OpenAI (OPENAI) is finalizing a model with advanced cybersecurity capabilities that it plans to release only to a small set of companies, similar to Anthropic's (ANTHRO) limited roll out of Mythos, a source familiar told Axios.
Restricting the rollout of a
Newsletters for Every Investor
Get daily, sector-specific newsletters packed with expert insights, fresh ideas, and new opportunities.
Subscribe to Newsletters
To ensure this doesnât happen in the future, please enable Javascript and cookies in your browser.
Apr 9, 2026 · via seekingalpha.com
Claude Mythos and misguided open-weight fearmongering Another dance around fears of open-source. With the announcement of the Claude Mythos model this week and the admittedly very strong stated abilities, especially in cybersecurity, a new wave of anti open-weight AI model narratives surged. The TL;DR of the argument is that our digital infrastructure will not be ready in time for an open-weight version of this model, which will allow attacks to be conducted by numerous parties. The backlash against open models in the wake of the Mythos news conflates too many general unknowns into a simple, broad policy recommendation that could actually further weaken cybersecurity readiness. We’ve been here before – open-weight models were discussed as being extremely dangerous when OpenAI withheld GPT-2 weights in 2019, and when OpenAI released GPT-4 in 2023. Both of these waves came and went. The core mistake that is being made is the composition of two issues: 1) the acceptance of the open-closed model gap being static in time and 2) linking open-weight viability generally to specific issues. I’ve written at length recently on how I think that the best, frontier-level open weight models are going to fall behind the best closed models in overall capabilities in the near future. I’ve also written about how the open-weight ecosystem needs to adapt to accept this reality. This is one of the times for the AI industry where I will repeat that it’s a total blessing to have the 6-18 month delay from when a certain capability is available within a closed lab to it being reproduced in the open. It’s a good balance of safety and monitoring the frontier of AI systems while allowing a useful open-source ecosystem to exist and thrive. The core argument I’ve focused on in the open-closed model time gap has been
Apr 9, 2026 · via interconnects.ai
The Most Important Cybersecurity Trends in 2026 So Far In the first quarter of the year, cybersecurity trends have been much of the same, with some new twists. Cyber threats are always evolving, but often have much of the same foundation. The leading 2026 cybersecurity trends so far involve AI, the failure of perimeter defenses, ransomware, and nation-state attacks. Let’s talk about what’s happening and how to best prepare for the expected and unexpected. AI-Fueled Attacks and Defenses AI plays both sides in cybersecurity. On one hand, AI-driven tools can help detect attacks faster and monitor complex networks and traffic patterns. On the other, hackers can use AI to develop more sophisticated attacks. AI is also a powerful augmenter for understanding where all your sensitive data is. It’s an essential part of data discovery, but it doesn’t replace good policy. So, governance is still essential. That’s the sentiment that PKWARE Field CTO, EJ Pappas, shared in a recent episode of the CISO Tradecraft® podcast. He and the hosts discussed how AI is a defensive and offensive strategy. It’s become a tactic for cyber criminals, using it to scale and elevate phishing and social engineering. Deep fakes are on the rise, making attacks more convincing and providing an entryway into systems. Another attack surface related to AI is chatbots. Almost every organization uses these in some way. As they become more deeply integrated into operations, they can be easier to attack. These AI agents need access to data to operate, and some of this could be sensitive. Businesses that have implemented them must consider the potential threat they present. The Failure of Perimeter Defenses Identity and Access Management (IAM) has a role in your data protection strategy. However, there are inherent weaknesses. IAM tools fall short where there are compromised credentials,
Apr 9, 2026 · via securityboulevard.com
