Your IT vendor just got named in the settlement

I have been telling clients for two years that the vendor gets pulled in eventually, and here it is in black and white from two state AGs at once. If you process or host data for US customers, your exposure is no longer limited to whatever indemnity cap you negotiated, because a regulator is not a party to your MSA. Read your incident response plan again and ask who answers if a state AG writes to you directly rather than to your customer.

Every SaaS product that asks a customer for an OAuth app registration is holding the same kind of key, and most teams I work with have never inventoried what their own app actually requests. Go look at the consented permissions in your Azure tenant this week, both the ones you granted to vendors and the ones your customers granted to you. When a US buyer's security team asks how you scope and rotate tenant access, this incident is the reason they are asking, and a vague answer costs you weeks.

Most SOC 2 and ISO programs I review promise critical patches inside seven days, written back when a Patch Tuesday was a hundred items. Two months of this volume and the policy becomes a finding waiting to happen, because the evidence will show you missed your own commitment. Fix the process before the auditor arrives: triage by exposure and exploitability, document the ranking method, and set a deadline you can actually hit.

Developer laptops hold the keys to production, and AI coding tools now sit right on top of those keys with broad file access that nobody has threat modelled. If your engineers adopted these tools on their own, which they almost certainly did, you have unmanaged software in the most privileged part of your environment. I would start with a simple inventory of what AI tooling is installed where, because that question is already showing up in buyer questionnaires and you want an answer that is not a guess.

Two things here. Storing a customer's credential for another service is custody, and it deserves the same controls you would put around their production data, which in practice means envelope encryption, narrow scoping and a rotation path you can trigger in an afternoon. The other half is the word legacy, because a system that fell out of scope is the most common way I see a clean audit and a real breach coexist in the same company.