Search for:
Announcement

Debevoise Data Blog: Top 5 Cybersecurity Blog Posts of 2025

By: , , , , , , , , , , , , , , , , , , , and

As we approach the end of the year, here are the Top 5 Cybersecurity posts on the Debevoise Data Blog in 2025.

1.  Protecting Privilege in Incident Response: Litigation Lessons (September 15, 2025)

Companies responding to data breaches are faced with the question of whether their incident response investigation can be protected by attorney‑client privilege or the work‑product doctrine.  This blog post explores the key questions that U.S. courts analyze when deciding whether reports and communications generated by incident response vendors are discoverable and provides practical guidance on structuring vendor engagements, managing workflows, determining vendor payment sources, document distribution, and drafting reports to maximize the likelihood that these materials receive privilege and work product protections.

2. Lessons for AI Risk Management from Ten Years of Cybersecurity Implementation (May 14, 2025)

As businesses increasingly adopt AI, many are looking for familiar frameworks, and well‑established cybersecurity programs offer natural analogies.  In this blog post, we discuss where lessons learned from cybersecurity governance are readily applicable to AI risk management, and where they are not.

3. Financial Services Industry Petitions the SEC for a Rulemaking to Amend the Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure Rule (May 27, 2025)

Five major U.S. financial‑services trade associations, with assistance from Debevoise, formally petitioned the SEC to amend its 2023 cybersecurity disclosure regime.  This blog posts highlights specific pitfalls of Form 8-K Item 1.05, as identified by industry, and outlines a proposal for a more balanced, principles-based cybersecurity disclosure regime.

4. SEC’s Focus on Cyber and AI to Continue Under Trump Administration (February 21, 2025)

The SEC announced the creation of a new Cyber and Emerging Technologies Unit (CETU) tasked with combatting cyber‑related misconduct and protecting retail investors from misuse of emerging technologies, including AI.  This blog post provides an overview of the announcement, which illustrates that the Trump administration will continue to prioritize SEC cybersecurity and artificial intelligence examinations and enforcement, with a particular emphasis on fraudulent conduct impacting retail investors.

5. Trump Executive Order Puts the Spotlight on Foreign Cyber Threats, Managing AI Vulnerabilities, and Secure Software Development (June 16, 2025)

The Trump Administration issued an Executive Order reprioritizing the federal cybersecurity agenda. The Order underscores foreign nation‑state threats, emphasizes the management of AI‑related vulnerabilities, promotes secure software‑development practices, and rescinds several prescriptive mandates from the prior administration in favor of more flexible guidance.  In this blog post, we outline key aspects of the Executive Order and explore possible implications for private companies, including software providers.

***

Summarized by Noah Schwartz and Sharon Shaji. We used ChatGPT to help generate first drafts of the summaries. The cover art for this blog was generated by Gemini 3 Nano Banana Pro.

To subscribe to the Debevoise Data Blog, please click here.

Author

Andrew J. Ceresney is a partner in the New York office and Co-Chair of the Litigation Department. Mr. Ceresney represents public companies, financial institutions, asset management firms, accounting firms, boards of directors, and individuals in federal and state government investigations and contested litigation in federal and state courts. Mr. Ceresney has many years of experience prosecuting and defending a wide range of white collar criminal and civil cases, having served in senior law enforcement roles at both the United States Securities and Exchange Commission and the U.S. Attorney’s Office for the Southern District of New York. Mr. Ceresney also has tried and supervised many jury and non-jury trials and argued numerous appeals before federal and state courts of appeal.

Author

Charu A. Chandrasekhar is a litigation partner based in the New York office and a member of the firm’s White Collar & Regulatory Defense and Data Strategy & Security Groups. Her practice focuses on securities enforcement and government investigations defense and artificial intelligence and cybersecurity regulatory counseling and defense. Charu can be reached at cchandra@debevoise.com.

