Vendor Risk

PwC has confirmed a cybersecurity incident at a third-party vendor that hosts its employee learning records, after the Everest extortion group listed PwC and claimed ~590.69 GB of data. What PwC actually confirmed, what Everest claims (still unverified), and the third-party / LMS lessons for security leaders.

A plain-English explainer on SOC 1 vs SOC 2: what each report covers (financial-reporting controls versus the Trust Services Criteria), Type I vs Type II, who needs which, and how SOC 3 fits in. General information, not legal advice.

A plain-English explainer on subprocessors: the GDPR controller-processor-subprocessor chain, fourth-party risk, subprocessor lists, flow-down obligations, and how third-party risk management programs handle the vendors behind your vendors. General information, not legal advice.

A practical vendor security assessment checklist: the areas to review before onboarding a third party, the evidence to ask for, and how to rank vendors by risk instead of treating them all the same.

Security questionnaires are the backbone of third-party risk management — when they are focused. What to include, how to avoid questionnaire fatigue, and how to turn answers into decisions.

Federal prosecutors arrested Oxygen Forensics CEO Lee Reiber and Russian national Oleg Davydov, alleging the Virginia-based digital-forensics vendor concealed Russian ownership and Russian-developed software while selling to the Secret Service, HSI, DHS OIG and other agencies. What the complaint alleges, what it explicitly does not, and what it means for vendor-risk programs everywhere.

A ranked table of 12 major enterprise infrastructure vendors by CVSS 10.0 vulnerability count and confirmed exploitability through September 2026, with Cisco's record advisory cluster and board-ready framing for CISOs.

How AI supercharges surveillance and profiling, the privacy and security risks it creates, and the governance safeguards a CISO or DPO can put in place.