3 pieces in Incident Response.
EU Cyber Resilience Act reporting begins September 11, and the U.S. CIRCIA final rule is expected soon. Together with existing SEC, NIS2, DORA and state requirements, many organizations will face several reporting clocks from one incident. How to prepare a single process that meets them all.
The first publicly documented espionage campaign run largely by an AI agent changes the tempo defenders should plan for. What the disclosure showed, what it didn’t, and how to adjust detection, triage and response.
The SharePoint exploitation wave stole cryptographic machine keys, so attackers could return after servers were patched. A timeline of the campaign, why key theft changes response, and what to check on any on-premises SharePoint farm.