Business

Understanding the CMMC Pause: Key Changes and Action Steps

On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements. The move was memorialized in a memo dated July 10, 2026, signed by DoW Chief Information Officer Kirsten Davies. Those requirements had been scheduled to take effect on November 10, 2026, and would have pushed many contracts handling Controlled Unclassified Information (CUI) into mandatory third-party C3PAO assessments.

The stated goal is straightforward: reduce compliance barriers for small, medium, and non-traditional businesses so the Defense Industrial Base can expand faster under the Department’s current acquisition priorities.
A 60-day CMMC Reform Task Force review is now underway, including a public Request for Information seeking industry input on cost drivers and administrative burden. Phase I self-assessment requirements remain firmly in place.

This is not a free pass.
It’s a pause on one layer of bureaucracy — not a suspension of the underlying security obligations.

What Actually Changed (and What Didn’t)

Suspended

  • The November 2026 transition to Phase II — third-party Level 2 assessments as a condition of award in many cases.
  • Pending and future CMMC implementation milestones (including Phase III and IV) that would have required C3PAO or DIBCAC assessments.
  • During the review period, contracting officers are limited to requiring only Level 1 (Self) or Level 2 (Self) assessments in new procurements.
  • Existing contracts that already contain Phase II language will have that language removed by modification, either before the next option period or at the next scheduled administrative update.

Still fully in force

  • Phase I self-assessments and annual affirmations in SPRS.
  • DFARS 252.204-7012 obligations to protect covered defense information and implement NIST SP 800-171 controls.
  • Contractual cybersecurity requirements that primes flow down to subcontractors.
  • The Department of Justice’s Civil Cyber-Fraud Initiative, which continues to treat inaccurate self-assessments and false claims seriously.

The official release is worth reading in full: Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements. The SBA has also publicly backed the move, arguing the prior framework was pushing small firms out of the defense supply chain.

In short: the certification theater got paused. The requirement to actually protect the data did not.

Continue reading
Standard
Linux terminal showing command 'sudo rm -rf /' followed by a lock icon
Business

What a Law Firm’s Ransomware Nightmare Can Teach Your Startup

I spend most of my time around developers who think “security” means:
npm audit
and a .env file that’s definitely in .gitignore file.

If you browse our (= Espresso Labs) pitch to law firms, you realized: the threat model we’re describing for a 40-person law firm is identical to the threat model for your bootstrapped SaaS, your dev agency, or your local accounting shop.
Only the data changes.
The attacker’s playbook doesn’t.

Here’s what I learned, and what I think every SMB owner and every engineer who’s ever been “the security person by default” should take from it.

Law firms are basically unencrypted API keys with a bar license

Think about what a law firm actually is, technically: a small team with admin access to an enormous amount of high-value, high-leverage data — M&A deal terms, litigation strategy, medical records, wire transfer instructions — protected by, in a lot of cases, the same IT hygiene as your uncle’s dentist office.
(It’s ugly – I know)

That mismatch between value of data and maturity of defenses is exactly what makes a target attractive, and it’s the same mismatch that makes early-stage startups attractive. You might not have client trust funds, but you’ve got:

Continue reading
Standard
Secure data streams from public, hybrid, enterprise cloud, and data sources into a compliance vault engine
AI, Business

Automating the Audit Trail: How I Built a GitHub Screenshoter for Zero-Friction SOC 2 Compliance

It’s audit season. And if you’re a SaaS startup, you know exactly what that means.
The dreaded “Change Management” evidence request.

Some auditor sends you a list of 15 random commit SHAs from your production branch and says: “Prove to me that every single one of these was reviewed, approved, and linked to a ticket.”

Your heart sinks.

You know you’re about to spend the next four hours of your life doing the most mind-numbing task in tech: opening GitHub, finding the commit, taking a screenshot, finding the PR, taking a screenshot, finding the issue, taking a screenshot, and pasting it all into a PDF.

It’s manual. It’s painful. And it’s a complete waste of engineering time.

So, I built a tool to kill this pain once and for all: GitHub Screenshoter.

Continue reading
Standard
Business

Scaling Engineering: Ownership Over Hiring

Most engineering leaders think scaling is about hiring.

And honestly, that instinct makes sense — more work, more people, problem solved. But in practice, scaling engineering is mostly about scaling ownership. The teams that succeed aren’t necessarily the ones with the most engineers, the most process, or the fanciest org charts. They’re the ones that can keep ownership close to the work as the organization grows.
That sounds simple until you’ve experienced the moment it breaks down at 2 AM.

I’ve had the chance to see engineering organizations at very different scales — from early startup environments to larger companies like Google, Netflix, Meta, and JFrog.
Every company is unique, but the patterns are surprisingly consistent.

The biggest takeaway is this: every growth stage introduces a new coordination tax.
The challenge isn’t eliminating that tax.
The challenge is preventing coordination overhead from growing faster than the company does.

The First 20 Engineers: Optimize for Builders

At around 20 engineers, speed is your biggest advantage, and process is often your biggest enemy.
Everyone sits close to the product. Engineers talk directly to customers.
The person writing the code can usually explain exactly why it exists and what it connects to. It’s a genuinely magical phase — and it’s also temporary, so it’s worth enjoying while it lasts.

At this stage, ownership should be brutally simple: teams own services end-to-end, carry their own on-call rotation, deploy their own code, and fix their own incidents.
No exceptions.
One of the strongest signals of a healthy engineering culture is whether the people building the software also feel the consequences when it breaks. If your team gets paged because their service is down, reliability becomes surprisingly important. Funny how that works.

The Platform Team Trap

One mistake I see repeatedly at this stage is creating a platform team too early.
The logic is completely understandable — someone notices that everybody is independently building CI pipelines, setting up monitoring, and solving the same deployment problems.

