Ransomware DataBreachToday.com

Why Measuring What Employees Do Matters More Than Tracking What They Complete
Security awareness programs track phishing clicks, training completion and defaulters, but those numbers say little about lasting behavior change. Research suggests the answer lies in better measurement, timely coaching and personalization, turning security awareness into a behavioral intervention.

Long-Term Compute Obligations Raise Questions About Strategic Flexibility
Anthropic's leaked IPO prospectus reveals more than $417 billion in long-term computing commitments and growing reliance on Amazon and Google for sales, infrastructure and funding, raising questions about conflicts of interest, supplier lock-in and the AI developer's strategic independence.

Agentic Banking Creates Two-Sided Trust Problem
Banks are deploying AI agents internally as customers send their own agents to shop, pay and negotiate. With rules on authentication, fraud, liability and reversibility lagging, institutions must decide what agents can do, how to verify their authority and who pays when they get it wrong.

As hospital-at-home programs expand and AI adoption accelerates, healthcare organizations face mounting cloud security demands. Anahi Santiago, CISO of ChristianaCare, discusses vendor accountability, identity management, clinical AI risks and the need for stronger cybersecurity foundations.

Renown Health is reshaping digital ID management with a strategy that reduces friction for clinicians, strengthens security and prepares the organization for emerging AI-driven identity challenges, said Steven Ramirez, Renown Health's chief information security and technology officer.

Threat Actor UTA0576 Chains 3 Flaws to Execute Commands as Root
Attackers are exploiting CVE-2026-104935 in Ivanti Connect Secure to bypass authentication and gain root access through a three-flaw exploit chain, targeting Active Directory credentials, BitLocker recovery keys and other secrets as researchers warn of wider enterprise compromise.

Northern Virginia Data Center Operators Lack Authority to Stop Drones
Ukrainian drones hit three Yandex data centers in four days, disrupting Russian cloud services used by banks, telecoms and the national railway. In Northern Virginia’s Data Center Alley, private operators can’t take down drones, and the FAA says it’s a safety regulator, not a security agency.

Agent Governance and Runtime Controls Have Yet to Catch Up With Adoption
AI agents are entering enterprise operations, but many organizations can't trace their actions or stop them automatically. A Salt Security survey says nearly half of respondents suspect an agent acted unexpectedly, including by changing permissions, altering data or calling an external API.

Startup Seeks to Slash Risk Without Adding More Tools to Enterprise Security Stacks
Reach Security raised $50 million in a Series B to expand autonomous optimization of existing enterprise security controls, using deterministic AI-driven decisions to disrupt multi-CVE exploit chains, remediate misconfigurations and reduce exposure without deploying additional tools.

Quantum Deadlines Loom. Most Banks Can't Say Where Their Cryptography Is Deployed
The standards are written, CERT-In has issued its CBOM guidance and adversaries are already harvesting encrypted data to decrypt later. The gap isn't quantum hardware. It's visibility. Here are five questions every bank CISO should answer now, starting with one: Do we have a cryptographic inventory?

Also, Three Ubiquiti Flaws Under Exploitation
This week, Mandiant detailed a Cisco SD-WAN hack as attackers exploited Ubiquiti flaws. London Hydro disclosed a customer data breach, researchers flagged cross-cloud bucket hijacking risks an INC ransomware leak, Texas and Gravity SMTP incidents.

Interim CEO Ken MacAskill Says Changes Will Speed Product Development and Execution
Boston-based Snyk is reportedly eliminating about 90 jobs while reorganizing leadership, go-to-market operations and research to accelerate AI-focused application security development as the company navigates slowing growth, a CEO transition and intensifying market competition.

Anthropic Says Legal Gaps Leave Frontier Labs Vulnerable to LLM Copying
U.S.-based AI companies are urging the U.S. government to crack down on alleged illicit model distillation by Chinese AI developers, arguing current protections lack enforcement. Anthropic and others say legal reforms and clearer antitrust rules are needed to deter theft of frontier AI models.

Agents Couldn't Group Chat or Text Foreign Counterparts
U.S. Secret Service agents abroad jeopardized their protective mission by using personal smartphones on foreign trips, say auditors, who fault the Department of Homeland Security office of the chief information officer. Government devices came with too many limits.

Long Dwell Times and Persistent Footholds Are Redefining the Election Threat Model
Election security has long been treated as a seasonal effort - defenses up before a vote, then scaled back after. But analysis of the 2024 global election cycle shows adversaries maintaining persistent access across jurisdictions, mapping ecosystems and positioning for future cycles.

Policy as Code Turns Static Compliance Documents Into Enforceable, Auditable Policy
For decades, policies, standards and procedures have anchored security and compliance governance. But static documents can no longer keep pace with dynamic regulations and frontier technology. Policy as Code transforms them into machine-readable, enforceable, continuously verifiable rules that drive real business decisions.