Alex: Welcome to Cleartext. It's Friday, October 2nd, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: We have a packed show today. Epic Systems has hit the brakes on all product development to fix security bugs threatening patient data. Two federal agencies breached in a single month. A critical FortiMail zero-day is being exploited right now. We've got China targeting AI policy experts, a ransomware group run by a teenager getting dismantled, Microsoft telling us AI is rewriting the rules for attackers, the National Cyber Director laying groundwork for AI governance, a fascinating Intel 471 report on criminal insider recruitment, and Kevin Mandia is back with a quarter-billion-dollar startup. Let's start where the operational urgency is highest.

Jordan: Yeah, let's talk about the FortiMail zero-day first because if you're running FortiMail, this is your Friday. CVE-2026-104286. CVSS 9.8. Unauthenticated arbitrary file write. It's on FortiMail, which sits at the perimeter for a lot of organizations handling email security. CISA added it to the KEV catalog Thursday, which means federal agencies are on the clock under BOD 22-01. Fortinet has a workaround out, patches still in development, and exploitation is confirmed in the wild.

Alex: So the action items here are straightforward. If you run FortiMail, apply the workaround today. Don't wait for the patch. Check your environment for indicators of compromise. And if you're a federal contractor or supplier, understand that your agency partners are going to be asking questions about this one.

Jordan: The broader pattern is worth noting. Fortinet perimeter devices have become a recurring theme in vulnerability disclosures over the past two years. If you're a CISO still running a heavy Fortinet edge stack, this is another data point for your architecture review conversations.

Alex: Let's stay on the breach side. The Ars Technica story about two federal agencies getting popped within a thirty-day window is significant not because of the technical details, which are still emerging, but because of what it signals structurally.

Jordan: Right. When you see back-to-back breaches at the federal level described as producing a bonanza of sensitive data, that's not a one-off. That's a pattern. And patterns at the federal level always produce downstream effects. Congressional scrutiny increases. GAO gets involved. And inevitably, new compliance requirements flow to contractors and suppliers in the critical infrastructure ecosystem.

Alex: If you're a CISO at an organization that does business with federal agencies, or if your data flows touch federal systems, I'd be getting ahead of this. Review your FedRAMP posture. Make sure your supply chain security documentation is current. Because the policy response to these breaches is going to land on your desk, probably within the next two quarters.

Jordan: And it's going to land in the context of an administration that's already signaling it wants structured public-private partnerships on security, which brings us to the National Cyber Director's comments.

Alex: Sean Cairncross was at a public forum Thursday explicitly framing AI risk management as a shared government-industry responsibility. He talked about regulations, pilot projects, competition with China. The key signal for CISOs is that the administration appears to be leaning toward collaborative frameworks rather than unilateral mandates. That's a window.

Jordan: It's a window that won't stay open forever. If you have a seat at the table, whether through industry groups, ISACs, or direct agency relationships, now is the time to shape those frameworks before they're handed to you as requirements.

Alex: Which connects directly to our lead geopolitical story. China-linked TA419 is running credential phishing campaigns impersonating a former White House Office of Science and Technology Policy official and prominent economists, targeting AI policy experts in the United States.

Jordan: This is Proofpoint's research, and it's a textbook example of how nation-state espionage adapts to strategic priorities. China isn't just interested in stealing AI models or training data. They want to know what the policy landscape looks like. They want to understand what regulatory decisions are being shaped, what competitive moves are being planned. And they're going after the people who inform those decisions.

Alex: The tradecraft here is notable. High-credibility impersonation of real, prominent figures. Cloud account credential harvesting. This isn't spray-and-pray. These are tailored campaigns against a very specific community.

Jordan: If your organization is involved in AI strategy, AI policy, or if your executives interact with government AI stakeholders, your executive protection program needs to account for this. That means enhanced email authentication, targeted phishing simulations for your policy-facing staff, and frankly, conversations with those executives about the specific threat they represent as targets.

Alex: The impersonation angle is important. When a phishing email appears to come from a former White House official, the social engineering leverage is enormous. Traditional security awareness training doesn't always prepare people for that level of sophistication.

Jordan: No, it doesn't. And it's worth saying plainly, if you're a CISO at a think tank, a university research center, or a tech company with an active AI policy team, you are in the crosshairs. Act accordingly.

Alex: Let's shift to Epic Systems, because this is one of the more unusual stories we've covered. Epic, the maker of MyChart, the dominant electronic health records platform in the United States, has paused all product development to focus on fixing security bugs that risk patient data.

Jordan: I can count on one hand the number of times a major enterprise software vendor has voluntarily halted all product development for security remediation. This is not a routine patch cycle. This is a company saying the problem is systemic enough that we need to stop everything else.

Alex: And the downstream implications are massive. Epic's EHR platform is used by the majority of large US health systems. If there are security vulnerabilities in that platform, the exposure extends to hundreds of millions of patient records. HIPAA breach notification requirements could come into play. State attorneys general could get involved.

