United States: Cybersecurity

The Defense Counterintelligence and Security Agency has released its 2026 annual report revealing alarming trends in foreign exploitation of U.S. cleared contractors and sensitive technologies. With over 22,000 suspicious contact reports and 2,900 identified incidents in FY 2025, the report exposes how foreign entities systematically target subject matter experts and leverage cyber operations to access classified information. The analysis highlights critical shifts in threat patterns, communication methods,

The FBI has released its first unclassified Cyber Strategy, outlining a comprehensive framework organized around four pillars: disrupting adversaries, supporting victims, strengthening partnerships, and building capabilities. This strategy operationalizes President Trump's Cyber Strategy for America and introduces significant changes to how the Bureau engages with private-sector entities...

The Cybersecurity and Infrastructure Security Agency's final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act has advanced to White House Office of Management and Budget review, signaling the rulemaking process may be nearing completion. This development creates a narrow window for stakeholders to engage with the Administration through EO 12866 meetings to address concerns about regulatory harmonization, compliance burdens, and implementation timelines before the rule is finali

Ankura's latest insights explore critical developments across cybersecurity, supply chain disruption, healthcare compliance, and financial crime enforcement. From AI-driven malware threats and tariff-induced supply chain reconfigurations to evolving cryptocurrency sanctions enforcement and clinical trial participant support regulations, these analyses examine how organizations navigate operational, regulatory, and strategic challenges in an increasingly complex risk landscape.

The $285 million theft from Drift Protocol serves as a high-stakes reminder that the human element remains one of the biggest cybersecurity gaps in any organization. This was not a “hack” in the traditional sense of breaking through a digital wallet. North Korean actors used sophisticated social engineering to exploit human trust – highlighting what looks like a “hacking” risk into valuable lessons learned for cybersecurity oversight.

Data sovereignty has become a geopolitical fault line. Governments from Washington to Hanoi are asserting control over information flows in ways that directly reshape how tech companies design their platforms, structure their organizations, and plan market expansion.

A federal court in Illinois recently dismissed a False Claims Act cybersecurity case against Archer Daniels Midland, ruling that the plaintiff failed to demonstrate that alleged cybersecurity deficiencies were material to the government's payment decisions. The decision provides critical guidance on what plaintiffs must prove to successfully bring FCA claims based on cybersecurity noncompliance, particularly regarding materiality requirements that go beyond mere contractual conditions of payment.

The Department of Justice secured a $2 million settlement with Honeywell Aerospace for allegedly failing to comply with NIST SP 800-171 cybersecurity requirements under a Department of War contract. This case demonstrates how cybersecurity compliance failures can trigger False Claims Act liability even without an actual data breach or cyberattack, and highlights the growing role of whistleblowers in exposing contractors' gaps between contractual obligations and actual security practices.

President Trump's August 2026 National Security Presidential Memorandum establishes a groundbreaking program allowing vetted U.S. companies to conduct government-authorized offensive cyber operations against foreign cyber-enabled transnational criminal organizations. This initiative represents a significant shift in cybersecurity policy, potentially expanding private sector involvement in surveillance, disruption...