STATUS: SECURE – The Cyber Threat Briefing

Ten million records walked out of Match Group this year, and the attacker never touched the product. Not Tinder's database. Not Hinge's. The data came out of a marketing analytics tool. This week we walk the full chain: the vishing call, the lookalike domain, the Okta single sign-on credential, and the third-party platform that turned one compromised identity into the largest consumer dating breac...

One attack stopped milk production at four plants. The other took 1.4 terabytes out of Nike and never encrypted a single file. This week we break down two of the biggest cyber events of 2026, and they failed in completely opposite directions. Coca-Cola's fairlife subsidiary lost its production systems to the Anubis ransomware group and chose not to negotiate. Nike lost product designs, supplier li...

A cloned badge gets somebody through the door. An unlocked laptop gets them onto the network. Not one cyber control has to be defeated for that to happen. This week we go the other direction from our usual briefing. Your security awareness training covers phishing and passwords and says nothing about the card hanging around your neck — and that gap is structural, because physical security and cybe...

The board wants AI controls. Procurement is writing AI clauses into contracts. And inside most organizations, nobody is sure which framework to commit to. This week we lay out what is actually on the table. ISO 42001, the NIST AI Risk Management Framework, COBIT and the ISACA credentials, and GRAICE — the Global Responsible AI Compliance and Ethics framework from the Global Council for Responsible...

No malware. No exploit. No vulnerability to patch. The attackers picked up a phone — and vishing, or voice phishing, walked them straight through single sign-on and into a terabyte of healthcare data. On August 28th, McKesson filed a Form 8-K with the SEC disclosing a cybersecurity incident discovered on August 25th. Then the extortion group ShinyHunters told BleepingComputer how they did it. They...

Tools don't stop attackers. The people running those tools do. Last week we covered how to get security funded. This week is the question that follows it — once you have the budget, how do you build the team that performs? Most companies are hiring for a résumé that doesn't exist. Ten years on every tool, a dozen certifications, all in one person. That posting doesn't produce a shallow candidate p...

The best security in the world protects nothing if it never gets funded. In this episode we are covering the one skill that determines whether a security program lives or dies, and it has nothing to do with technology. Most security programs are not killed by an adversary. They are killed in a budget meeting, by a technically flawless brief that nobody in the room could act on. Executives decide i...

In this episode we're covering how AI is accelerating the speed at which attackers find and weaponize vulnerabilities — and where you actually go to get reliable threat intelligence without drowning in noise. The defensive problem has changed. It's no longer whether you're aware of your vulnerabilities. It's whether you can prioritize and act faster than an AI-accelerated attacker. The list of fla...

This week's briefing comes down to one word: trust. Three stories that look separate and turn out to be the same story. We open with the largest child-safety ruling against a social media company to date — a New Mexico judge ordering Meta to pay an additional $567 million, bringing the total to $942 million, for allowing bad actors to operate on its platform. The judge called Meta a "public nuisan...

This week we went off script. Our CISO called in from the floor of Black Hat in Las Vegas — where she'd been invited to speak on AI and child privacy — for a wide-ranging briefing on the threats defining right now. We open with the Iranian-affiliated cyberattack that knocked a Minnesota water utility onto manual operations. The headline sounds sophisticated. The reality is the opposite: the attack...

This week our CISO takes you somewhere most healthcare leaders never get to go — inside a nationwide Health-ISAC threat briefing, the healthcare sector's own member-only intelligence-sharing call, including a business continuity exercise run across more than 500 organizations. First, the two threats the sector is tracking right now. World Leaks, a data-theft extortion group that steals your data a...

Ransomware evolved, and the evolution invalidates a defense most healthcare organizations still rely on. Attackers stopped just encrypting your data and started stealing it first. You can pay, restore from backup, and still watch your patient records get sold. The backup that used to be your leverage now solves half the problem. And they're not breaking in to do it. They're logging in — using cred...

Two days after we walked defense contractors through the CMMC certification timeline, the Department of War suspended Phase II. So we broke format for a rapid-response briefing. On July 13, 2026, the Department suspended the mandatory third-party C3PAO certification requirement that was set to take effect November 10 — effective immediately, across pending and future solicitations and contracts —...

