This week at a glance
Start with accountability, because that is where the week moved. On 7 October Rep. Lori Trahan released a discussion draft of the CLAIM Act, which would make AI developers liable when an agent does something that would be negligent, tortious or criminal if a person did it — and would stop them arguing that software cannot have intent. The same morning Sen. Maria Cantwell, who could chair the Commerce Committee after November, published a framework calling for NIST safety standards, independent audits before release and mandatory incident reporting, including loss of control over autonomous agents. Politico reports that state attorneys general in both parties are running on AI enforcement rather than waiting for Congress. On Saturday Microsoft’s Satya Nadella added his own list: controls outside the model, tamper-resistant logs, and a person who can always stop it mid-task.
Regulators with direct reach into enterprises went further. The PCI Security Standards Council wants explicit human approval for any agent action touching cleartext cardholder data, and says no single AI system should combine sensitive data, external communication and untrusted input. The Monetary Authority of Singapore told banks they cannot outsource AI accountability to vendors, with compliance phased in from October 2027. The UK ICO secured data-protection changes from ten AI firms and opened a call for evidence on agentic AI.
That raises the question of who inside the company owns all this. CSO Online asks whether the CISO role should be split; U.S. Bank’s CISO says no one leader can own every part of it; Proofpoint’s survey of 1,600 CISOs has 77% saying too much is expected of them. PwC finds only 17% of organisations formally assign AI risk to the CISO, which, as one analyst puts it, leaves the CISO in line to be fired anyway. Elsewhere the obligations kept arriving: 72-hour CUI incident reporting for federal contractors, a Senate-passed healthcare cyber bill, and a GAO report showing one of 24 major agencies has finished its post-quantum inventory.
On our watch list
- Whether the CLAIM Act draft gains a Republican cosponsor. Trahan released it as a discussion draft that does not preempt state law, which has historically cost Republican support in the House. A formal introduction with a Republican name on it would mean developer liability for agent conduct has a path; comments alone would leave it as a marker.
- Who holds the Senate Commerce gavel after November. Politico reports Cantwell’s framework is stricter than what Sens. John Thune and Amy Klobuchar are expected to produce, and it comes with no legislative text. A Democratic Senate would turn it into a starting draft; a Republican one keeps it a statement of position.
- How state AG races and investigations play out. Alabama is investigating OpenAI, Florida has sued to stop OpenAI advancing its models, and states have passed more than 100 AI laws this year. Watch the November AG results and any first settlement terms, which would set operator expectations faster than Congress.
- Whether the FAR CUI rule is final by year-end, and with which clock. Attorneys expect it by the end of 2026. The proposal sets 72 hours to report unauthorised CUI access; the Aerospace Industries Association wants 30 days. The final number decides how much of your incident process needs rebuilding.
- House action on the healthcare cyber bill. The Senate passed it by unanimous consent. The open question the American Hospital Association raised — whether minimum standards such as MFA reach third-party vendors — is the one that matters most to anyone selling into healthcare.
- What the ICO hears on agentic AI by 20 November. Responses to its call for evidence feed future guidance and a statutory code of practice on AI and automated decision-making. Also watch its formal investigations into X and xAI over Grok for a first enforcement benchmark.
- Whether PCI assessors start asking about agents. The PCI SSC guidance is advisory and existing requirements take precedence. Assessor questions about agent permissions, human approval and detokenisation tools at your next assessment would show it becoming de facto expectation.
- MAS’s 2027 consultation on agentic AI. The new guidelines leave agents for a separate consultation next year, with the first compliance sections due 7 October 2027. Foreign institutions’ Singapore operations are in scope wherever their systems are built.
- How many agencies accept GAO’s post-quantum recommendations. Only 12 of 23 fully agreed to the 89 recommendations, and 16 agencies said vendors had not yet shipped the new algorithms. Vendor PQC roadmaps landing in products would remove the main excuse.
- Whether OpenAI’s mathematical results are verified — and whether any touch cryptography. Commentators warn AI-accelerated mathematics could shorten the runway for public-key cryptography, but there is no evidence of a break and the proofs are unverified. A credible result against lattice or elliptic-curve problems would change PQC timelines overnight.