Independent Research Firm gives Bitsight the top score in the Current Offering category, and the highest possible scores across 11 criteria, the most of all vendors evaluated BOSTON – April 9, 2026 – Bitsight, the global leader in cyber risk intelligence, today announced it has been named a Leader in The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2026, receiving the highest possible scores across 11 criteria, the most of all vendors evaluated. Bitsight achieved the highest score in the Current Offering category and a top score in the Strategy category. Forrester’s evaluation reflects a broader shift in the market, from static ratings to dynamic, data-driven intelligence that enables real risk reduction. As the report states, “The real value of CRR platforms is in the data and intelligence underlying a rating and their ability to surface actionable risk findings when this data is used correctly. As a result, CRR platform vendors have evolved their roadmaps to focus on gleaning better insights from their data and delivering those insights in the form of actionable findings that concretely reduce customers’ risk.” According to the report, “Customers praised the utility of Bitsight’s data across their programs.” Bitsight’s scores reflect its strength across the capabilities that matter to customers most. Bitsight has been driving this evolution, expanding beyond ratings to deliver a unified view of exposure, supply chain risk, and threat intelligence with AI-enabled features that helps organizations move from understanding risk to actively reducing it. In the Q2 2026 report, Bitsight received the highest possible scores (5.0) in 11 criteria, including Vision, Asset Discovery and Attribution, Data Source Acquisition and Variety, Vendor Discovery and Mapping, Security Performance Analytics, and Data Source Quality and Integrity. Forrester’s evaluation states that “Bitsight stands out for its clear vision of how ratings enable risk reduction.” Unlike platforms
Apr 9, 2026 · via bitsight.com
About
Press
Copyright
Contact us
Creators
Advertise
Developers
Terms
Privacy
Policy & Safety
How YouTube works
Test new features
NFL Sunday Ticket
© 2026 Google LLC
Apr 9, 2026 · via youtube.com
Justice wants $110.3M to boost zero-trust cybersecurity in fiscal 2027 The Department of Justice is asking Congress for a major boost in fiscal 2027 to the fund it uses to support IT modernization and enterprise cybersecurity, with the entire increase going directly to the agency’s zero-trust cybersecurity architecture. DOJ has requested $149 million for its Justice Information Sharing Technology fund as part of the Trump administration’s fiscal 2027 budget request. Congress appropriated $38.5 million for the program in the past two fiscal years. The primary difference between this request and the funding enacted in the most recent years prior is the $110.3 million that DOJ says it needs to support its migration to a zero-trust architecture for its unclassified and national security systems. To put that into perspective, Justice requested a more meager $11.8 million increase to the JIST fund’s topline in fiscal 2026 for “cybersecurity posture enhancement,” which it did not get. In its congressional budget justification for 2027, Justice explains that despite an industrywide shift to zero trust as the cybersecurity model of choice in response to the SolarWinds attack on federal agencies in 2020, its funding for cyber was cut by $108 million in fiscal 2024 and remained essentially flat since then. Justice was among the federal agencies impacted by the SolarWinds incident. “Enacted funding levels over the past three years are below the level required to cover DOJ’s over 275,000 endpoints and approximately 160,000 users,” the budget document states, adding that “the current funding levels impact the Department’s current defenses and constrain its ability to adapt to evolving threats.” Without a full move to zero trust, which the Biden administration mandated in its cyber-focused Executive Order 14028 in May 2021 in the wake of the SolarWinds breaches, “the Department’s cyber risk exposure and its susceptibility to
Apr 9, 2026 · via fedscoop.com
Software companies nearly across the board were bleeding on Thursday, with cybersecurity names hit the hardest amid persistent fears of AI disruption and a shaky geopolitical backdrop.