Cyberattacks are now a subscription business. Ransomware-as-a-service has erased the skill barrier so anyone can rent the malware and launch an attack, and AI-generated phishing has erased the warning signs a decade of training taught people to spot. In this episode we cover the threat economy hitting every sector, the three controls that actually blunt it, and then everything defense contractors...

The most important fact about the Colonial Pipeline attack is the one most people forget: the ransomware never touched the pipeline. It hit the billing and IT systems — and half the East Coast's fuel supply still shut down for six days, because the company couldn't prove the two worlds were separated. This is a special briefing. The CISO just got back from speaking on a panel at the Data Driven Oi...

For a decade we taught people to spot the phishing email by its bad grammar and awkward phrasing. AI has erased every one of those tells. The phishing email is now perfect, and the voice on the phone approving a wire transfer sounds exactly like your CFO. In this episode we cover the two threats hitting finance hardest in 2026 — AI-driven voice and deepfake fraud, and the e-skimming payment breach...

If you lose comms, you lose the mission. If you lose your enterprise customers' trust, you lose the company. In this episode we deliver two missions in one briefing. First — the threats reshaping every industry in 2026: software supply chain attacks up nearly 4x since 2020, and the new attack surface from agentic AI that most organizations cannot even see on their asset inventory yet. Then the fou...

If you lose comms, you lose the mission. If you lose your patient data, you lose your license to operate. In this episode we deliver two missions in one briefing. First — the cross-industry threat landscape every executive must understand. Identity abuse has overtaken network exploits as the dominant breach vector of 2026, and the third-party vendor breach pattern is compounding the threat across...

If you lose comms, you lose the mission. If you miss the November 10, 2026 CMMC Phase 2 deadline, you lose the next decade of defense contracts. In this episode we deliver the operational reckoning on CMMC Phase 2. This is Part 2 of the CMMC briefing series — the deadline-driven sequel to last week's foundational Part 1 on what CMMC is, the three levels, and the supply chain flowdown reality. 80,0...

If you lose comms, you lose the mission. If you lose your CMMC certification window, you lose your eligibility to bid on the next decade of defense contracts. In this episode we are analyzing the single most important compliance program in the Defense Industrial Base — the Cybersecurity Maturity Model Certification. 80,000 contractors need CMMC Level 2 certification before Phase 2 begins on Novemb...

If you lose comms, you lose the mission. If you write the check without verifying what is in the codebase, you lose the fund. In this episode we are analyzing the federal court ruling that rewired cybersecurity due diligence for the entire investment community. On March 18, 2026, a California federal judge allowed class action claims against Bain Capital to proceed for a data breach at PowerSchool...

If you lose comms, you lose the mission. If you inherit a control library you cannot operationally vouch for, you lose the contract — and possibly your name. In this episode we are analyzing the longest, quietest failure inside the Defense Industrial Base: control drift. There is no breach. No threat actor. No alarm. Just a slow, silent erosion of operational reality — a control library certified...

If you lose comms, you lose the mission. If you lose your compliance timeline, you lose the company. In this episode, we are analyzing the collision between the SEC's new 96-hour breach disclosure mandate and the extortion tactics of modern ransomware cartels. Many financial executives believe the SEC rule is just an administrative burden. The reality? Threat actors are actively weaponizing this m...

If you lose comms, you lose the mission. If you lose data integrity, you risk patient lives. In this episode, we are analyzing the rapid disappearance of the traditional hospital perimeter. Through the massive expansion of "Hospital-at-Home" programs, clinical care is now being delivered over highly vulnerable residential Wi-Fi networks. Many healthcare executives assume that deploying a clinical...

If you lose control of your algorithm, you lose control of your company. In this episode of Status: Secure, we are analyzing the sudden, largely unregulated integration of internal AI agents within the Tech Sector. For 20 years, we built our security around the "human firewall," relying on human intuition to catch anomalies. But what happens when you strip the human out of the loop? We break down...