Javier Perez

Excellent new contribution to Claroty Nexus from Providence CISO Mike Ratliff on the #healthcare system's teardown of traditional #GRC. Providence's approach: GRAC — Governance, Risk, Attack Surface Management, and Compliance — is a risk-centric, threat-aligned function built for outcomes, not reporting, Ratliff writes. https://hubs.li/Q03yc3pB0

2

Ransomware upstart ‘The Gentlemen’ raises the stakes for OT‑heavy sectors. Victims already span 17 countries, with manufacturing and construction hardest hit. Analysts warn that custom evasion tooling and domain‑wide deployment tactics heighten operational, regulatory, and reputational risk.

9

I spend a lot of time with manufacturers and product teams who aren’t questioning whether they must comply with the Cyber Resilience Act (CRA) they’re stuck on the how. The CRA is clear on the obligations, but in practice the hard part is interpretation: software distributed online, products that depend on cloud back-ends, continuous updates, open-source components, product families, legacy models… This is exactly what the European Commission is trying to address now. The Commission is preparing a Communication (a guidance document) to explain how the CRA should be applied in real situations and to support a consistent approach across the EU. It’s not a new Regulation and it’s not “binding law” in itself but it matters because it clarifies how key provisions are expected to be understood and implemented in practice. https://lnkd.in/etm43Utx What I like in this draft is that it turns the CRA into practical “rules of the road”, especially on: • Software scope & “placing on the market” (including iterative releases) • What counts as the “product” when hardware depends on apps/drivers/software delivered separately • Open-source (FOSS): when it’s out of scope vs when it becomes a commercial activity, and the steward concept • Updates vs “substantial modifications”: focus on risk/attack surface/intended purpose, not release size • Support period: 5 years is a minimum, and how this works with versioned software/upgrade paths • Cloud / remote processing: what’s part of the product vs general IT infrastructure • Risk assessment & due diligence: manufacturers keep responsibility, including for third-party components The draft is open for feedback for a limited period, and comments are expected in a structured template (so they can consolidate input). If you build products that will fall under CRA, this is a very good moment to stress-test your assumptions and flag the parts that are unclear, unrealistic, or could lead to unintended consequences. I’m sharing the draft guidance here because, from what I see, the companies that will move fastest are the ones that turn these interpretations into concrete internal rules: scope mapping, update governance, support period policy, OSS governance, and evidence-ready documentation.

32

New on Nexus: Providence CISO Mike Ratliff writes about an internal AI skills-building program for his #cybersecurity team that paid immediate dividends, especially in the area of operational efficiency. Read more: https://hubs.li/Q03T0jz_0 Claroty for Healthcare

3

Move faster. Investigate with clarity. Security Operations Centers (SOCs) are under siege—not just by the volume of alerts but by their vagueness. Analysts waste countless hours deciphering what’s real and what isn’t, often without the evidence they need. Fatigue rises. Threats slip through. Talent is wasted. Binalyze AIR brings clarity to chaos. It augments your existing alerting stack (SIEM, EDR, XDR) with automated, forensic-grade context—enabling your team to validate alerts in minutes, streamline investigations, and make better decisions, faster. Less noise. More signal. All in a single platform. ==

3

The state of Rhode Island publicly released the results of a third-party analysis of the 2024 RIBridges cyberattack and data breach at a press conference with Rhode Island Governor Dan McKee and Chief Digital Officer Brian Tardiff. Cybersecurity company CrowdStrike conducted the analysis, which revealed the five-month timeline of the breach and a more accurate number of impacted individuals -- approximately 644,401 people. RIBridges is a system run by Deloitte that the state of Rhode Island uses to administer important social services benefits like health insurance, food stamps and the Child Care Assistance Program. As previously reported, Deloitte informed the state of a potential security threat to RIBridges on Dec. 5, 2024, stating that there was a high probability that a cyberthreat actor had obtained files containing sensitive information. The Brain Cipher cyberthreat group later took responsibility for the hack. The state took RIBridges temporarily offline and later sent notification letters to nearly 650,000 individuals. The newly released third-party analysis provided clarity on how the cyberthreat actor gained access to the RIBridges environment and how it performed data access, staging and exfiltration activities on 28 RIBridges systems. Reviewing post-incident analyses of healthcare data breaches can help defenders bolster security efforts. https://lnkd.in/gBJR5kBh

