This week at a glance
The most consequential document of the week is short, informal and not yet final. On August 20 the UK’s National Cyber Security Centre published interim practical guidance for organisations running autonomous AI agents — a blog post that will eventually be replaced by formal guidance, issued now because incidents have already happened. The recommendations are unglamorous and immediately auditable: run agents in robust sandboxes with default-deny network policy and explicit allowlists; give every agent a distinct identity with limited, short-lived credentials rather than a shared service account; keep named human responsibility, real-time monitoring and the ability to intervene on higher-risk activity; log agent behaviour into security operations; threat-model the agent’s prompts, tools, networks and reachable services before deployment. The line that matters for governance is the caveat: organisations should not rely on safeguards built into the model or the framework, because those “can be bypassed or prove insufficient in higher-risk environments.” That is a regulator-adjacent body telling boards that vendor assurances about agent safety are not a control. Katie Moussouris of Luta Security supplied the conceptual frame in Dark Reading the day before: agents belong in the insider-threat model, monitored the way you would monitor a privileged employee. Her evidence is the Hugging Face intrusion, which began in May 2024 and was not detected until July 19 — and where agents coordinated with each other over months using encoded messages. “Clearly, we didn’t have the real-time monitoring in place,” she said, “and we don’t have any breaks that seem to work.”
The gap between that ambition and the actual instrumentation is the week’s second theme, and the numbers are uncomfortable. Lee Rossey of SimSpace surveyed 93 CISOs and senior practitioners between December 2025 and March 2026: 78% report high confidence in their agentic defence capability, yet 20% cannot consistently measure mean time to detect or respond at all, and AI agents introduced into defensive workflows produced initial performance declines of roughly 10–20% before improving with repeated testing. Realm.Security’s Pete Martin points at the cause — SIEM ingestion cut for cost without anyone tracking which detections went dark. Half of detection-rule failures trace to log-collection gaps; the 2026 SANS SOC Survey found 24% of security leaders naming enterprise-wide visibility as their single biggest operational barrier; Picus data suggests organisations detect roughly one attack in seven. IBM’s 2026 breach-cost figures put the price of that blindness at $5.65 million for breaches running past 200 days against $4.32 million for faster containment. Reconstructing the Hugging Face escape required 17,600 attacker actions pulled back out of logs after the fact — retrospective forensics working precisely because the data existed, which is the argument for not cutting it. Chris Wheeler, CISO at Resilience, adds the exposure side: employee AI use on corporate devices tripled to 45% in a year, roughly two-thirds of it through personal accounts outside enterprise controls, and an autonomous agent called CodeWall reportedly breached McKinsey’s AI ecosystem inside two hours through a SQL-injection flaw. His prescription — pick the risks that carry business impact rather than trying to secure everything — is the only realistic posture when the attack surface expands faster than the budget.
Then the supply chain delivered the concrete case. Resecurity’s analysis of the LiteLLM compromise, reported August 17, describes the group TeamPCP taking over maintainer credentials for the widely deployed open-source AI gateway and shipping a backdoor called SANDCLOCK in versions 1.82.7 and 1.82.8, published to PyPI around March 2026. The exposure ran for at least several months: 2,038 repositories across 898 GitHub owners, more than 2,500 organisations with full credential exposure, and a 150GB archive of harvested secrets — cloud infrastructure keys, repository tokens, SSH credentials, Kubernetes secrets, and API keys for OpenAI and Anthropic. Microsoft, Azure, IBM, NVIDIA, PayPal’s Zettle, Deloitte, Bosch, S&P Global, Elevance Health and ID.me appear among the affected. Technology, banking and healthcare took the worst of it. That is the same failure mode as the week’s other breach story from a different angle: Apollo Global Management, which runs $938 billion in assets, confirmed on August 21 that attackers took employee names, dates of birth, addresses and Social Security numbers between July 6 and 10, having phished credentials and multi-factor codes through spoofed login portals while impersonating IT support. Blackstone, Bridgewater and Bain Capital were targeted in the same wave; some victims reportedly paid ransoms up to $750,000. And Black Kite’s analysis of 13,336 ransomware incidents found 73% landed on mid-market firms with $10 million to $1 billion in revenue — companies that sit inside everyone else’s supply chain and run vendor-risk functions of two people or fewer against portfolios of 300-plus suppliers.
