Cybersecurity protects your systems. Cybersecurity risk management protects your business.®
Client PortalRemote SupportToll Free: +1 (800) 835-2302Regional: +1 (916) 333-1062
Schedule a Call

The Information Highway

The Information Highway

Red-Alert-in-the-Server-Roo_20261103-032438_1

When a Hospital Goes Dark: What the UNM Health Ransomware Attack Teaches Every SMB About Cyber Risk and Compliance

Cybersecurity Risk Compliance News

When a single ransomware attack can cancel surgeries, divert ambulances, and cancel classes within hours, "we're too small to be a target" stops being a credible security strategy for any organization including yours.

Continue reading
img-ai-accountability

"The AI Did It" Is Not a Defense: What the OpenAI Lawsuit Means for Businesses Using AI Agents

News Artificial Intelligence (AI)
AI agents are quickly moving from experiment to everyday business tool, and a new lawsuit is a timely reminder that when an AI agent causes harm, someone is still responsible. On September 29, 2026, the nonprofit Legal Advocates for Safe Science and Technology (LASST) sued OpenAI in California, seeking to hold the company accountable for the actions of its AI agents, including their role in the July 2026 breach of Hugging Face. At the center of the case is a California law that took effect this year and says, in effect, that "the AI did it" is not a legal defense.
Continue reading
Spectra-Certified-Asset-29-Colour-300ppi

LBT Technology Group Is Now SPECTRA Certified: What It Means for You

Compliance News

We have some good news to share: as of Wednesday, September 30, 2026, LBT Technology Group, LLC is officially SPECTRA Certified.

If you've never heard of SPECTRA, you're not alone. Most business owners don't spend their days thinking about IT certifications, and they shouldn't have to. That's our job. But this one is worth a few minutes of your time, because it affects how well your business is protected, and it may even lower what you pay for cyber insurance.

In this post, we'll explain what SPECTRA Certification is, what we had to prove to earn it, and what it means for you, whether you're already a client or you're looking for an IT partner.

Continue reading
broken-chain-link-backup-recovery

Your Backups Might Not Save You: What a New Ransomware Recovery Study Means for Small and Mid-Sized Businesses

Business Continuity & Disaster Recovery News
A new field study of 800+ real-world ransomware recoveries found that only four organizations hit their 24-48 hour recovery target — and the reason usually wasn't missing backups, it was an untested, incomplete recovery plan.
Continue reading
Cybersecurity-for-Small-Busines_20260920-225557_1

The First AI-Agent Data Breach Is Here: What Spain's Regulator Just Told Every Small Business

News Artificial Intelligence (AI)
A European regulator has confirmed that autonomous AI agents are now breaking into real company systems, and its advice is a checklist any small or mid-sized business can start on this week.
Continue reading
business-continuity-disaster-recovery

Business Continuity and Disaster Recovery: Could Your Business Keep Running Tomorrow?

Business Continuity & Disaster Recovery
Data BackupBackups aren't the whole recovery plan. Learn how business continuity and disaster recovery help protect your operations when technology fails.
Continue reading
cmmc-level2-certification

CMMC Audits Are Paused: Here's Why Your Compliance Risk Just Went Up, Not Down

Compliance News
The Pentagon just paused third-party CMMC audits and made it permanent policy, but a $507,000 settlement from June shows that "paused" doesn't mean "off the hook," and the lesson applies well beyond defense contracting.
Continue reading
SOC

CIRCIA Is Almost Here

Compliance News
After more than four years of waiting, the federal government's most far-reaching cybersecurity reporting law is finally close to taking real, enforceable shape. The Cybersecurity and Infrastructure Security Agency (CISA) has told stakeholders it intends to publish the long-delayed final rule for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) in September 2026 — and once that happens, the clock starts ticking toward mandatory reporting for hundreds of thousands of U.S. businesses.
Continue reading
AI_cyber_attack_Main

