Regulators in the 50 states have been applying a higher and more elaborate standard for “reasonable cybersecurity” in their enforcement than previously, according to experts. Beyond a few key areas preoccupying the AGs and sectoral regulators, the enforcers also are asking deeper questions about companies’ routine practices like system alerts, bug patching and logging.

This article, the final part of a three-article series published in collaboration with IAPP looking at the frontlines of cybersecurity enforcement, shares leading defense practitioners’ advice on how companies can address investigators’ sharper probes of foundational cyber tasks like penetration testing, vulnerability management and risk assessment. It also looks at the emerging impact of AI issues on enforcers’ discussions with companies.

Part one of the series was authored by Jim Dempsey, IAPP managing director of the Cybersecurity Law Center, and discussed breakthrough state legislative developments gaining force in 2026, including strictures concerning national security, genetic data and critical infrastructure. Part two presented experts’ advice on how companies can address regulators’ initial questions after breaches and inquiries into hot areas that pose substantial enterprise-wide challenges, including data governance and vendor risk management.

See “For the First Time, Verizon Data Breach Investigations Report Finds Exploitation of Vulnerabilities a Top Threat” (Jul. 29, 2026).

Upgrade Monitoring and Detection Capabilities

After an incident report, regulators often focus first on how the company detected the breach and whether warning signs were missed because of inadequate monitoring practices. “I’ve had regulators ask whether there was an alert on a particular bad guy activity like data leaving the system,” Morrison & Foerster partner Miriam Wugmeister told the Cybersecurity and AI Law Report.

Regulators recognize practical limitations, including alert overload for security teams and the expense of around-the-clock monitoring, particularly for smaller organizations, Shook Hardy & Bacon senior counsel Jon Wilson said.

However, standards have risen for detection practices, BakerHostetler partner Matthew Van Hise observed. “Although state AGs evaluate entities based upon their size, scope and complexity, the expectation that an organization can onboard an endpoint detection and response tool is becoming more commonplace,” he told the Cybersecurity and AI Law Report.

Moreover, in multiple enforcements, regulators have deemed inadequate staffing for security alerts to be unreasonable, Ropes & Gray partner Edward McNicholas noted.

As part of ensuring reasonable monitoring and detection capabilities are in place, compliance leaders should establish that company monitoring policies clearly set out the after-hours staff requirements, the systems that are scanned, and procedures for prioritizing and escalating alerts, experts agreed. Companies also should test and document whether their monitoring tools generate alerts for likely attack scenarios, such as data exfiltration, privilege escalation and unusual remote access, Wugmeister suggested.

Useful records that companies can show regulators include evidence that executives reviewed the cyber team’s reports and documentation showing that the team adjusted alerts based on prior findings.

See “Understanding and Mitigating Six Key Cyber Threats” (May 6, 2026).

Accelerate Patching and Vulnerability Management

Vulnerability management and patching are growing in importance to regulators, Debevoise & Plimpton partner Erez Liebermann told the Cybersecurity and AI Law Report. As AI accelerates attackers’ ability to identify and exploit weaknesses, “our old vulnerability patching cycles of 30, 60 or 90 days, which were pretty reasonable, are going to be unreasonable very quickly” in regulators’ eyes, he forewarned.

Move to Risk-Based Patching

On July 7, 2026, Microsoft lowered its patch timing recommendations for Windows products from 21 days to a mere three. Previously, enterprise administrators of Windows products preferred to wait a couple weeks to check compatibility and test systems before patching.

With patching windows shrinking and bug volume increasing, patching supervisors should set risk tiers to guide their triage. Likely priorities for action include systems that hold sensitive data, operate with restricted permissions, are managed by vendors, are internet-facing and support core business functions, experts said. Companies also can prioritize patching vulnerabilities known to be actively exploited. AGs may start asking companies about steps they have taken to prioritize patching more frequently during investigations, Liebermann predicted.

IT and cyber teams also should freshly evaluate the company’s dependence on unsupported legacy software or machines – a domain where AI can greatly help attackers identify vulnerabilities.

See “Anthropic’s Mythos Model Forces Companies to Regroup for a New Cyber Era” (Apr. 22, 2026).

Protect Development Environments

Companies are developing new policies and procedures for their software developers following supply-chain breaches that have struck enterprises’ coding and engineering work. “Companies’ development environments are a new playground for the bad guys,” Paul Hastings partner Michelle Reed told the Cybersecurity and AI Law Report. One exploit, the 2026 Trivy breach, affected over 1,000 software-as-a-service environments.

