It’s been more than a decade since the United States first publicly blamed another country for a cyberattack, an accusation detailed in a 31-count indictment against five members of the Chinese military who hacked into the systems of American nuclear, metal, and solar companies over a period of eight years. That public attribution of economic espionage in 2014 marked a major shift for the United States, which had previously worked behind the scenes to address digital intrusions that came from beyond its borders, if it did anything at all. Part of the rationale for naming and shaming the perpetrators was to deter bad actors from carrying out future hacks. Deterrence as a defense strategy, however, has so far proved to be something of a dud. Today, cyberattacks seem almost commonplace; breaches of public and private entities are everyday news. So-called ransomware attacks, in which hackers lock up an entity’s system or files and demand payment to restore functionality, have proliferated. In 2024, in a federal indictment, a North Korean intelligence operative was accused of using the proceeds from ransomware attacks he’d carried out against hospitals to fund additional cyberattacks on government entities around the world, among them two U.S. Air Force bases. Other attackers, including groups sponsored by countries such as China and Russia, do not announce their presence; their goal is to stay hidden long enough to steal information that can later be used for financial or geopolitical gain. By hacking into U.S. telecommunications companies in 2024, China apparently intercepted surveillance data that was meant for law enforcement agencies. Cyberattacks may be difficult to prevent, but that doesn’t mean policymakers, governments, and the sector have given up trying. Harvard Law School faculty and alumni who have worked on cybersecurity issues in their research and practice, some at the highest
Apr 21, 2026 · via hls.harvard.edu
In the article Avoiding Punitive Damages After a Data Breach published by Texas Bar Journal, Spencer Fane attorney Shawn Tuma’s piece on cybersecurity was included as an additional resource. Shawn also had a separate article published by Texas Bar Journal relevant to data privacy. In his articles, Shawn discusses the promotion of stronger cybersecurity practices and the evolving legal risks surrounding data privacy, including Texas’ SB 2610 safe harbor framework and recent developments involving artificial intelligence, unauthorized system access, and data misuse. He highlights the benefits of aligning with recognized security standards while outlining the broader impact on risk management, litigation exposure, and data breach liability. “Data breaches are costly – not just in terms of remediation and reputational harm, but also in litigation risk. SB 2610 offers businesses a way to mitigate that risk by aligning with industry standards. For organizations that handle sensitive personal information, this is an opportunity to strengthen defenses and gain legal protection,” Shawn wrote. Shawn co-leads the firm’s Cyber | Data | Artificial Intelligence | Emerging Technology Practice Group while serving as Office Managing Partner for the firm’s Plano, Texas, location. He helps businesses protect their information and protect themselves from their information. He represents a wide range of clients, from small companies to Fortune 100 companies, across the U.S. and globally in dealing with artificial intelligence (AI), cybersecurity, data privacy, data breach and incident response, regulatory compliance, computer fraud-related legal issues, and cyber and AI-related litigation.
