Security News & Regulatory Intelligence

Ransomware Groups Are Shifting to Data Extortion Without Encryption

Encrypting a victim's files takes time and leaves forensic evidence. Increasingly, ransomware groups skip it entirely and go straight to exfiltration-and-extortion.

Why Supply-Chain Attacks Keep Working: Lessons from SolarWinds and xz-utils

Two of the most consequential software supply-chain compromises on record share a root cause that most vendor-risk programs still don't test for.

NIS2 Transposition Status: Where EU Member States Actually Stand

The 17 October 2024 transposition deadline came and went with most member states still finalizing their national laws. Here's why that matters for your actual compliance date.

The MOVEit Breach, One Year Later: What It Changed About Vendor Risk

A single zero-day in a widely-used file-transfer product cascaded into one of the largest data-exposure events on record, purely through vendor concentration.

DORA Is Now Applicable: What Actually Changed on January 17, 2025

Unlike NIS2, DORA needed no national transposition — it became binding across the entire EU financial sector on a single day. Here's what that actually triggers.

The CVE Program's Funding Scare and What It Means for Vulnerability Management

A near-lapse in the CVE program's federal funding in 2025 was a real wake-up call about how much of global vulnerability management runs on a single point of failure.

PCI DSS 4.0's Future-Dated Requirements Are Now Mandatory

The subset of PCI DSS v4.0 requirements that were 'best practice until' 31 March 2025 are now simply requirements. Expanded MFA is the one most organizations still have work on.

Why MFA Fatigue Attacks Keep Succeeding Against Well-Defended Organizations

Push-notification MFA fatigue — spamming a user with approval requests until they tap 'approve' out of frustration — keeps working against organizations that have already deployed MFA correctly.

CMMC 2.0's Program Rule Is Now in Effect — What Contractors Need to Know

32 CFR Part 170 is live. The DFARS acquisition rule that actually puts CMMC into contracts is rolling out separately, and on its own timeline.

AI-Generated Phishing Is Measurably Better — What the Research Actually Shows

Large language models remove the grammatical and cultural tells that used to make phishing easy to spot. Security awareness training built around those tells needs to change.

HHS Proposes Mandatory MFA and Encryption Under an Updated HIPAA Security Rule

The January 2025 NPRM would convert several 'addressable' safeguards into flatly required ones. It is proposed, not final — but the direction is clear.

ISO/IEC 27001:2022 Transition Deadline: What Happens If You Miss It

Organizations certified under the 2013 version had a hard deadline, set by the International Accreditation Forum, to move to the 2022 controls. Here's what a missed transition actually means.