Nick Santora

The latest OCR enforcement actions—highlighted in Shook, Hardy & Bacon L.L.P.’s March 2025 update—offer a clear and urgent reminder: Risk analysis isn’t optional. It’s foundational. Whether you’re a covered entity or a business associate, failure to conduct an enterprise-wide, accurate, and thorough risk analysis remains one of the most common and costly compliance gaps cited by OCR. And yet, in 2025, too many organizations still treat it as a one-time checkbox or an IT-centric task. In fact, according to OCR enforcement data, only 10% of organizations have taken this essential step in enterprise cyber risk management (ECRM). This is precisely why the Leadership in Healthcare Cyber Risk Management program at UT Austin places risk analysis at the center of its curriculum. In my course, Healthcare Enterprise Cyber Risk Management, we emphasize not just how to perform an OCR-Quality risk analysis—but why it matters strategically, operationally, financially, and legally. 💡 Risk analysis is where cyber risk management begins. 📉 OCR penalties are often where failure to act ends. The next cohort for my course begins June 30, 2025. Register here: https://lnkd.in/e26qgbry https://lnkd.in/eFV2ET2M #ECRM #CyberRiskManagement #HIPAACompliance #RiskAnalysis #HealthcareCybersecurity #OCR #UTAustin #LeadershipInAction

5

A joint law enforcement operation has dismantled LeakBase, one of the world's largest online forums for cybercriminals to buy and sell stolen data and cybercrime tools. The LeakBase forum, per the U.S. Department of Justice (DoJ), had over 142,000 members and more than 215,000 messages between members as of December 2025. Those attempting to access the forum's website are now greeted with a seizure banner that says it was confiscated by the U.S. Federal Bureau of Investigation (FBI) as part of an international law enforcement effort. "All forum content, including users' accounts, posts, credit details, private messages, and IP logs, has been secured and preserved for evidentiary purposes," the banner reads. Available in English and accessible over the clearnet, LeakBase offered hacked databases, including hundreds of millions of account credentials and financial information such as credit and debit card numbers, banking account and routing information, usernames, and associated passwords that could be abused to facilitate account takeovers. According to a report published by Flare in April 2023, LeakBase explicitly prohibited users from peddling or publishing Russian databases, likely in an attempt to avoid scrutiny. The forum has been active since June 2021. https://lnkd.in/ggqEM3sA

10

1 Comment

Check out Janet Costello Worthington's blog on this often overlooked, but extremely important requirement to understand what exactly you have just placed within your Enterprise.

6

1 Comment

“The security concerns surrounding Moltbot (Clawdbot) persist even when it is set up correctly, as the team at Hudson Rock pointed out this week. Its researchers said they looked at Moltbot's code and found that some of the secrets shared with the assistant by users were stored in plaintext Markdown and JSON files on the user's local filesystem.” by Connor Jones (The Register) https://lnkd.in/dZSPx7t2

41

Threat Modeling Guides Secure Design Decisions Security requirements must be integral, not afterthoughts. VerSprite embeds threat modeling into design cycles. Executive takeaways • Secure design roadmaps • Early mitigation strategy planning • Risk informed architecture reviews • Compliance backed security rationale • Developer friendly threat insights Build security in from day one https://lnkd.in/gwvJ_vaf #SecureArchitecture #Leadership #EngineeringExcellence #Cybersecurity #RiskManagement

4

Last April, CISA issued an 11-month extension for its CVE program with MITRE, rescuing the program from an almost certain death. Since then, CISA and MITRE have negotiated a new deal that puts the CVE program on firmer footing. In a statement, Nick Andersen, acting director of CISA, told CSO, “Under CISA’s leadership and sponsorship, the CVE program is fully funded and has continually evolved and modernized to support the global vulnerability ecosystem.” My exclusive for CSO. (link in the comments)

11

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment

Deepfake forensics is much more than deepfake detection. We have always been clear about this. Deepfake detection, including in our own tools, is not a silver bullet. It must be supported and validated through additional forensic analyses. A few days ago, The New York Times published an article testing several AI-based tools to distinguish real images and videos from deepfakes: https://lnkd.in/dWtxyQGE The outcome was mixed. Many tools produced partially correct results. None achieved full accuracy. After reading the article, I ran Amped Software Authenticate on all the images and some frames from videos included in the piece. The result? Every single one was classified correctly. 💪 To be clear, we do not recommend blindly relying on deepfake detection, especially on single frames extracted from videos. That is not a forensically sound workflow. Still, even those isolated frames were correctly classified. In the final example, AI had been used to add smoke to a real photo. The file was correctly classified overall as real, and the manipulated smoke region was identified using traditional image forensic analysis. This is the real point. Deepfake forensics goes far beyond pressing a detection button. It requires context, methodology, and validation. But when deepfake detection works reliably, it is a great start.

69

11 Comments

Manual, alert-by-alert triage is reaching its breaking point. This week, we're introducing Corelight Agentic Triage, a new capability within Corelight Investigator designed to move SOC workflows beyond isolated alerts and toward entity-centric investigations. Instead of reviewing hundreds of alerts, analysts receive prioritized entities with pre-correlated evidence and behavioral context already assembled. Read the launch blog: 👉 https://lnkd.in/gGjUR7Hb #Cybersecurity #NetworkSecurity #NDR #SOC

24