Plenty of contractors read that news as breathing room. We read it as a warning.

The signature just got heavier

Nothing about the pause touches the annual affirmation. A senior official at your company still signs it every year, attesting that you meet all 110 requirements of NIST SP 800-171. What changed is that no third-party auditor stands behind that signature anymore. Your own self-assessment is the only thing under it.

The Department has said plainly that it is not relaxing standards. And the False Claims Act enforcement that produced multiple DOJ settlements over inaccurate self-attestations is exactly where it was in June. The pause removed the deadline. It did not remove the exposure.

Everything else is still in force

NIST SP 800-171 remains the standard for protecting Controlled Unclassified Information. DFARS 252.204-7012 remains in every applicable contract you hold. Level 1 and Level 2 self-assessments are still required, along with a current SPRS score. And primes can still make compliance a condition of award, whatever the Department does with its own timeline.

Don’t coast through the review

The task force is reviewing how compliance gets verified. The standard it verifies against comes from DFARS and NIST 800-171, and nothing in the review suspends it. Whatever model emerges in September will sit on top of the same 110 requirements, and a company that lets its posture slide carries legal exposure the whole time it waits to find out.

If you already have a C3PAO audit scheduled, it’s a good idea to keep it. A completed audit is independently verifiable proof of your posture at a moment when most of the Defense Industrial Base is self-attesting, and that carries weight with contracting officers and teaming partners alike.

Put your two cents in by August 14

Alongside the suspension, the Department issued a Request for Information asking contractors what CMMC actually costs, where the administrative burden sits, and which controls deliver real security instead of paperwork. The task force will build its recommendations partly from those responses. If the

current model has been pricing you out or burying your team in documentation, this is your chance to say so on the record and help the process. Responses are due August 14.

Keep two things current

The affirmation your leadership signs covers the whole year, so two things need to hold up year-round. The first is security operations, the monitoring, detection, and response that satisfy Level 2 requirements on an ordinary Tuesday, not just in the weeks before an assessment. The second is documentation. Your System Security Plan, your POA&M, and the evidence behind them are what give the person signing something defensible to stand on.

Where Guard Street fits

Guard Street has helped the Defense Industrial Base meet Department of War cyber requirements since 2020. We have watched frameworks pause, restart, and change shape, and our mission does not move: protect the systems.

For a clear read on where your posture stands before the task force reports, reach out at https//guardstreet.com/connect

This is vendor risk, and most mid-market companies are doing it wrong. Not because they’re careless. Often it’s because the program they’re running was built either for an enterprise with a thirty-person risk team or for a five-person shop with three vendors. The middle inherits the worst pieces of both, and that’s where things break.

A few patterns we see often.

Vendor risk has become a procurement task.

In a lot of mid-market companies, vendor risk lives inside procurement. A questionnaire goes out with the contract. The vendor fills it in. Somebody saves it in a SharePoint folder nobody opens again. Deal closes. Box checked.

The trouble is that the questionnaire describes the vendor on the day they signed. Two years later, after a private equity buyout, two rounds of layoffs, a new platform, and an engineer who left her AWS keys in a public repo over a long weekend, that questionnaire is a museum piece.

You bought a product. You didn’t buy a guarantee that the company selling it would still look the same eighteen months in.

SOC 2 is being read as a verdict.

A SOC 2 Type II report is useful. It doesn’t tell you the vendor is safe to plug into your business, but that’s how a lot of buyers treat it.

Two issues. First, the vendor writes the scope. We’ve reviewed plenty of clean Type II reports that, when you actually read them, exclude the integration the client is using. Second, the report measures whether controls exist and operate against a set of criteria. It doesn’t measure how those controls would hold up against somebody who’s actually trying to get in.

If a vendor’s whole answer to “how do you handle security” is the SOC 2 logo at the bottom of their website, you don’t have an answer. You have marketing.

The big vendors get the attention, the small ones get the access.

Programs at this size tend to be top-heavy. The biggest contracts get the most diligence. Everyone else gets the short questionnaire, or nothing.

Attackers don’t really care about your contract values. They care about which door is unlocked. The Target breach famously came through an HVAC contractor. SolarWinds came through a build server most of its customers didn’t know existed. Kaseya rolled downhill through MSPs into thousands of small businesses that had never heard the name. The small specialty vendor is often the way in.

Try this exercise. Make a list of every vendor that holds customer data, financial data, employee data, or has any kind of access to your network. Now mark which ones have a security program you’ve actually looked at. For most mid-market businesses we work with, the second list is much shorter than the first.

An assessment is not a program

A questionnaire is a snapshot. A vendor risk program is what happens after the snapshot.

