EvidenceIQ

EvidenceIQ A modern audit workspace built to support professional judgment.

10/22/2026

A flaw in a certificate authority's key-generation process created potentially serious risks for website authentication.

Google, Apple, Microsoft, and Mozilla moved to block the affected certificates.

This is an interesting example of how much internet security depends on providers most organizations rarely think about.

10/21/2026

SOC 2 is getting some company.

The AICPA and AIUC announced a joint assurance offering that adds live AI-agent testing to traditional SOC 2 examinations.

Good direction. A vendor’s controls matter, but so does how its agents actually behave.

10/19/2026

The U.S. is banning DeepSeek from civilian federal systems.

The directive also covers third-party products built using DeepSeek implementations.

Interesting vendor-risk problem.

You may know which software vendors you use. But do you know which AI models they’re using?

10/19/2026

Anthropic is exploring AI agents that negotiate deals for us.

Imagine buying a car and letting your AI argue with the dealership's AI for six hours.

Neither gets tired.

Of course, we'd want some guardrails. Spending limits, clear instructions, and probably a final approval from the person whose money is being spent. After all, you don't want your AI agreeing to a $40,000 purchase because it got a little too enthusiastic.

Still, this might be the best use of AI we've heard about all week.

G7 countries are planning cybersecurity exercises to simulate AI-enabled attacks against financial systems.We think that...
10/19/2026

G7 countries are planning cybersecurity exercises to simulate AI-enabled attacks against financial systems.

We think that's a worthwhile development.

Most organizations have incident-response plans, escalation procedures, and recovery documentation. But having those procedures written down doesn't tell you how well they'll work during an actual crisis, which is why exercises are valuable.

They expose assumptions, communication gaps, unclear responsibilities, and dependencies that may have been overlooked.

From an audit perspective, we'd want to see how organizations follow through on what these exercises uncover.

Were the weaknesses documented? Were corrective actions assigned? And did anyone verify that the problems were actually fixed?

10/19/2026

A compromised backup-provider credential has reportedly been used to access hundreds of Microsoft 365 environments.

ConnectWise has suspended its Cloud Backup service while investigating the incident. Here's what makes this particularly concerning:

The attackers were able to authenticate through application identities that customers had already authorized.

No employee needed to click a phishing link or approve an MFA request.

The permissions were already there.

And even after the affected applications were disabled, customers still needed to investigate whether unauthorized credentials or permissions had been added elsewhere.

This shows just how much access third-party applications can have to our environments, sometimes long after we've stopped thinking about the permissions we've granted them.

10/17/2026

CERN and Mistral are building an AI model trained on billions of particle collisions, which is pretty fascinating.

Instead of learning primarily from text, the model will learn from the data generated by particle physics experiments.

CERN already holds around one million terabytes of experimental data.

Imagine what researchers might discover if AI can help them analyze that information in ways that weren't previously practical.

We hear so much about AI writing code, generating images, and answering questions. We're particularly excited about what happens when we apply these capabilities to scientific discovery.

10/17/2026

OpenAI and Meta told a federal judicial panel yesterday that AI-generated audio and video are becoming increasingly difficult to distinguish from authentic evidence.

And while that concern is growing, the numbers suggest courts haven't encountered the problem very often.

Only 15 of 931 surveyed judges reported encountering a case where evidence was challenged as a deepfake.

That may change as AI-generated content becomes more convincing and accessible. And it has implications well beyond the courtroom.

If we can no longer reliably determine authenticity by examining the content itself, how much more important do the source, chain of custody, and supporting records become?

10/16/2026

OpenAI and Meta told a federal judicial panel yesterday that AI-generated audio and video are becoming increasingly difficult to distinguish from authentic evidence.

Here’s an interesting detail.

Only 15 of 931 surveyed judges reported encountering a case where evidence was challenged as a deepfake.

So the problem hasn’t become widespread in courtrooms yet.

But it raises an important question for anyone working with evidence.

If we can no longer reliably determine authenticity by examining the content itself, how much more important do the source, custody, and supporting records become?

10/16/2026

A cybersecurity incident at BAE Systems has disrupted bankruptcy notices across federal courts in the United States.

BAE operates the Bankruptcy Noticing Center on behalf of the federal judiciary, and the service has been unavailable for nearly a week.

That's a pretty significant dependency.

When assessing critical vendors, we spend a lot of time evaluating their security controls and recovery capabilities. But there's another question worth asking:

What happens to everyone depending on that service when the provider goes down?

Sometimes a single third-party disruption can affect an entire system.

Address

Denver, CO

Website

Alerts

Be the first to know and let us send you an email when EvidenceIQ posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category