Apr 21, 2026 · via spencerfane.com
Press Release Johns Hopkins APL Contributions Fuel Critical Navy Cybersecurity System The Navy-engineered Situational Awareness, Boundary Enforcement, and Response (SABER) system, with key capabilities developed by the Johns Hopkins Applied Physics Laboratory (APL) in Laurel, Maryland, in collaboration with government and industry partners, has become a vital line of security in protecting Navy ships against cyberattacks. SABER continuously and autonomously monitors a surface ship’s vital systems for signs of a cyberattack, including its hull, mechanical, and electrical (HM&E), navigation, and combat components. When a potential attack is detected, the system generates alerts that provide crew members with defensive and/or remediation options. The growing threat of cyberattacks on naval vessels, especially smaller ships such as destroyers and frigates, has made it critical to have a reliable system in place not only to protect the nation’s military infrastructure but also to instill confidence in the readiness of those systems for potential future conflicts. “With SABER being deployed to the fleet at large, we are creating tools that will enhance mission assurance in a cyber-contested environment,” said Vamsi Maddula, Cyber Resilient Platforms program manager at APL. Multiple Capabilities, One Mission The APL capabilities underpinning SABER draw on more than a decade of demonstrative events and innovative technical leadership. Many of these capabilities originated in APL’s SEACHANGE initiative, launched in 2016 with three lines of effort: assess situational awareness technologies, establish a prototype and temporary solution based on the technologies used in fleet experiments, and lead a human-systems engineering working group to develop guidance to better enable cyber warfare on a ship. SABER integrates tools developed by the government, APL, and industry partners to form the backbone of shipboard, tactical system cybersecurity. As SABER gains traction as a Naval Sea Systems Command (NAVSEA) rapid-development capability focused on a subset of ship systems, APL is
Apr 21, 2026 · via jhuapl.edu
The cybersecurity industry has spent the last several years chasing sophisticated threats like zero-days, supply chain compromises, and AI-generated exploits. However, the most reliable entry point for attackers still hasn't changed: stolen credentials. Identity-based attacks remain a dominant initial access vector in breaches today. Attackers obtain valid credentials through credential stuffing from prior breach databases, password spraying against exposed services, or phishing campaigns — and use them to walk through the front door. No exploits needed. Just a valid username and password. What makes this difficult to defend against is how unremarkable the initial access looks. A successful login from a legitimate credential doesn't trigger the same alarms as a port scan or a malware callback. The attacker looks like an employee. Once inside, they dump and crack additional passwords, reuse those credentials to move laterally, and expand their foothold across the environment. For ransomware crews, this chain leads to encryption and extortion within hours. For nation-state actors, the same entry point supports long-term persistence and intelligence gathering. AI Is Accelerating What Already Works The fundamental attack pattern here hasn't changed much. But what has changed is the speed and polish with which it gets executed. Attackers are leveraging AI to scale their operations by automating credential testing across larger target sets, writing custom tooling faster, and crafting phishing emails that are materially harder to distinguish from legitimate communications. This acceleration puts additional pressure on already-stretched defenders. Breaches are unfolding faster, spreading further and touching more of the environment, from identity systems to cloud infrastructure to endpoints. IR teams built for a slower tempo of engagement are finding that their existing processes can't keep pace. A Dynamic Approach to Incident Response This is where the way teams think about incident response matters as much as the technical controls they deploy.
Apr 21, 2026 · via thehackernews.com
This initiative aims to enhance access to the Falcon platform for small and medium-sized businesses (SMBs). Details CrowdStrike announced an expansion of its Managed Security Service Provider (MSSP) strategy, partnering with Dicker Data and Otsuka Corporation to increase SMB access to its Falcon platform. This move is expected to accelerate AI-driven cybersecurity transformation, allowing MSSPs to deliver tailored security services to meet growing regional demand. Jon Fox, vice president of channels and alliances, CrowdStrike Japan and Asia Pacific, added, “Budget constraints, complexity, and resource limitations continue to challenge businesses, with SMBs experiencing these challenges at a greater scale. Together with our partners, we are expanding access to the AI-powered protection that enables organizations to stay focused on their core business.” Technical Analysis The broader market saw gains on Monday, with the Technology sector rising 0.21%. CrowdStrike’s performance aligns with this positive sentiment, indicating that the stock is moving with broader market trends. CrowdStrike is currently trading within its 52-week range, showing a solid position compared to its recent performance. The stock is trading 9.4% above its 20-day simple moving average (SMA), indicating short-term strength, while it is 0.4% below its 100-day SMA, suggesting some intermediate weakness. The relative strength index (RSI) is at 59.29, indicating neutral momentum. This level suggests that the stock is neither overbought nor oversold, which may lead to a stable trading environment. - Key Resistance: $452.00 — This level may act as a barrier for upward movement. - Key Support: $364.50 — This level could provide a safety net for buyers if tested. CrowdStrike has shown a 12-month performance of 19.43%, reflecting a positive trend over the longer term. This performance suggests that the stock is maintaining upward momentum, despite some fluctuations along the way. Recent Earnings & Buyback Boost Annual recurring revenue (ARR) climbed 24%
