Cybersecurity · Industry brief

M&A is still hunting for established revenue.

Worldwide NFT signed a letter of intent to acquire cybersecurity firm RedTrace Technologies, signaling dealmakers are now targeting operating companies with customer bases rather than early-stage point solutions [Quelle: CityBiz]. The shift reflects August's consolidation surge where platform vendors locked in AI security tuck-ins; now financial and industrial buyers are hunting profitable, recurring-revenue targets to anchor their own security stacks.

Deal counsel should expect successor-liability audits on RedTrace's existing customer contracts and certification posture.

Federal acquisition rules just tightened contractor reporting timelines.

The FAR amendment now imposes eight-hour incident reporting to CISA and mandatory security baseline compliance on federal contractors, running parallel to CISA's CIRCIA implementing rules expected this month, which require 72-hour substantial-incident reporting [Quelle: CISA]. Defense and aerospace firms already navigating post-Honeywell enforcement audits now face dual federal mandates with overlapping thresholds—meaning the tighter eight-hour clock governs federal contract work while CIRCIA's 72-hour window applies to broader critical infrastructure. Certification accuracy and incident response workflows must account for both tracks simultaneously.

General counsel and security operations must coordinate federal-contract incident protocols immediately or face audit exposure.