Cybersecurity firms were hemorrhaging the most, led by Qualys (QLYS), which was
Apr 9, 2026 · via seekingalpha.com
OpenAI is working on a cybersecurity model to rival Anthropic's Mythos The company is developing a security-focused AI for its restricted "Trusted Access for Cyber" program Cheng Xin / Getty Images OpenAI is developing a cybersecurity-focused AI model for a restricted program called "Trusted Access for Cyber," according to a new report, putting it in direct competition with Anthropic's Claude Mythos Preview. Details of the model and program are limited. Axios reported the development, which positions OpenAI as a rival to Anthropic in the emerging market for frontier AI systems built for offensive and defensive security work. Related Content Project Glasswing, Anthropic's accompanying initiative, set aside up to $100 million in usage credits and limited the model's initial rollout to twelve partners — including Amazon $AMZN Web Services, Apple $AAPL, Broadcom $AVGO, Cisco $CSCO, CrowdStrike $CRWD, Google $GOOGL, JPMorganChase, the Linux Foundation, Microsoft $MSFT, Nvidia $NVDA, and Palo Alto Networks $PANW — each contractually bound to use it exclusively for defensive security work. More than 40 additional organizations that build or maintain critical software infrastructure also received access. Anthropic says the model can find and exploit software weaknesses on par with the best human security researchers. When tested, Mythos Preview uncovered thousands of previously unknown vulnerabilities in popular operating systems and browsers. For example, it found a 27-year-old bug in OpenBSD and an FFmpeg flaw that automated tools had missed in five million earlier checks. Anthropic pointed out that Mythos Preview did not get any special security training. Its ability to find vulnerabilities comes from general improvements in code understanding and logical reasoning, not from targeted preparation. This has both benefits and risks, because the same skills that help it fix flaws could also let it exploit them. Claude Mythos Preview first surfaced publicly after internal draft materials were left
Apr 9, 2026 · via qz.com
Russian state hackers are hijacking TP-Link and MicroTik routers to steal Outlook credentials, cybersecurity center warns — APT28 group targets DNS and redirects traffic to attacker-controlled servers Traffic is being redirected through attacker-controlled servers. Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. You are now subscribed Your newsletter sign-up was successful The UK National Cyber Security Centre (NCSC) on Tuesday published an advisory warning that Russian state hacking group APT28 has been exploiting vulnerable small office and home office (SOHO) routers since 2024 to overwrite their DHCP and DNS settings, redirecting downstream traffic through attacker-controlled DNS servers to harvest passwords and authentication tokens for web and email services. The NCSC assesses that APT28 is "almost certainly" the Russian Main Intelligence Directorate (GRU)'s 85th Main Special Service Centre, Military Intelligence Unit 26165. According to the advisory, the actor has been configuring virtual private servers to act as malicious DNS resolvers, then pointing compromised SOHO routers at them by rewriting the routers' DHCP DNS settings. Laptops, phones, and other downstream devices on the network inherit those settings automatically and begin sending lookups to the attacker-controlled infrastructure. Lookups for domains tied to targeted services, such as login pages, get pointed to further attacker-owned IPs that host adversary-in-the-middle infrastructure. Meanwhile, requests outside the targeting criteria are resolved to the legitimate addresses to avoid breaking the connection. Article continues belowOnce a victim connects through the attacker's infrastructure, APT28 attempts to capture passwords and OAuth or similar authentication tokens from both browser sessions and desktop applications. Targeted domains listed in the advisory include autodiscover-s.outlook.com, imap-mail.outlook.com, outlook.live.com, outlook.office.com, and outlook.office365.com. The TP-Link WR841N router is named by the NCSC as one of the models APT28 has been exploiting, likely using CVE-2023-50224, an unauthenticated information disclosure flaw that allows an attacker to retrieve credentials
Apr 9, 2026 · via tomshardware.com