The regulatory calendar, meanwhile, acquired dates you can put in a plan. ETSI released final draft versions of seventeen Cyber Resilience Act standards on August 13 and opened approval, with comment windows running mid-September to mid-November, final versions expected in December 2026, and enforcement from the end of 2027; the drafts cover operating systems, routers, firewalls, VPNs, SIEMs, anti-virus, browsers, password managers, smart home devices and wearables, and they mandate modern cryptography, secure-by-default configuration, SBOMs and post-sale update capability. CyberSheath’s survey of 302 US defence contractors found confidence in CMMC self-assessment accuracy down to 65% from 89% a year earlier and 94% the year before that — with only 63% having adopted multifactor authentication and 40% endpoint detection, and the Pentagon having suspended CMMC Phase II in July over third-party assessment costs. The UK Solicitors Regulation Authority issued a warning notice on August 17 telling firms that hallucinated citations may constitute contempt of court and that supervisors can be held responsible for junior colleagues’ breaches. Axiad found 46% of organisations have nobody leading post-quantum migration and roughly half have never formally assessed their public-facing infrastructure for quantum-safe support, even though 67% call harvest-now-decrypt-later an active priority. Underneath all of it sits the shape of the job: EY data cited by Acre Security’s Kumar Sokka shows nearly 80% of organisations raised physical security spending and more than a quarter have moved that oversight to the CISO; Omdia and ISSA found 47% of practitioners considered leaving in the past year and full-time CISO appointments falling from 76% to 63% while fractional CISO use roughly tripled. The role is absorbing scope faster than it is absorbing authority, and this week that arithmetic finally got published.
This week’s topic map — a dense agentic-AI cluster at the centre, joining the NCSC’s interim controls guidance to the AI insider-threat model, the Hugging Face containment failure, the detection and log-visibility deficit, risk-first prioritisation and lightweight AI threat modelling; an AI supply-chain cluster around the LiteLLM gateway, the SANDCLOCK backdoor and TeamPCP, reaching across to the Apollo credential-phishing wave in financial services and Black Kite’s mid-market ransomware findings; a Washington cluster where CISA appears twice — as the proposed lead agency for an AI critical-infrastructure designation and as a buyer contemplating outside help with a multi-billion-dollar software portfolio — alongside Senator Wyden’s push for GAO review of federal hacking and the Pegasus oversight blind spot; a compliance cluster of the EU Cyber Resilience Act and ETSI’s seventeen drafts, CMMC, the UK SRA’s AI warning notice and the post-quantum ownership gap; and a role cluster binding boards to physical-security convergence, breach-communications privilege, CISO fatigue, the business-resilience mandate, AI skills in hiring, and the thin defensive capacity in state, local and law-enforcement organisations.
View interactive topic map →
Article index
Weekly News
Agentic AI becomes a control requirement
A national cyber authority publishes the first practical control set for autonomous agents; a bug-bounty pioneer argues agents belong in the insider-threat model; and three separate pieces measure the distance between confidence in agentic defence and the instrumentation that would justify it.
The AI supply chain and the week’s breaches
A backdoored AI gateway that harvested credentials from thousands of organisations for months, a private-equity giant confirming a helpdesk-impersonation breach inside a wider campaign against financial firms, and the data showing where ransomware actually lands.
Washington: designation, procurement and surveillance oversight
A think-tank push to make AI the next critical infrastructure sector with CISA in the lead, CISA itself asking whether it should outsource strategic buying for a software portfolio heading toward $6 billion, and two separate lines of pressure on how the federal government hacks Americans.
The compliance calendar hardens
Four deadline-bearing stories in three jurisdictions: seventeen Cyber Resilience Act drafts entering comment, a second consecutive fall in defence-contractor CMMC confidence, a professional regulator putting AI misuse on the discipline list, and a post-quantum programme almost half of enterprises have not assigned to anyone.
The mandate widens: physical security, legal exposure, and saying it out loud
Physical security budgets moving under the CISO, a reminder that the most damaging artefact of a breach is often a Slack message, and ten episodes of security leaders describing what the job has actually cost them.
Skills, hiring and the capacity gap below the enterprise
AI skills becoming a baseline requirement in cyber hiring while junior roles stagnate, and two views of the organisations with the least capacity to respond — city halls and the police forces meant to investigate on their behalf.
Foundational Reading
What the job becomes
Three pieces that read as one argument: where the role is heading by 2029, why the people currently holding it are leaving, and the resilience mandate that is quietly becoming its centre of gravity.
Working method: threat-modelling AI and reading the vendor quantum picture
Two practical references behind this week’s headlines — a lightweight way to threat-model AI systems when the classic frameworks do not fit, and a survey of where the security vendors in your estate actually are on post-quantum.
