The public details of the Educational Testing Service (ETS) breach are brief. According to the California Department of Education (CDE), an unauthorized party used a compromised login credential to access an ETS-operated SFTP site that carried statewide assessment data to and from the department. Files were copied at various times between May 22 and September 18, 2026, and ETS identified the activity on September 25. The files covered millions of current and former California

“We don't have time for a tabletop exercise right now” is the most common objection we hear — usually from teams that assume it means a multi-day simulated outage. It doesn't. Here’s what actually happens, start to finish. Before the room: two to three weeks of setup A tabletop exercise starts well before anyone sits down. The consulting team reviews your existing incident response (IR) plan, network diagram, backup architecture, and any prior incident history. From that, the

Every IT leader we talk to during Cybersecurity Awareness Month can point to a document. It has a title page, a revision date, a distribution list, and a set of steps to follow if ransomware hits. What most of them can't point to is the last time anyone ran through it. That gap is the difference between a plan and a defense. A plan is a claim until someone tests it An incident response (IR) plan describes what your organization believes it will do during a ransomware event: w

Ask a compliance leader what changed this year, and you’ll usually get a list of new requirements. That’s the wrong list to plan from. The more useful one is what moved. So far in 2026, four widely tracked compliance dates have moved, paused, or been repealed before taking effect. Not every one applies to your organization. The pattern behind them does, no matter which frameworks you’re tracking. The updated HIPAA Security Rule remains a proposed rule. HHS’s projected final a

The four models solve different problems. Here’s how higher ed audit leaders should think about the choice, and where each one wins. The pressure most higher ed internal audit shops are under The pattern is familiar to every higher ed audit leader: the risk universe is growing fast (cyber, AI, third-party, federal compliance), the audit plan reflects that, but the team is the same size it was five years ago. At some point each year, that math forces a choice: get bigger, get

Two questions follow every AI output your organization produces: who owns it, and what rights did you transfer to the vendor to create it? Most have answered neither. In our 2026 AI Governance Benchmark of five city governments and three universities, Intellectual Property (Domain 8 of the Securance 11) averaged 1.1 of a possible 9 points — and the higher education institutions in the group scored a flat zero. Composite AI governance maturity across all 11 domains averaged 11

The average score in our Securance 11 Peer Benchmark was 11.8 out of 100. Five of the 11 domains came back at a flat zero across every organization assessed. Knowing that changes nothing by itself. This is the part of AI governance nobody warns you about. The assessment is the easy half. You get a number, it’s worse than you hoped, and then the work stalls — because 11 domains scored at once looks like 11 projects, and no CIO has capacity for 11 projects. The score goes into

A remediation portal shouldn't be a premium add-on. Why structured, consultant-supported remediation belongs in every cybersecurity assessment engagement. (154 characters)