The Indian Health Service (IHS) is turning to artificial intelligence (AI) to support both its healthcare and cybersecurity operations, including integrating AI-powered transcription into patient care as it rolls out a new electronic health record (EHR) system. Speaking at the Splunk GovSummit in Washington, IHS Chief Information Security Officer (CISO) Benjamin Koshy said AI-driven transcription capabilities will improve clinician-patient interactions. “Normally, when you go to a doctor’s office, and you’re talking to the physician, they sometimes sit facing a computer” to take notes, Koshy said on Wednesday. Now, IHS is working toward an environment where, with the patient’s consent, the interaction can be recorded on a government-approved device. This allows the doctor to give the patient their full attention, Koshy explained. “It makes the patient interaction a lot easier. You get to make eye contact with the physician and have a meaningful conversation without them having to look left and right and having to type,” Koshy said. Importantly, Koshy stressed that clinicians will remain fully accountable for the final record. “We remind the patient, just because the AI wrote it, we’re not going to blindly accept it. At the end of the day, the doctor looks at it and reads it, hits the accept button, and [their] name is attached to the note,” he said. Alongside clinical applications, IHS is exploring AI to bolster cybersecurity operations. Koshy framed security as inseparable from healthcare delivery, particularly as digital systems become more central to patient care. “From a security standpoint, we want to have a widespread understanding that for IHS, cybersecurity is patient safety,” he said. “You can’t have one without the other, especially in the healthcare environment.” To support that posture, Koshy said the agency is looking to leverage AI tools to automate labor-intensive cybersecurity tasks such as log analysis. Automating
Apr 9, 2026 · via meritalk.com
Cybersecurity stocks have been under pressure in recent weeks. Will AI create the world's first trillionaire? Our team just released a report on the one little-known company, called an "Indispensable Monopoly" providing the critical technology Nvidia and Intel both need. Continue » *Stock prices used were the afternoon prices of April 4, 2026. The video was published on April 8, 2026. Should you buy stock in Fortinet right now? Before you buy stock in Fortinet, consider this: The Motley Fool Stock Advisor analyst team just identified what they believe are the 10 best stocks for investors to buy now… and Fortinet wasn’t one of them. The 10 stocks that made the cut could produce monster returns in the coming years. Consider when Netflix made this list on December 17, 2004... if you invested $1,000 at the time of our recommendation, you’d have $532,929!* Or when Nvidia made this list on April 15, 2005... if you invested $1,000 at the time of our recommendation, you’d have $1,091,848!* Now, it’s worth noting Stock Advisor’s total average return is 928% — a market-crushing outperformance compared to 186% for the S&P 500. Don't miss the latest top 10 list, available with Stock Advisor, and join an investing community built by individual investors for individual investors. *Stock Advisor returns as of April 8, 2026. Parkev Tatevosian, CFA has no position in any of the stocks mentioned. The Motley Fool has positions in and recommends Fortinet. The Motley Fool has a disclosure policy. Parkev Tatevosian is an affiliate of The Motley Fool and may be compensated for promoting its services. If you choose to subscribe through his link, he will earn some extra money that supports his channel. His opinions remain his own and are unaffected by The Motley Fool.
Apr 9, 2026 · via theglobeandmail.com
Anthropic on Tuesday said its yet-to-be-released artificial intelligence model called Claude Mythos has proven keenly adept at exposing software weaknesses. Mythos has laid bare thousands of vulnerabilities in commonly used applications for which no patch or fix exists, prompting the San Francisco-based AI startup to form an alliance with cybersecurity specialists to bolster defenses against hacking and withhold wide distribution. “We have a new model that we’re explicitly not releasing to the public,” Mike Krieger of Anthropic Labs said at a HumanX AI conference in San Francisco. Instead, Anthropic is letting cybersecurity specialists and engineers in the open-source community work with Mythos to use the model as a defensive weapon “sort of arming them ahead of time”, Krieger explained. Leaps in AI model capabilities have come with concerns about hackers using such tools for figuring out passwords or cracking encryption meant to keep data safe. The oldest of the vulnerabilities uncovered by Mythos dates back 27 years, and none were ostensibly noticed by their makers before being pinpointed by the AI model, according to Anthropic. Mythos is the latest generation of Anthropic’s Claude family of AI, and a recent leak of some of its code prompted the startup to release a blog post warning it posed unprecedented cybersecurity risks. “AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities,” Anthropic said in a blog post. “The fallout – for economies, public safety, and national security – could be severe.” Software vulnerabilities exposed by Mythos were often subtle and difficult to detect without AI, according to Anthropic. As an example, it said Mythos found a previously unnoticed flaw in video software that had been tested more than 5m times by its creators. As a precaution, Anthropic
Apr 9, 2026 · via theguardian.com