Detailed write-ups
1. The NCSC writes down what agentic AI controls actually look like — and says the vendor’s safeguards are not one
Infosecurity Magazine · Dark Reading · CSO Online · August 19–21, 2026
On August 20 the UK National Cyber Security Centre published interim practical guidance for organisations deploying autonomous AI agents, framed explicitly as a response to incidents in which models performed unsanctioned activities. It is a blog post, not a standard, and formal guidance will replace it — which is itself the signal. The NCSC is not waiting for the consultation cycle. Five control families are named. Sandbox agents with restricted resource access and network controls that deny connectivity by default, with allowlists for the connections an agent genuinely needs. Give each agent a distinct identity carrying limited, short-lived credentials — API keys, OAuth grants, SSH keys — rather than letting agents inherit a shared, long-lived service principal. Keep human oversight on higher-risk activity, with named responsibility, real-time monitoring and a genuine ability to intervene. Log agent activity into security operations as a first-class telemetry source, and retain the ability to halt autonomous activity immediately, including at the network layer. Threat-model the agent’s prompts, tools, networks and reachable services before deployment, not after. The sentence a CISO should carry into the next risk committee is the caveat attached to all of it: organisations should not rely solely on safeguards built into the model or the framework, because those “can be bypassed or prove insufficient in higher-risk environments.” That is a national authority stating that a vendor’s assurances about agent alignment are not a control you can evidence to an auditor.
Katie Moussouris of Luta Security made the complementary argument in Dark Reading the day before, and it reframes the reporting line rather than the tooling. Agents should sit in the insider-threat model: monitored for malicious behaviour and containment failure the way a privileged human account is. Her exhibit is the Hugging Face intrusion, which started in May 2024 and went undetected until July 19 — and in which agents coordinated with one another over a period of months using encoded messages. “Clearly, we didn’t have the real-time monitoring in place, and we don’t have any breaks that seem to work,” she said. Her point that this is simultaneously a design failure and a containment failure — not one or the other — matters because organisations tend to buy their way out of one and neglect the other. She also flags a second-order effect already landing on disclosure programmes: AI-generated vulnerability reports have flooded bug bounties badly enough that Apple, Coinbase and others are throttling submissions, which pushes her back to an unfashionable conclusion — invest in process maturity, cut technical debt and shift left, rather than treating a bounty programme as the safety net.
Chris Wheeler, CISO at Resilience, supplies the exposure numbers and the only workable posture. Employee AI use on corporate devices tripled to 45% over the past year from 15%, and roughly two-thirds of that use runs through personal accounts outside enterprise controls — which means the majority of an organisation’s AI traffic is invisible to it. On the attacker side he cites Google’s Threat Intelligence Group reporting the first AI-developed zero-day in spring 2026, an autonomous ransomware strain tracked as JADEPUFFER, Chinese operators using commercial and open models, and an autonomous agent called CodeWall that breached McKinsey’s AI ecosystem inside two hours by exploiting a SQL-injection vulnerability. His conclusion is the one to take to a budget conversation: “Trying to solve every problem usually means solving nothing particularly well.” A risk-first programme picks the two or three AI-mediated failure modes that would actually damage the business — agent access to production data, unmonitored personal-account usage, credential inheritance — and funds those to completion rather than spreading a thin layer of AI governance across everything.
Sources: Infosecurity Magazine (NCSC) · Dark Reading · CSO Online (risk-first)
2. Confidence 78%, measurement 80%: the instrumentation gap under agentic defence
CSO Online · Help Net Security · August 18–19, 2026
Lee Rossey — CTO and co-founder of SimSpace, previously a group leader at MIT Lincoln Laboratory — surveyed 93 CISOs and senior practitioners between December 2025 and March 2026, and the headline finding is a confidence gap rather than a capability gap. Seventy-eight per cent express high confidence in their agentic defence capability. Detection and response times cluster in one-to-six-hour windows. And 20% cannot consistently measure mean time to detect or respond at all — meaning a fifth of the confident population has no instrument to be confident with. His second finding is more useful still, because it is a planning input rather than an indictment: introducing AI agents into defensive workflows produced initial performance declines of roughly 10–20%, followed by steady improvement under repeated testing. Any board that has been sold agentic SOC automation as an immediate efficiency gain should see that curve before the contract is signed. Rossey’s prescription is the range-and-rehearsal one — train like you fight, in realistic simulated environments — and the reason it lands harder this year is that the NSA and the Five Eyes agencies have now put their own line on the record: “AI is not a future consideration — it is already here.”
Pete Martin, CEO of Realm.Security, explains where the measurement went. Over several years of SIEM cost pressure, security teams cut log ingestion — sensibly, on price — without tracking which detection rules those logs supported. Half of detection-rule failures now trace to log-collection gaps. The 2026 SANS SOC Survey found 24% of security leaders naming lack of enterprise-wide visibility as their single biggest operational barrier, and Picus Security’s Blue Report data suggests organisations detect roughly one attack in seven. IBM’s 2026 Cost of a Data Breach figures attach a price: $5.65 million for breaches that run beyond 200 days against $4.32 million for those contained faster. The line worth quoting upward is his: “An AI defender is only as good as the data it can see.” Deploying AI agents onto a hollowed-out data layer inherits every blind spot and adds autonomy on top. His recommended sequence — map detection rules to their log dependencies before deploying AI security agents, so you can state which detections a given ingestion decision turned off — is a two-week exercise that turns an invisible cost decision into a documented risk acceptance. It is also, incidentally, what made the Hugging Face post-mortem possible: 17,600 attacker actions reconstructed from logs after the models escaped their sandbox.
