023 Ransomware-as-a-Service, AI Phishing, and Everything You Need to Know About CMMC Level 3

023 Ransomware-as-a-Service, AI Phishing, and Everything You Need to Know About CMMC Level 3

Cyberattacks are now a subscription business. Ransomware-as-a-service has erased the skill barrier so anyone can rent the malware and launch an attack, and AI-generated phishing has erased the warning signs a decade of training taught people to spot. In this episode we cover the threat economy hitting every sector, the three controls that actually blunt it, and then everything defense contractors need to know about CMMC — because the calendar just got real. Level 2 third-party certification is mandatory now. Level 3 arrives in 2027. And there is no Level 3 without Level 2 first. For the defense industrial base, the 2027 clock has already started. Intel Declassified in this Briefing: * [00:32] Ransomware-as-a-Service: How cybercrime industrialized into a rentable subscription business, the DarkSide affiliate model, and why backups no longer save you when the data is stolen first. * [04:09] AI Phishing Erased the Tells: Why generative AI writes perfect internal-looking emails, how deepfake voice clones an executive from about eight seconds of audio, and the IBM finding that 16% of breaches now involve AI. * [07:24] The Three Universal Marching Orders: Phishing-resistant MFA and verification protocols, immutable and tested backups, and network segmentation to shrink the blast radius. * [09:05] CMMC Level 2 Is Mandatory Now: Why self-attestation is over, what a C3PAO is, and why subcontractors and joint ventures each have to be certified independently. * [14:13] Why Level 3 Makes Level 2 Urgent: The hard dependency — you cannot start a Level 3 assessment without Final Level 2 first — plus who actually needs Level 3 and what DIBCAC assessment involves. * [21:03] The Affirmation on Your Signature: How a self-attestation you can't now certify becomes a False Claims Act exposure, and why the verified assessment protects the executive who signs. Mission Links: * Verify your Security Posture: https://watchur6.com/secure [https://watchur6.com/secure] * Want to Hire us: https://watchur6.com/contact/ [https://watchur6.com/contact/] * View the Show Notes: https://watchur6.com/podcast/023-ransomware-as-a-service-ai-phishing-cmmc-level-3/ [https://watchur6.com/podcast/023-ransomware-as-a-service-ai-phishing-cmmc-level-3/] * Read the Associated Sitrep: The CMMC Level 2 Certification Timeline — Why the Road to Level 3 Starts Now for Defense Contractors: https://watchur6.com/sitrep/compliance-protocols/cmmc-level-2-certification-timeline-path-to-level-3/ [https://watchur6.com/sitrep/compliance-protocols/cmmc-level-2-certification-timeline-path-to-level-3/]

022 OT Attacks, AI Risk, and Data Security in the Oil and Gas Industry

The most important fact about the Colonial Pipeline attack is the one most people forget: the ransomware never touched the pipeline. It hit the billing and IT systems — and half the East Coast's fuel supply still shut down for six days, because the company couldn't prove the two worlds were separated. This is a special briefing. The CISO just got back from speaking on a panel at the Data Driven Oil & Gas USA 2026 conference in Houston, so we go deep on the energy sector — the OT attacks crossing from IT into the systems that physically run operations, the AI rush wiring operational data straight into the control room, and the data security discipline that decides whether an operator rides the wave or wipes out. And while the focus is oil and gas, the core lesson reaches every organization that connects physical operations to an IT network — which in 2026 is nearly everyone. Intel Declassified in this Briefing: * [00:32] OT Attacks Cross the IT/OT Line: Why ransomware and wiper activity now hit industrial organizations hardest, and why OT was built for reliability, not security. * [03:32] Unsophisticated Attackers Are Still Winning: The CISA, FBI, DOE, and EPA joint advisory on default credentials and exposed remote access — and the nation-state pre-positioning underneath it. * [09:19] The Three Universal Marching Orders: Get internet-facing assets off the public internet, segment the network to shrink the blast radius, and detect the intruder who's already inside. * [12:16] The AI Rush and IT/OT Convergence: Inside the Houston panel — the $200–400B opportunity, why only 15% of organizations are true AI leaders, and how connecting OT to AI opens a door that runs both ways. * [19:28] Case Study, Colonial Pipeline: One legacy VPN account, no MFA, 100GB stolen in two hours, and a six-day shutdown of half the East Coast's fuel — without the attackers ever touching a control system. * [24:31] Securing Your Data: Fix the identity gaps, govern operational data as a security asset, and pressure-test the shutdown decision through real functional exercises. Mission Links: * Verify your Security Posture: https://watchur6.com/secure [https://watchur6.com/secure] * Want to Hire us: https://watchur6.com/contact/ [https://watchur6.com/contact/] * View the Show Notes: https://watchur6.com/podcast/022-ot-attacks-ai-risk-data-security-oil-gas/ [https://watchur6.com/podcast/022-ot-attacks-ai-risk-data-security-oil-gas/] * Read the Associated Sitrep: IT/OT Convergence Security — How Oil & Gas Operators Ride the AI Wave Without a Colonial Pipeline Repeat: https://watchur6.com/sitrep/mission-resilience/it-ot-convergence-security-oil-gas-ai/ [https://watchur6.com/sitrep/mission-resilience/it-ot-convergence-security-oil-gas-ai/]