Apr 21, 2026 · via benzinga.com
Outdated software has become a major cybersecurity liability Why AI‑accelerated threats are making patch delays untenable Takeaways - AI is compressing the vulnerability‑to‑exploit timeline, giving defenders less time to respond to newly disclosed flaws - Most attacks still target known, unpatched vulnerabilities, making outdated software a persistent and preventable risk - Automated updates and rollback capabilities are no longer optional, as manual patching cannot keep pace with modern threat activity In the artificial intelligence (AI) era, IT and cybersecurity teams must ensure every device runs the most secure software version available. As cybercriminals gain access to more advanced AI models, the amount of time and effort required to first discover a vulnerability and develop a means to exploit it is now approaching zero. While that is likely to increase the number of unknown zero-day vulnerabilities that might be exploited, most cybercriminals will—at least initially—focus on exploiting known vulnerabilities faster than ever. Unfortunately, there is no shortage of existing vulnerabilities to be exploited. For example, a Jamf Threat Labs analysis of 1.7 million iOS and Android devices and over 150,000 Mac devices finds more than half (53%) of organizations discovered they had devices with critically out-of-date operating systems. Additionally, 75% of devices had at least one vulnerable application installed. In fact, 95% of the applications assessed contained at least one medium-severity vulnerability, with 62% enabling dangerous permissions. A full 44% of devices had been exposed to malicious network traffic. Historically, many IT teams have been reluctant to deploy the latest version of any type of software for fear the update would break the application. However, as cybersecurity threats become more sophisticated the potential damage that might be unleashed by a successful cybersecurity attack is in many cases starting to exceed the risk that might occur if an application was unavailable. The
Apr 21, 2026 · via blog.barracuda.com
The IS&T Experience Episode 4: Leadership and Cybersecurity
Meet Zaid Kakish, a UNO student who unlocked new opportunities and deepened his mastery of cybersecurity by staying involved and leading an impactful student club.
- published: 2026/04/20
- contact: Kaylee Pena Guerrero - College of Information Science and Technology
This episode features Zaid Kakish, a cybersecurity graduate student at the University of Nebraska at Omaha (UNO), and Martha Garcia-Murillo, Ph.D., Dean of the UNO College of Information Science & Technology (IS&T). Kakish shares their involvement on campus through Nullify, a student club that explores cybersecurity fundamentals, tools, workshops, and current industry topics—all while hosting guest speakers and organizing community events.
Watch Episode on Youtube
About the IS&T Experience Series
The IS&T Experience gives an insider look at the people and stories shaping the future of technology at the University of Nebraska Omaha's College of Information Science & Technology. Through engaging conversations with students, faculty, staff, alumni, and community partners, discover the experiences that define our community—from navigating career development and research breakthroughs to building the skills that prepare the next generation of technology leaders.
Learn more about the College of Information Science & Technology
Apr 21, 2026 · via unomaha.edu
ZAWYA: OPSWAT and Emerson to strengthen cybersecurity for critical infrastructure operators with global reseller agreement Dubai, United Arab Emirates – OPSWAT, a global leader in critical infrastructure cybersecurity, and Emerson EMR, a global automation leader, have announced a global strategic reseller agreement that will bring OPSWAT’s industry-proven cybersecurity technologies to Emerson’s power and water industry customers. As the first initiative under this enterprise-wide agreement, Emerson will integrate OPSWAT’s scalable and safe operational technology (OT) patch management capabilities into its Ovation™ Automation Platform. The new OT patch management solution further builds on the collaboration to date by securing the Ovation Platform through OPSWAT’s MetaDefender Endpoint™ and My OPSWAT™ Central Management On-Premises, part of Emerson’s purpose-built power and water cybersecurity suite of solutions. “Our customers need cybersecurity solutions designed specifically for operational technology—not adapted from IT,” said Robert Yeager, President of Emerson’s power and water solutions business. “They benefit from purpose-built OT cybersecurity solutions that protect critical, real-time industrial systems while