Security Boulevard

How Cybercriminals Are Repackaging Infostealer Data Over the last year, the underground economy has undergone a significant transformation. Cybercriminals are no longer focused on distributing massive collections of raw infostealer logs, they are increasingly investing time in organizing and enriching stolen information into service-specific compilations. These datasets are no longer random collections of credentials extracted from infected endpoints.

Scott Wright joins Shared Security to discuss his Digital Legacy Tree framework and upcoming book, The Digital Legacy Tree. We talk about what happens to your accounts, passwords, devices, files, money, cloud storage, crypto, and online identity if you die, become incapacitated, or are suddenly unavailable — and how to plan for trusted access without weakening your security today.

Apollo Global Management has disclosed a data breach involving sensitive personal information after attackers gained access to parts of its cloud environment. The breach occurred between July 6 and July 10, 2026. Apollo later determined that the affected information may include names, dates of birth, contact details, home addresses, and Social Security numbers. The company has not disclosed how many people were affected or which cloud platforms were accessed.

Only 13% of enterprises have deployed passkeys at scale. Yet 93% are somewhere in the pipeline, according to a June 2026 FIDO Alliance and HID study of 500 IT and security decision-makers across the US, Canada, UK, France, and Germany. That is an 80-point gap between “started” and “actually running in production.” I have reviewed enough of these rollouts, first scaling authentication at LoginRadius past a billion users, now building GrackerAI, to know where that gap usually comes from.

Legacy applications or legacy development processes Fragmented tools and disconnected workflows Security, governance, or compliance requirements Limited automation across the delivery lifecycle Difficulty integrating AI into software delivery workflows Skills or resource constraints Organizational or cultural resistance to change Limited visibility across the software delivery lifecycle Budget or investment constraints Nothing is significantly limiting our progress

For many UK SMEs, the real question is not whether you have security tools in place, but whether those tools would actually spot a problem in time. A business can spend money on antivirus, logging, and monitoring, yet still miss the events that matter most. That gap is what we mean by detection coverage and blind spots. In business terms, poor coverage means a threat can sit unnoticed for longer, do more damage, and cost more to recover from.

A former board member still had access to sensitive files, ten months after the term ended, and nobody on the legal team noticed until an internal audit turned it up. Cases like that rarely make headlines, but the files involved were merger terms, litigation strategy, and unreleased financial results. Most enterprise software treats permissions as a setup task, confirmed once when an account is created and rarely reviewed after that.

CMMC compliance assessments represent a critical evolution in protecting controlled unclassified information (CUI) across the defense industrial base. As organizations navigate CMMC 2.0 requirements in 2026, understanding the nuanced differences between self-attestation and third-party assessments becomes essential for CISOs and compliance officers managing NIST SP 800-171 Rev 3 controls.

In 2026, forward-thinking organizations recognize that ISO 42001 certification transcends checkbox compliance, emerging as the strategic convergence point where AI governance meets rigorous multi-framework risk management. Lazarus Alliance experts observe that AI systems now underpin critical operations across defense, healthcare, and financial services, demanding controls that simultaneously satisfy ISO 42001, NIST 800-53, CMMC, and FedRAMP requirements without creating redundant audit fatigue.

Legacy applications or legacy development processes Fragmented tools and disconnected workflows Security, governance, or compliance requirements Limited automation across the delivery lifecycle Difficulty integrating AI into software delivery workflows Skills or resource constraints Organizational or cultural resistance to change Limited visibility across the software delivery lifecycle Budget or investment constraints Nothing is significantly limiting our progress