021 AI Voice Fraud, Payment Breaches, and Everything You Need to Know About PCI DSS & NACHA

For a decade we taught people to spot the phishing email by its bad grammar and awkward phrasing. AI has erased every one of those tells. The phishing email is now perfect, and the voice on the phone approving a wire transfer sounds exactly like your CFO. In this episode we cover the two threats hitting finance hardest in 2026 — AI-driven voice and deepfake fraud, and the e-skimming payment breaches stealing card data in the browser before it ever reaches a back-end system — then deliver the foundational briefing on the two standards that govern payment security: PCI DSS for cards, and NACHA's brand-new fraud monitoring rules for ACH. The lesson that ties it all together: Heartland Payment Systems was fully PCI DSS compliant when it suffered one of the largest card breaches in history. The standard is the floor, not the finish line. Intel Declassified in this Briefing: * [00:32] AI Has Erased the Phishing Tells: Why generative AI and deepfake voice defeat a decade of "spot the typo" training, and the IBM finding that 16% of breaches now involve AI-driven attacks. * [04:50] Why Your Technical Controls Don't Stop This: How AI fraud bypasses your MFA and firewall entirely by attacking the human authorization step instead of the technology. * [05:40] Payment Breaches Have Moved to the Browser: E-skimming, Magecart, and formjacking — how card data is stolen as the customer types it, outside your back-end, with your logs showing nothing. * [10:45] The Heartland Paradox: How a fully PCI DSS-compliant company suffered one of the largest card breaches in history, and why compliance is the baseline, not security. * [11:30] What PCI DSS Actually Is: Why it's a contractual standard and not a government regulation, who's in scope, the 12 requirements, the four merchant levels, and the QSA / ROC / SAQ / ASV / AOC vocabulary. * [16:51] PCI DSS v4.0.1 — The Grace Period Is Over: All 64 requirements now mandatory, the payment page as an explicit attack surface, expanded MFA, 12-character passwords, and the annual risk analysis. * [20:47] How PCI Is Enforced and What a Breach Costs: The $5,000–$100,000 monthly fines, the $50–$90 per-record breach math, and why a breach can shut a smaller business down for good. * [23:33] NACHA — The New ACH Fraud Rules Live This Week: How Phase 2 eliminated the volume threshold, the new "False Pretenses" category targeting credit-push fraud, and why the receiving bank now shares the monitoring duty. Mission Links: * Verify your Security Posture: https://watchur6.com/secure [https://watchur6.com/secure] * Want to Hire us: https://watchur6.com/contact/ [https://watchur6.com/contact/] * View the Show Notes: https://watchur6.com/podcast/021-ai-voice-fraud-payment-breaches-pci-dss-nacha/ [https://watchur6.com/podcast/021-ai-voice-fraud-payment-breaches-pci-dss-nacha/] * Read the Associated Sitrep: The NACHA 2026 Fraud Monitoring Rules — A Finance Leader's Guide to ACH Credit-Push Compliance: https://watchur6.com/sitrep/compliance-protocols/nacha-2026-fraud-monitoring-rules-ach-compliance/ [https://watchur6.com/sitrep/compliance-protocols/nacha-2026-fraud-monitoring-rules-ach-compliance/]

