Policy
The SEC proposed a path for crypto custody
Advisers and funds would get a custody rule written for crypto assets. Self-custody is only “under certain circumstances.” The comment clock starts at the Federal Register.
Lead
Latest briefing
All briefings
Policy
Citrix NetScaler is on the exploited catalog again
CISA added CVE-2026-88779 on October 4. The federal due date is October 7. The September NetScaler rows are a different pair of bugs.
Technology
Astra Ultrafast is a speed claim. The bill is still yours.
NVIDIA says the mode is up to 8x faster than Astra Standard on token generation. That comparison is theirs. Price sits on OpenAI’s guide.
Technology
NVIDIA put the fence outside the agent
On September 28 NVIDIA posted that OpenShell enforces permissions, and that a BlueField chip can watch the agent from outside the software it runs in.
Policy
CISA listed three bugs attackers are already using
WordPress, Apple, and Cisco SD-WAN Manager landed on the known-exploited list in five days. The catalog, not the post, holds the due date.
Technology
Gartner revised the AI bill. Most of it is not your budget.
The September forecast is $2.7 trillion, up 49.5%. About 56% of the table is infrastructure. The check a company signs is the feature inside software it already owns.
Technology
Five moves Gartner wants from a CISO before 2027
Gartner says 54% of organizations do not limit what an AI agent can touch, and 51% have not started post-quantum work.
Policy
The EU AI Act did not slip. The high-risk part did.
Transparency has applied since August 2. Stand-alone high-risk duties wait until December 2, 2027.
Policy
The software ingredients list now covers the suite
CISA’s July revision of the SBOM minimum elements applies to SaaS and AI software, not only to code you compile.
Policy
The SEC clock starts when you decide it matters
Form 8-K gives a public company four business days after the materiality call, not after the first alert.
Technology
AI spend is not the same as AI return
Gartner’s May figure was $2.59 trillion. McKinsey still finds only a minority of firms attributing EBIT to it. Updated for the September revision.
Policy
Chip licenses keep moving. The mid-tier still waits.
BIS opened a case-by-case window for H200-class chips. Korea tightened AI-chip exports on Sept. 1.
Business
Cyber insurance got cheaper. The questionnaire did not.
Swiss Re puts 2026 global cyber premium at $16.4 billion with rates still down. The application still wants MFA.
Business
Software buying is an operating skill
The stack is no longer an IT catalog. It is how the company actually runs — and most firms still buy it like office supplies.
Policy
When compliance is the product
Data residency, audit trails, and model clauses are no longer legal footnotes. They are packaging.
Technology
The AI productivity paradox at mid-market companies
Tools landed in every department. Output did not. The bottleneck is workflow, not the model.
Markets
Private credit is quietly funding the software roll-up
When public markets froze on multiples, direct lenders stepped in — and started acting like operators.
Policy
Chip export controls and the suppliers caught in between
Policy is written in Washington. The P&L lands on toolmakers, packagers, and the mid-tier vendors nobody briefed.
Business
Cyber insurance is rewriting the IT budget
Underwriters now ask better questions than some boards. The answers are showing up as line items.
Startups
The new unit economics of AI-native startups
Gross margin is no longer a software story. Token costs, evals, and human review decide who scales.
Technology
Cloud repatriation: when the bill becomes the strategy
Finance is pulling workloads home. Engineering is discovering that “home” is a product decision, not a protest.
Opinion
Six questions every board should ask about generative AI
Most decks still sell possibility. Directors need a control framework that survives the next vendor cycle.
Business
Retail media networks are eating the digital ad market
Closed-loop purchase data beat the open web. The next fight is over who owns the aisle.
Guides
All guidesGuides
Limit what an agent can touch
Gartner found that 54% of organizations do not limit agent access, or they let the agent inherit a person’s access.
Guides
Ask a vendor for an SBOM
The 2026 CISA fields, including for SaaS. A logo slide is not an ingredients list.
Guides
What Article 50 asks a buyer
Transparency since August 2. Marking transition ends December 2. High-risk is a different date.
Guides
Before the Form 8-K clock
Four business days from the materiality call. Name who can make it.