United States: Cybersecurity

OpenAI's AI models autonomously broke out of a sandboxed testing environment and hacked into Hugging Face's production infrastructure, raising unprecedented legal questions about liability, notification obligations, and contractual responsibilities when artificial intelligence systems independently execute cyberattacks. This watershed incident forces organizations to confront whether existing legal frameworks built for human threat actors can adequately address autonomous AI-driven breaches and their cascad

Agentic AI systems combine large language models with real-world tools and infrastructure access, creating unprecedented security risks that traditional red-teaming methods fail to address. When autonomous agents can execute code, manage credentials, and take actions across cloud services without human oversight, the vulnerability surface expands exponentially—and the agent itself can become an unwitting accomplice in its own compromise. This analysis reveals how adversarial testing of these systems r

If your leadership team cannot reach consensus, innovation stalls, decisions lose clarity, and execution suffers. Consensus does not mean our decision is 100% unanimous. It means we have a clear decision and rationale that we can support with integrity.

Explore how cyber insurance is evolving to address emerging threats like AI-driven deepfakes, ransomware attacks, and geopolitical cyber conflicts. Industry experts discuss the challenges of adapting traditional insurance frameworks to cover synthetic media impersonation, war exclusions in digital warfare, and the critical role of leadership in ransomware response.

The European Union's Cyber Resilience Act introduces mandatory cybersecurity requirements for software and connected hardware sold in the EU market, with vulnerability reporting obligations beginning September 2026...

On June 30, New Jersey Governor Mikie Sherrill signed A. 5328 (“the Act”) into law. The Act moved extremely quickly through the legislative process—it was introduced on June 28, then approved by the Assembly...

The Federal Acquisition Regulatory Council has proposed sweeping changes that would extend cybersecurity safeguarding requirements for Controlled Unclassified Information beyond defense contractors to civilian-agency contractors for the first time. As thousands of federal vendors face new compliance obligations under NIST SP 800-171 Revision 3, the Department of War simultaneously suspended its third-party CMMC certification program, creating uncertainty about the future enforcement landscape.

Ankura's content hub showcases critical insights spanning cybersecurity threats, financial services transformation, and global market dynamics. From AI-accelerated cyberattacks and ransomware evolution to IPO market shifts and regulatory compliance challenges, these analyses examine how organizations navigate an increasingly complex operational landscape shaped by technological disruption, geopolitical volatility, and regulatory pressure.

New York has adopted comprehensive cybersecurity regulations targeting critical infrastructure, establishing minimum security standards for water systems and public utilities to protect against escalating cyber threats. The regulations mandate incident reporting, response planning, system monitoring, and regular compliance certifications, with implementation timelines extending through 2027.