The Schellman Blog

You Cannot Patch Faster Than AI Finds Vulnerabilities CVE discovery is accelerating fast, and AI-driven vulnerability discovery makes it even worse. Exploitation timelines have shrunk from on average 2.3 years to 9 hours, and with current AI capabilities, that may now be reduced to minutes.

SOC 2 reports are soon going to look different. The AICPA has opened a revised Trust Services Criteria (TSC) for comment with an expectation to release in 2027. While organizations should pay attention, similar to the changes in HIPAA’s Safeguards, these are still very much in draft and are subject to change prior to official release.

HITRUST announced in HAA 2026-005 that HITRUST CSF version 11.9 has been released. HITRUST updates the CSF at least annually or more frequently based upon changes in the security and privacy landscape. While not an entire overhaul of version 11, there are noteworthy updates, outlined below, to be aware of.

Cyber and AI risk assurance in a single examination to close the gap between traditional cyber assurance and the realities of autonomous AI. Developed in collaboration with the AICPA and AIUC and delivered by Schellman.

My kids think "quantum" is something out of a Marvel movie. And honestly, for a long time, I think a lot of the business world saw it the same way: interesting, a little unsettling, and always about ten years away.

Over the past year, I've spent a lot of time talking with AI founders, enterprise executives, CISOs, and technology leaders about the opportunities and challenges associated with artificial intelligence. There's an incredible amount of excitement about what AI can do, but there's also a growing recognition that developing powerful technology and getting enterprises comfortable deploying it are two very different things.

Data centers are the most talked-about infrastructure of the AI era. Coverage focuses on power, land, and GPUs. Far less attention goes to what lets a customer trust a facility with sensitive data: independent assurance.

I remember sitting in a Major Firms Group meeting several years ago when Barry Melancon, then CEO of the AICPA, said something that has stayed with me ever since: CPAs have always been in the trust business.