Jordan: Healthcare CISOs should be on the phone with their Epic account teams today if they aren't already. You need to understand which bugs are being fixed, what your exposure is, and what interim controls you should be putting in place. And if your organization has custom integrations with Epic, which most large health systems do, you need to assess whether those integrations introduce additional risk surface.

Alex: Beyond healthcare, this is a signal to every CISO about vendor concentration risk. When your most critical platform has a systemic security problem, your options are limited. That's a risk that belongs on the board's radar.

Jordan: Let's talk about Microsoft's 2026 Digital Defense Report, because it provides the macro context for almost everything else we're discussing today.

Alex: Microsoft's report covers July 2025 through June 2026, a full year of telemetry, and the headline finding is that threat actors are adopting AI faster than defenders. AI is accelerating vulnerability weaponization, malware generation, and post-compromise lateral movement. Microsoft's phrase was that AI is changing the physics of cybersecurity.

Jordan: I appreciate that framing because it's not hyperbole. When you compress the time between vulnerability disclosure and weaponized exploit from days to hours, that's not an incremental change. That's a phase shift. The defensive playbooks that assume you have a patch window of seventy-two hours or even forty-eight hours are being invalidated.

Alex: This is board-level material. If you need ammunition for your next budget conversation about AI-driven defense capabilities, this report is it. Microsoft is essentially saying the gap between attacker and defender adoption of AI is a structural problem, not a tactical one. Structural problems require structural investment.

Jordan: And it ties directly to the Armadin story. Kevin Mandia, who built Mandiant and sold it to Google for five point four billion, has launched a new startup using autonomous agent swarms for continuous security testing. They just raised two hundred fifty-five million at a two and a half billion dollar valuation.

Alex: That valuation tells you where institutional money thinks the market is going. Autonomous, AI-driven offensive testing as a continuous capability, not a periodic engagement. CISOs should expect two things. First, vendor outreach from Armadin and competitors building similar capabilities. Second, board members reading about this in the Wall Street Journal and asking why your red team isn't autonomous yet.

Jordan: My take is to watch the space but be cautious. Mandia's pedigree is real, but agent swarm technology in security is still early. The organizations that will benefit most are the ones with mature security operations that can actually act on what autonomous testing surfaces. If your fundamentals aren't solid, autonomous red-teaming just generates noise.

Alex: Agreed. Quick hit on the KillSec takedown. Authorities from multiple countries arrested three members of the KillSec extortion group, including an alleged sixteen-year-old mastermind, and seized their leak site and infrastructure. They'd claimed roughly five hundred victims in under two years.

Jordan: A teenager-led operation hitting five hundred organizations is a commentary on the accessibility of ransomware tooling. The barrier to entry is effectively zero. The takedown is good news, and it shows law enforcement coordination is working, but the affiliates who used KillSec infrastructure will migrate to other platforms within weeks. The threat doesn't disappear. It reorganizes.

Alex: And finally, the Intel 471 report on criminal insider recruitment. This is one that I think deserves more attention than it's going to get.

Jordan: It absolutely does. Intel 471 documented a thriving underground market where cybercriminals actively recruit current employees at targeted organizations. Not disgruntled insiders who go looking for buyers on their own, but employees who are approached by brokers offering payment for routine privileged actions. Information lookups, account resets, transaction approvals, shipment modifications.

Alex: This reframes insider threat. It's not just about the unhappy employee with an axe to grind. It's about the employee who's approached by someone offering real money for something that feels low-risk. Your insider threat program needs to account for external recruitment, which means monitoring for unusual patterns in routine privileged actions, not just data exfiltration indicators.

Jordan: And it means having honest conversations with your workforce about the fact that they may be targeted. This isn't a trust issue. It's a reality of the threat environment.

Alex: All right, let's look at what's emerging. Jordan, what's the thread that ties this week together for you?

Jordan: Speed and structure. AI is compressing attacker timelines, zero-days are being exploited before patches exist, and the adversary ecosystem is becoming more structured, whether it's nation-state phishing operations or criminal insider recruitment markets. The common thread is that the pace of threat evolution is outrunning the pace of defensive adaptation at most organizations.

Alex: I'd add that this week shows the consequences of concentration risk. Epic's pause affects the majority of US health systems. FortiMail sits at the perimeter for thousands of organizations. Federal agency breaches cascade to every supplier in the chain. The strategic question for CISOs heading into Q4 budget season is whether your security investment is keeping pace with the structural shifts Microsoft is describing, or whether you're still funding last year's threat model.

Jordan: Watch for the policy response to those federal breaches. Watch for Epic's remediation timeline. And if you run FortiMail, don't leave the office today without confirming that workaround is in place.

Alex: That's our show for Friday, October 2nd. Show notes and links to every story we covered are at cleartext.fm. Have a good weekend. Stay sharp.

Jordan: See you Monday.