Advancements in artificial intelligence could help bad actors influence political discourse ahead of the midterm elections, a former North Carolina cybersecurity official warns. Improvements in AI technology are making it easier for people to create accounts on social media that are controlled by bots, says Torry Crass, a cybersecurity analyst who previously worked for North Carolina’s Department of Information Technology and state Board of Elections. Those bots post about controversial political subjects in hopes of influencing North Carolina voters, Crass said Wednesday during a virtual presentation on the issue. Other WRAL Top Stories “There is really a kind of transformation that has taken place in the last couple of years related to bots, as well as it pertaining to mis-and-disinformation,” Crass said during the event, hosted by the Catawba College Center for North Carolina Politics and Public Service. “As we get closer to the election, I would expect to see the generated AI content go significantly higher than what it is today,” he said. The November elections will determine who controls Congress, state legislatures and more. North Carolina’s U.S. Senate race between Democrat Roy Cooper and Republican Michael Whatley is expected to be among the tightest in the nation. Federal laws don’t prohibit the use of AI to create misleading audio or video in political ads. And AI-use by political groups has increased in recent years. People have used AI in subtle ways, such as to generate video of military jets flying over a candidate’s campaign events. People have also used it to impersonate a candidate’s image or voice. People have also created social media accounts with the sole purpose of generating outrage that influences a voter’s opinion of a certain candidate or political party. In previous elections, Crass said, bot-controlled social media accounts featured flaws that were easy to
Apr 8, 2026 · via wral.com
Cybersecurity researchers have flagged a new variant ofmalware called Chaosthat'scapable of hitting misconfigured cloud deployments, marking an expansion of the botnet's targeting infrastructure. "Chaos malware is increasingly targeting misconfigured cloud deployments, expanding beyond its traditional focus on routers and edge devices," Darktrace said in a new report. Chaos was first documented by Lumen Black Lotus Labs in September 2022, describing it as a cross-platform malware capable of targeting Windows and Linux environments to run remote shell commands, drop additional modules, propagate to other hosts by brute-forcing SSH keys, mine cryptocurrency, and launch distributed denial-of-service (DDoS) attacks via HTTP, TLS, TCP, UDP, and WebSocket. The malware is assessed to be an evolution of another DDoS malware known as Kaiji that has singled out misconfigured Docker instances.It's currently not known who is behind the operation, but the presence of Chinese language characters and the use of China-based infrastructure suggest that the threat actor could be of Chinese origin. Darktrace said it identified the new variant targeting its honeypot network last month, a deliberately misconfigured Hadoop instance that enables remote code execution on the service. In the attack spotted by the cybersecurity company, the intrusion commenced with an HTTP request to the Hadoop deployment to create a new application. The application, for its part, embedded a sequence of shell commands to retrieve a Chaos agent binary from an attacker-controlled server ("pan.tenire[.]com"), set permissions to allow all users to read, modify, or run it ("chmod 777"), and then actually execute the binary and delete the artifact from disk to minimize the forensic trail. An interesting aspect of the attack is that the domain was previously put to use in connection with an email phishing campaign carried out by the Chinese cybercrime group Silver Fox to deliver decoy documents and ValleyRAT malware. The campaign was
Apr 8, 2026 · via thehackernews.com
Alabaster, Ala.-based Heart South Cardiovascular Group has provided notice of a data security incident.
In November 2025, Heart South was informed that an unauthorized party claimed to have accessed and possessed Heart South data. A forensic investigation did not find any evidence of unauthorized access or data theft, but the unauthorized party recently posted limited Heart South information on the dark web, according to a recent notice from Heart South.
Information that may have been impacted includes full names, Social Security numbers, dates of birth, treatments, procedures, diagnoses, medications and health insurance information.
At this point, Heart South does not have any evidence that any personal information has been used for identity theft as a direct result of the incident, the notice said.
Heart South has locations in Alabaster, Clanton and Centreville, Ala.
At the Becker's 23rd Annual Spine, Orthopedic and Pain Management-Driven ASC + The Future of Spine Conference, taking place June 11-13 in Chicago, spine surgeons, orthopedic leaders and ASC executives will come together to explore minimally invasive techniques, ASC growth strategies and innovations shaping the future of outpatient spine care. Apply for complimentary registration now.
