In partnership with
| Remote Access
MFA Is On. Is It On for Every Door?
Hi there,
Last Friday CISA added a SonicWall firewall flaw to its list of vulnerabilities attackers are actively using. On SonicWall's SSL VPN, someone with a valid login for a different sign-in method can skip the SAML sign-in, and the MFA that comes with it. SonicWall has published a fix and guidance, and CISA wants it addressed by November 20.
The lesson goes past SonicWall. Most teams turn on MFA for the main login and call it done, while an older local account, a backup sign-in method or a vendor's remote-support login quietly skips it. Attackers look for that side door first. Three things to check this week:
List every way in. VPN, email, remote desktop, remote-support tools and any cloud admin console. Each one should require MFA, with no fallback that skips it.
Clean up old accounts. Disable local and shared VPN accounts nobody uses, including former staff and old vendor logins.
Patch the front door. Firewalls and VPN appliances belong on your patch list with a named owner, just like laptops and servers.
If you handle patient information, your risk analysis should name each of these access points and the safeguard that protects it.
| This Week's CVEs from CISA
A quieter week: two new additions to CISA's Known Exploited Vulnerabilities (KEV) catalog since Thursday's issue. Both are being used in real attacks.
CVE-2026-19868 | SonicWall SonicOS SSLVPN. Someone with valid credentials for another sign-in method can get around SAML sign-in, including SAML-enforced MFA. Patch or apply the vendor mitigation. KEV due date: November 20, 2026.
CVE-2024-27834 | Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS. An attacker who already has a foothold on the device can get around one of its built-in memory protections, a step used in chained attacks. Patch or apply the vendor mitigation by keeping Apple devices and Safari updated. KEV due date: November 18, 2026.
Why it matters for HIPAA: your risk analysis should account for remote access and the devices your team uses every day, and your patch management records should show when each fix went in.
| Framework Spotlight
HITRUST: e1, i1 or r2?
HITRUST certification is common in healthcare, and it's often what a hospital or health plan asks a vendor for. The first question we hear is which of the three levels you need.
e1 (Essentials, 1-year): a curated set of foundational cybersecurity controls. Entry-level assurance, renewed every year.
i1 (Implemented, 1-year): a broader set of leading cybersecurity practices for moderate risk. Also renewed every year.
r2 (Risk-based, 2-year): tailored to your risk factors, with the highest level of assurance. Valid for two years with an interim assessment at the one-year mark.
The most common mistake is jumping to r2 when your customer would accept an e1 or i1. Ask the customer what they require before you scope, and remember e1 can be a stepping stone to the higher levels. HITRUST explains the differences on its r2 page.
Listen in: Our latest podcast episode, "Compliance, Elevated: The Next Chapter of VanRein", walks through how we're making audits clearer and smoother for growing teams.
AI risk check: MFA covers your logins, but what is your team pasting into AI tools? The AI Exposure Score takes about 2 minutes and shows where AI use could be exposing your data.
We Can Help
Not sure every way into your network requires MFA, or who owns patching the firewall? We'll help you map your access points, close the gaps and document it in your risk analysis. Reply to this email or book a time below.
Thanks for reading, and for trusting us with your compliance.
Rob and Dawn Van Buskirk
Co-founders, VanRein Compliance
Compliance, Elevated.
The voice-to-text app that built its own speech model
Most dictation apps are a wrapper around someone else's speech model. Wispr Flow trained its own.
It's called Canto, and it was built for the way people actually talk to AI: thinking out loud, changing direction mid-sentence, half-whispering in an open office.
Wispr tested it on 10 hours of real dictations from more than 2,300 speakers. Canto had the lowest word error rate of every model tested, including models from Google, OpenAI, AssemblyAI and Deepgram. That means your prompts to ChatGPT, Claude and Cursor come through the way you said them.
Talk naturally in any app and Wispr Flow types clean, formatted text, 4x faster than typing.