Most companies stop at the snapshot. There’s a folder of questionnaires, some from three or four years ago, and the assumption is that the work is done. Meanwhile two of those vendors have had public incidents, one was acquired and migrated its data to a different cloud, and a fourth quietly subcontracted part of its operation overseas without telling anybody.

You don’t need an expensive monitoring platform for this. Often it’s a calendar entry, a few news alerts on the vendor names, and somebody whose job it is to ask a follow-up question when something hits the news.

You probably don’t know what data your vendors actually have.

This is the one that catches owners off guard.

Most companies cannot tell you, with any precision, what’s sitting where. Marketing uploaded a customer export to an email tool last spring. Finance hooked up the bank to a forecasting app. HR is using a recruiting platform that has a year’s worth of resumes, including the W9s with SSNs for contract workers. Each of these decisions made sense to the person making it. Nobody mapped any of it.

When something breaks, the first question from your lawyer, your insurer, and any regulator who shows up is: what did they have? “We’ll have to find out” is not a great answer in that moment.

What we’d recommend:

The fix isn’t complicated. Most of it is process. Tools come later, if at all.

Inventory everything. Not the procurement list, the actual list. Every tool, service, and contractor that touches your data or your network, including the ones some manager spun up on a corporate card last quarter.

Sort by risk. Most vendors are not equal. The ones holding sensitive data or with privileged access are tier one. The plant watering service is not. Put the effort where it earns its keep.

Re-review the top tier annually at minimum. Make it a calendar event so it actually happens. Tie it to budget cycles if that’s what it takes to get it on the schedule.

Write down what data each vendor has. Keep it current. If somebody asked tomorrow morning, you should be able to answer in five minutes.

Plan how the data comes back, or gets destroyed, when the relationship ends. We’ve seen breach disclosures involve a vendor a company stopped working with three years ago.

That’s most of it. Mid-market vendor risk usually isn’t a problem of awareness. The owners we talk to generally know they should be doing more. It’s a problem of where the program lives, what it actually covers, and who’s on the hook for keeping it current.

If you’re not sure where your business stands on that, we’d rather talk through it now than after something happens.

How Guard Street can help.

Guard Street assists companies in creating their vendor risk assessments and management strategy.  We provide an ongoing management service to identify the vendor changes, security risks and remediation plans specific to your key vendors.

Visit www.guardstreet.com/connect to discuss your business’ vendor risk needs and how to address them.

We’ll break it down in plain terms. 

What Is a Letter of Attestation? 

A Letter of Attestation (LoA) is a formal document issued by an independent cybersecurity firm confirming that a security control has been pursued and typically it demonstrates proof that a professional penetration test was conducted on your systems. It is written for external audiences including the client reviewing your vendor application, the auditor checking your compliance posture and the insurer evaluating your risk profile. 

It confirms that a qualified third party tested your systems, what standards governed that testing and that findings were addressed. The full technical report stays internal. The LoA is what you share externally. 

Who Is Asking for This? 

• Enterprise clients vetting vendors before signing contracts. 

• Healthcare and financial sector partners requiring compliance proof. 

• SOC 2, ISO 27001 and several other audit frameworks. 

• Government contractors and procurement offices. 

• Cyber insurers assessing risk before issuing or renewing a policy. 

What a Letter of Attestation Includes 

If someone is asking you for an LoA for a penetration test, here is what a legitimate one contains. This is also useful to know when evaluating whether what you have already received from a testing firm is complete: 

• Final Statement: A formal declaration that penetration testing was performed by a qualified third party. 

• Scope of Testing: The scope of what was tested, including systems, applications, and networks covered. 

• Methodology: The methodology used, such as OWASP Top 10, NIST SP 800-115, or PTES. 

• Finding Summary: Depending on the purpose (for example if requested by an auditor), a high-level summary of findings categorized by severity: Critical, High, Medium, and Low. 

• Remediation Confirmation: Confirmation that critical and high findings were remediated prior to issuance. 

• Signature and Firm Credentials: A formal signature from the testing firm, establishing accountability. 

Why There Is No Letter Grade 

A question that comes up frequently is “Why does an LoA not just give a score or a grade?” If a penetration test was performed, why not summarize it as a B+ or an 87 out of 100 and call it a day? 

The short answer is that a grade would actually make the document less useful and more dangerous. Here is why. 

A Grade Does Not Reflect What Was Actually Tested 

Every penetration test is bound by time and agreed-upon scope. A three-day test of one application looks the same on a graded scale as a three-week test of your full infrastructure. The grade removes that context, and without context, it is misleading to anyone reading it. 

A Grade Can Create Problems for You 

If your LoA shows a B+ and a breach occurs later, that grade becomes a liability. Stakeholders may point to it as evidence that you represented your security as stronger than it was. A penetration test is a point-in-time assessment and framing it as a score implies something closer to a certification, which it is not. 