Apr 8, 2026 · via beckersasc.com
In this article, we will list the 5 Best Performing Cybersecurity Stocks in 2025. Please visit 12 Best Performing Cybersecurity Stocks in 2025 if you would like to see the extended list and the methodology behind it. 5. Akamai Technologies Inc (NASDAQ:AKAM) Number of Hedge Fund Holders: 47 Past Year Performance: 49.78% Akamai Technologies Inc (NASDAQ:AKAM) is among the best performing cybersecurity stocks in 2025. On March 25, Akamai Technologies Inc (NASDAQ:AKAM) announced the launch of an AI-powered tool designed to help companies combat brand fraud. According to Akamai, generative AI allows scammers to create sophisticated fake websites and other digital identities more easily. In this condition, businesses using manual discovery methods to protect their brands can’t keep pace with the threats. Akamai says its AI-driven monitoring tool, called Brand Guardian, is the solution that businesses need now to safeguard their brands. According to the company, Brand Guardian scans the internet and automatically detects and removes fraudulent or copycat websites and digital identities. This tool has 99.99% automated takedown accuracy. Fraudulent sites pose various threats to brands, including revenue loss and damaged customer relationships. Akamai targeted businesses in sectors like financial services, retail, and healthcare with its AI-powered brand protection solution. On March 17, KeyBanc reaffirmed its Overweight rating on Akamai Technologies Inc (NASDAQ:AKAM) stock with a price target of $120. For this renewed bullish stance, the firm pointed to the company’s GPU opportunity. According to KeyBanc, the addition of GPU infrastructure could expand Akamai’s growth rate from mid-single digits level to double digits. KeyBanc sees a multi-billion dollar business opportunity for Akamai in the GPU infrastructure space. In 2025, Akamai’s Cloud Infrastructure services business saw a 36% jump in revenue to $314 million. The core Security business saw revenue rise 10% to $2.24 billion. Akamai Technologies Inc (NASDAQ:AKAM) is
Apr 8, 2026 · via insidermonkey.com
WASHINGTON (AP) — Hackers backing Tehran say an uncertain ceasefire between Iran and the United States and Israel won't end their retaliatory cyberattacks, a warning that American cybersecurity experts say potential targets in the U.S. and Israel should take seriously. One leading hacking group known as Handala said after the ceasefire announcement that it was temporarily postponing attacks on the U.S. but would continue to target Israel. It vowed to revive its efforts against America when the time was right — demonstrating again how digital warfare has become ingrained in military conflict. Already, the two-week ceasefire appears at risk of fraying over significant disagreements between the parties, which each are claiming victory in the war. A pro-Palestinian, pro-Iranian network that operates independently of Tehran, Handala has claimed credit for disrupting the operations of the U.S. medical manufacturer Stryker and hacking into FBI Director Kash Patel's personal email account, among other cyberattacks. The group is just one of several proxy hacking networks allied with Iran. "We did not begin this war, but we will be the ones to finish it," Handala wrote on its X account. "And let it be clear: The cyber war did not begin with the military conflict, and it will not end with any military ceasefire." READ MORE: Ceasefire is threatened as Israel expands Lebanon strikes and Iran closes strait again U.S. authorities warned on Tuesday that hackers supporting Iran had burrowed into internet-connected computers used to automate and control technology in a variety of important industrial sectors. The computers, known as programmable logic controllers, are used in ports, power plants and water plants — key targets for foreign hackers looking to disrupt everyday life in the U.S. In a joint advisory from the FBI, National Security Agency and Cybersecurity and Infrastructure Security Agency, officials urged organizations
Apr 8, 2026 · via pbs.org
Tharros has secured a task order to support the U.S. Navy Operational Test and Evaluation Force’s cybersecurity division under the SeaPort Next Generation contract vehicle. Want to learn more about the challenges that the Department of War and its components are facing in the cyber domain? Join the Potomac Officers Club’s 2026 Cyber Summit on May 21. The event will feature speakers from the Pentagon, including DOW cyber policy leader Katherine Sutton, to discuss ongoing initiatives and future opportunities for industry to help strengthen the nation’s cyber defenses. Industry leaders will also be present to explore new cyber capabilities and to forge new partnerships that advance U.S. priorities. Get your tickets today. What Services Will Tharros Provide the Navy? The company said that it will deploy red team operators, analysts and engineers to OPTEVFOR to conduct penetration testing and exploitation analysis across operational environments, cyber ranges and cloud-based systems. The team will simulate real-world adversary tactics to identify vulnerabilities and strengthen mission systems against threats prior to deployment. “This partnership with OPTEVFOR represents an important milestone as