Author

Luke Dembosky is a Debevoise litigation partner based in the firm’s Washington, D.C. office. He is Co-Chair of the firm’s Data Strategy & Security practice and a member of the White Collar & Regulatory Defense Group. His practice focuses on cybersecurity incident preparation and response, internal investigations, civil litigation and regulatory defense, as well as national security issues. He can be reached at ldembosky@debevoise.com.

Author

Avi Gesser is Co-Chair of the Debevoise Data Strategy & Security Group. His practice focuses on advising major companies on a wide range of cybersecurity, privacy and artificial intelligence matters. He can be reached at agesser@debevoise.com.

Author

Daniel M. Gitner is a partner in the White Collar & Regulatory Defense Group in the firm’s New York office. Mr. Gitner focuses his practice on advising corporations and institutions on a broad range of white collar matters, especially those involving complex, large-scale crises and government investigations. He is a Fellow of the American College of Trial Lawyers. He can be reached at dmgitner@debevoise.com.

Author

Erez is a litigation partner and a member of the Debevoise Data Strategy & Security Group. His practice focuses on advising major businesses on a wide range of complex, high-impact cyber-incident response matters and on data-related regulatory requirements. Erez can be reached at eliebermann@debevoise.com

Author

Jim Pastore is a Debevoise litigation partner and a member of the firm’s Data Strategy & Security practice and Intellectual Property Litigation Group. He can be reached at jjpastore@debevoise.com.

Author

Ben Pedersen is a partner in the firm’s Capital Markets Group and member of the Special Situations team. His practice focuses on a broad range of capital markets transactions, regularly representing issuers, private equity firms and underwriters in public and private offerings of debt and equity securities, and advising public and private companies on securities laws, disclosure, corporate governance and general corporate matters. He can be reached at brpedersen@debevoise.com.

Author

Jeffrey L. Robins is a corporate partner and a member of the Debevoise Banking Group. His practice focuses on representing broker-dealers, swap dealers, banks, securities exchanges, industry associations and buy-side institutions in regulatory and transactional matters. He can be reached at jlrobins@debevoise.com.

Author

Julie M. Riewe is a litigation partner and a member of Debevoise's White Collar & Regulatory Defense Group. Her practice focuses on securities-related enforcement and compliance issues and internal investigations, and she has significant experience with matters involving private equity funds, hedge funds, mutual funds, business development companies, separately managed accounts and other asset managers. She can be reached at jriewe@debevoise.com.

Author

Kristin Snyder is a litigation partner and member of the firm’s White Collar & Regulatory Defense Group. Her practice focuses on securities-related regulatory and enforcement matters, particularly for private investment firms and other asset managers.

Author

Matthew Kelly is a litigation counsel based in the firm’s New York office and a member of the Data Strategy & Security Group. His practice focuses on advising the firm’s growing number of clients on matters related to AI governance, compliance and risk management, and on data privacy. He can be reached at makelly@debevoise.com

Author

H Jacqueline Brehmer is a Debevoise litigation associate and a member of the Data Strategy & Security Practice Group. She can be reached at hjbrehmer@debevoise.com.

Author

John M. Jacob is an international associate and a member of the Capital Markets Group. He can be reached at jjacob@debevoise.com.

Author

Gabriel Kohan is a litigation associate at Debevoise and can be reached at gakohan@debevoise.com.

Author

Amer Mneimneh is an associate in the Litigation Department. He can be reached at amneimneh@debevoise.com.

Author

Andreas Constantine Pavlou is a former associate in the Litigation Department.

Author

Lily Schoen is an associate in the Litigation Department and a member of the firm’s Data Strategy & Security Group. She can be reached at laschoen@debevoise.com.

Author

Cameron Sharp is a former associate in the Litigation Department.

Author

Stephanie D. Thomas is an associate in the Litigation Department and a member of the firm’s Data Strategy & Security Group and the White Collar & Regulatory Defense Group. She can be reached at sdthomas@debevoise.com.

Author

Cindy Tu is a corporate associate and a member of the Capital Markets Group. She can be reached at ktu@debevoise.com.

Related Posts