This week’s Department of Know is hosted by Sarah Lane with guests Dmitriy Sokolovskiy, senior vice president, information security, Semrush, and Nick Espinosa, host, The Deep Dive Radio Show
Missed the live show? Check it out on YouTube
The Department of Know is live every Monday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com
Jen Easterly to helm RSAC
The RSA Conference, host of the world’s largest and most influential cybersecurity conference, announced yesterday that Easterly has been appointed as its Chief Executive Officer. Easterly is a leading cybersecurity expert, highly decorated U.S. Army veteran, and the former Director of CISA. As CEO, she will “guide RSAC’s global portfolio, including its annual flagship conference in San Francisco; expanded international programming; the renowned Innovation Sandbox contest and startup ecosystem; RSAC’s emerging professional membership platform; education initiatives; and programs focused on AI security, secure software development, and global collaboration.”
Two-thirds of third-party applications access sensitive data without justification, says report
The report, released this month by researchers at Reflectiz, analyzed 4,700 leading websites over a 12-month period ending in November of last year. It suggests that 64% of third-party applications access sensitive data without business justification, up from 51% in 2024. Government sector and education sites showed the most active compromise, with Google Tag Manager, Shopify and Facebook Pixel showing up consistently as “specific offenders.” The report highlights “a growing governance gap termed unjustified access referring to instances where third-party tools are granted access to sensitive data without a demonstrable business need.” A link to the report is available in the show notes to this episode.
AI industry insiders launch site to poison the data that feeds them
A group calling themselves Poison Fountain is seeking to get website admins to add Poison Fountain URLs to their websites, with the goal being to implant bad data for AI crawlers to find and process as part of AI training. This is being attempt in an effort to undermine AI’s intelligence models. According to one individual on the project, its goal “is to make people aware of AI’s Achilles’ Heel – the ease with which models can be poisoned, and to encourage people to construct information weapons of their own.”
Huge thanks to our sponsor, Dropzone AI
If you don’t know those numbers, or you don’t like them, Dropzone AI can help.
They’ve helped enterprises like UiPath and Zapier handle ten times more alerts without adding headcount. Their AI SOC agents work around the clock, investigating every alert autonomously.
Book a demo and they’ll show you exactly how many hours you could recover.
Head over to dropzone.ai and request your demo today at dropzone.ai.
JPMorgan discloses law firm data breach
JPMorgan is notifying investors about a data breach tied to an incident at law firm Fried Frank, the same intrusion that prompted Goldman Sachs disclosures in late 2025. An unauthorized party copied files from a shared drive containing names, contact details, account numbers, SSNs, and passport or government ID numbers for 659 private equity fund investors. JPMorgan and Goldman say their own systems weren’t compromised. Fried Frank faces lawsuits and says it contained the incident, engaged external responders, and involved law enforcement. (SecurityWeek)
UK police blame Microsoft Copilot for intelligence mistake
The chief constable of West Midlands Police, one of Britain’s largest police forces, has admitted that Microsoft’s Copilot AI assistant made a mistake in creating an intelligence report that included a hallucination of a nonexistent soccer match between London team West Ham United and a visiting team, and Maccabi Tel Aviv. The report “led to Israeli football fans being banned from a match last year. Initially the forced denied that AI had been used in preparing the report, blaming “social media scraping” and a Google search result for the error. Microsoft has not yet confirmed that Copilot was involved in this particular mistake, but said in a statement to The Verge that the British police force “should be reviewing the sources of information that Copilot provides. It added, “Copilot combines information from multiple web sources into a single response with linked citations. It informs users they are interacting with an AI system and encourages them to review the sources.”
U.S. weighs private companies’ cyberwarfare roles
The US administration is considering a policy shift that would let private companies play a more direct role in offensive cyber operations, according to former senior officials speaking with the New York Times. The move would expand the current model where firms can build tools but not conduct attacks, and would require changes to federal law plus congressional approval. The idea is expected to surface during the confirmation hearing for NSA and U.S. Cyber Command nominee Lt. Gen. Joshua Rudd, raising open legal and operational questions about outsourcing cyberwarfare to the private sector.
DeadLock uses smart contracts to hide work
Group-IB researchers say the DeadLock ransomware crew, first spotted in mid-2025, is using Polygon smart contracts to hide its command-and-control infrastructure. Instead of double extortion, DeadLock encrypts systems and threatens to sell stolen data on underground markets. Its smart contract system rotates proxy addresses, complicating blocking efforts and mirroring tactics recently seen in North Korean campaigns. Access vectors aren’t clear, but earlier Cisco Talos reporting linked DeadLock to BYOVD techniques and EDR-kill exploits.