- What the MonsterCloud case reveals about recovery-firm practices. Zohar Pinhasi has pleaded not guilty. Discovery or further charges could prompt scrutiny of how other recovery providers handle ransom payments on clients’ behalf.
This week’s topic map — the CISO at the centre, tied to boards, Proofpoint’s and IANS’s role surveys and PwC’s AI risk-ownership data; an agent cluster linking the CLAIM Act, Maria Cantwell, state attorneys general, OpenAI and Satya Nadella with PCI SSC, MAS and the UK ICO on human approval and third-party AI; and an obligations ring of CUI rules, CIRCIA, the healthcare bill, MonsterCloud’s ransom payments and GAO’s post-quantum findings.
View interactive topic map →
Article index
The CISO role and its limits
The job keeps expanding — fraud, resilience, third parties and now AI — while only 17% of organisations formally hand the CISO AI risk. Surveys from Proofpoint, IANS and ISACA show the gap is capacity and skills, not awareness.
AI liability moves to Congress and the states
A House draft would make developers liable for what their agents do, the Senate Commerce Committee’s top Democrat set out a six-point framework, state attorneys general are campaigning on AI enforcement, and Microsoft’s CEO asked for an emergency brake.
Regulators set terms for AI agents
Payment, banking and privacy regulators moved from principles to specifics: human approval for agent actions on cardholder data, vendor assurances for banks in Singapore, and data-protection commitments from ten AI firms in the UK.
Federal and sector cyber obligations
Obligations that will bind sooner: 72-hour CUI reporting for federal contractors, minimum standards for healthcare, a recovery-firm indictment that should change how you write IR retainers, and a GAO audit showing how far behind post-quantum migration is.
Foundational reading: governance, risk and the economics of security
Longer reads for the board pack: governance that can actually intervene in time, pricing supplier and loss scenarios in money, and keeping control of data as AI models come and go. Several are vendor-authored columns; one is a sponsored post.
Detailed write-ups
1. The CISO role keeps growing, and no one wants to split it
CSO Online · Help Net Security · The Hacker News · October 5–7, 2026
CSO Online’s Rosalyn Page puts the question directly: should the CISO role be split in two? The numbers she gathers make the case for asking. Splunk’s 2026 CISO Report found 79% of CISOs say their remit has become significantly more complex, and 96% are now also responsible for AI governance and risk. The IANS 2026 State of the CISO Report found 52% believe their scope is no longer fully manageable, and two-thirds of CISOs still report into IT. Both of her interviewees — former CISO Todd Fitzgerald and Team8’s Tim Brown, who was charged by the SEC after SolarWinds — still argue for one CISO with technical, governance and operational responsibilities spelled out, rather than two.
Ann Barron-DiCamillo, EVP and CISO at U.S. Bank, describes the same expansion from inside a large bank: fraud, resilience, third-party risk and AI governance have all landed on the role. Her answer is partnership rather than reorganisation: “no one leader can personally own every aspect of those disciplines at scale.” She also argues many organisations overspend on compliance evidence when the money would do more in automation, asset visibility, identity, vulnerability management and secure-by-design engineering, and she notes the tension between shorter regulatory reporting deadlines and getting the facts right in the first hours.
Proofpoint’s 2026 Voice of the CISO survey of 1,600 CISOs, presented in a partner-contributed piece by its resident CISO Patrick Joyce, adds the workload view: 77% say excessive expectations are placed on the CISO, up from 49% in 2022, and 79% expect to manage AI risk without a matching increase in resources. Human error tops the risk list at 79%, 78% now restrict employee GenAI use, and board alignment rose to 85%. “The gap is no longer awareness. It is operational capacity,” Joyce writes. It is vendor research, but the direction matches the independent surveys: the job is growing faster than the team behind it.