The Industry Measures Risk by Severity, Not Score 

Security findings are categorized as Critical, High, Medium or Low based on how exploitable they are and what the business impact would be. That framework is precise and consistent. A Remote Code Execution vulnerability is Critical regardless of who assesses it. A grade introduces subjectivity where there should not be any. 

The LoA and the Technical Report Serve Different Purposes 

The LoA is a clean external document. The technical report is the detailed internal record. Putting a grade on the LoA blurs that line and risks surfacing internal details in a document that was never meant to carry them. 

Your clients and auditors are not looking for a score. They want confirmation that real testing happened and that problems were fixed. A well-written LoA does that more clearly than any grade could. 

When Should You Get One? 

Any time a client, auditor, or insurer needs proof that security testing happened, an LoA is what they are asking for. The most common triggers: 

• A client or prospect requires security documentation as part of vendor onboarding. 

• You are pursuing SOC 2, ISO 27001, or a similar compliance certification. 

• A past security incident requires documented proof of remediation. 

• Company leadership / board requires one each year.  

How Guard Street Can Help 

If a client or partner is asking for a Letter of Attestation and you are not sure where to start, or if you want to make sure your security program is documented in a way that holds up to real scrutiny, Guard Street can help. 

Visit www.guardstreet.com/connect to discuss what your business needs and how to get there. 

LiteLLM is an open-source Python library that acts as a universal gateway to over 100 large language model providers, including OpenAI, Anthropic, Google, and Amazon. On March 24th, a threat group called TeamPCP used stolen credentials to upload two poisoned versions of the package to PyPI (Python Package Index), the public repository that developers worldwide depend on. Those compromised versions sat there for roughly three hours before anyone caught it.

Three hours does not sound like much. But for a package with an estimated 95 million monthly downloads, that window was more than enough to cause serious damage.

Why This One Is Different

LiteLLM is not some obscure utility buried deep in a codebase. Its entire purpose is to sit between your applications and your AI providers and manage the API keys, credentials and access tokens for all of them in one place. Compromising LiteLLM does not give an attacker one key. It gives them every key.

The malware embedded in the compromised versions was engineered to sweep up the entire credential surface of a modern AI deployment: cloud provider keys for AWS, GCP and Azure; SSH keys; Docker configurations; CI/CD tokens; database credentials; and even cryptocurrency wallets. All of it was encrypted before being shipped to an attacker-controlled server.

In plain terms: if your organization was running one of the affected versions, the attackers potentially walked away with the keys to your entire digital infrastructure. Not just your AI tools, but everything connected to them.

The Lucky Break

The attack was not discovered by a monitoring system or a security audit. It was thankfully caught because of a bug in the malware itself. A researcher named Callum McMahon was testing an unrelated tool that happened to pull in LiteLLM automatically as a hidden dependency. The malicious code had a flaw that caused it to spawn processes uncontrollably until it consumed all available memory and crashed his machine.

McMahon investigated the crash, traced it to LiteLLM, and reported it. Within hours, the compromised packages were pulled. But as AI researcher Andrej Karpathy pointed out publicly: if the attackers had not made that coding mistake, the malware could have run undetected for weeks, silently collecting credentials from organizations around the world.

The difference between a contained incident and a prolonged credential harvest across the global AI development community came down to sloppy code written by the attackers themselves.

The Ripple Effect

What makes this especially alarming is that LiteLLM is not just installed directly by developers. It gets pulled in automatically as a hidden dependency by a large number of major AI frameworks. Projects including Microsoft GraphRAG, Google ADK, DSPy, MLflow, CrewAI, and OpenHands all depended on LiteLLM. Over 600 public repositories had unprotected LiteLLM dependencies at the time of the compromise.

Consequently, organizations using those tools may have been exposed without anyone on their team ever directly installing LiteLLM. If your company runs AI workloads of any kind, there is a real chance that LiteLLM is somewhere in your software supply chain whether your team put it there or not.

What This Means for Your Organization

You do not need to be a technology company to be affected by this. If your organization uses AI-powered tools, chatbots, automation, analytics, or any application that connects to large language models, you are part of the ecosystem that was just compromised. A few questions worth asking:

Do you know what your AI tools depend on? Most organizations have adopted AI tooling quickly without applying the same supply chain scrutiny they would to other critical software. If you cannot answer the question “what open-source packages does our AI stack rely on,” that is a gap that needs attention.

Are your software dependencies locked to verified versions? The difference between installing a package with an open version range and locking it to a specific, reviewed version is the difference between a door with a deadbolt and a door propped open with a brick.

