BankInfoSecurity.com

How Consolidation Is Forcing CISOs and CIOs to Rethink Security Architecture
For more than a decade, enterprise security has relied on point solutions. Companies invested in separate tools - endpoint detection, firewalls, cloud security and IAM - each designed to address a specific threat or compliance requirement. But that approach is starting to break down.

Booz Allen Loses Treasury Work in Move Tied to Trump Waste Crackdown
The U.S. Department of Treasury said it canceled all active contracts with Booz Allen Hamilton, citing data protection failures in handling taxpayer information. Treasury cited a criminal case against Charles Littlejohn, a former employee who leaked the tax returns of President Donald Trump.

Claroty CEO Yaniv Vardi Outlines IPO Strategy and Growth Through Acquisition
Claroty’s $150 million Series F funding round will help scale its platform for protecting critical infrastructure with embedded AI. CEO Yaniv Vardi says the company aims to reach profitability, pursue M&A and strengthen verticalized offerings for the healthcare, manufacturing and industrial spaces.

Series B Round at $1.5B Valuation Backs Push Into AI, Application and Data Security
Cloud security startup Upwind has raised $250 million to expand its CNAPP capabilities beyond detection and response. The company aims to accelerate engineering investment and move into high-demand categories such as AI and data security, achieving a $1.5 billion valuation.

Nearly 60% of Tech Students Said They'd Violate HIPAA If the Price Was Right
Budding IT insiders can be corrupted into giving up protected health information of a very famous patient, say State University of New York at Buffalo researchers who also found a correlation between an interest in white hat hacking and illegal breaches.

Also: How Non-Human Identities Redefine Security; the Delinea-StrongDM Deal
In this week's panel, four editors discussed how deepfakes are reshaping digital Know Your Customer practices, what the rise of non-human identities means for CISOs and what Delinea's acquisition of StrongDM tells us about where the privileged access market is heading.

FBI Accessed Encrypted Windows Devices Via BitLocker Keys, Microsoft Says
Microsoft confirmed it handed over BitLocker recovery keys to the FBI in 2025 under court order, raising concerns over cloud-stored encryption keys and whether default designs that prioritize recovery convenience and efficiency weaken user control and security.

Partnership With Israeli Startup Brings Real-World Threat Labs to Security Training
ISMG has teamed with CyCube to strengthen CyberEd.io's hands-on cyber training platform. The strategic investment aims to deliver personalized, adaptive labs and assessments that help security teams respond to evolving threats fueled by generative and agentic AI.

'WhisperPair' Flaw Likely to Endure for Years
A hacker could secretly record phone conversations, track users' locations and blast music through headphones due to a flaw in implementations of a Google-developed low-energy technology for discovering nearby Bluetooth devices.

Feds Warn US May Lose Quantum Race Without Sustained Research Funding
Federal scientists told Congress that failure to reauthorize the National Quantum Initiative threatens to unravel coordinated research and development progress, stall commercialization and allow China to surpass U.S. leadership as adversaries accelerate post-quantum capabilities.

Also, CIRO Phishing Breach, Ingram Micro Ransomware and CVE Surge
This week, DOGE posted sensitive data on an outside server. A phishing attack affected 750,000 Canadians. A hacktivism warning from the U.K. NCSC. An Ingram Micro breach. CVEs surged in 2025. SK Telecom challenged a fine. Researchers disclosed Chainlit flaws. North Korean hackers abused VS Code.

OIG: Gaps in Standards, Third-Party Oversight Put Agencies, Health Sector at Risk
Auditors say the U.S. Department of Health and Human Services should buttress its ability to respond to cyberthreats by standardizing governance and controls across its many divisions - and also do a better job of overseeing its many contractors and the risk they introduce.

Vendor Ships Emergency Fixes, Warning Flaw Facilitates Full System Compromise
Attackers are targeting a zero-day vulnerability in Cisco's Unified Communications and Webex products that facilitates remote code execution and root-level access to the underlying operating system, risking full system compromise. Cisco has released patches, warning that no workarounds exist.