020 Supply Chain Attacks, AI Agent Risk, and Everything You Need to Know About SOC 2

If you lose comms, you lose the mission. If you lose your enterprise customers' trust, you lose the company. In this episode we deliver two missions in one briefing. First — the threats reshaping every industry in 2026: software supply chain attacks up nearly 4x since 2020, and the new attack surface from agentic AI that most organizations cannot even see on their asset inventory yet. Then the foundational SOC 2 briefing every tech startup founder needs, because the enterprise customers you want are worried about exactly these risks, and the SOC 2 report is how you prove you have handled them. Most founders have heard SOC 2 demanded by a prospect. Far fewer have had it explained from the ground up — where it comes from, why it is a CPA firm's opinion and not a certification, the difference between Type 1 and Type 2, what it actually costs, and the business play that uses a Type 1 like a letter of intent to keep an enterprise deal moving while the Type 2 is still in process. Intel Declassified in this Briefing: * [00:24] Why Supply Chain Is the Defining Threat of 2026: The 4x surge since 2020, the TeamPCP package-poisoning pattern, and the difference between a third-party breach and a supply chain attack. * [02:12] The Agentic AI Attack Surface: How a compromised AI agent becomes a "helpful insider" for the attacker, and why most companies cannot inventory the agents they are already running. * [03:52] Three Universal Marching Orders: Build an SBOM and vendor inventory, govern your non-human identities, and lock down the CI/CD pipeline and secrets. * [05:49] What SOC 2 Actually Is: The AICPA origin, the SOC 1 / SOC 2 / SOC 3 family, the five Trust Services Criteria, and why it is an attestation, not a certification. * [09:31] Type 1 vs Type 2: Control design at a point in time versus operating effectiveness over months, explained in plain terms. * [12:35] The Business Play: Using a Type 1 and the CPA engagement letter like a letter of intent to keep an enterprise deal moving. * [15:46] Real Costs and the Shortcut Warning: The $10K-$150K+ range, the two separate bills founders forget, and why cheap-and-fast SOC 2 shortcuts have collapsed under scrutiny. * [18:17] The Tech Startup Marching Orders: Scope the SOC 2, build the control evidence, and map AI and vendor risk into the control set. Mission Links: * Verify your Security Posture: https://watchur6.com/secure [https://watchur6.com/secure] * Want to Hire us: https://watchur6.com/contact/ [https://watchur6.com/contact/] * View the Show Notes: https://watchur6.com/podcast/020-supply-chain-attacks-ai-agent-risk-soc-2/ [https://watchur6.com/podcast/020-supply-chain-attacks-ai-agent-risk-soc-2/] * Read the Associated Sitrep: The SOC 2 Readiness Roadmap — How Tech Startups Get Audit-Ready Without Failing the First Time: https://watchur6.com/sitrep/compliance-protocols/soc-2-readiness-roadmap-tech-startups/ [https://watchur6.com/sitrep/compliance-protocols/soc-2-readiness-roadmap-tech-startups/]

019 Identity Attacks, Vendor Breaches, and Everything You Need to Know About HIPAA

If you lose comms, you lose the mission. If you lose your patient data, you lose your license to operate. In this episode we deliver two missions in one briefing. First — the cross-industry threat landscape every executive must understand. Identity abuse has overtaken network exploits as the dominant breach vector of 2026, and the third-party vendor breach pattern is compounding the threat across every sector. Healthcare. GovCon. Finance. The tech sector. The Mini Shai-Hulud variant. The Zestix Initial Access Broker. The Oncology Institute breach. The ShareFile, Nextcloud, and OwnCloud cluster hitting aviation, defense, healthcare, utilities, telecom, legal, real estate, and government simultaneously. Then the second mission — the foundational HIPAA briefing every healthcare executive needs from the ground up. What HIPAA actually requires. The Privacy Rule and Security Rule distinction. Who counts as a Covered Entity. Why most executives underestimate Business Associates. What actually qualifies as Protected Health Information. The OCR enforcement reality. The four civil penalty tiers. And the criminal exposure that can put healthcare executives in prison for up to ten years. Intel Declassified in this Briefing: * [00:23] Identity Abuse Has Overtaken Network Exploits: Why threat actors now walk through the front door with stolen credentials, hijacked sessions, and bypassed MFA — and why every industry is affected. * [04:37] The Vendor Breach Pattern: How the Oncology Institute breach and the ShareFile cluster proved your security posture is now tied to your weakest vendor. * [07:08] The Three Universal Marching Orders: Phishing-resistant MFA on every account, the credential hygiene audit, and the vendor inventory with posture verification. * [09:25] The Foundational HIPAA Walkthrough: The 1996 origin, the Privacy Rule, the Security Rule, the three Covered Entity categories, the Business Associate definition, and what PHI actually is. * [16:42] Privacy Rule vs Security Rule: Records management versus technology management — the cleanest framing for executives to remember. * [19:59] HIPAA Enforcement in 2026: The OCR, the Breach Notification Rule, the four civil penalty tiers, and the ten-year prison exposure for intent-driven violations. * [22:50] The Three Healthcare Marching Orders: The credential audit this week, the Business Associate inventory this month, and the HIPAA Security Rule Risk Assessment this quarter. Mission Links: * Verify your Security Posture: https://watchur6.com/secure [https://watchur6.com/secure] * Want to Hire us: https://watchur6.com/contact/ [https://watchur6.com/contact/] * View the Show Notes: https://watchur6.com/podcast/019-identity-attacks-vendor-breaches-hipaa/ [https://watchur6.com/podcast/019-identity-attacks-vendor-breaches-hipaa/] * Read the Associated Sitrep: The HIPAA Security Rule Risk Assessment — A Step-by-Step Guide for Healthcare Leaders in 2026: https://watchur6.com/sitrep/compliance-protocols/hipaa-security-rule-risk-assessment-guide/ [https://watchur6.com/sitrep/compliance-protocols/hipaa-security-rule-risk-assessment-guide/]