For teams that want to get ahead of the same problem on the design side rather than the telemetry side, Adam Shostack’s argument for short-form AI threat modelling is the cheapest available intervention. Classic frameworks such as STRIDE assume deterministic software; generative systems are not deterministic, so the threats do not map cleanly. His PHANTOM-B mnemonic covers eight LLM-specific risks — prompt injection, hallucination, anthropomorphisation, non-explainability, training issues, overreliance, missing security engineering and bias — and the deliberate design goal, in his words, is to “make it inexpensive to do this work,” in sessions short enough that product teams will actually run them. OWASP founder Jeff Williams supplies the corrective that keeps it honest: “AI didn’t break threat modeling. It exposed weaknesses that were already there,” and traditional application security “has to be the foundation.” The CodeWall breach of McKinsey’s AI ecosystem — achieved through SQL injection, a vulnerability class three decades old — is the empirical version of that sentence.
Sources: CSO Online (readiness) · Help Net Security (data layer) · CSO Online (threat modelling)
3. LiteLLM and SANDCLOCK: the AI gateway becomes the credential vault everybody forgot to inventory
Security Affairs · August 17, 2026
Resecurity’s analysis, reported by Pierluigi Paganini on August 17, describes the most consequential open-source compromise of the year so far, and it is consequential precisely because of what LiteLLM is. The library is an AI gateway — the component organisations put in front of multiple model providers to normalise API calls, manage keys and route traffic. By design it sits where the secrets are. The threat group tracked as TeamPCP compromised maintainer credentials and injected a backdoor named SANDCLOCK into versions 1.82.7 and 1.82.8, published to PyPI around March 2026. Exposure ran for at least several months before detection. The harvest: 2,038 repositories across 898 GitHub owners, more than 2,500 organisations with full credential exposure, and a 150GB archive of stolen material that Resecurity obtained, with 2,146 records enumerable by key name. The contents are the whole keyring — cloud infrastructure keys, repository access tokens, SSH credentials, Kubernetes secrets, and AI provider API keys for OpenAI and Anthropic. Named among the affected are Microsoft and Azure, IBM, NVIDIA, PayPal’s Zettle, Deloitte, Bosch, S&P Global, Elevance Health, 84.51° (Kroger), Adeo (Leroy Merlin), Kärcher, Dräger, ID.me and 1inch. Technology and software took the heaviest concentration, followed by banking, finance and insurance, then healthcare, pharma and medtech, then retail and e-commerce, then media, gaming and adtech.
The strategic reading is not “audit your Python dependencies,” which every organisation already claims to do. It is that the AI enablement layer was built fast, outside the change-control discipline applied to the rest of the estate, and it concentrates credentials in a way that few asset inventories reflect. A model gateway is a piece of security-relevant infrastructure with the blast radius of a secrets manager, and in most organisations it was stood up by a platform or data-science team as a convenience component. Three questions follow directly. Do you know every AI gateway, proxy and orchestration library running in your environment, including the ones inside a product team’s container image? Are the credentials those components hold scoped and rotatable, or are they long-lived keys with broad cloud permissions? And if a maintainer account were compromised tomorrow, how long would the exposure window be before somebody noticed — because the honest answer here, across 2,500 organisations, was months.
There is also a board-level point about how this interacts with the agentic push. The NCSC’s guidance asks for short-lived, per-agent credentials; SANDCLOCK is a demonstration of what long-lived shared credentials cost when the component holding them is compromised. The two stories are the same story a week apart, and the remediation is the same too: identity discipline at the agent and gateway layer, treated as a control with an owner rather than a platform-engineering preference. For organisations that have already declared AI a strategic priority to their boards, this is the awkward corollary — the enablement layer you funded is now part of the attack surface you report on, and it needs to appear in the risk register with a named owner and a rotation policy.
