PeritumAI

30 months. That's Delaware's planned sandbox for companies run by AI agents, no human at the helm, per Ars Technica. Draft bill: the owner "is not liable for any act or omission" of the AI company. Fraud aside. Banking's off limits. When the agent wrecks somebody, who pays?

If a nuclear plant let a vetted guard press buttons while an unvetted operator read him instructions over the phone, we'd call it a violation. In gov cloud, per these alleged Microsoft screenshots, we call it a process.

Careful with this one. The Microsoft screenshots show an approval, no log contents, no named customer, no transfer (per Cybersecurity News). Allegation, not breach. But "we followed the process" was ProPublica's whole story last time too.

Question for every GRC person this morning: if your vendor's compliance depends on a human relay who's told not to think, is that a control or a liability you haven't priced yet?

About 100 government agencies and school districts have contracts with EM1, an AI startup for emergency managers, per Grist and WIRED. None automate weather alerts yet. Experts say chatbots write them anyway. One AI storm map in Alabama was wrong. Whose name is on the next one?

808 K-12 school organizations got told their staff logins were for sale. I read all 23 pages of the new State of K-12 Cybersecurity 2026 report from CIS and MS-ISAC, out Oct 27. 1. 808 of 6,116 member orgs had staff accounts or credentials found on underground markets and dark web sources. 2. The trick is called account takeover hopping. Phish one district account, then phish its contacts at the next district. Real accounts, real mail paths. Filters wave it through. 3. Hijacked school accounts were used to pose as superintendents and commit fraud. 4. 1,159 of 1,796 top malware infections came from malicious ads on legitimate websites. Teachers reading the news. 5. 285 ClickFix findings. Users talked into running the attack themselves. 6. 66% have one or two people responsible for cybersecurity. 11% have nobody. 7. 70% delayed security projects, tech or hiring over budget. 8. 83% run MFA. 59% have an incident response plan. 15% practice it regularly. 9% call their security strategy fully implemented. 9. 2,707 incidents reached a school laptop, Chromebook, desktop or server. In 1,711 the attacker tried to hide. Disabling or tampering with security tools showed up 881 times. 10. 51% had a cyber incident in the past year. 22% saw classroom instruction disrupted. 2% closed schools. 11. AI: 87% report teachers using it. 42% report ungoverned use. 33% have a formal AI policy. 12. 3.52 billion blocked connections, more than 3.1 million per protected org. Two people versus 3.1 million knocks. Who checks the console at your kid's school when it goes quiet? cisecurity.org/insights/whit…

October 30 was the date. After backlash, Meta moved it to Nov 20. That's when new business terms let it use content from your business's linked website to build its products, per 404 Media. It cut the word "train." UK and EU accounts can object. Where's everyone else's button?

4 countries. Ars Technica asked Google's AI Mode who won the 2020 US election via Taiwan, Russia, France and Canada. Straight answers. From inside the US: go read the FEC. Google calls it a "technical gap" and says a fix is coming. Easier to get the answer from Moscow.

$3.5 million. That's what one Russian allegedly laundered since January 2025 for North Korea's IT worker scheme, per Treasury via The Record. The workers, in US company IT jobs, had a boss in Russia checking they hit earnings targets. Remote job. Real quota. Wrong country.

Nobody is talking about this: 87.9% of scam victims who asked for help got no answer, per the ITRC via Help Net Security. 78.9% paid a third party promising to recover the money, fix credit or catch the scammer. The ITRC calls those recovery scams. Robbed. Ignored. Robbed again.

92,000 Japan Airlines customers. About 2,000 lost passport numbers too. JAL says the breach was at Amadeus, the IT provider that runs its booking and check-in, per The Record. Your airline is a logo on someone else's database. How many airlines check in through that one vendor?

$1,000 per violation. That's what West Virginia let judges and cops sue data brokers over published home addresses. A federal appeals court just struck it down, per The Record. The law exists because a judge's son was killed at her door in 2020. The brokers won this round.

CVSS 2.7. The kind of score that sits at the bottom of the patch queue. China-nexus Warp Panda used it as a zero-day on VMware ESX to do admin work without it being logged, per CrowdStrike via The Hacker News. Targets: US legal sector. Still sorting patches by score alone?

40% of 500 IT leaders told Sectigo they're very prepared for TLS renewals because it's automated. 4% automate more than 90% of them. 61% had a cert outage or incident last year, per Help Net Security. Max cert life: 200 days. 47 by 2029. Confidence renews itself. Certs don't.