we continue expanding our impact across the defense community,” Lonnie Parker, CEO of Tharros, stated. “Our focus is delivering operationally relevant cybersecurity testing that strengthens mission resilience and helps ensure Navy systems remain secure against evolving threats.” The task order was issued through SeaPort-NxG, a contract vehicle launched in 2018 to enable the Navy to procure engineering and technical services across multiple functional areas, including systems engineering, software development and information technology support. Work on the task order will be performed for up to five years if all options are exercised. What Is Tharros? Tharros provides cybersecurity services and vulnerability research to federal agencies. The company combines cyber research, development, and test and evaluation with operational expertise to support mission-critical systems Formerly known
Apr 8, 2026 · via executivebiz.com
Chugach Government Solutions has achieved Level 2 Cybersecurity Maturity Model Certification. The Anchorage, Alaska-based company said the certification followed an assessment conducted by a certified third-party assessment organization and confirms compliance with National Institute of Standards and Technology Special Publication 800-171 Revision 2 requirements. The designation validates CGS’ ability to safeguard controlled unclassified information and maintain a strong enterprise cybersecurity posture. “We take seriously the trust our government partners place in us,” stated Laine Klein, president of CGS. She added that the company will continue to “innovate, invest and lead with integrity” to support government missions. DOW leaders will discuss cybersecurity challenges and requirements as the deadline to fully implement zero trust across all systems draws closer at the Potomac Officers Club’s 2026 Cyber Summit on May 21. Katherine Sutton, the Pentagon’s assistant secretary for cyber policy, and other defense officials are already confirmed to speak at the event. Sign up today to secure your spot. What Does CMMC Level 2 Certification Mean for CGS? CGS said the achievement strengthens its position as a trusted partner to federal customers and enhances its ability to compete for contracts requiring higher cybersecurity standards. The Department of War has identified cybersecurity as a top priority as the defense industrial base faces increasingly frequent and complex cyberattacks. CMMC was developed to assess contractor compliance with requirements for protecting federal contract information and controlled unclassified information. “Cybersecurity is not a checkbox for us — It’s an operational imperative,” Tom Langdon, senior director of digital solutions at CGS, commented. “This certification underscores our commitment to maintaining a secure digital foundation so our defense customers can execute their missions with confidence.” What Services Does Chugach Government Solutions Provide? CGS delivers a range of technical, facilities and mission support services to federal customers, including the U.S. Coast Guard,
Apr 8, 2026 · via executivebiz.com
The FBI and the Cybersecurity and Infrastructure Security Agency in a joint advisory released Tuesday warned that Iran-linked threat actors have exploited internet-facing devices at U.S. critical infrastructure sites, including water, energy and municipal locations. The hackers have targeted programmable logic controllers (PLCs) made by Rockwell Automation/Allen-Bradley, in attacks involving malicious interactions with project files. The attacks led to data manipulation on both the human machine interface and supervisory control and data acquisition displays, according to the advisory. The agencies did not specify the number or specific locations of the attacks, but noted the incidents resulted in financial losses and operational disruption, the advisory stated. The Environmental Protection Agency, Department of Energy, National Security Agency and U.S. Cyber Command also participated in the advisory, which urged security teams to enable multifactor authentication, remove devices from the public internet and check logs for suspicious activity, as well as place physical-mode switches on Rockwell devices to the “run” position. Rockwell Automation authentication bypass vulnerability At the center of the campaign is an authentication bypass vulnerability in Rockwell Automation’s Logix controllers. Rockwell Automation in March updated an advisory on the flaw (CVE-2021-22681) in its Studio 5000 Logix Designer software that could allow a cryptographic key to be found and let a non-Rockwell application connect with Logix controllers. The company at the time also issued an advisory reminding customers to disconnect devices from the open internet and harden security on their PLC environments. The Rockwell guidance was specifically referenced in the federal advisory Monday. The company “takes seriously the security of its products and solutions and has been closely coordinating with government agencies,” a spokesperson told Cybersecurity Dive. More than 3,000 Rockwell devices remain visible on the public internet, either because organizations are not aware they are exposed or they underestimate the risk, Markus
Apr 8, 2026 · via cybersecuritydive.com