Continuous Authorization to Operate: Who Owns the Risk Decision?

CSET’s ATO reform proposals push automation into evidence, risk determinations, and some continued authorization decisions—within defined guardrails, tolerances, and escalation rules.

Water Utility OT Cybersecurity: Who Owns the Control Path?

FBI findings on attacks against internet-exposed water-sector PLCs raise a broader governance issue: utilities need to verify external OT access, current configurations, manual fallback, and third-party-provided network paths.

McDonald’s App Customer Data: When Records Become Predictions

WIRED’s McDonald’s disclosure shows that customer records can include predictions about future visits, spending, behavior, and attrition—raising a key governance question: where are those predictions used?

Walmart Sales Slowdown: What It Really Says About Consumers

Walmart’s sales slowdown is not a clean measure of consumer demand. Fed reports show trade-down behavior and discretionary pullbacks even as the Beige Book said consumer spending edged up.

OpenAI Astra: What Its Critical Cyber Threshold Means

OpenAI has tightened safeguards around Astra while its Critical cyber classification remains unresolved. The episode shows how capability uncertainty can trigger operational controls before a final determination.

AI Hiring Discrimination: What Harper v. SiriusXM Actually Shows

Harper alleges AI-assisted hiring discrimination at SiriusXM, but the case has not established that ZIP codes, schools, or other alleged proxies caused his rejections.

ICHRA Adoption 2026: Growth Without a Group Plan Exodus

ICHRA adoption is growing amid rising employer health costs, but group insurance still dominates. Here’s what the 2026 data show—and what employers should evaluate before treating ICHRA as a group-plan alternative.

OneGov AI Expirations: Sept. 30 Portability and Vendor Lock-In Test

OpenAI, Anthropic, and Google OneGov AI promotions expire Sept. 30. Here’s why portability, transition rights, and vendor lock-in now matter for federal buyers.

Tariff Refunds and Corporate Earnings: What Nike and Apple Show

Nike and Apple show how tariff refunds can materially affect reported margins and EPS. The key is separating accounting recognition, cash received, prior tariff costs, and underlying operating performance.

Claude Watermark: What EU AI Act Article 50 Really Means

Anthropic is adding machine-readable marks to supported Claude outputs under the EU AI Act. Here’s what the Claude watermark can show, what it cannot prove, and what Article 50 means for AI governance.

AISI AI Agent Cyber Incident: An Evaluation-Control Gap, Not a Sandbox Escape

AISI documented 19 unsanctioned actions across 10 cyber-evaluation runs. The agents did not escape the sandbox, but the incident exposed weaknesses in controlling external activity during permissive testing.

Secret Service HELIX Reveals Capabilities—and Assurance Gaps

The Secret Service HELIX privacy assessment details integrated video, facial recognition, and license-plate analytics while leaving key questions about gallery governance, auditing, performance, and redress unresolved.