How are credentials managed across your AI infrastructure? Tools like LiteLLM concentrate API keys and cloud credentials into a single point. If that point is compromised, the blast radius extends across every provider and system those credentials touch.

Are your own security tools introducing risk? This entire chain of events started with a compromised security scanner. The tools your team relies on to protect your environment can themselves become the entry point if they are not properly verified and maintained.

The Bigger Picture

The era of blindly trusting open-source AI infrastructure is over. Organizations everywhere have rushed to adopt AI tools, and in that rush, many have skipped the supply chain diligence they would apply to any other critical piece of software. That gap is now being actively exploited by sophisticated threat actors who understand exactly where the weak points are.

At Guard Street, we have been having these conversations with business and technology leaders for months. The rapid adoption of AI has created entirely new categories of risk that most existing security programs were not built to handle. If your organization is treating AI infrastructure like any other software dependency, without dedicated scrutiny, it is time for a reassessment.

The LiteLLM compromise is a wake-up call. Whether your organization responds to it now or learns the lesson the hard way is a decision that is being made today, whether anyone in the room realizes it or not.

Malware in the conventional sense was not installed by the attackers. They altered the DNS settings of the devices by taking use of known flaws in consumer-grade TP-Link routers. They were able to covertly reroute internet traffic from all of the network’s devices through servers under their control thanks to that one modification. They then collected emails, passwords, login tokens, and other private information. The end user did not need to interact with the assault. The majority of victims were unaware that something was amiss.

Microsoft found that the campaign affected 5,000 individual devices and more than 200 organizations. Governmental organizations, military personnel, defense contractors, operators of vital infrastructure, and telecom companies in North America, Europe, Africa, Central America, and Southeast Asia were among the targets. After casting a broad net, the GRU filtered for intelligence targets with high value.

In order to prevent the attackers from regaining access, the FBI responded by issuing court-authorized commands to hacked routers located within the United States to reset their DNS settings. The operation did not gather user data or interfere with regular router operation. However, the fact that the FBI had to remotely intervene in devices sitting in American homes and offices should tell you something about the scale of the problem.

Why Routers Are the Weakest Link

Home routers have been attacked by nation-states before, and this won’t be the last. A Chinese botnet that had taken control of hundreds of similar devices was stopped by the FBI in 2024. It was the Cyclops Blink botnet in 2022. VPNFilter in 2018 came before that. Because routers are the most overlooked component of security infrastructure in the majority of households and companies, the trend continues to recur.

This continues to occur for several reasons:

Firmware updates are manual and invisible. Most routers don’t update automatically, in contrast to your laptop or phone. Most users have never seen the admin panel they must log into in order to update. Automatic updates are rarely released by manufacturers, and many older devices no longer receive any updates at all.

Default credentials are everywhere. How many users have altered the default admin password on their router? Every study that has ever been done on the subject has found that the response is far from sufficient.  Many routers still ship with credentials like “admin/admin” or publicly documented defaults that attackers can look up in seconds.

Remote management is often enabled by default. Anybody can try to access the admin panel from anywhere in the globe because some routers come with remote administration interfaces that are open to the internet. The majority of users are unaware that this feature even exists, much less that it need to be disabled.

Nobody monitors router activity. Laptops and servers are safeguarded by endpoint security technologies. Inboxes are protected by email security measures. However, very few people are keeping an eye on what the router is doing. There was no alarm when APT28 altered DNS settings on hacked routers. All of the network’s devices were silently affected by the modification.

End-of-life devices stay in service for years. Unlike phones, which are replaced every few years, routers are not. Hardware that was long since discontinued by the manufacturer is still in use in many homes and businesses. These devices continue to be linked to the internet and trusted to manage all network traffic, but they will never get another security patch.

The Remote Work Problem

This issue has significantly worsened due to the transition to remote and hybrid work. Prior to 2020, corporate networks with specialized firewalls, intrusion detection systems, and IT professionals keeping an eye on traffic handled the majority of sensitive business data. Nowadays, a large amount of that same data passes through consumer-grade routers that staff members purchased from a big-box retailer and mindlessly plugged in.

This is particularly mentioned in the NSA’s advice, which advises companies that use telework to examine their policies for employee access to sensitive data, including the usage of VPNs and hardened application setups. The reason for this suggestion is that the agency recognizes what this attack showed: when a home router is compromised, the attacker does not simply see the router. They perceive everything that is related to it. The fraudulent DNS settings are passed down to any device connected to that Wi-Fi network. Every email, file transfer, and login from every device in the house passes through infrastructure under the attacker’s control.

This implies that your security perimeter now encompasses each employee’s home network if your company employs remote workers. Additionally, you typically have little visibility into what’s going on there.