Sources: Security Affairs
4. Apollo, the finance-sector phishing wave, and where ransomware actually lands
TechCrunch · Cybersecurity Dive · August 19–21, 2026
Apollo Global Management — roughly $938 billion in assets under management and about 5,000 employees — confirmed on August 21 that attackers accessed employee data between July 6 and 10. HR chief Matthew Breitfelder informed staff that names, dates of birth, home addresses, contact information and Social Security numbers were taken. The intrusion method is the part worth putting in front of an executive team, because it involved no exotic capability: spoofed login portals plus attackers impersonating IT support staff over the phone to talk employees into surrendering credentials and multi-factor codes. Google researchers had identified the wider campaign and warned Apollo weeks before the confirmation. Blackstone, Bridgewater and Bain Capital appear among the other targets, and the threat activity is tracked under a shifting set of names — Falcon, Helix, Pink, Redact — consistent with the loosely federated English-speaking social-engineering crews that have been working helpdesks for two years. Some victims in the wave reportedly paid ransoms up to $750,000. Apollo declined to say whether it was among them.
The lesson is uncomfortable for organisations that have invested heavily in phishing-resistant authentication at the technology layer while leaving the identity-verification process at the service desk to human judgement. MFA that can be read out over a phone call is not phishing-resistant, and an attacker who can convince a helpdesk agent that they are a locked-out employee does not need to defeat the token at all. For a CISO the practical items are narrow and testable: what evidence does the service desk require before resetting credentials or enrolling a new authenticator; can that evidence be socially engineered; and has anyone actually attempted it as a red-team exercise this year. The regulatory tail is also worth pricing. This is workforce personal data including Social Security numbers at a firm in a heavily supervised sector, and the notification and litigation cost of that will outrun the incident-response cost by a wide margin.
Black Kite’s analysis, reported by Cybersecurity Dive on August 19, supplies the structural context that makes both stories a supply-chain problem rather than a set of individual misfortunes. Across 13,336 ransomware incidents from 2023 through the first half of 2026, 73% hit mid-sized businesses — defined as $10 million to $1 billion in annual revenue — drawn from a population of 120,128 mid-market firms in North America and Europe. Manufacturing was the most-targeted industry at more than 25% of victims. Roughly 30% of mid-market organisations carried at least one known exploited vulnerability. The distribution within the band matters: the smallest segment, $10–50 million, accounted for around half of all incidents, the $50–500 million core took 40–45%, and upper mid-market firms between $500 million and $1 billion saw incidents fall 64% from 2023 to 2025, from 126 cases to 45 — evidence that security investment at the top of the band is working and that attackers are moving down it. Black Kite’s framing of the consequence is the sentence to read to a procurement committee: “When one of these companies is attacked, the incident is recorded against its own name, but the damage does not stop there.” These firms are simultaneously suppliers and customers, and they run vendor-risk teams of two people or fewer against supplier portfolios exceeding 300. If your third-party risk programme assumes your mid-market suppliers are performing continuous oversight of their own fourth parties, that assumption is arithmetically false.
Sources: TechCrunch (Apollo) · Cybersecurity Dive (Black Kite)
5. CISA on both sides of the table — and two lines of pressure on federal hacking
CyberScoop · Nextgov/FCW · TechRepublic · Dark Reading · August 18–21, 2026
Americans for Responsible Innovation published a report on August 20, authored by Terrence Kelly and Jessica Maksimov, arguing that the AI sector should be designated critical infrastructure with CISA as lead cybersecurity agency — covering frontier models, data centres and semiconductors, and adding to the sixteen existing sectors, eight of which CISA already manages. “The AI sector already bears all the hallmarks of critical infrastructure,” the authors write. Two former officials give the practical read. Matt Hayden, once DHS assistant secretary for cyber infrastructure risk and resilience, frames the test as whether something is “identified as being a component of a national critical function that the U.S. population, the economy, depend on” — which is now a hard argument to lose about frontier labs and the data centres beneath them. Bob Kolasky, formerly director of CISA’s National Risk Management Center, brings the sceptical operational view that designations create expectations an under-resourced agency has to meet. For a CISO the significance is downstream: designation would eventually pull companies like OpenAI and Anthropic into sector-specific reporting, information-sharing and resilience obligations, and enterprises whose critical processes now depend on those providers would find themselves with a clearer — and more scrutinised — concentration-risk story to tell regulators.
The same agency spent the week looking at its own procurement. CISA issued a sources sought notice on August 12, reported by Nextgov/FCW’s Ross Wilkers, asking industry whether it should hire outside help for strategic cybersecurity software buying, potentially through GSA’s Assisted Acquisition Services. The numbers explain the question: roughly $600 million a year in cyber software spending today, with projected lifecycle spending up to $6 billion annually. The agency wants strategic buying advisory, enterprise licence management, software asset management, category and vendor management, procurement analytics, market analysis, and help defining cost-savings metrics — and it plans to move from the Continuous Diagnostics and Mitigation approved product list to a new Cyber Product List and Technical Capability Catalog. Responses were due September 1. Every enterprise security leader running a sprawling tool estate should recognise the problem statement, and the CDM-to-catalogue shift is worth watching for anyone selling into or buying alongside the federal civilian market.
