TrustedCISO

WIRED reports, citing anonymous sources, that an Accenture contractor ran a personal Claude Code agent on a secure DOW network for 2 months. Accenture denies it. Shadow AI is how a 72-hour DFARS 7012 report starts. ✅ FREE CMMC Assessment: dlvr.​it/TWBfMV dlvr.​it/TWBfMk

A self-assessed SPRS score of 110. A government-assessed -170. A $507,144 False Claims Act settlement (allegations, no finding of liability). Contractors self-attest, so check your evidence before you affirm. ✅ FREE CMMC Assessment: dlvr.​it/TWBWWN #CMMC dlvr.​it/TWBWWT

DOW's own RFI data undercuts its CMMC pause, per Federal News Network: average assessment cost $47K, not SBA's "up to $600K." The top cost driver was NIST 800-171 itself. That work never went away. ✅ FREE CMMC Assessment: dlvr.​it/TW9lhR dlvr.​it/TW9lhs

Fired in April. Main login shut off. But not the Constant Contact login. A federal complaint alleges the ex-employee logged back in five days later and exported client and prospect contacts. Allegations only; the case is ongoing. #InsiderRisk #Offboarding

Bank of America's warning on AI assistants: "If you do share your credentials, keep in mind that you're responsible for activity resulting from that access." If the agent gets it wrong, that's on you. AI agents need their own scoped, revocable access. Never your password.

5 ways vendors got companies breached this fall, ranked: a vendor-run website, a poisoned plugin update, stolen logins to outside platforms, a vendor's API key, and #1: a vendor app with admin rights in your tenant. dlvr.​it/TW8m7L #ThirdPartyRisk #VendorRisk dlvr.​it/TW8m7T

Two Marines are suing DOW for $5M over a DMDC breach. Their suit claims a file share exposed data on about 3M people for about 9 months. File shares need encryption, access logging and a known incident-reporting deadline. ✅ FREE CMMC Assessment: dlvr.​it/TW87tw

DOW contracts can only require CMMC self-assessments right now, so contractors self-attest. But C3PAOs are still running Level 2 certification assessments: 2,362 final certificates as of September, per the Cyber AB. ✅ FREE CMMC Assessment: dlvr.​it/TW83sw #CMMC dlvr.​it/TW83t0

👻 Vulnerabilities are only scary when you can't see them. AppSec Bot scans your code with Semgrep, Gitleaks & Dependabot. Pennie Tester passively scans your website. No tricks, just treats 🎃 dlvr.​it/TW7cGz dlvr.​it/TW7cH6 dlvr.​it/TW7cHF

Anthropic's deputy CISO Jason Clinton: "please go to your boards and ask for help right now. not for ai, for the basics." FBI/CISA advisory AA26-293A: SafePay ransomware has 600+ victims. Ways in include stolen VPN passwords and five old Cisco, Veeam and SonicWall flaws.

Do you need a SOC 2 Type 1 before a Type 2? No. Type 1 = controls designed right as of one date. Type 2 = controls actually operated over a period, with the auditor's tests and results. Ask your buyer which they need. dlvr.​it/TW7Tgw #SOC2 #Startups dlvr.​it/TW7Th0

Banks are finding unvetted AI agents in customer accounts, using customers' own passwords. Morgan Stanley is blocking them; JPMorgan, BofA and Citi are restricting them. (Morgan Stanley says it hasn't seen "rogue AI agents.") Give every agent its own login you can shut off.

Attackers didn't phish a user. Per Todyl, they signed in as ConnectWise's Cloud Backup app using its secret, so MFA never came into play. Huntress confirmed 162 compromised Microsoft 365 tenants as of Oct 16. Audit your app permissions. dlvr.​it/TW6sfc… dlvr.​it/TW6sfp

Should you stop CMMC work until DOW's Reform Task Force report comes out? No. Contractors self-attest today, and NIST 800-171, an SPRS score and an annual affirmation still apply. ✅ FREE CMMC Assessment: dlvr.​it/TW67WR #CMMC dlvr.​it/TW67Wg

The password was 123456. Reporting says it opened records on about 8.​8 million people in Denmark, through a small IT vendor with authorized access to the national register. It got caught because of an unusually large bill. #ThirdPartyRisk #VendorRisk

Boards don't want to hear about vulnerabilities. They want risk, dollars and decisions. Debra Baker is speaking at ISC2 Security Congress in Denver this month: "From the Server Room to the Boardroom." In Denver? Come find her. #ISC2 #CISO

Speaking twice at #ISC2Congress in Denver this week: 🎙 Ethics in Cybersecurity panel, today 2:45 PM MT, ISC2 Insights Studio (Aurora Exhibit Hall Foyer) 🎤 From the Server Room to the Boardroom, Wed 9:35 AM MT, Adams Ballroom C Here? Let's meet: dlvr.​it/TW411X dlvr.​it/TW411g

MYTH: Phase II is suspended, so we can stop CMMC work. FACT: Contractors self-attest. Level 2 = all 110 NIST 800-171 requirements, an SPRS score and an annual affirmation. DFARS 7012 still applies. ✅ FREE CMMC Assessment: dlvr.​it/TW3wW8 #CMMC

Your SOC 2 report says your controls work. It doesn't say your AI agent behaves. The AICPA and AIUC now offer one CPA-led engagement: SOC 2 plus AIUC-1, with live testing of agent behavior. Full launch expected early 2027. dlvr.​it/TW3LJS #SOC2 #AISecurity

Reuters reports one hacker's AI agents tried 1,200+ sites and breached 100+, for about $5K in AI tokens. Cummins says it's investigating a possible attack on a vendor-run site. Your vendors' sites are your attack surface too. dlvr.​it/TW2rfj #AISecurity #ThirdPartyRisk