What You Should Do

The good news is that self-defense measures are simple. Unfortunately, the majority of individuals and institutions have not adopted them. Here are our recommendations based on the FBI, NSA, and CISA guidelines:

1. Change your router’s admin credentials. If your router’s login is still set to the factory default, change it immediately. Use a strong, unique password. This is the single most impactful step you can take.
2. Update your router’s firmware. Log into your router’s admin panel and check for available updates. If you do not know how, your manufacturer’s website will have instructions. If your router is no longer receiving updates from the manufacturer, it is time to replace it.
3. Disable remote management. Unless you have a specific reason to manage your router from outside your network, turn this feature off. It is one of the primary ways attackers gain initial access.
4. Replace end-of-life hardware. If your router is old enough that the manufacturer has stopped issuing security updates, it is a liability. No amount of configuration hardening can protect a device with known, unpatched vulnerabilities.
5. Pay attention to certificate warnings. The NSA specifically flagged this. If your browser or email client starts showing certificate warnings that it did not show before, do not ignore them. A DNS hijacking attack can trigger these warnings because traffic is being routed through an untrusted server.
6. Review your remote work policies. If your organization has employees working from home, you need to address the security of their home networks. At a minimum, require VPN usage for accessing sensitive systems. Better yet, provide guidance or support for employees to secure their home routers.

The Bigger Picture

Since 2018, the FBI has now carried out four significant operations to combat nation-state router breaches. Every time, the assailants broadened their scope and changed their strategies. Unmanaged, unmonitored, unpatched consumer networking equipment at the edge of networks handling sensitive data was the underlying vulnerability in each case.

These hazards are not hypothetical. Before this operation was stopped, Russian military intelligence secretly collected credentials from infected routers for at least two years. Over 200 organizations and 120 countries were impacted by the program. And this is the only one that we are aware of.

At Guard Street, we collaborate with companies to find and fill precisely these kinds of gaps. One of the most neglected aspects of most security programs is router and edge device protection, and events like Operation Masquerade serve as a reminder that the dangers are genuine, active, and aimed at companies of all sizes.

The FBI advises getting in touch with your local field office or submitting a report to the Internet Crime Complaint Center at ic3.gov if you think your router has been compromised.

Guard Street provides cybersecurity advisory, threat intelligence, and strategic risk management for organizations navigating an evolving threat landscape. To learn how we can help your organization assess and strengthen its security posture, visit guardstreet.com.

The Iran-linked hacktivist group Handala claimed responsibility, alleging they wiped data from more than 200,000 systems and servers, forcing Stryker’s offices across 79 countries to shut down. Investigators believe the attackers gained access to Stryker’s Microsoft Intune management console, then used it to wipe corporate devices back to factory settings. A devastating result that required no ransomware, no malware. Just administrative access turned against the company itself. 

This is what modern nation-state warfare looks like. 

The Threat Is Escalating Fast 

Iran has historically relied on cyber operations as a primary tool of retaliation, precisely because it lacks the conventional military reach to strike back symmetrically against the United States and Israel. Since the U.S.-Israel military campaign began in late February, that calculus has shifted dramatically. 

Multiple Iranian state-aligned groups have formed under a coordinated “Electronic Operations Room,” with Handala, linked directly to Iran’s Ministry of Intelligence and Security, claiming attacks against energy companies, payment systems, and now American critical infrastructure. 

The Stryker attack is not an isolated incident, but the first of likely many. This is a signal to the US. 

Who Needs to Be on Guard 

Threat analysts and ratings agencies are warning that the current environment puts local governments, critical infrastructure providers, and major U.S. companies at heightened risk. Attacks range from DDoS to financially motivated intrusions to full data-wiping operations. Currently, the sectors with the greatest exposure include: 

• Healthcare and medical technology — as Stryker demonstrates, patient-care disruptions create maximum pressure. 

• Energy and utilities — Iranian state-sponsored actors have repeatedly targeted water and energy sector networks and industrial control systems. 

• Financial services — U.S. security officials have specifically warned that the financial sector has historically been a target for Iranian-aligned groups during periods of elevated tension. 

• Defense and aerospace — defense industrial base companies, particularly those with ties to Israeli research and defense firms, are at increased risk 

• Every U.S. multinational — as one former CIA official put it plainly: every American company operating internationally should be briefing its overseas personnel right now 

What This Means for Your Organization 

The Stryker attack succeeded not because of exotic zero-day exploits, but because of access. Specifically, privileged administrative access to a device management platform. This is a pattern we see repeatedly with Iranian threat actors: they find the door you left unlocked, walk in, and use your own tools against you. 