Sources: CSO Online (Should the CISO role be split in two?) · Help Net Security (U.S. Bank CISO says the security role keeps grow…) · The Hacker News (The Sixth Voice of the CISO Data Shows Cyber Ris…)
2. Who owns AI risk? Mostly not the CISO, which is the problem
TechTarget · Cybersecurity Dive · October 8–9, 2026
TechTarget’s Alissa Irei draws on PwC survey data to show how unsettled AI accountability still is: 17% of organisations formally assign AI governance and risk to the CISO, 29% to the CIO, CTO or technology function, and 11% split it across functions. A third have a dedicated AI role such as a chief AI officer. Nemertes Research analyst Johna Till Johnson put the consequence bluntly: “Their actual job is to be fired if something goes wrong, and AI is now one of the biggest ‘somethings.’”
The fixes on offer are about matching authority to accountability. One consultant proposes that business leaders own how AI is used, CISOs own AI system security, and legal and compliance own oversight. Innowise’s Stanislav Kazanov goes further: a CISO who cannot block deployment of an agent that failed its security review does not really own that system’s risk.
Cybersecurity Dive’s David Jones adds the board-level frame. PwC’s October report of more than 3,900 leaders in 71 countries finds about half of security leaders see protecting AI systems as their largest preparedness gap, ahead of cloud, third-party and ransomware. KPMG’s third-quarter data shows 49% have now defined high-risk scenarios where autonomous agent access is restricted, up from 28% a year earlier, and the UK NCSC has warned that shadow AI and third-party AI tools often get privileged access outside existing visibility. Bedrock Data’s George Gerchow offered the simplest rule: “Treat every agent as a new identity with a named human owner.”
Sources: TechTarget (Unclear AI risk ownership could leave CISOs in f…) · Cybersecurity Dive (What the C-suite needs to know about AI governan…)
3. AI liability: a House draft, a Senate framework and the state AGs
Politico · TechCrunch · October 7–10, 2026
Rep. Lori Trahan (D-Mass.) released a discussion draft of the Clear Liability for Artificial Intelligence Misconduct (CLAIM) Act on 7 October. If an AI system injures a third party through conduct that would be negligence, an intentional tort or a crime if a person did it, the developer is liable — unless the user or a company that modified the system intended the conduct or was negligent. Courts would presume the system acted with the state of mind a person taking the same actions would have had, there would be a federal cause of action, and state law would not be preempted. Unlike the Hawley–Murphy proposal of the week before, it does not amend the Computer Fraud and Abuse Act. “When someone breaks the law and hurts you, you can take them to court. That shouldn’t change just because the wrongdoer is an AI agent,” Trahan said.
The same morning, Sen. Maria Cantwell, the Commerce Committee’s top Democrat, set out six principles for frontier AI: enforceable safety standards developed by NIST, continuous testing and independent audits before release, disclosure and prompt incident reporting — including loss of control over autonomous agents — continued developer liability, public-private work on defensive AI, and US-led global standards, including a secure channel with China for AI incidents. It has no legislative text, but Cantwell could chair the committee again if Democrats win the Senate in November.
Politico’s Casey He reports that state attorneys general are not waiting. Incumbents and candidates in both parties are campaigning on AI enforcement; Alabama is investigating OpenAI, Florida has sued to stop it advancing its models, and states have enacted more than 100 AI laws this year despite a December 2025 executive order threatening funding for states with “onerous” rules. On Saturday Microsoft CEO Satya Nadella, writing on X, called for controls outside the model, tamper-resistant logs of every significant action, and an authorised person able to pause or shut down a model mid-task: “We must assume a model is compromised and contain it from the start.” None of this binds you yet. Taken together, it says operators will be expected to show they could stop an agent and prove what it did.
Sources: Politico (Trahan unveils AI liability discussion draft) · Politico (Top Commerce Committee Democrat releases AI fram…) · Politico (State attorneys general seize on AI as Washingto…) · TechCrunch (Microsoft's Satya Nadella says AI models need an…)
4. Federal contractors: 72-hour CUI reporting is close
CyberScoop · October 7, 2026
Federal Acquisition Regulation rules on controlled unclassified information (CUI), published in the Federal Register on 23 June as part of a broader contracting overhaul, are nearing completion. Attorneys told CyberScoop’s Tim Starks they expect the rules to take effect by the end of 2026, and no later than the end of President Trump’s term.