supporting availability, performance, and safe operations. Collaborating with OPSWAT enhances our ability to help operators protect their Ovation Automation Platform with a modern, OT appropriate approach to patch management. It reflects our commitment to delivering proven, efficient, best-in-class protection for critical infrastructure.” Critical infrastructure operators, including power generation and water/wastewater utilities, continue to face increasing cyber threats, regulatory pressure, and operational risk stemming from unpatched vulnerabilities. OPSWAT’s solution for the Ovation Automation Platform delivers a modernized patch management approach designed specifically for industrial environments, addressing challenges posed by a mix of modern and legacy tools and the ongoing surge of nation-state and ransomware activity targeting the energy and water sectors. “As LLMs, automation, and digital transformation accelerate across power and water infrastructure, the attack surface expands just as quickly,” said Benny Czarny, Founder and CEO of OPSWAT. “In environments where safety
Apr 21, 2026 · via tradingview.com
AI cloud company Vercel breached after employee grants AI tool unrestricted access to Google Workspace — hacker seeking $2 million for stolen data The culprit? An infostealer infection from a Roblox cheat download. Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. You are now subscribed Your newsletter sign-up was successful Vercel, the cloud platform behind the widely used Next.js web framework, has acknowledged a security breach after an attacker compromised a third-party AI tool called Context.ai and used it to gain access to a Vercel employee's enterprise Google Workspace account. The breach exposed non-sensitive environment variables, and a threat actor operating under the ShinyHunters name has claimed responsibility, reportedly seeking $2 million for the stolen data. Vercel said it has engaged Google-owned incident response firm Mandiant, notified law enforcement, and contacted a limited subset of affected customers directly. According to Vercel’s bulletin, the breach didn’t start with them but instead with Context.ai, an enterprise AI platform that builds agents trained on company-specific knowledge. At least one Vercel employee had signed up for Context.ai's AI Office Suite using their corporate account and granted it "Allow All" OAuth permissions, Context.ai explained in its own security notice, which says that “Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace.” The attacker exploited that broad access to take over the employee's Vercel Google Workspace account and move laterally into internal systems. Article continues belowCybersecurity firm Hudson Rock claims to have traced Context.ai's own compromise back further to an employee infected by Lumma Stealer malware after downloading Roblox game exploit scripts in February. The stolen credentials reportedly included Google Workspace logins along with keys for Supabase, Datadog, and Authkit, Hudson Rock reported, but Vercel hadn’t independently confirmed this at the
Apr 21, 2026 · via tomshardware.com
About
Press
Copyright
Contact us
Creators
Advertise
Developers
Terms
Privacy
Policy & Safety
How YouTube works
Test new features
NFL Sunday Ticket
© 2026 Google LLC
Apr 21, 2026 · via youtube.com
Expanded go-to-market empowers distributors to recruit and onboard MSSPs, increasing SMBs access and adoption of the Falcon platform AUSTIN, Texas & DA NANG, Vietnam--(BUSINESS WIRE)--Apr. 20, 2026-- JAPAC Partner Symposium -- CrowdStrike (NASDAQ: CRWD) today announced an expansion of its Managed Security Service Provider (MSSP) go-to-market strategy across Japan and Asia Pacific (JAPAC), increasing access to the CrowdStrike Falcon® platform for small and medium-sized businesses (SMBs) and accelerating AI-driven cybersecurity transformation. Through expanded strategic partnerships with Dicker Data and Otsuka Corporation, this distributor-led aggregation model enables partners to onboard MSSPs at scale and deliver managed security services that bring AI-powered protection to SMBs. Independent research from Canalys shows that for every $1 of Falcon platform sales, partners can generate up to $7 in services revenue – validating CrowdStrike’s services-led ecosystem as a key driver of partner growth and profitability. Building on this momentum, CrowdStrike’s distributor-led model enables select distributors to recruit and activate MSSPs across JAPAC, with flexible billing through distributor marketplaces. This approach allows MSSPs to quickly build and deliver tailored offerings, expanding access to enterprise-grade security and meeting growing regional demand from SMBs. “Distributors and MSSPs are pivotal to scaling CrowdStrike’s reach across JAPAC and helping organizations modernize their security for the AI era,” said Jon Fox, vice president of channels and alliances, CrowdStrike Japan and Asia Pacific. “Budget constraints, complexity, and resource limitations continue to challenge businesses, with SMBs experiencing these challenges at greater scale. Together with our partners, we are expanding access to the AI-powered protection that enables organizations to stay focused on their core business.” Supporting Partner Quotes: "Cybersecurity continues to be a key growth driver for the ICT channel, with many SMBs needing access to additional capabilities to defend against modern threats," said Vlad Mitnovetski, executive director and chief operating officer of Dicker Data.
