Drift data theft started in a vendor’s environment, not in any customer’s Salesforce org. Approving an integration hands a vendor a standing credential, and most third-party reviews never asked how that credential was kept.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

September 2025

1. Week of 29 September 2025

   How the lapse of a 2015 law put counsel in the threat-sharing loop

   When the Cybersecurity Information Sharing Act expired as the October 2025 shutdown began, sharing did not stop. Each outbound indicator acquired a legal question, and teams that had never written down who approves sharing found analysts waiting on lawyers.

   • Cross-sector
   • Operations & Workforce
   • 5 min read

October 2025

1. Week of 6 October 2025

   Cl0p’s Oracle campaign: an attack on the systems security teams did not run

   The Oracle E-Business Suite extortion wave succeeded because ERP sits with finance, not security. Closing the gap means settling emergency authority, shrinking what faces the internet and cutting what the application retains.

   • Cross-sector
   • Security & Resilience
   • 5 min read

December 2025

1. Week of 29 December 2025

   The 2026 state privacy laws split institutional exemptions from data exemptions

   Indiana, Kentucky and Rhode Island brought comprehensive privacy laws into force on January 1, 2026. For banks and health systems, exposure turned on whether each statute exempted the organization or only its regulated data, and that answer keeps changing.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

February 2026

1. Week of 2 February 2026

   Vendors repriced in a day, contracts run for years: the buyer’s side of the software selloff

   The February selloff was a bet on software vendors. Regulated buyers faced a different exposure: agreements priced per human seat, locked for years, closed to automated access and hard to leave. Each needed renegotiating before the next renewal.

   • Cross-sector
   • Economics & Procurement
   • 5 min read

March 2026

1. Week of 23 March 2026

   The tool that checked for supply-chain risk was the supply-chain risk

   TeamPCP turned a trusted vulnerability scanner into a credential thief and used what it stole to poison an AI gateway library. Exposure depended on three things: which tools held keys, where keys were pooled, and how long stolen keys stayed valid.

   • Cross-sector
   • Data & AI
   • 5 min read

June 2026

1. Week of 15 June 2026

   The client-certificate deadline that moved, and the certificate authorities that didn’t wait

   Chrome pushed its cutoff for client authentication in public TLS certificates to March 2027, but certificate authorities kept their own earlier schedules. For any mutual TLS link, the deadline that counts is the one set by whoever issues the certificate.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

August 2026

1. Week of 3 August 2026

   Article 50 kept its date, and it lands on the chat window

   The EU deferred high-risk AI obligations weeks before August 2, 2026, but the transparency duties arrived on schedule. For banks, insurers, hospitals and agencies serving Europeans, the work sits in interface design, content pipelines and publishing sign-off.

   • Cross-sector
   • Regulation & Compliance
   • 5 min read

2. Week of 10 August 2026

   Post-quantum signatures are still being chosen, so build PKI to switch twice

   Signatures had moved up the post-quantum queue, but two years after NIST’s first standards the choice of signature scheme was still open. Organizations should sort signatures by how long they must stay verifiable, and design each tier for a second change.

   • Cross-sector
   • Platforms & Architecture
   • 5 min read

September 2026

1. Week of 7 September 2026

   Europe’s 24-hour vulnerability clock reports to regulators first and customers second

   From September 11, 2026, the Cyber Resilience Act required manufacturers to warn EU authorities of exploited flaws within 24 hours. Customers were owed notice too, but on no fixed clock, so buyers still need their own intake.

   • Cross-sector
   • Security & Resilience
   • 5 min read