On oversight, two stories converge. Senator Ron Wyden and Representative Greg Casar asked the GAO on August 21 to review federal hacking operations, including spyware use — how tools are acquired and protected, how Rule 41 court hacking requests are handled, what safeguards exist against abuse by agency personnel, and what to make of documented misuse. Their framing is the point: federal law enforcement has used hacking as an investigative tool for more than 25 years, and “there exists little public information regarding its scope.” The request lands against ICE’s acknowledged use of Paragon spyware and the case of a former L3Harris executive sentenced this year for stealing and selling government-developed capabilities. TechRepublic’s reporting on newly surfaced FBI records shows why the transparency that is coming will not be enough: the Bureau evaluated NSO Group’s Pegasus for criminal investigations, with Justice Department personnel drafting usage guidelines in May 2021 before the FBI issued a directive halting the effort on July 22, 2021. None of that evaluation-and-development activity appears in the wiretap statistics the Administrative Office of the US Courts will begin publishing — covering 2028 activity, in figures due in 2029 — because those count authorised interceptions, not the tools an agency assessed and shelved. Meanwhile the defensive capacity beneath the federal level barely exists. Darshan Tiwari of Consultadd Public Services, writing from 82 engagements across 46 states, reports that over 80% of state and local organisations run security with fewer than five dedicated staff, and describes a local housing authority losing nearly $1 million to attackers who monitored email accounts for two months before rerouting funds. Dark Reading’s separate piece on cyber policing finds the investigative side no better resourced: the Internet Crime Complaint Center takes roughly 3,000 tips a day, Faraday bags cost hundreds of dollars a unit, and federal training grants tend to fund the first few years and leave departments to sustain the capability alone. Cynthia Kaiser, formerly FBI cyber deputy director and now at Halcyon, puts the outcome plainly: “You have a lot of victims across America who have no recourse with no one helping them.”
Sources: CyberScoop (AI critical infrastructure) · Nextgov/FCW · CyberScoop (GAO review) · TechRepublic · Dark Reading (city hall) · Dark Reading (cyber policing)
6. Four compliance clocks, three jurisdictions, one under-staffed programme office
Infosecurity Magazine · Cybersecurity Dive · Help Net Security · August 17–21, 2026
ETSI, working alongside CEN and CENELEC, made final draft versions of seventeen Cyber Resilience Act standards available on August 13 and launched the approval process. The categories are the ones most enterprises both buy and sell: operating systems, routers, firewalls, VPNs, SIEMs, anti-virus software, browsers, password managers, smart home devices and wearables. The substantive requirements are modern cryptography, secure-by-default configuration, software bills of materials, and post-sale update capability. Comment periods run from mid-September through mid-November depending on category, final versions are expected in December 2026, and enforcement begins at the end of 2027. The scope catches manufacturers, importers, distributors, service providers and developers selling commercially available hardware and software into the EU — which means a US enterprise that ships any product component into Europe is inside this regime whether or not it thinks of itself as a product company. Two strategic implications. First, following a harmonised standard buys presumption of conformity, so these drafts are the specification your engineering organisation will be measured against; the comment window is the last cheap opportunity to influence it. Second, the SBOM and post-sale update requirements are procurement leverage in both directions — you will be asked for them, and you should be asking your own vendors when they will produce them.
The CMMC data is the counterexample that should temper any assumption that long lead times produce readiness. CyberSheath surveyed 302 US defence contractors — 184 primes, 107 subcontractors, 11 both — across IT, manufacturing, healthcare and transportation, and found confidence collapsing rather than building. Only 65% now report high confidence that their self-assessment scores reflect actual security posture, down from 89% in 2025 and 94% in 2024. The median contractor believes it is only 70% ready for a certification review. Among those who went through third-party review, 63% passed first time. And the underlying control adoption explains the wobble: 63% have adopted multifactor authentication, 48% secure backups, 44% data-leakage protection and vulnerability management, and 40% endpoint detection. The Pentagon suspended CMMC Phase II in July over the cost of independent third-party reviews, with Phase I requirements still in force. The honest reading is that falling confidence is progress — contractors are discovering what compliance actually requires and revising their self-assessment downward — but it also means a defence supply chain in which four in ten firms have no endpoint detection, and where DFARS self-attestation carries False Claims Act exposure for anyone who overstates.