The natural reaction is, “we need a platform team.” And you know what?
That instinct isn’t wrong.
It’s just early.

At 20 engineers, the cost of coordination is often higher than the cost of duplication.
A few redundant solutions are cheaper than introducing another organizational boundary and the meetings, hand-offs, and dependency management that come with it. This tradeoff becomes even more relevant in the AI era.

Generating code is now cheap.
Creating clear ownership is still expensive. The bottleneck is no longer writing software — it’s understanding who should maintain it six months from now. That’s a human problem, not a tooling problem.

Around 50 Engineers: The Coordination Tax Arrives

Continue reading
Standard
Futuristic cockpit with holographic compliance and cybersecurity monitoring dashboard
AI, Business

CMMC Certification Cost: How AI-Native Compliance Can Cut Expenses by over 70%

If you’re pursuing CMMC certification, one of the first questions you’ll ask is:

How much does CMMC certification cost?

The answer depends on your current security posture, the size of your organization, and how you approach compliance. For many small and mid-sized businesses, the total cost of achieving and maintaining CMMC Level 2 compliance can range from tens of thousands to hundreds of thousands of dollars.

The surprising part?

The audit itself is rarely the biggest expense.

Continue reading
Standard
Physical legal documents dissolving into digital code and holographic interface on an office desk
AI, Business

AI and Compliance: The Most Boring Billion-Dollar Opportunity Nobody Is Talking About

The US compliance sector is massive, expanding rapidly, and heavily strained.
It represents over $40 billion in annual labor spend with more than 400,000 officers. Despite ballooning teams, compliance work has remained stubbornly manual, bureaucratic, and paper-based (“schlep work”), leading to high employee churn (>20%) and massive backlogs (e.g., TD Bank’s $3B fine over a 70,000-alert backlog).

Here’s a weird data point:
Over the last 20 years, the fastest-growing occupation in the US was manicurists and pedicurists.
Right behind it?
Compliance Officers.

Not AI engineers. Not data scientists. Compliance officers.
That says something important about where the real work has been hiding.

The Problem Nobody Wanted to Solve

Compliance is painful. Bureaucratic. Paper-heavy. Repetitive.

Continue reading
Standard
Home office devices protected by a glowing digital shield blocking cyber attacks
AI, Business

Ransomware Risks: Why SMBs Need AI Security Now

Last week I was staring at my EnduraCoach dashboard, watching it yell at me for sneaking in an extra sprint session that my body wasn’t ready for. The AI caught the overtraining pattern across heart-rate, sleep, and power data and shut it down before I wrecked my Ironman build. That same evening the April ransomware numbers landed. SMBs got hammered again. And I thought: if only every founder had an always-on coach like this for their security stack.

Here’s the uncomfortable truth from April 2026: ransomware didn’t slow down—it accelerated. A new player called JanaWare quietly encrypted files for hundreds of Turkish home users and small businesses through targeted phishing campaigns. Low-dollar demands ($200–$400) but high volume. Attackers are learning that SMBs are softer targets and faster payers.

The broader picture is uglier.
Verizon’s 2025 DBIR (still the gold standard) showed 88% of ransomware breaches hit SMBs versus just 39% for enterprises. Unpatched vulnerabilities caused 29% of incidents; stolen credentials another 30%.
Sophos and Black Kite reports confirm SMBs in the $4M–$8M revenue band are now the sweet spot for attackers.

Most of us simply don’t have a 24/7 SOC or the headcount to patch, triage, and remediate at machine speed.

Continue reading
Standard
AI

Understanding MCP vs Agent Skills: Key Differences Explained

There’s a lot of confusion right now between MCP (Model Context Protocol) and “Agent Skills.” They’re often mentioned in the same breath, but they solve different problems. If you treat them as interchangeable, you’ll either over-engineer simple workflows or underpower serious integrations.

Here’s the clean way to think about it.

The Core Difference

MCP is about connecting agents to systems.
Skills are about teaching agents how to do things.

That distinction alone gets you 80% of the way.

Integration Model

MCP is a client-server protocol. You stand up an MCP server, expose tools, and now multiple agents can talk to multiple backends through a consistent interface. It’s a hub.

Skills are much simpler: a folder with a SKILL.md file. The agent loads it when triggered and follows the instructions. No protocol, no network layer, no abstraction.

Implication:

  • MCP scales across teams and services
  • Skills scale across use cases and workflows
Continue reading
Standard
Business

Effortless Techmeme Summaries to Slack and Telegram

Every morning starts the same way: open Techmeme, scan headlines, open too many tabs, and somehow end up 20 minutes deep into something you didn’t mean to read.

That loop is the problem. Instead of trying to “summarize the internet” or build another bloated AI dashboard, this project does something much simpler: take a strong source, rank and summarize it, and deliver a clean digest to Slack or Telegram.

That’s it—and that’s why it works.

Continue reading
Standard
AI, Business

Why SMBs Struggle with Cybersecurity: The Real Challenges

I recently had a conversation on The Changelog, and it reinforced something I’ve seen over and over again:

SMB cybersecurity isn’t just hard — it’s structurally broken.

Not because people don’t care.
Not because tools don’t exist.
Because the entire model assumes resources that SMBs simply don’t have.

The uncomfortable truth

Security today is designed for enterprises and downsized for everyone else.
That doesn’t work.
Enterprise model:

  • Dedicated security teams
  • Time to triage alerts
  • Budget to stack tools

SMB reality:

  • One DevOps person wearing five hats
  • Compliance pressure (SOC 2, ISO 27001, CMMC…)
  • A pile of tools that don’t talk to each other

So what happens?

They install more tools…generate more alerts…and end up less certain about their security posture.
That’s the paradox.

Continue reading
Standard