The fundamentals matter now more than ever: hardened identity and access management, endpoint visibility, rapid detection of abnormal administrative activity, and a tested incident response plan. Nation-state actors do not announce themselves. By the time you know they are in, the damage is often already done. 

At Guard Street, we work with organizations every day who believe a sophisticated attack will not happen to them, until it does. The Stryker breach is a reminder that no sector, no size, and no geography makes you immune. The question is not whether you are a target. The question is whether you are ready. 

Ready to assess your exposure? Let’s talk.

Visit https://guardstreet.com/connect or call 1-800-811-9130 to talk with our experts about building a strategic security plan for your organization.

While the numbers can feel daunting, the good news is that ransomware is increasingly preventable and manageable with the right preparation. This article outlines the current landscape of ransomware costs, what drives those figures and practical steps organizations can take to reduce both likelihood and impact.

Why Ransomware Costs Keep Rising

Several trends are pushing costs higher in 2026:

1. Double and Triple Extortion Tactics: Attackers don’t just encrypt data, they exfiltrate it first, then threaten public release or contact customers directly. This multi-layered pressure increases negotiation complexity and reputational risk.
2. Targeting of Backups and Recovery Systems: Sophisticated groups now specifically seek out and encrypt or delete backups. When recovery takes longer, business interruption costs (lost revenue, employee idle time, customer impact) skyrocket.
3. Supply Chain and Third-Party Entry Points: A single compromised vendor can lead to widespread infection. Mid-market firms often lack the resources to fully vet every partner, creating hidden vulnerabilities.
4. Regulatory and Insurance Fallout: Stricter incident reporting rules (e.g., SEC requirements, state laws) and cyber insurance carriers demanding higher deductibles or denying coverage for unprepared organizations add financial strain.

Quantifying the Real Impact

A useful framework for understanding ransomware risk is Annualized Loss Expectancy (ALE):

● Single Loss Expectancy (SLE): Estimated cost of one successful incident (downtime, recovery, legal, PR, etc.)

● Annual Rate of Occurrence (ARO): How often you expect an incident in a given year (e.g., 0.1 = once every 10 years)

● ALE = SLE × ARO

For many mid-market organizations, even a conservative estimate shows ALE in the hundreds of thousands to millions annually, making proactive investment in prevention and resilience far more cost-effective than reacting after an attack.

Practical Prevention and Resilience Strategies

Here are actionable steps that mid-market teams can implement without massive budgets or overhauls:

1. Implement the 3-2-1 Backup Rule (and Test It):
   • Three copies of data
   • On two different media types
   • One copy offsite and immutable test monthly restores—unverified backups are a common failure point.
2. Segment Networks Aggressively: Isolate critical systems (finance, HR, customer data) so that one compromised endpoint cannot spread laterally. Use micro-segmentation where possible.
3. Adopt Multi-Factor Authentication (MFA) Everywhere: Prioritize hardware keys or biometrics for admin accounts and remote access. Phishing resistant MFA blocks the majority of initial entry points.
4. Run Regular Incident Response Tabletop Exercises: Simulate a ransomware scenario with your leadership team quarterly. These sessions clarify roles, reduce panic, and uncover gaps in communication and decision-making—often more valuable than technology alone.
5. Conduct an Independent Quantified Risk Assessment Annually: A knowledgeable cybersecurity company understand the right questions to ask to address changes in your environment (technically and non-technically) and can update the risk quantification for your organization. This is essential in helping prioritize your focus and spending (e.g., spending $40K on better backups and training could reduce ALE by $300K).

Looking Ahead with Confidence

Ransomware in 2026 is serious, but it is not inevitable. Organizations that prepare thoughtfully, quantify their risks and focus on resilience rather than reaction are far better positioned to weather incidents with minimal disruption.

As a cybersecurity boutique, Guard Street specializes in a tailored approach with quantification and AI strategic considerations to deliver vulnerability assessments, tabletop exercises, and compliance guidance as your dedicated cybersecurity partner. Connect with us for a complimentary consultation to map these strategies to your environment.

We’d be happy to discuss how these approaches could apply to your organization. Feel free to reach out for a complimentary conversation.

Connect with Guard Street

1. AI-Enhanced Social Engineering and Phishing

AI tools are enabling attackers to craft highly personalized phishing emails, deepfake voice calls and videos, and adaptive malware that evades traditional detection. Reports indicate a 30-50% rise in AI-assisted phishing attempts in late 2025, targeting supply chains and remote workers.

Proactive Steps:

• Implement multi-factor authentication (MFA) across all accounts, prioritizing hardware keys or biometrics for high-risk users.
• Conduct monthly phishing simulations with immediate, non-punitive feedback to build team awareness.
• Use AI-powered email filters that analyze behavioral patterns, not just signatures, for early anomaly detection.

