Insights

Severity: CriticalDate: October 21, 2026 Security researchers have identified a critical vulnerability in PHP, a widely used web application programming language. Immediate Action to Take Customers using PHP for websites, applications, and/or APIs must immediately update their PHP version to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. These PHP versions were released October 21st, and any…

For many hedge funds, outsourcing IT is an operational necessity. Managed service providers play an important role in maintaining infrastructure, supporting users and keeping technology running effectively. But there is an important distinction between managing your technology and independently assessing how secure it is. If the same provider is responsible for both, hedge fund managers…

Private equity firms spend years preparing businesses for stronger exits. Financial performance is improved. Operations are professionalized. Management teams are strengthened. Technology is upgraded. Governance matures. Cybersecurity increasingly belongs on that list. The problem is that cyber readiness can still receive disproportionate attention late in the exit process when a buyer’s diligence team begins asking…

Closing a deal does not close the cyber diligence process. In many respects, it is where the more important work begins. The acquisition process may have identified vulnerabilities, control gaps and areas requiring improvement. Once the company enters the portfolio, however, the sponsor has an opportunity to turn those findings into a structured program of…

Cyber risk has become increasingly difficult to separate from investment risk. For private equity firms assessing an acquisition, the technology environment, security controls and cyber maturity of the target can all influence what happens after the deal closes. Weaknesses that are not identified during diligence do not disappear at completion. They become part of the…

The emergence of AI-powered software engineering tools such as OpenAI Codex and Anthropic Claude Code has fundamentally changed how organizations develop applications. Firms with previously no development capabilities are now able to create applications. These tools enable “vibe coding,” a development approach where users describe desired functionality in natural language and AI generates significant portions…

For most hedge funds, the challenge is no longer knowing that cybersecurity needs attention. It is knowing where that attention should go next. There will always be another control to strengthen, vulnerability to address or process to review. But time, budget and internal resources are finite. The question is not simply what you could improve.…

Last year, the SEC’s FY2026 Exam Priorities identified “emerging financial technologies” as an area of focus and Drawbridge prioritized AI as part of our broader cybersecurity guidance to clients. Recent SEC exams indicate a shift towards evaluating AI as a standalone risk area, rather than generalizing it as part of a larger audit. The SEC…

Cybersecurity has become increasingly measurable. Hedge fund managers can assess controls, identify vulnerabilities, track remediation and monitor changes in their cyber posture over time. But there is still a fundamental question that many firms struggle to answer: How good is good enough? Knowing that your cybersecurity program has improved is valuable. Knowing how that program…

Drawbridge Advisory Notice Executive Summary Our Advisory Team is monitoring reports of a series of sophisticated cyberattack attempts targeting major Wall Street investment firms, including Two Sigma, Citadel, Point72 Asset Management, and several private equity organizations (ref: Two Sigma, Citadel, Point72 Targeted in Sophisticated Wall Street Cyber Attacks – Bloomberg) . According to public reporting,…

The Challenge Blocking AI isn’t a strategy. The productivity benefits are too compelling. Employees will continue experimenting with new tools and new capabilities will continue emerging. The question isn’t whether AI should be used. It’s whether firms understand how it is being used. Historically, cybersecurity focused on attackers outside the walls. Tomorrow’s risk may originate…

The Challenge Every prompt creates a data journey. Employees are increasingly using AI to summarize notes, draft emails, analyze spreadsheets and automate repetitive tasks. But many organizations haven’t stopped to consider what happens after someone presses Enter. Information doesn’t simply disappear. It is processed, stored and managed somewhere. Historically, firms focused on governing email, cloud…