Risk on Andrew Healey

Your vendors’ weaknesses are yours

Sun, 25 Oct 2026 09:08:12 -0500

Your vendors’ weaknesses are yours. That systems integrator still keeping secrets next to your vpn instructions in client-passwords.xlsx is your risk. The new flashy AI manufacturing partner cutting corners to ship and onboard your company onto their platform, dropping their systems in your facility with “military grade security” but a backdoor with admin/admin is your risk.

Their gaps, shortcuts, and weak processes become the standard in your environment and your contracts whether you want them to be or not.

Outside regulated industries like defense, cybersecurity has always been pushing rope

Sat, 19 Sep 2026 07:58:48 -0500

Outside regulated industries like defense, cybersecurity has always been pushing rope. Around 2013, with the rise of CryptoLocker, ransomware began to change that. Once CEOs started hearing about peers who couldn’t ship product, make payroll, or get paid, budgets finally moved. That’s why the pitch is now regulatory capture and scary AI agent hackers. Fear sells.

The tools are powerful and the velocity is shocking. The controls, however, remain largely traditional. They require strategy, discipline, and meaningful investment in more than just tools. How robust those controls actually become will keep separating well-run organizations from reactive ones.

This week is the anniversary of a boring sounding document that rewrote the map of American infrastructure

Sun, 17 May 2026 11:26:19 -0500

This week is the anniversary of a boring sounding document that rewrote the map of American infrastructure. On May 19, 1857, a chemist named Lammot du Pont was granted U.S. Patent No. 17,321 for an “Improvement in Gunpowder.”

Before that patent, the American industrial machine had a single point of failure. Gunpowder needed potassium nitrate, and the global supply was controlled by the British Empire, sourced from India. Want to blast a tunnel through a mountain or mine the coal that fed your factory? You were at the mercy of a foreign supply chain and whatever geopolitical wind was blowing that month.

"I'm smart enough not to get hacked"

Tue, 30 Dec 2025 04:35:21 -0600

Oftentimes your high-ego, “I’m smart enough not to get hacked” techies are more dangerous than Randall over in Sales. They see a shiny new “PoC exploit” for a spicy CVE on GitHub and think, “I got this. I’ll just test it real quick on my machine.

Well, that’s exactly how the WebRAT malware is spreading right now. Threat actors are spinning up convincing GitHub repos that mimic proof-of-concept exploits for recently disclosed vulnerabilities (high CVSS stuff like Windows RasMan flaws). The repos look legit: AI-generated descriptions, mitigation details, code snippets, etc.

62 malicious Chrome extensions

Fri, 31 Jan 2025 22:30:20 -0600

62 malicious Chrome extensions have found ways around Google’s ban on remote code execution. They’re linked to Phoenix Invicta, Technosense Media, and notably, Sweet VPN. These extensions inject ads and could compromise user data.

Phoenix Invicta, once known as Funteq Inc., has a convoluted corporate setup, with ties to the US, Hong Kong, and operations in Ukraine. They use techniques like manipulating the declarativeNetRequest API to execute remote code, despite Google’s restrictions.

The Biden administration orders a Software Bill of Materials (SBOM)

Mon, 24 May 2021 20:11:18 -0600

The Biden administration is making a Software Bill of Materials (SBOM), an electronically readable format designed to provide an inventory of third-party components in devices, a requirement amid efforts to improve cybersecurity across the federal government and private sector.

https://www.medtechdive.com/news/biden-orders-software-bill-of-materials-to-boost-cybersecurity-advamed-wan/600594/