The rise in incidents affecting software development has spurred regulators to ask more questions about security measures for that domain. “Companies should assess who can access their developer environment and whether there are any tokens [or API keys] shared with other environments,” Reed advised. Other controls to consider include scanning the company’s code and repositories and requiring signatures on project versions. The development security issue is less discussed in companies than network security, “so it is critical to make sure that appropriate levels of leadership are aware of the risk to ensure improvement,” she recommended.

See “Benchmarking Threats and Approaches to SaaS Security” (Sep. 3, 2025).

Check and Expand Logging

Regulators investigating incidents have long focused on the quality of companies’ logs. With improvements in technology, AGs increasingly anticipate that robust logs exist. “Storage is a lot cheaper than it used to be, so regulators every year expect it should be easier for companies to broaden their logging,” Liebermann noted.

Even as pressure increases on cyber leaders to expand logging, they must verify the logs they previously set up. “Companies often believe logs exist – until an incident proves otherwise,” Liebermann observed. Significant gaps are common. When reviewing logging effectiveness, companies should “pull the logs and act as if they have had an incident. Then they can test whether a certain log would have allowed them to see who actually accessed their systems,” he recommended.

Companies should prepare to answer several questions from regulators in the event of an incident:

• Which systems generate logs?
• Where are they stored?
• How long are they retained?
• Are they tamper-resistant?
• Can investigators retrieve them quickly?

Regulators expect companies to generate logs for system areas with privileged permissions and remote access. Logging that captures endpoint activity, network traffic, cloud activity and administrator actions also is becoming obligatory. Organizations should document risk-based decisions to forgo logging or limit log retention, along with the business rationale and cost considerations, Liebermann advised.

See “How to Select the Latest Cloud Security Tools and Platforms” (Aug. 21, 2024).

Use Risk Assessments to Reshape the Program

Top cyber regulators want to see how companies use their risk assessments and whether they addressed the key findings. For example, the “New York Department of Financial Services recommends building a cyber program based on the assessment” and actual risks, Wugmeister said.

Risk assessments help companies more efficiently protect themselves, Liebermann stressed. A useful assessment looks at sensitive data, critical systems for the company, its high-risk vendors, business disruption scenarios, control gaps and remediation priorities, experts highlighted.

Once companies conduct their risk assessments, they should use the findings to shape their budgets, board reporting, tabletop exercises, audit plans and incident response improvements.

Given the rapid pace of change driven by AI, risk assessments remain a core exercise that companies should conduct regularly. Companies should be able to demonstrate that they are “identifying risk and then implementing improvements” to their cyber programs based on findings, Wilson advised. Regulators want to see that risk “assessments are an ongoing process, not a one-time exercise conducted five years ago,” he reported.

Companies should review procurement risks as part of their assessments, particularly as increasingly agentic AI systems create new supply-chain management challenges that could draw regulatory scrutiny, Reed emphasized.

Companies also should conduct new risk assessments after major business changes, acquisitions, AI deployments or significant vendor changes, experts recommended.

Risk assessment challenges grow with scale, particularly for multinational companies with many business lines and subsidiaries, Wugmeister cautioned.

See “Recent Developments and Upcoming Obligations Under the E.U. AI Act” (Feb. 4, 2026).

Segment Systems and Move Toward Zero Trust

Regulators continue to endorse network segmentation to limit the impact of attacks. “It is easier to do on new systems, more difficult to implement on old ones,” Liebermann noted.

To achieve segmentation, reasonable steps for companies to take include segregating backups, isolating sensitive environments and administrative functions, and restricting lateral movement. Limiting vendor access and applying least privilege are related efforts that regulators expect.

Companies should document constraints and compensating controls, particularly with issues that legacy systems pose, experts agreed.

Regulators commonly urge that companies implement a Zero Trust approach, a term “that is often used and seldom understood,” McNicholas said. “The practical versions of it are certainly wise” for companies to consider, but a full re-architecture to segment an entire system is often unrealistic, he noted.

AI is currently complicating the segmentation and Zero Trust discussion, Liebermann highlighted. “The point of AI is to crunch data, so pooling all that data together is a critical business need. Whereas, in the past, we were all talking about segmenting the data to protect us,” he said.

AI data use needs direct governance, Liebermann recommended. If data is pooled for AI, the company should define access rights, safeguards, retention and its permitted uses. The company should also determine whether data can be re-segmented afterward. It is critical for business teams to adapt well to AI, “but they have to balance it with security and privacy considerations,” he urged.