Contractors would have to report unauthorised access to CUI, including from cyberattacks, within 72 hours of discovery — down from an eight-hour window, which also covered suspected incidents, in the January 2025 draft. The 72 hours aligns with CISA’s forthcoming CIRCIA rules; the Aerospace Industries Association asked for 30 days. Contractors handling CUI must meet NIST SP 800-171 and flow the requirements down to subcontractors, and experts expect False Claims Act exposure to reach firms that work only with civilian agencies.
“Going to be a sea change for a lot of companies,” said Trayce Howard, a government contracts partner at Wiley Rein. The effective date is lawyers’ expectation rather than a published date, but for civilian-agency suppliers that have never been through a DoD-style assessment, the work starts now.
Sources: CyberScoop (Major rules for federal contractors handling sen…)
5. Senate passes a healthcare cyber bill with minimum standards
The Record · October 7, 2026
The Health Care Cybersecurity and Resiliency Act of 2026, introduced by Sen. Bill Cassidy (R-La.) with Sens. Maggie Hassan, Mark Warner and Angus King, passed the Senate by unanimous consent. It would have HHS require minimum cybersecurity standards, such as multifactor authentication, for private healthcare entities, and work with CISA on information for the sector and a joint plan for significant incidents.
Breach notifications would have to state the total number of victims. The bill also calls for workforce training and readiness guidance for rural providers, and asks HHS to update its own cybersecurity plan every two years under a single designated official. “Cyberattacks can shut down hospitals and expose patients’ private medical records,” Cassidy said. The Record, by Jonathan Greig, sets it against Change Healthcare’s 190 million affected people and breaches at Aesto, CareCloud and Baylor Genetics.
The American Hospital Association supports the bill’s grants but wants to know whether the rules reach third-party vendors. The House still has to act. If you supply healthcare, assume MFA and incident-coordination expectations will flow into your contracts either way.
Sources: The Record (Senate passes healthcare cybersecurity bill afte…)
6. A ransomware recovery CEO is charged with secretly paying the attackers
BleepingComputer · October 7, 2026
Federal prosecutors in Brooklyn have charged Zohar Pinhasi, owner of Florida-based MonsterCloud, with one count of conspiracy to commit wire fraud and two counts of wire fraud. They allege that from June 2018 to June 2023 the company told victims it had proprietary decryption technology it did not have, and instead paid ransomware gangs for keys — often as its first step — while charging clients far more.
Prosecutors cite cases where about $8,200 went to attackers and the victim paid about $150,000, and another where about $236,000 was paid and the client was charged about $380,000. In total they allege more than $8 million in ransom payments and more than $19 million billed to hundreds of companies in the US and Canada. Pinhasi pleaded not guilty and was released on a $2 million bond; the charges carry up to 20 years. “By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients,” said U.S. Attorney Joseph Nocella Jr.
These are allegations. The governance lesson does not depend on the verdict: if a third party handles recovery, you may be paying a ransom without knowing it — with the sanctions, insurance and disclosure consequences that follow. A 2019 ProPublica investigation raised the same concern about the recovery market.
Sources: BleepingComputer (Ransomware recovery CEO charged over secret rans…)
7. Payment, banking and privacy regulators set terms for AI agents
Help Net Security · TechRepublic · Infosecurity Magazine · October 8–9, 2026
The PCI Security Standards Council published Security Considerations for AI Systems. It is advisory, and existing PCI requirements take precedence, but its recommendations are specific: define each AI system’s purpose, permissions and data access before deployment; give it only the access its tasks need; have a suitable person formally accept responsibility for its output; and enforce restrictions with independent controls such as identity policy and network isolation. Agents with access to cleartext cardholder data should get explicit human approval for any action involving it. No system should combine sensitive data access, external communication and unrestricted untrusted input — split those across agents with different permissions. Access to tokenised data plus a detokenisation tool counts as access to readable data, and contracts with AI providers should bar training on your data.