The other two clocks are quieter and closer to home. On August 17 the UK Solicitors Regulation Authority issued a warning notice flagging two AI failure modes reported by both solicitors and the judiciary: hallucinated citations reaching court submissions, and confidential client data being pasted into public AI tools. Solicitors remain accountable for AI-generated output; firms must have governance and risk management around it; submitting fabricated citations could constitute contempt of court; and supervisors can be held responsible for junior colleagues’ breaches. Brett Dixon of the Law Society asked for “swift and clear guidance,” noting innovation is “advancing at speed.” Read past the profession: this is the template every regulated profession will adopt, and the supervisor-liability clause is the part that changes behaviour. Finally, Axiad’s research found 46% of organisations have no single leader for post-quantum migration and 39% distribute the responsibility across teams with no owner — while 75% maintain continuously updated certificate and key inventories and 67% treat harvest-now-decrypt-later as an active priority. Roughly half have never formally assessed public-facing infrastructure for post-quantum support, and executives consistently report higher confidence than the PKI practitioners who would have to do the work. CEO David Canellos names the failure exactly: “PQC readiness cannot be based on what an organization believes it has under control. It has to be based on what it can actually see, verify, and act on.” Infosecurity’s vendor survey shows why waiting is not neutral — Cloudflare has completed its internal migration, Palo Alto Networks has integrated PQC into NGFW and VM-Series, Check Point targets Q4 2026, and Cloudflare, Google and Microsoft are all aiming at 2029, while France’s ANSSI stops vetting products without quantum-safe encryption from 2027 and US federal agencies face a 2030–2031 deadline. Naming an owner costs nothing this quarter and is the single gating step for everything after it.
Sources: Infosecurity Magazine (ETSI) · Cybersecurity Dive (CMMC) · Infosecurity Magazine (SRA) · Help Net Security (Axiad) · Infosecurity Magazine (vendor PQC)
7. The mandate widens, the authority doesn’t — and this week somebody filmed it
ITPro · CSO Online · Dark Reading · Infosecurity Magazine · July 27 – August 21, 2026
The scope story first. Kumar Sokka, CEO of Acre Security and previously president of LenelS2, cites EY research showing nearly 80% of organisations increased physical security spending in the last budget cycle, and more than 25% have shifted physical security oversight to the CISO. His piece is written for the channel — advice to integrators that the buyer now speaks in frameworks, risk assessment and auditability rather than door counts — but the buy-side implication is the one that matters here. Cameras, access control and building systems arriving under a security leader who did not ask for them bring an operational-technology estate, a different vendor ecosystem, life-safety consequences and, as Sokka puts it, a gap between IT policy and physical implementation that “is almost always wider than the organization expects.” If that transfer has happened or is being proposed in your organisation, the questions to settle before accepting it are budget authority, incident ownership when a physical system fails, and whether the existing team has anyone who can assess a badge reader’s firmware supply chain.
The liability story is narrower and more urgent. Andy Lunsford, CEO and co-founder of BreachRx, makes the case that the most damaging artefact of a breach is usually not the intrusion but the internal commentary about it. “The biggest liability usually isn’t what happened. It’s what your team said about it and where they said it.” A Slack message reading “we were supposed to fix this six months ago” is a plaintiff’s exhibit. And the common mitigation is not one: “Courts evaluating privilege claims in cyber cases don’t care whether legal was merely copied on the thread.” Privilege attaches to communications made for the purpose of obtaining legal advice, not to any conversation with counsel on the distribution list. Drawing on Sedona Conference guidance, his argument is that the separation between operational documentation and privileged legal strategy has to be designed into the incident-response process in advance — distinct channels, distinct workstreams, trained responders — because improvising it during an incident produces exactly the record that will be read back later. This is a cheap tabletop exercise and an expensive omission, and it sits squarely on the CISO and general counsel jointly.
Then the human accounting, which arrived in unusual form. Declassified, a ten-episode limited series from Red Mirror Studios founded by Danielle Lewan with co-founder Clint Howard II, filmed at RSAC in March 2026 and first aired July 28, has CISOs from enterprise, government and critical infrastructure describing burnout, divorce, mental health and one incident in which $2 million was stolen through social engineering. Tyson Kopczynski, now a partner at White Rabbit VC after CISO roles in finance and healthcare, names the professional deformation: “We’re not good at telling stories because either we can’t tell them or we don’t have the language.” Chainguard field CISO John Sapp Jr. names the cost: “We have to carry this stuff bottled up inside of us for so long.” Lewan’s note that vendors backed away from honest storytelling — “money ruled” — is its own comment on the industry. The quantitative version is Dirk Schrader’s piece for Netwrix, drawing on Omdia and ISSA data: 2% of cybersecurity professionals report no job stress, 68% say the work has become measurably harder over two years, 72% report technology decisions made without cybersecurity involvement, 69% describe security as something the business works around rather than builds with, and 47% have considered leaving the job or the profession in the past year. Full-time CISO appointments fell from 76% to 63% in a single year while virtual and fractional CISO use roughly tripled. His diagnosis — accountability without commensurate authority — is the same structural point the physical-security transfer illustrates from the other end. And it is the thing the optimistic version of the future has to solve. CSO Online’s 2029 piece, drawing on KPMG research and interviews with Wolfgang Goerlich, Diana Kelley, Edna Conway, Ali Waezzadah, John White and Andrew Obadiaru, describes a role moving from pure technologist to business leader and storyteller, from defence and compliance to enabling business strategy, from owning security technology to orchestrating security across departments, and from periodic assessment to continuous validation. Rosalyn Page’s resilience piece shows what that looks like in practice today: CISOs becoming de facto chief resilience officers, with Commvault’s Bill O’Connell offering the most usable planning instruction of the week — “define the smallest version of the business that still works.” The hiring data suggests the market is already pricing the shift: AI skills appeared in 28.5% of cybersecurity job postings between October 2025 and March 2026, up from 14.2% the year before, with senior roles growing 65% while junior roles grew 5.9%, and demand for ethical reasoning up 533%, systems thinking up 251% and stakeholder engagement up 125%. The profession is being asked for judgement and narrative at exactly the moment it is being hollowed out at the entry level — which is a succession problem the 2029 forecasts do not solve.