Apr 21, 2026 · via ir.crowdstrike.com
About
Press
Copyright
Contact us
Creators
Advertise
Developers
Terms
Privacy
Policy & Safety
How YouTube works
Test new features
NFL Sunday Ticket
© 2026 Google LLC
Apr 21, 2026 · via youtube.com
CISA Adds Eight Known Exploited Vulnerabilities to Catalog CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. - CVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability - CVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability - CVE-2025-2749 Kentico Xperience Path Traversal Vulnerability - CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability - CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability - CVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability - CVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability - CVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. This product is provided subject to this Notification and this Privacy & Use policy.
Apr 21, 2026 · via cisa.gov
Education & Training Advance Your Cybersecurity Career Practical advice for cyber professionals seeking to advance their careers. Security Magazine: What education or certification(s) can support a successful career in cybersecurity? Jenkins: As a hiring manager for more than 20 years, I recognize and appreciate that having a degree or being “certified” is not necessarily indicative of knowledge, skill, or long‑term success. I have hired several candidates — and worked with many colleagues — who had no formal credentials to speak of, yet they were highly skilled and successful in their fields. That said, having one or more degrees or certifications related to your career — in this case, cybersecurity — does imply a certain level of foundational knowledge, discipline, and the ability to synthesize information. Relevant education and certifications also help establish a shared vernacular and common thought processes, which creates useful points of reference when working with others in the same professional domain. Education that supports a successful career in cybersecurity, even if not explicitly labeled as such, includes related technical and engineering disciplines such as computer science, information technology, computer engineering, and electrical engineering. Useful corollaries include business- and policy‑oriented education in areas like information systems, business administration, and even privacy or technology law. Certifications include the obvious examples — CISSP, CISM, CRISC, CompTIA Security+, and others. Ultimately, what matters most to me as a hiring manager is hands‑on experience, demonstrated skills, certifications that align to the role, and the relevance of a candidate’s educational background. Aspiring leaders must also know how to build trust — both with their teams and with executive leadership. These capabilities are not ‘nice to have’; they are foundational skills for anyone seeking to lead effectively in cybersecurity. Security: What “soft skills” should aspiring security leaders develop? Jenkins: Negotiation, compromise, and the ability
Apr 21, 2026 · via securitymagazine.com
Airdate: Tuesday, April 21 at 10 AM
The San Francisco AI firm Anthropic has developed a new model that it says is too powerful to be released to the public. Called Mythos, Anthropic says it’s in a “different league” when it comes to identifying and exploiting cybersecurity vulnerabilities, and in the wrong hands could enable bad actors to unleash powerful cyberattacks. Anthropic is alerting governments and releasing a limited version called Claude Mythos Preview to about 40 tech companies (including some of its AI competitors) to find and fix their own security vulnerabilities. We look at how this next generation of AI could reshape digital security and policy.