The Monetary Authority of Singapore issued AI risk-management guidelines on 7 October for banks, insurers and payment providers. Institutions should obtain sufficient assurances from AI vendors, and restrict, suspend or replace a service whose risks they cannot manage; they should keep an inventory of AI use and apply proportionate safeguards. Sections 3 and 4 apply from 7 October 2027 and sections 5 and 6 from 7 October 2028, and the rules reach foreign institutions’ Singapore operations. MAS plans a separate consultation on agentic AI in 2027.
In the UK, the ICO says ten AI firms — Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI — have made or committed to data-protection changes. It has opened a six-week call for evidence on agentic AI, closing 20 November, and formal investigations into X and xAI over Grok. “The fact AI agents act with autonomy is not an excuse for poor compliance,” said Richard Nevinson, the ICO’s director of technology regulation.
Sources: Help Net Security (PCI SSC calls for human approval of AI agent act…) · TechRepublic (Singapore's New AI Guidelines Hold Banks Account…) · Infosecurity Magazine (Major AI Firms Pledge Data Protection Changes Fo…)
8. Post-quantum migration lags, and AI-accelerated maths adds pressure
Cybersecurity Dive · The Independent · October 8, 2026
GAO report GAO-27-108740 finds federal agencies are not ready for post-quantum cryptography. Only one of 24 major agencies had finished inventorying its priority systems and the vulnerable algorithms they use; none had identified all the funding needed; none had fully tested PQC algorithms. Five used automated tools to find data protected by vulnerable algorithms, and 16 said testing was premature because most vendors had not yet added the new algorithms. GAO made 89 recommendations in a non-public version of the report, and only 12 of the 23 agencies receiving them fully agreed. The Office of the National Cyber Director blamed an immature vendor market for delayed funding estimates.
The Independent’s Anthony Cuthbertson adds a reason the timeline may be shorter than planned. After OpenAI published more than 700 mathematical papers within weeks, Johns Hopkins cryptographer Matthew Green said: “I think we might lose public key cryptography.” Ethereum co-founder Vitalik Buterin warned that lattice-based schemes may need to be significantly larger to stay safe.
Keep it in proportion: there is no evidence that any of these results comes close to breaking deployed cryptography, and the proofs have not been verified. The practical point for a CISO is GAO’s, not the commentators’: you cannot migrate what you have not inventoried, and most organisations, like most agencies, have not finished.
Sources: Cybersecurity Dive (US government lagging in transition to post-quan…) · The Independent (AI is causing a 'mathocalypse' that could break…)
Calls to action
- Write down who owns AI risk, and give security a veto. PwC finds only 17% of organisations formally assign it to the CISO. Put business use, system security and oversight on one page with named owners, and make sure an agent that fails security review cannot go live.
- Give every agent a named human owner. Treat agents as identities: inventory them, assign an owner, scope permissions to the task, and confirm that someone can pause each one mid-task.
- Split risky agent workflows the way PCI SSC suggests. No single agent should hold sensitive data access, external communication and untrusted input together. Where cardholder data is in reach, require explicit human approval and treat detokenisation tools as access to readable data.
- Ask your incident response and recovery providers in writing whether they pay ransoms. The MonsterCloud indictment alleges payments to attackers disguised as decryption technology. Require disclosure of any payment, prior approval, and a sanctions check in the retainer.
- If you hold CUI, gap-assess against NIST SP 800-171 now. Build a 72-hour reporting path from discovery and confirm your subcontractors can meet the same flow-down terms before the rule is final.
- Get AI-vendor assurances into contracts. MAS and PCI SSC both expect vendor assurances, a right to restrict or replace a service, and a bar on training on your data. Add those terms at the next renewal of every AI provider with access to sensitive data.
- Start or refresh the cryptographic inventory. GAO found one in 24 major agencies had finished one. Identify systems using vulnerable public-key algorithms and long-lived sensitive data, and ask your top vendors for dated PQC roadmaps.
- Put the top three loss scenarios in money. Use a top-down model — loss range, 12-month likelihood, how proposed spend shifts the range, and who signs if the risk is accepted — and use the same model for the board and the cyber insurer.
|