Late September, Citrix disclosed two critical vulnerabilities in NetScaler ADC and NetScaler Gateway, both scoring 9.5 on CVSS. One let an unauthenticated attacker run arbitrary commands on a default configuration, no special setup required. The other bypassed authentication and handed attackers root access. Both were exploited as zero-days, before any patch existed, and tens of thousands of internet-facing appliances were exposed when the fixes shipped. CISA gave federal agencies three days to remediate. By now… Read more: The NetScaler Zero-Day Was a Patch Story. The Real Failure Was Governance.

We flagged this convergence back in July’s midyear review post. Q4 is when three things happen at once: the threat environment elevates, organizational attention and headcount contract for the holidays, and year-end compliance deadlines compete for the same stretched resources. The 2026 midterms land November 4, eight days after this post publishes, and Black Friday follows three and a half weeks after that. This is the year those two elevated-risk periods sit closer together than… Read more: Q4 Threat Convergence: Election Aftermath Meets Holiday Season

Private equity deal volume has been climbing, and a growing share of that activity runs through take-private transactions, roll-ups, and portfolio company add-ons where cybersecurity posture is no longer a due diligence afterthought. It’s a line item that can move valuation. If you work in GRC and haven’t been through an acquisition yet, it’s worth understanding what actually happens, because the process looks nothing like a SOC 2 audit and nothing like a typical vendor… Read more: What Cybersecurity Due Diligence Actually Looks Like in an M&A Deal

October is Cybersecurity Awareness Month. CISA’s 2026 theme is “Securing the Next 250,” tying the campaign to the country’s semiquincentennial and framing national cyber resilience as part of the broader infrastructure conversation. Most organizations will run their annual push this month: phishing simulations, an all-hands presentation, maybe a poster campaign. That’s useful, and it should happen. But Awareness Month content is written for employees, not for boards. The governance version of this conversation is different,… Read more: Cybersecurity Awareness Month: What Boards Should Actually Be Asking

The Cybersecurity Information Sharing Act of 2015 was supposed to expire September 30. Again. This is now the fourth time in thirteen months that this law has approached its sunset date, and the fourth time Congress has resolved it with a short-term patch rather than a durable fix and this time extending the law through December as part of a broader continuing resolution. If you’re tracking this closely, you already know the history. If you’re… Read more: Congress Kicked the Can Again on CISA 2015 & Here’s Why the Pattern Itself Is the Risk