Guides
- AI-agent software vulnerabilities on CISA KEV: quarterly count (Q3 2026)
As of 29 October 2026, six CVEs in the AI-agent software stack were added to CISA's Known Exploited Vulnerabilities catalog between 1 July 2026 and 30 September 2026. Q4 2026 is partial through 28 October 2026 and has zero additions in the stack so far. The catalog was pulled on 29 October 2026.
- Checking a crypto wallet or exchange for sanctions exposure
As of 29 October 2026, screening a crypto wallet or exchange against the US sanctions lists is three checks: search the Specially Designated Nationals List for the address and for the exchange's names and operators, apply the 50 Percent Rule to any owners, and treat an OFAC digital-currency address listing as non-exhaustive, not a complete map of blocked wallets.
- First 72 hours after ransomware: the OFAC payment question and who to call
As of 29 October 2026, the first 72 hours of a ransomware incident are four jobs run in parallel: contain and preserve, call insurance and counsel, report to the government, and settle the sanctions question before any payment is considered. OFAC treats a payment to a sanctioned actor as a sanctions risk even if the facilitator did not know.
- Hiring an executive protection firm for international travel: what to check
As of 29 October 2026, hiring an executive protection firm for a foreign trip is five checks: the official travel picture for every stop, the firm's licensing and in-country status, its people and vehicles, its standards and insurance, and its communications plan. The State Department advisory level sets the baseline the firm's plan has to meet.
- Using a sanctions MCP server: how an AI assistant can check OFAC data
As of 29 October 2026, a sanctions MCP server lets an AI assistant read OFAC's recent actions and search the US screening lists through the Model Context Protocol. The Distributed Risk server at https://www.distributedrisk.com/mcp is a public, read-only example that needs no key. This guide covers how to connect it and what to expect from each tool.
- How to screen a counterparty against OFAC lists, and what a match means
As of 29 October 2026, screening a counterparty against the US sanctions lists is three steps: search the Specially Designated Nationals List and the Consolidated Screening List for the name, aliases and identifiers; apply the 50 Percent Rule to any owners; and treat every hit as a lead to confirm on the official entry, not a decision.
- SEC 8-K Item 1.05 cybersecurity incident filings, October 2026
As of 29 October 2026, one 8-K filing used Item 1.05 to disclose a material cybersecurity incident between 1 and 29 October 2026, by SEC EDGAR full-text search. A second October filing used Item 8.01 for a cybersecurity disclosure without that materiality judgment. November 2026 is a partial month and is not counted here.
- CISA KEV and EPSS in your AI assistant: a free, read-only MCP server
As of 28 October 2026, the Distributed Risk MCP server at https://www.distributedrisk.com/mcp lets an AI assistant search CISA's Known Exploited Vulnerabilities catalog. Each result gives the CVE, vendor, product, date added, federal due date, known ransomware use, required action and FIRST's EPSS estimate. It is read-only and needs no key.
- What a cyber underwriter checks when CISA adds a KEV listing
As of 28 October 2026, a CISA KEV listing gives a cyber underwriter four checks: whether the policyholder's estate runs the affected product, whether it is at or above the fixed version, whether CISA's due date has passed, and whether ransomware use is recorded. Our desk notes set these out per listing, with sources.
- KEV vs EPSS: what each tells you and how to use them together
As of 28 October 2026, CISA's KEV catalog records vulnerabilities with evidence of exploitation, and sets a federal due date. FIRST's EPSS is a model's estimate of how likely exploitation is. Treat a KEV listing as a fact to act on, and EPSS as a ranking for everything not yet listed. Read both for the same CVE.
- OFAC general licenses: what to check before relying on one
As of 28 October 2026, before relying on an OFAC general license, check five things on the official record: the program it sits under, who and what it covers, its expiry or wind-down date, any conditions or reporting terms, and whether OFAC has amended or replaced it. Read the license text, then the related FAQs.
- OFAC recent actions and sanctions screening in your AI assistant
As of 28 October 2026, the Distributed Risk MCP server at https://www.distributedrisk.com/mcp gives an AI assistant OFAC's recent actions, newest first, and a search of the Consolidated Screening List by name, alias or identifier. It is read-only, needs no key, and OFAC's recent actions are read again every 20 minutes.
- Tracking SEC 8-K Item 1.05 cybersecurity incident disclosures
As of 28 October 2026, an 8-K Item 1.05 filing means a public company judged a cybersecurity incident material. Item 8.01 reports are made without that judgment. The Distributed Risk MCP tool list_cyber_incident_filings lists both, newest first, with company, tickers, filing and event dates, industry code and the EDGAR filing link.
- Tracking vulnerabilities in LiteLLM, MCP servers and AI agent tools
As of 28 October 2026, list_ai_stack_vulnerabilities on the Distributed Risk MCP server lists new advisories against the software AI agents run on: agent frameworks, LLM gateways such as LiteLLM, MCP servers and SDKs, model serving and ML platforms. Malicious-package reports come first. Each entry gives package, severity, fixed versions, CVEs and EPSS.