These steps create a human-technical hybrid defense, reducing breach likelihood by up to 99% according to recent NIST guidelines.

2. Ransomware Targeting Backup and Recovery Systems

Ransomware groups continue to evolve, with 2025 seeing increased attacks on cloud backups and immutable storage. Mid-market firms face average recovery costs of $200K-$2.5M per incident, often driven by downtime rather than ransom payments.

Proactive Steps:

• Maintain 3-2-1 backups: three copies, two media types, one offsite/immutable, tested monthly for restorability.
• Perform annualized loss expectancy (ALE) calculations to quantify ransomware impact.
  • Multiply single loss expectancy (SLE) by annual rate of occurrence (ARO) for prioritized budgeting.
• Segment networks to limit lateral movement, ensuring critical systems remain isolated during an attack.

Preparation like this minimizes disruption, allowing most organizations to recover in hours rather than days.

3. Supply Chain and Third-Party Vulnerabilities

Interconnected ecosystems amplify risks, as seen in 2025 supply chain breaches affecting thousands of mid-market vendors. Weak access controls in SaaS tools and unpatched third-party APIs remain common entry points.

Proactive Steps:

• Adopt a zero-trust model: Verify every access request with least-privilege principles, regardless of user location.
• Review vendor contracts quarterly for shared security responsibilities, focusing on SOC2 Type II reports and incident response SLAs.
• Map your supply chain digitally and run automated scans for known exploited vulnerabilities (e.g., via tools aligned with CISA’s KEV catalog).

This approach extends your security perimeter effectively, without requiring a full infrastructure overhaul.

4. Evolving Compliance and Regulatory Pressures

Frameworks like SOC2, CMMC, PCI, and cyber insurance mandates are tightening, with Q4 renewals driving 40% of mid-market audits. Non-compliance risks include 20-30% premium hikes or coverage denials.

Proactive Steps:

• Create a compliance roadmap aligning NIST CSF 2.0 with your industry (e.g., CMMC Level 2 for DoD contractors, HIPAA for healthcare-adjacent firms).
• Automate control evidence collection for audits, focusing on high-impact areas like data encryption and incident logging.
• Schedule annual gap assessments to track maturity, turning compliance into a competitive edge for insurance negotiations.

Forward planning here not only avoids penalties but strengthens overall resilience.

Moving Forward Thoughtfully

Cybersecurity in 2026 rewards organizations that prioritize preparation over reaction. By quantifying risks through models like ALE, layering defenses thoughtfully, and aligning with compliance realities, mid-market teams can protect operations with confidence.

As a cybersecurity boutique, Guard Street specializes in a tailored approach with quantification and AI strategic considerations to deliver vulnerability assessments, tabletop exercises, and compliance guidance as your dedicated cybersecurity partner. Connect with us for a complimentary consultation to map these strategies to your environment.

Connect with Guard Street

The unsettling detail? The impersonated co-worker had passed away nearly a year earlier.

This was no ordinary email—it was a sophisticated phishing attack, leveraging social engineering to mimic internal communications and exploit trust. Scans of the employee’s computer and the network fortunately detected no malware or breaches. However, the risk was significant: Potential deployment of malicious software, theft of sensitive data, or even a ransomware outbreak.

Compounding the concern, the organization had required all staff to complete cybersecurity training just a month prior. Employees reviewed modules on identifying phishing attempts, avoiding dubious attachments, and escalating suspicions. Yet, this near-miss demonstrates a persistent truth: Awareness does not always translate to action.

The Persistent Threat of Phishing

Phishing continues to be a leading cyber threat, with reports indicating that it initiates over 90% of successful data breaches. Modern attackers refine their methods, using psychological tactics to create convincing forgeries. Impersonating a deceased colleague, as in this example, adds emotional manipulation, making recipients less likely to scrutinize the message.

Key indicators of such attacks include:

• Unexpected updates or shares from unrecognized sources.
• Demands for urgent review without standard verification.
• Attachments in common formats like PDFs that may conceal harmful code.
• Subtle discrepancies in sender information, such as altered email domains.

The fallout can be severe: Monetary losses, harm to reputation, and compliance violations. For businesses of any size, one breach can prove devastating.

Why Traditional Training Falls Short

While mandatory online training provides foundational knowledge, it is frequently passive and easily forgotten. Participants navigate through content, complete assessments, and resume normal duties—without deeply embedding the principles. In creative roles like marketing, where ideas flow rapidly and collaborations are constant, instinctive reactions prevail, leading to risky decisions like opening unverified attachments.

This incident illustrates that intellectual understanding differs from behavioral change. Under pressure, even trained individuals may revert to habits, revealing that some lessons require more than repetition to take hold.

