Weekly Threat Intelligence Briefing - March 16, 2026

PSY LOGISTICS TECHNOLOGY PARTNERS

Cyber Intelligence Briefing

Monday, March 16, 2026|For Business Leaders & Executives

Every Monday I cut through the noise to bring you what actually matters in cybersecurity — framed for the C-suite, not the SOC. This week: a critical vulnerability actively exploited in enterprise networking gear since 2023, a government contractor breach affecting 25 million people, a fundamental shift in how CEOs are thinking about AI risk, and the numbers that should reshape your cyber investment strategy.

🚨THE BIG STORY: Cisco SD-WAN — A 3-Year Blind Spot

Nation-State Actors Exploited Federal Networks Since 2023CRITICAL

On February 25, CISA issued Emergency Directive 26-03 — one of the most serious federal cybersecurity orders in recent memory. The directive targets two vulnerabilities in Cisco Catalyst SD-WAN systems: CVE-2026-20127 (CVSS 10.0, authentication bypass) and CVE-2022-20775 (privilege escalation). Forensic analysis confirmed threat actors — working with Five Eyes intelligence partners — had been silently present in federal networks since at least 2023.

SD-WAN is the backbone of how modern enterprises connect offices, data centers, and cloud environments. This isn't a niche government IT problem — the same products and the same vulnerability patterns run across thousands of private-sector organizations.

What Executives Need to Know:

•If your organization runs Cisco Catalyst SD-WAN (vManage/vSmart/vBond), treat this as Priority 1 — patch immediately and hunt for indicators of prior compromise.

•CISA notes the attack vector: a rogue device injected into the SD-WAN management plane, appearing as a legitimate component. Adversaries then escalated privileges and moved laterally — often erasing forensic evidence behind them.

•The geographic scope is global. The techniques will migrate to commercial targets.

💥BREACH SPOTLIGHT: The Conduent Cascade — 25 Million and Counting

Third-Party Risk in Full Display

Conduent — a major government services contractor processing food assistance, unemployment benefits, and workplace services for over 100 million Americans — has confirmed that a January 2025 ransomware attack has now compromised data for at least 25 million individuals. The breach has rippled across multiple agencies and organizations, including Volvo Group North America (17,000 employees impacted) via the same contractor.

Compromised data includes Social Security numbers, dates of birth, health insurance details, and financial information.

The Executive Lens:

•This is a textbook third-party risk failure. Conduent was the single point of failure for dozens of organizations that had no direct knowledge of the breach for months.

•The average time to identify and contain a breach is now 241 days (Breach Sense, 2026). Conduent's breach went public more than a year after initial compromise.

•Ask your team today: Do you know which vendors have access to your most sensitive data? Are they contractually required to notify you within 72 hours of a breach?

🧠THE SHIFT: CEOs Are Rethinking AI Risk — And Getting It Backwards

GenAI Data Exposure Has Surpassed 'Adversarial AI' as the #1 CEO Fear

The World Economic Forum's 2026 Global Cybersecurity Outlook reveals a striking reversal in executive thinking. Last year, 47% of CEOs cited adversarial AI capabilities as their top GenAI concern. This year, that number has dropped to 29%. Meanwhile, fear of unintended data exposure through GenAI tools has surged from 22% to 34%.

Translation: the C-suite has stopped worrying primarily about AI-powered attacks and started worrying about what their own employees and tools are inadvertently leaking. That's the right problem — and most organizations are not equipped to address it.

Three Questions for Your Leadership Team:

•Are employees using personal GenAI tools (ChatGPT, Gemini, Copilot) to process proprietary business data, client information, or competitive intelligence?

•Does your acceptable use policy explicitly address AI tools? Have employees acknowledged it in the last 12 months?

•Do you have technical controls that prevent sensitive data from being submitted to external AI platforms?

PwC's 2026 Global Digital Trust Insights adds important context: 60% of business leaders globally now rank cyber risk investment in their top three strategic priorities in response to geopolitical uncertainty. But only 24% are spending significantly more on proactive measures than reactive ones. The math on that doesn't work — reactive cyber spending (legal, PR, remediation, fines, lost revenue) consistently exceeds proactive investment by a factor of 3 to 10.

📊NUMBERS THAT MATTER THIS WEEK

$4.44M — average cost of a data breach in 2025 (IBM). Nearly $5M projected for 2026.

$1M — the savings when organizations identify and contain breaches within 200 days vs. those who don't.

108 days — faster breach detection for organizations using AI in their security programs.

15% — of cybersecurity spending now originates outside the CISO function, growing at 24% CAGR.

64% — board alignment with CISOs, down from 84% in 2024. A warning signal for governance.

11 — publicly disclosed data breaches per day globally, based on 2025 figures.

⚡CVE RADAR: What Your IT Team Should Be Patching Now

CISA added multiple critical vulnerabilities to its Known Exploited Vulnerabilities catalog this week. These are confirmed in-the-wild exploits — not theoretical risks.

CVE-2026-3909 / CVE-2026-3910 — Google Chrome (Skia + V8 engine). Out-of-bounds write and unspecified flaw. Actively exploited in browser attacks. Update Chrome on all endpoints immediately.

CVE-2026-1603 — Ivanti Endpoint Manager. Authentication bypass. Ivanti has had multiple critical issues this year — if you're running EPM, patch now.

CVE-2026-22719 — VMware Aria Operations. Command injection, CVSS 8.1. Unauthenticated attackers can execute arbitrary commands. Federal patch deadline: March 24.

CVE-2025-26399 — SolarWinds Web Help Desk. Deserialization vulnerability. SolarWinds remains a high-value target. Verify your patch status.

CVE-2021-22681 — Rockwell Automation Studio 5000 Logix Designer. CVSS 9.8. Authentication bypass in industrial control systems. OT environments must prioritize.

🎯STRATEGIC SIGNAL: The CISO Is Becoming a Business Executive

Multiple converging signals this week point to a structural transformation in security leadership. Deloitte data shows 41% of boards now discuss cybersecurity monthly — a cadence reserved for critical enterprise risks. More than half of organizations (52%) now place OT and operational technology security under the CISO, up from just 16% in 2022. And cybersecurity spending outside the CISO function is growing at 24% annually, driven by CFOs, COOs, and product leaders making their own security investments.

What this means for non-security executives: your CISO should be presenting in business terms — loss scenarios, revenue impact, resilience KPIs — not firewall statistics. If that conversation isn't happening at your leadership table, it's a governance gap. Forward-thinking boards are asking for a 'security charter' that links cybersecurity investment directly to revenue protection, customer trust, and operational continuity.

Cyber risk is no longer an IT problem. It is a business continuity problem, a revenue protection problem, and a leadership credibility problem.

Drop a comment or DM me if any of these stories are hitting close to home in your organization. I consult with executive teams across the Defense Industrial Base, maritime, energy, and commercial sectors — happy to talk through what these threats mean for your specific context.

#CyberSecurity #ExecutiveRisk #CISO #DataBreach #CyberResilience #BusinessLeadership #CyberIntelligence #RiskManagement #PSYLogistics

Craig Wood, CISM, CCA Lead Assessor, ISO 27001 Lead Auditor

CEO & Founder | PSY Logistics Technology Partners, Inc. | Houston, TX / Littleton, CO

vCISO Services · CMMC Compliance · Maritime Cybersecurity · ISO 27001