AI Coding Tools Got Hacked Into Hacking: What It Means for Your Business

News Artificial Intelligence (AI)
Hackers didn't need to write new malware, they just told a trusted AI coding assistant it was "running a test," and it happily helped them break into ten companies. If a $9-billion AI tool can be talked into attacking its own users, what's stopping the AI plugins already running inside your business?
Continue reading
AI-phishingv2

AI Phishing Attacks Are Changing Fast: What Businesses Need to Know in 2026

Cybersecurity Risk News Artificial Intelligence (AI)

AI phishing attacks are making familiar cyber scams faster, more convincing, and harder for employees to recognize. Recent 2026 threat intelligence shows attackers expanding beyond email into Microsoft Teams, voice calls, trusted cloud services, and highly personalized messages. For businesses, protecting Microsoft 365 identities and training employees to verify unusual requests has become increasingly important.

Continue reading

Critical Cisco SD-WAN Flaw Under Active Attack: What Business Owners Need to Do Now

img-cisco-sdwan
Cisco has confirmed that attackers are actively exploiting a critical vulnerability in the software many businesses use to connect their offices together. The flaw, tracked as CVE-2026-76504 and rated 9.8 out of 10 on the CVSS severity scale, affects Cisco Catalyst SD-WAN Manager. It lets a remote attacker slip past a login check and gain administrator-level access to a protected management API. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has already added it to its Known Exploited Vulnerabilities (KEV) catalog and gave federal agencies until October 3, 2026 to fix it.
Continue reading
0
  785 Hits

An AI Agent Hacked a Security Nonprofit Through Its Helpdesk: Lessons from the DIVD Breach

img-zammad
A cybersecurity nonprofit whose entire mission is warning others about vulnerabilities has itself been breached, and it believes an AI agent did the hacking. On September 24, 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) announced that attackers had broken into its systems. Over the following week, DIVD revealed that the attacker exploited two previously unknown vulnerabilities in Zammad, a popular open-source helpdesk and ticketing system, and stole volunteer data. Zammad has not yet released official patches.
Continue reading
0
  647 Hits

Critical Citrix NetScaler Zero-Days Are Under Active Attack: What Your Business Needs to Do This Week

server-room-closeup-critical-error

A pair of critical, unauthenticated zero-day vulnerabilities in Citrix NetScaler are being actively exploited right now and with roughly 23,000 internet-exposed devices worldwide, this is a "patch today, not next sprint" moment that shows exactly why continuous vulnerability management can't be a once-a-quarter checkbox for any growing business.

Continue reading
0
  698 Hits

Cybersecurity Threat Advisory: WordPress "Click2Shell" Flaw Turns One Admin Click into Full Site Takeover

Threat-Advisory-Banner3

Threat update

A newly disclosed vulnerability in WordPress Core, nicknamed Click2Shell, allows an attacker to take control of a WordPress website if a logged-in administrator simply opens a specially crafted link. No further clicks, prompts, or approvals are needed. WordPress fixed the issue in version 7.1.1 and backported the fix to every supported branch back to 4.7. Because proof-of-concept code is now public, any organization running WordPress should confirm its sites are updated today.

Continue reading
0
  589 Hits

Cybersecurity Threat Advisory: ZcopyReaper Linux Kernel Flaw Gives Local Users Root Access, and Exploit Code Is Public

Threat-Advisory-Banner3

Threat update

A newly detailed Linux kernel vulnerability, tracked as CVE-2026-43502 and nicknamed ZcopyReaper, allows an unprivileged local user to escalate to full root control by abusing a memory-handling error in the kernel's Reliable Datagram Sockets (RDS) component. The flaw has existed since Linux kernel 4.17, working exploit code has been published, and patched kernels are available from major distributions. Organizations running Linux servers, cloud workloads, or Linux-based appliances should confirm patch status now. 

Continue reading
0
  654 Hits

Top Breaches Cost ($) of 2024

HEALTHCARE
FINANCIAL
INDUSTRIAL
TECHNOLOGY
ENERGY
Source: IBM Cost of a Data Breach Report 2024