Louisville – October 17, 2026 -- RedTag, an independent Louisville marketing agency founded in 2008, has repositioned itself from a digital performance agency into a strategy-first marketing partner and launched outcome-based programs for clients.

RedTag bets strategy, not execution speed, will differentiate clients

The agency is wagering that AI-driven gains in production speed will make strategy the scarcer asset. Founder and CEO Russ Renbarger said AI can produce hundreds of ads in an afternoon but cannot identify which one a brand needs. Clients can now choose from outcome-based programs matched to their marketing needs.

RedTag built its reputation on paid digital campaigns and later added strategy, creative, video production and website development.

United States – October 17, 2026 -- Coalition says policies it provided paid more than $315 million in cyber claims in 2025. The insurer is urging brokers to counter the belief that cyber insurance does not pay claims, an objection it says can stall coverage decisions.

Zero-indemnity closures reflect early intervention, Coalition argues

The National Association of Insurance Commissioners (NAIC) reported that 26% of cyber claims in 2025 closed with indemnity payments. Verizon reported a recorded pay-out on 55% of 2025 claims. Coalition says critics read claims closed without an indemnity payment as denials, when many reflect incidents contained early.

Global – October 17, 2026 -- Coalition Incident Response (CIR) has documented rival Business Email Compromise (BEC) attackers using the names of inbox rules as a chat channel inside the same compromised mailbox, and says the exchanges expose gaps in default email platform security.

Two intruders negotiate and fight through rule names

Abusing inbox rules to evade detection (MITRE ATT&CK T1564.008) is a widespread tactic. Attackers use it to hide, redirect or forward emails containing keywords such as "invoice" or "confidential." In one CIR investigation, an attacker aware of a second intruder appeared willing to cooperate so that neither ruined the payout. In another incident, two actors fought over an inbox in a prolonged argument recorded as a sequence of rule names.

London – October 17, 2026 -- Coalition reports 130,000+ global policyholders and $1 billion in global gross written premium on a proforma basis, figures it presented at the debut of Activate Europe, its largest cyber broker event outside the US.

The event drew brokers, underwriters, reinsurers, incident response firms and legal experts, according to the company.

Allianz partnership extends Coalition's enterprise reach across 20+ geographies

Coalition announced a long-term strategic partnership with Allianz in July to bring Active Cyber Insurance to the global enterprise market. Allianz supplies AA-rated capacity, global reach and infrastructure for international programs. Coalition contributes real-time risk intelligence, data-driven underwriting, active protection and specialised claims response.

Texas – October 17, 2026 -- Third Wave Innovations, a Texas-based managed security service provider (MSSP), has eliminated dedicated Level 1 analyst triage from its core business after adopting Wirespeed Automated Detection and Response (ADR). The platform now filters background noise so the team receives only one or two meaningful items per week.

Legacy SIEM and XDR stack capped the MSSP's growth

Third Wave, which has served small and midsized businesses for nearly a decade, hit an operational ceiling while planning to expand its managed security offerings. Its heavy security information and event management (SIEM) and extended detection and response (XDR) architecture was complex and dependent on correlation. Analysts spent billable hours working through high-volume, low-context alerts and chasing minor events regardless of actual risk.

Global – October 17, 2026 -- Coalition says its Wirespeed platform cuts alert noise by 99.99% before any alert reaches a customer queue, replacing analyst-driven managed detection and response (MDR) with automated verdicts and containment in milliseconds.

Coalition acquired Wirespeed to address a bottleneck it attributes to legacy MDR: human analyst capacity. Adding headcount widens the alert queue and raises prices for customers without speeding up response, the company argues. Forrester Research recognized Coalition in its report The Managed Detection And Response Services Landscape, Q3 2026.

Global – October 17, 2026 -- Citrix confirmed on September 27 that two critical NetScaler zero-day vulnerabilities, each scoring 9.5 in severity, were exploited in the wild. According to cyber insurer Coalition, the vendor's public communications lagged the first reports by at least 36 hours.

Two flaws allow remote code execution on unpatched NetScaler appliances

CVE-2026-88771 is a critical remote code execution (RCE) flaw that lets an unauthenticated attacker run arbitrary commands. CVE-2026-88772 is a memory overflow vulnerability that can lead to RCE or a denial-of-service condition. The Citrix patch also fixes six other flaws, bringing the total to eight.

NetScaler provides remote access to internal applications and desktops and is often exposed directly to the internet, which makes it a frequent target. Enterprises across all industries use it.

Global -- Coalition sent just 49 Zero-Day Alerts (ZDAs) between May 1 and August 1, 2026, even as Microsoft's July Patch Tuesday swelled to 569 vulnerabilities, and 94% of its policyholders did not receive a single one.

Microsoft's Patch Tuesday count nearly triples in one month

June's Patch Tuesday set a record with 206 vulnerabilities. July's release nearly tripled that to 569. Before Microsoft adopted multi-model AI for vulnerability discovery, it typically shipped around 100 fixes a month. Windows said in July that it would apply AI across security analysis to find flaws earlier and at greater scale, which Coalition says likely contributed to the jump.

Attackers are also moving faster. Anthropic disclosed earlier this year that Mythos could create working exploits for newly discovered vulnerabilities in hours rather than weeks.

Global – October 17, 2026 -- ConnectWise is investigating attempted unauthorized access to its Cloud Backup for Microsoft 365 service, formerly SkyKick Cloud Backup, after disclosing the incident on October 16. The company says containment measures are in place and it has no indication that partner backup data was accessed. The investigation is ongoing.

Community reports allege attacker used the backup app's Entra credentials

Separate reports in the MSP community describe an attacker using the backup service's Microsoft Entra application to enter customer tenants and exfiltrate email, SharePoint and Teams data. ConnectWise has not confirmed these reports.

ConnectWise published indicators tied to the suspicious authentication activity: source IP 144.172.64.128 and the user agents Python-urllib/3.12 and python-requests/2.31. The company notes that their presence alone does not confirm compromise.

Global – October 17, 2026 -- Transpacific container rates rose 2% last week to new peak-season highs on both US coasts, with West Coast prices above $7,600/FEU and East Coast prices near $9,800/FEU, according to the Freightos Baltic Index (FBX).

Carriers add September capacity as volumes stay elevated

Volume strength has run through August, despite peak-season demand starting early in late May. Carriers are adding slightly more capacity for September and may push further rate increases, especially to the East Coast, at the start of the month. Blanked sailings are scheduled around October's Golden Week holiday.

The source identifies no clear explanation for the demand. Possible contributors are the absence of tariff hikes in late July and higher data center hardware volumes. Tariff refunds may also be letting some retailers cut prices while building inventories.