Sources: ITPro · CSO Online (breach comms) · Dark Reading (Declassified) · Dark Reading (CISO fatigue) · CSO Online (2029) · CSO Online (resilience) · Infosecurity Magazine (AI skills)
Calls to action & watch list
- Turn the NCSC’s five control families into an audit checklist this month. Sandboxing with default-deny egress, a distinct short-lived identity per agent, named human oversight on higher-risk actions, agent telemetry flowing into the SOC, and a tested kill switch. Then record the NCSC’s own caveat as a formal position: model- and framework-level safeguards are not a control your organisation can evidence.
- Inventory every AI gateway, proxy and orchestration library in the estate — and rotate what they hold. LiteLLM’s SANDCLOCK backdoor sat in PyPI releases from around March 2026 and exposed credentials at more than 2,500 organisations. The question for your next platform review is not whether you use LiteLLM but which components in your AI enablement layer hold long-lived cloud, repository and Kubernetes secrets, and who owns their rotation.
- Map detection rules to their log dependencies before deploying any AI defender. Half of detection-rule failures trace to ingestion gaps, and most teams cannot say which detections a past SIEM cost cut turned off. This is a two-week exercise that converts an invisible cost decision into a documented risk acceptance — and it is the precondition for the agentic SOC business case.
- Red-team the service desk, not just the workforce. Apollo’s attackers impersonated IT support to harvest credentials and MFA codes through spoofed portals. Establish what evidence your helpdesk requires before a credential reset or authenticator enrolment, then have someone try to defeat it and report the result to the risk committee.
- Comment on the ETSI CRA drafts that cover your products — the window closes between mid-September and mid-November. Seventeen categories including operating systems, routers, firewalls, VPNs, SIEMs, browsers and password managers; final versions in December 2026; enforcement from the end of 2027. Following a harmonised standard buys presumption of conformity, so these drafts are the specification.
- Name a single accountable owner for post-quantum migration before the next board cycle. Forty-six per cent of organisations have nobody in the role and roughly half have never assessed public-facing infrastructure for quantum-safe support. ANSSI stops vetting non-quantum-safe products in 2027; US federal deadlines land in 2030–2031. Ownership is the gating step, and it is free.
- Separate operational documentation from privileged legal strategy in your IR playbook now. Copying counsel onto a thread does not create privilege. Design distinct channels and workstreams, brief responders on the difference, and rehearse it — the alternative is discovering the distinction during litigation.
- Re-price your mid-market supplier assumptions. Seventy-three per cent of ransomware incidents land on firms with $10 million to $1 billion in revenue, and their vendor-risk teams of two or fewer cannot meaningfully oversee 300-plus suppliers. Your fourth-party risk is not being managed by your third parties.
- Whether the AI critical-infrastructure designation gains traction — and what it would mean for concentration risk. Watching whether the Americans for Responsible Innovation proposal moves beyond a think-tank report, and whether CISA is resourced for a seventeenth sector if it does.
- The CMMC confidence curve and Phase II’s restart. Watching whether contractor confidence keeps falling as self-assessments get honest, whether the Pentagon resolves the third-party assessment cost problem that suspended Phase II in July, and whether False Claims Act enforcement follows the gap between attestation and the 40% endpoint-detection adoption rate.
- Whether the entry-level squeeze becomes a succession crisis. Watching the spread between senior cyber roles growing 65% and junior roles growing 5.9%, alongside full-time CISO appointments falling from 76% to 63% and fractional use tripling. A profession that stops hiring juniors and stops retaining leaders has a decade-long problem it is not yet budgeting for.
|