The Power of Tabletop Exercises: Hands-On Defense

Tabletop exercises offer a proactive, interactive alternative to conventional training. These simulations convene teams—either in person or virtually—to enact cyber scenarios, debate strategies, and pinpoint deficiencies in a controlled setting.

Envision a session modeling the “ghost co-worker” phishing ploy:

• Team members encounter simulated emails and evaluate responses.
• Group discussions expose issues, such as obsolete directories or inadequate checks.
• Participants rehearse protocols, from alerting IT to containing threats.

Advantages include:

• Enhanced Engagement and Memory: Practical involvement reinforces concepts far beyond passive learning.
• Collaborative Strength: Involving multiple departments builds unity and collective vigilance.
• Vulnerability Detection: Identify and address weaknesses preemptively, like flaws in filtering systems.
• Tailored Relevance: Adapt exercises to specific sectors, focusing on collaboration-related phishing for relevant teams.

Research indicates that companies employing tabletop exercises experience up to a 50% drop in phishing successes, as staff cultivate instinctive, secure responses.

Don’t Let Phishing Ghosts Haunt Your Business

This example serves as a stark reminder: Cyber adversaries target human elements, undeterred by prior trainings. True resilience demands cultivating habits via immersive, practical preparation.

Prepared to fortify your defenses? Contact Guard Street Cybersecurity for robust, hands-on tabletop trainings customized to your needs. Our specialists ensure your organization is equipped to handle the unforeseen. Email us at info@guardstreet.com or visit https://guardstreet.com/connect/ to arrange a session. Secure your future today.

Despite rising awareness, many organizations still approach ransomware as an inevitable technical issue—one best left to antivirus software or IT departments. But the truth is, most ransomware attacks begin with a human click, not a machine vulnerability. And that’s where the real opportunity for prevention lies.

The True Cost of Ransomware vs. Training

The average cost of a ransomware payment on a mid-sized business exceeds $5 million, factoring in downtime, ransom payments, data loss, legal fees, and reputational damage. And the longer it takes to detect and respond to an attack, the more expensive it becomes.

Compare that to the cost of proactive, high-quality employee cybersecurity training. A typical program ranges from $50 to $300 per employee per year. Even with robust training solutions and tabletop simulations, the total investment is a fraction of what a single attack could cost.

The numbers speak for themselves: It’s not just more effective to train—it’s significantly more affordable.

Understanding Ransomware Tactics

Ransomware isn’t just one-size-fits-all. It comes in many forms, and each is designed to exploit the people and processes within an organization:

• Locker Ransomware: Denies access to systems or devices entirely.
  
• Crypto Ransomware: Encrypts files and demands payment for the decryption key.
  
• Double Extortion: Attackers steal data before encrypting it, threatening to release it if the ransom isn’t paid.
  
• Ransomware-as-a-Service (RaaS): Pre-packaged kits that allow even non-technical criminals to launch sophisticated attacks.

But the method of entry is almost always the same: social engineering.

Attackers impersonate trusted sources—CEOs, vendors, IT staff—and use urgency, fear, or curiosity to trick employees into clicking a link, opening an attachment, or sharing credentials. A single moment of distraction can open the door.

Training That Actually Works

To prevent ransomware, you don’t just need annual slide decks and checkbox compliance. You need training that sticks, training that replicates real-world conditions, and training that evolves alongside the tactics of threat actors.

Effective programs include:

• Training Modules: At one and ideally two short training videos per month that include the foundational topics for a strong cyber posture with quizzes are essential.  People learn through frequency and repetition of a pre-planned curriculum. 
• Ongoing Phishing Simulations: Realistic, targeted tests that help employees recognize suspicious messages.  This should be performed in conjunction with the training modules above.
  
• Role-Based Education: Tailored training for finance teams, HR, executives, and other high-risk roles.
• Onsite or Video Conference Training: This approach reinforces the above training and goes a step further with questions and answers.  It facilitates engagement which is an important aspect of training and retention.
• Incident Response Drills: Practice runs that simulate a live ransomware attack and stress-test decision-making.
• Tabletop Exercises: Team-based sessions where departments walk through hypothetical scenarios—what they’d see, who they’d alert, and how they’d respond.

Where Guard Street Comes In

Guard Street specializes in essential cyber training, incident response drills, realistic, high-impact tabletop exercises that go beyond theory. Our simulations aren’t generic—they’re built around your actual environment, risk profile, and common attack vectors. We design experiences that expose gaps, surface unspoken assumptions, and equip your people to recognize and react to ransomware attacks.

From IT teams to front-line employees, we help organizations turn human vulnerability into a human firewall.

While ransomware attacks may be inevitable—falling for them doesn’t have to be.