Apr 20, 2026 · via kqed.org
This website uses certain cookies, pixels and similar tracking technologies in order enhance site navigation, analyze site usage, and assist in our marketing efforts. Certain information collected by that technology may be shared with our third party partners. By continuing to use this website, you agree to the use of these technologies. The April 14 Park County Commission meeting was held in the City/County Complex in Livingston. The City of Livingston and Park County are developing a cybersecurity incident response plan. It’s part of an effort to ensure public resources aren’t compromised by hackers and other malicious actors. State, local, tribal and territorial governments are frequent targets of cyberattacks and are on the front lines of cybersecurity, according to a fact sheet from the U.S. Cybersecurity and Infrastructure Security Agency. “Whether it’s a phishing email targeting a small-town clerk or ransomware disrupting a huge city’s emergency services, you see real threats every day,” reads the fact sheet. Park County commissioners will consider adopting a resolution on Tuesday to establish the Park County-City of Livingston Computer Security Incident Response Team to support the development and implementation of the Park County Cybersecurity Incident Response Plan. The team would include a core IT group consisting of the county IT director and two people appointed by the director; and a staff support group composed of the county emergency management director, county HR director, city HR director, someone appointed by the sheriff, county commission assistant, and the county maintenance director. The purpose of the IT group will be to direct cybersecurity incident response efforts, analyze cybersecurity incidents, recommend technical containment actions, and other such efforts as appropriate, according to the proposed resolution. The staff group will support the efforts of the IT group and engage appropriate city and county departments. Commissioners will consider the resolution
Apr 20, 2026 · via livingstonenterprise.com
At the same time, the city board that manages the office ignored concerns from other city departments and officials that the office may have violated state laws, a member of the Madison City Council said. Madison police paused openly sharing data with the Office of the Independent Police Monitor and requested an internal review of its employees’ handling of sensitive documents after learning that sensitive, unredacted documents it had provided the office were being uploaded to a personal device and analyzed with software not approved by the city’s IT department. Cybersecurity isn’t the city’s only concern with the monitor’s office. In an email the Wisconsin State Journal obtained through a public records request, Ald. MGR Govindarajan told the chair of the Police Civilian Oversight Board, Maia Pearson, the office’s staff were working beyond allotted hours, circumvented the city’s AI policy and purchased and contracted services without following city guidelines. “While independence in its core function is both important and necessary, extending that independence to areas such as compliance with City policies and legal requirements creates risk not just for the OIM, but for the City as a whole,“ Govindarajan wrote. POLICE PUSHBACK AGAINST DATA SHARING Police paused record-sharing on Nov. 7 after the monitor’s data analyst, Greg Gelembiuk, told Assistant Police Chief Angie Kamoske that he had used his personal computer to analyze police records provided to the monitor’s office. According to an internal memo from Madison Police Chief John Patterson, Gelembiuk called his city-issued laptop a “paperweight“ and stated that he received permission from the previous monitor, Robin Copley, to use his own device. Gelembiuk never received approval from the city’s IT department to use his own computer for the work. He also reportedly told Kamoske that he used software that IT initially rejected. “I have ‘data analyst’ in
Apr 20, 2026 · via govtech.com
The House Appropriations Financial Services and General Government (FSGG) Subcommittee advanced its fiscal year (FY) 2027 appropriations bill on Friday, including $5 million for the Technology Modernization Fund (TMF) and millions in appropriations for cybersecurity improvements. In the FY 2027 FSGG bill, House appropriators included $5 million in total funding for the TMF “to remain available until expended.” The TMF – overseen by the General Services Administration (GSA) – was created in 2017 under the Modernizing Government Technology Act to fund federal civilian agencies’ technology modernization projects. House appropriators’ draft differs slightly from the White House’s FY 2027 budget proposal. The White House asked for no direct appropriation for the TMF and instead recommended relying on budget transfer authority to fund the program. That approach would allow GSA – with the Office of Management and Budget’s approval – to collect up to $100 million in unobligated appropriations across federal agencies to fund the TMF. The House, according to its bill, is instead considering funding the TMF directly. The $5 million in funding – if enacted – would match what Congress ultimately approved for FY 2026 TMF appropriations. Beyond TMF-related funding, the 2027 FSGG bill takes a largely decentralized approach to IT funding. It expands agencies’ ability to redirect existing funds toward IT modernization, allowing up to 5% of certain appropriations to be transferred into IT working capital funds. At the same time, the bill continues support for shared digital services through GSA, with the Federal Citizen Services Fund authorized to finance interagency IT projects and improvements to online government services, up to $150 million. The measure channels funding into data and analytics capabilities, particularly for Treasury systems used in financial analysis and data processing. The bill does not include major new artificial intelligence funding, but it still enables agencies to