See “Considerations for Improving Defenses to AI-Enabled Ransomware Attacks” (Jan. 14, 2026).

Validate Controls Through Program Audits and Testing

Regulators often request cyber audits to see whether a company’s written cyber policies operate in practice. California’s mandate for companies to have auditors evaluate two dozen cyber-related practices has raised many more companies’ attention to audits, Liebermann observed. “Those who may not have yet matured their program to include audits and risk assessments now have that requirement” to drive the process, he noted. The initial deadline for submitting audit certifications in California is in 2028.

Audits are just one of the conflicting demands on cyber teams’ attention right now, McNicholas observed. Most will need to improve their systems and procedures in certain ways to satisfy California’s heightened audit standards. At the same time, cyber operations must adjust “to meet the challenges of AI-driven attackers,” which may involve substantial new learning and procedures, he said.

Cyber teams trying to prioritize should remember that even the toughest regulators and auditors are secondary threats, McNicholas continued. “People worried about the auditors are missing the main threat. The attackers will be much more aggressive in adopting new methods,” he pointed out.

To prepare for California’s audits, companies should run an internal pre-audit in 2026 to produce a clean result in 2028, experts agreed. They might prioritize those cyber areas that receive frequent scrutiny, like companies’ access controls, multi-factor authentication coverage, sensitive-data protections and backup restoration.

See “Steps to Address the New California Audit Rule That Seeks to Reset Reasonable Security” (Nov. 5, 2025).

Remain Steadfast in Penetration Testing

Penetration testing remains a core component of a mature cyber program, but litigation worries make some companies hesitant to commission third-party tests, McNicholas reported. Companies fear outsiders will use red-team reports of defensive shortcomings against them and “create an ongoing demonstration of their gaps,” he said.

Rather than testing less, companies should establish policies for sharing pen-test findings with stakeholders and accountability for completing remediations. This focus on testing should improve resilience, while also helping to satisfy a future inquiry.

See “Pervasive Flaws in PE Sponsors’ Cybersecurity Oversight of Portfolio Companies” (Dec. 17, 2025).

Prepare for Converging Enforcement

Companies should expect privacy and traditional data security inquiries to overlap more often. “We’re starting to see clients that receive privacy-based inquiries also receive questions about various security controls,” Van Hise observed. It may not be long before AGs collaborate on “a multi-state action that would incorporate both data security and comprehensive privacy claims holistically,” he posited.

The convergence of privacy and cybersecurity enforcement is occurring against the backdrop of longstanding consumer protection laws, which prohibit unfair and deceptive practices (UDAP) and continue to drive enforcement, McNicholas pointed out. “The state AGs often prefer to use their UDAP authorities as opposed to the newer comprehensive privacy laws. The legal authorities are more familiar and are more difficult for defendants to argue against because there is a dearth of case law on what is ‘unfair,’” he elaborated.

Despite the growing number of available enforcement tools, regulators remain selective in deciding which incidents warrant action. State regulators ask more post-breach questions but are sophisticated in assessing cyber programs, Liebermann observed. “Companies report hundreds of data breaches, and we don’t see enforcement actions on even a small percentage,” he said.

Meet AI-Driven Expectations

AI’s impact was not directly felt during enforcement in the first half of 2026, but experts expect that to change as AI-assisted attacks become more prevalent. So far, companies have reported social engineering attacks aided by AI rather than breaches attributed to AI models, Liebermann noted. However, the July 2026 report of a first fully autonomous intrusion could inspire some regulators to issue guidance about specific controls relevant to autonomous attacks.

Regulators have yet to state that they expect companies to rely on AI tools for defense or incident response, Wugmeister shared. For example, an AG might opine that a breached company should have used “AI to analyze its unstructured data to get notice out faster. I’m sure that’s coming,” she said.

Even before regulators set forth their AI-specific expectations for companies, dramatic change is in store for cyber programs, thanks to AI, McNicholas predicted. “The whole area of cybersecurity is going to shift away from just gatekeeping and restricting access to focus more on rapid patching, rapid response and resilience. Alignment to international norms will also become a focus,” he said.

“We need to have some discussion with the regulators about what reasonable looks like in this new environment,” McNicholas asserted. For now, companies can increase governance of their AI use, update risk assessments to account for AI-enabled attacks, focus on patching, and document how they identified risks and then prudently responded.