Security Trends. Business Decisions. Practical Guidance.

Cyber insurance is not simply a policy purchased and forgotten. Insurers increasingly ask whether businesses have MFA, secure backups, incident response plans, endpoint protection, and employee training.

In Travelers v. International Control Services, a ransomware incident led to a dispute over whether the company accurately represented its MFA implementation. The parties later agreed to void the policy. The business lesson is clear: application answers should match controls actually operating across the organization.

In May 2026, Microsoft documented a Storm-2949 attack that began with social engineering and abuse of the password-reset process. Users were persuaded to approve fraudulent MFA prompts, allowing attackers to take control of their identities.

The attackers accessed Microsoft 365, downloaded thousands of files from OneDrive and SharePoint, and expanded into Azure resources. The incident demonstrates why security must include Conditional Access, privileged-role review, password-reset protection, application governance, and monitoring—not MFA alone.

On July 13, 2026, the Department suspended CMMC Phase II implementation while reviewing the program. Phase I self-assessment requirements remain in place.

Contractors should not treat the suspension as permission to stop protecting federal information. Contract requirements, NIST SP 800-171 obligations, SPRS submissions, and affirmations may still apply. Organizations should confirm scope, requirements, implemented controls, and supporting evidence.

Deepfake attacks are no longer theoretical. Engineering firm Arup confirmed that an employee was deceived by AI-generated voices and images during a video meeting and transferred approximately $25 million.

In July 2026, the FBI warned that scammers were using AI-generated video, cloned voices, spoofed websites, and impersonation. Businesses need separate verification and approval procedures for payments, banking changes, password resets, and urgent executive requests.

In March 2026, Microsoft and international partners disrupted Tycoon 2FA, a phishing-as-a-service operation targeting Microsoft 365, Outlook, and Gmail accounts.

Microsoft reported that it supported tens of millions of fraudulent emails reaching more than 500,000 organizations each month. The lesson is not that MFA has failed; businesses need phishing-resistant MFA, properly configured Conditional Access, restricted administrator access, and employee verification procedures.