Apr 20, 2026 · via meritalk.com
Highlights - Cybersecurity demand continues to reshape digital defense priorities - Leading firms expand influence across enterprise ecosystems - Market momentum reflects resilience in evolving threat landscapes Cybersecurity continues to evolve as a critical industry, driven by innovation, cloud adoption, and identity protection, strengthening digital ecosystems and supporting resilient operations across global enterprises. The cybersecurity sector continues to command strong attention as digital transformation accelerates across industries, with companies like Palo Alto Networks (NASDAQ:PANW) standing at the forefront of innovation. As organizations navigate increasingly complex cyber risks, the sector’s evolution is closely tied to broader market benchmarks like the S&P 500 Index (SPX), reflecting its growing importance in the modern economy. This shift highlights how cybersecurity is no longer optional but a foundational pillar of enterprise strategy, shaping how businesses operate, secure, and scale in a connected world. Industry Expansion Trends Cybersecurity has moved beyond traditional network protection into a comprehensive ecosystem that includes cloud security, identity verification, endpoint protection, and threat intelligence. This transformation is fueled by the rapid adoption of remote work environments, cloud infrastructure, and data-driven operations. Organizations across sectors are investing heavily in robust digital defenses to safeguard sensitive information and maintain operational continuity. As cyber threats become more sophisticated, companies specializing in proactive threat detection and response are gaining prominence. Evolving Threat Landscape The cybersecurity landscape is continuously evolving, driven by emerging technologies and increasingly sophisticated cyber threats. From ransomware attacks to data breaches, organizations face persistent risks that require advanced defense strategies (NASDAQ:PANW). Cybersecurity firms are responding by investing in automation, artificial intelligence, and predictive analytics. These technologies help identify vulnerabilities before they can be exploited, enabling faster and more effective responses to potential threats. Cloud Security Takes Center Stage Cloud adoption has become a defining trend in modern business operations, and with it
Apr 20, 2026 · via kalkinemedia.com
Understanding Cybersecurity Maturity Model Certification: The New Standard for Doing Business with the Department of Defense The post Understanding Cybersecurity Maturity Model Certification: The New Standard for Doing Business with the Department of Defense appeared first on Welcome to the PKWARE Blog – PKWARE®. For anyone working with or hoping to work with the Department of Defense (DoD), cybersecurity compliance is no longer optional. It’s now a condition of doing business. The DoD created the Cybersecurity Maturity Model Certification (CMMC) to solve a growing problem within the defense supply chain: inconsistent protection of sensitive information and unreliable self-reporting of compliance. CMMC changes that equation. It replaces self-attestation with formal certification, holding every defense contractor to clearly defined technical and legal standards. For thousands of organizations across the Defense Industrial Base (DIB), those standards are both explicit and non-negotiable. Why Cybersecurity Maturity Model Certification Exists The DoD depends on a vast network of suppliers, subcontractors, and service providers. These organizations handle two main types of information: - Federal Contract Information (FCI): Data generated under government contracts not meant for public release - Controlled Unclassified Information (CUI): Sensitive but unclassified material such as technical drawings, specifications, or export-controlled data Before CMMC, the government relied on contractors to self-report compliance with the NIST SP 800-171 cybersecurity framework. However, assessments revealed large gaps—particularly around encryption and data protection. The result was predictable. The outcome was inconsistent safeguards across the supply chain. With this comes increased risk to national security. CMMC aims to correct that, ensuring accountability through verified audits and standardized certification. The Three Levels of Compliance CMMC 2.0 organizes requirements into three tiers: Foundational: Level 1 - Defines the basic safeguards for contractors handling FCI only. - Directs organizations to self-assess their compliance with 17 core practices. Advanced: Level 2 - Applies to
Apr 20, 2026 · via securityboulevard.com