7

A summary of the announcements made by cybersecurity vendors on the first day of the RSAC 2026 Conference. https://lnkd.in/dKyA8uXV Includes announcements from Acalvio Technologies Apiiro Arctic Wolf ArmorCode Inc. Astrix Security BeyondTrust BlackDuck Broadcom Cloud Security Alliance Cisco Commvault Cribl CrowdStrike CyberProof Dataminr Dropzone AI Fenix24 Flashpoint Forcepoint Forescout Technologies Inc. Geordie AI Google Cloud Security Illumio Intel 471 Keeper Security, Inc. Kiteworks NVIDIA Operant AI OmniTrust OpenText Palo Alto Networks Qualys RSA Security Rubrik SandboxAQ SentinelOne Snyk SOCRadar® Extended Threat Intelligence Sysdig Wiz

27

3 Comments

A new report from Semperis takes a look at the current state of ransomware risk, and some of the revelations are shocking. While ransomware is on a slight decline, ransomware gangs are getting more aggressive, including threatening business leaders with physical harm, according to the report. Here are more of the report’s key findings:

1

Good morning! Here is this week's ICS Advisory, Other CERT, and Vendor vulnerability advisories weekly summary for 23 - 27 February 2026. This past week, CISA released 12 new CISA ICS Advisories for the following vendors: Copeland, InSAT, CloudCharge, EV Energy, Chargemap, SWITCH EV, Mobility46, EV2GO, Gardyn, Johnson Controls, Inc. Pelco, Inc. and Schneider Electric. One update was released this past week for Honeywell Schneider Electric, Mitsubishi Electric, Hitachi Energy, ICONICS and Mitsubishi Electric. Based on the new CISA advisory, #Energy, #TransportationSystems, #Commercial #Facilities, #Healthcare and #PublicHealth, #Defense #Industrial Base, #Food and #Agriculture, Critical #Manufacturing, #Government #Facilities, #Financial #Services, #InformationTechnology, #Water and #WastewaterSystem are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 16 new ICS Advisories for Festo, ARC Informatique, Moxa, Phoenix Contact, ABB, Bosch Rexroth, Hitachi Energy, Ubiquiti Networks, Trumpf, PDUexperts, Socomec and one update for Hitachi Energy. View the summary details of other CERT & Vendor product advisories identified last week (23 - 27 February 2026) at: https://lnkd.in/efKiMsxs This past week, CISA added 3 new Known Exploited Vulnerability (KEV) Catalog. None added this week correlated to a CISA ICS Advisory. ICS Advisory Project identified one CVE: CVE-2020-11023 – JQuery Cross-Site Scripting (XSS) Vulnerability listed in the Festo advisory for CODESYS vulnerabilities in Festo Automation Suite [VDE-2025-108]. This week, ICS Advisory Project, powered by Industrial Data Works LLC, in collaboration with EmberOT, released our 2024–2025 ICS/OT Vulnerability Intelligence Report. Check it out at: https://lnkd.in/ehG4DNPs Thank you all at EmberOT for your amazing support in getting this report out this year. Acknowledgement: Thank you Mikael Vingaard at the ICSRange for sharing with ICS[AP] the new ICS Advisory for PDUexperts. Visit the ICS[AP] CISA KEV Catalog Dashboards: https://lnkd.in/emzXBbBw View previous ICS Advisory Project weekly summaries: https://lnkd.in/eQKxhAEi To view the updated ICS Advisory Project Dashboards, visit: icsadvisoryproject.com Sign up to receive ICS[AP] Weekly Summary Slides & Other CERT and Vendor Advisory Summaries via email every Monday https://lnkd.in/eUwQrrj4 I appreciate everyone's comments & support. Have a great week!  #CISA #ot #ics #otsecurity #icssecurity  #cybersecurity #cybersecurityawareness #industrialautomation #buildingautomation #oilandgas #maritime #vulnerabilitymanagement Disclaimer: The views expressed in my LinkedIn posts and profiles are my own, not those of my employers or LinkedIn.

29

Beazley Security's Security Posture Reports are used to assess risk in underwriting but are now available to any organization to provide a point in time view of their external attack surface. Learn how you can access at: https://lnkd.in/gwbMXWsb. Next up, we're going to make this functionality continuous and available as service through the VERACIS™ client portal.

36

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments