Issue 025 · Friday Brief · October 9, 2026

The Friday Brief
Weekly field intelligence for enterprise and mobile security leaders

Institutional trust is borrowed. Security and resilience decide whether it remains earned.

The Board Funded the Detail. Who Owns the Address?

More than a third of S&P 500 companies now disclose executive security as a perquisite in their proxy statements, and the median amount rose 20% in a year. Compensation committees are approving drivers and residential security by name, in a public filing, with a dollar figure attached.

I spent part of this week running a people-search removal pass on myself. Eleven of the twenty sites I checked carried the same record: my age, my home city, my phone numbers and my relatives. None of that sits behind a login, and the protective budget in a proxy statement does not reach it.

So the question I want every CISO and every head of executive protection to take into Monday is simple. Your company pays to guard the house. Who owns the listing that tells someone where the house is, and the phone number that resets the executive's accounts?

Signals & Moves You Shouldn't Ignore

Boards now disclose executive security as a line item, and more of them every year

Equilar's early look at 2026 proxy filings found 37.8% of S&P 500 companies disclosed security perks for the 2025 year, up from 23.6% for 2021. The median disclosed value reached $130,468, a 20% increase over the prior year. Blackstone reported about $13.5 million. Medtronic, Walmart and TJX adopted security perks for the first time recently. Equilar points to the killing of UnitedHealthcare CEO Brian Thompson as a catalyst.

Read the register correctly: these are disclosed perquisites in proxy statements filed through April 7, 2026, which is narrower than total executive security spend. The direction is still unambiguous. The budget for protecting named executives is approved, public, and growing.

SOURCE: Equilar, "Early Look at Security Perks" (2026; S&P 500 proxy filings through April 7, 2026)

A court took a people-search site offline to protect home addresses

On August 27, 2026, the New Jersey Superior Court entered a final default judgment in Atlas Data Privacy Corporation v. Radaris.com (Docket No. MID-L-000847-24) and transferred the radaris.com domain to Atlas. The court found violations of Daniel's Law, which protects the home addresses and unpublished home phone numbers of judges, prosecutors, law enforcement officers and other covered persons. Atlas brought claims assigned by roughly 21,760 of them. The order also reaches Rehold.com and Trustoria.com.

The enforcement is real, and its scope is specific. Daniel's Law covers public servants in named roles. A Fortune 500 CEO is not a covered person under that statute, so for most executives, getting a home address off these sites remains a program decision their company has to make.

SOURCE: Court-order notice published at radaris.com (accessed October 6, 2026); KrebsOnSecurity, "Data Broker Radaris Loses Domains in Privacy Fight" (September 16, 2026)

Apple patched a zero-day used against specific targeted individuals

CVE-2026-86950 is an out-of-bounds write in CoreGraphics that can lead to code execution when a device processes a crafted file. Apple fixed it on September 28 in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, and said it may have been exploited against "specific targeted individuals" on versions before iOS 27. Meta Product Security reported it. CISA added it to the Known Exploited Vulnerabilities catalog on September 29 with an October 2 federal due date.

Targeted attacks pick people, and executives are the people on the list. The practical question for this week is narrower than "are we patched": is the CEO's personal iPhone, the one with the family group chat and the bank app, on 26.7.1 or iOS 27, and can anyone at the company say so with evidence?

SOURCE: Apple security release notes for iOS 26.7.1 (September 28, 2026); CISA KEV catalog entry CVE-2026-86950 (added September 29, 2026)

The executive inbox sits behind a mail gateway CISA says is being exploited

CISA added Fortinet FortiMail CVE-2026-104286 to the KEV catalog on October 1. The flaw combines path traversal with improper handling of NULL bytes and can let an unauthenticated attacker write arbitrary files on the appliance through crafted HTTP or HTTPS requests. The federal remediation date was October 4, and CISA flagged the entry for forensic triage.

A mail gateway sees every wire approval request and board pack that reaches an executive. Patching closes the hole going forward. Forensic triage answers the question executive protection will ask, which is whether anyone read the principal's mail while it was open.

SOURCE: CISA KEV catalog entry CVE-2026-104286 (added October 1, 2026); Fortinet PSIRT advisory for CVE-2026-104286

The Control Gap

Executive security has a funding owner. The compensation committee approves it, the proxy discloses it, and a head of executive protection spends it on the physical layer, from the drive to the residence.

The identifiers that lead an attacker to that physical layer usually sit with nobody. The home address lives on people-search sites. The executive's personal mobile number resets accounts, approves pushes and receives the bank's fraud call. The personal phone holding both is often outside enrollment because it belongs to the executive, not the company. The CISO's program was built around corporate assets, executive protection was built around the principal's body and residence, and the space between them is where this week's signals land.

Closing that gap does not need a new budget line. It needs one named owner for the principal's public data and phone number, sitting inside the protection program the board already funded.

My Take

I ran this week's removal pass from my own environment with my own agent, and the tracker lives in my files. Eleven of twenty people-search sites had me. The figure I care about more is how many new places my data landed during the cleanup. For that run, the answer is zero.

Now look at how most removal programs open. If your program starts with a report that lists everything the brokers hold on you, you started by stepping backwards. Someone just assembled your aggregated data into one clean document, and that document now sits on a vendor's servers. If a provider needs my Social Security number to protect my Social Security number, it has expanded my attack surface and billed me for it.

So ask your provider some harder questions. What incentive keeps them protecting the data you handed them after the renewal clears? Are they investing the time, people and money it takes to keep up as social engineering gets cheaper, and as data stored today becomes the data someone tries to decrypt on the way to quantum? Can they give you a receipt other than a screenshot or a confirmation email? A confirmation proves one thing: they are now another key holder, and another place your data can leak from.

The executive security budget in a proxy statement pays to guard a body and a house. Spending part of it to hand a fresh copy of the principal's dossier to one more vendor works against the reason the budget exists.

My recommendation: run removal for your principals in-house, inside your own environment, under the protection program the board already funded. Re-check monthly, because these sites rebuild listings from public records, and keep evidence you can show an auditor: the search before and the search after, dated, held by you. That is the Executive Mobile Risk Snapshot Build In-House delivers, and the first step is small enough for your executive's assistant, or their AI agent, to start this week.

Start in-house → unlisted.buildinhouse.com

-W

One Thing Worth Doing This Week

Put a lock status next to every number that can approve something

Start with the executives named in your proxy statement, then their assistants, then everyone else whose phone number can approve an action in your environment: MFA push, account recovery, wire approval, help-desk callback. For each number, check the carrier account and record two facts. Is the account lock on, and does a port-out require a PIN?

Under the FCC's 2023 SIM swap and port-out fraud order, wireless carriers must offer customers a free way to lock their account against SIM changes and number ports. The carrier offers it. Someone on your side has to switch it on, line by line, and for a personal executive line that someone is usually the executive, which means it rarely happens.

Approver lists rarely carry this column. Add it, and put a date next to every blank.

What you hold: the Number Lock Roster, approver numbers with lock status and PIN status, executives first, every blank dated.

Capture: Roster template plus a carrier-by-carrier lock checklist → conditions.buildinhouse.com

SOURCE: FCC 23-95, Protecting Consumers from SIM Swap and Port-Out Fraud (Report and Order, November 2023)

Cleared Today

A standing section on third-party access. Part 4: airlines.

The contract mechanic at the outstation has the same access as the one at base

An airline's maintenance work does not all happen at the hub. At smaller outstations, contract technicians often handle line checks and minor repairs for carriers that keep no staff of their own on site. Their sign-off lands in the same maintenance records as an employee's at base.

In the setups I have looked at, the technician reaches those records through a tablet or a personal phone, on whatever connection the ramp offers. The login works the same at three in the morning on a regional apron as it does in the main hangar. What the login was not designed to carry is the commercial fact behind it: whether this contractor's agreement with this carrier, at this station, is still in force today.

That fact lives in a vendor contract or a station manager's spreadsheet. When the agreement ends or a technician moves to another provider, the change reaches the identity system on someone's to-do list, if it reaches it at all. The account stays valid. The device stays compliant. The person may no longer be authorized to sign anything for that aircraft.

Crew and operations numbers sit in the same pattern. A dispatcher's callback number or a crew scheduler's line can approve a change, and the person holding the phone may have left the contract that made the number trustworthy.

This week's question: for your last contract maintenance provider whose agreement ended, on what date did their technicians lose access to your maintenance records, and who can show you the log?

EVERY FRIDAY. SIGNALS. ONE CONTROL GAP. ONE ACTION.

If someone typed your CEO's name into a people-search site tonight, how many sites would answer, and who at your company would know?

#MobileSecurity #CISO #ExecutiveProtection #Privacy #iOS