Jacobian Engineering

Jacobian Engineering Cyber security, compliance, audit, and managed IT services. At Jacobian Engineering, your success is our success.

Jacobian Engineering: Your Partner in Tailored IT and Compliance Solutions

Since 2005, Jacobian Engineering has empowered organizations to achieve strategic goals through comprehensive IT, compliance, and security solutions. As a trusted managed service provider, we specialize in designing, planning, and executing strategies that align with your vision and immediate needs. Our Services

Technolog

y Services Division

- Managed IT and Cloud Services: Our AWS- and Microsoft-certified engineers provide remote and on-site support, building secure and compliant cloud solutions tailored to you.
- DevOps and Software Architecture: Expert solutions to streamline operations and enhance efficiency.
- 24/7 Operations Centers: Round-the-clock teams ready to respond to operational and security incidents, ensuring business continuity. Compliance and Security Division

- Audit Preparation and Assessments: As a HITRUST Alliance Certified Assessor Company, we conduct HITRUST assessments and prepare you for SOC 2, ISO 27001, FedRAMP, NIST, and CMMC audits.
- Regulatory Compliance Expertise: Navigating international regulations like GDPR, PIPEDA, UK privacy laws, and domestic regulations such as HIPAA, California privacy statutes, and StateRAMP.
- Security Services: Implementing robust security controls, conducting pe*******on testing, DAST, vulnerability scanning, and providing training to strengthen your security posture. Why Jacobian Engineering

We excel in guiding companies through complex regulatory landscapes and technical challenges. Specializing in assisting early-stage startups and medium-sized businesses, we offer cost-effective solutions for those without dedicated compliance teams or in-house legal counsel. Our "right-size fit" approach ensures you receive precisely tailored services aligned with your strategic vision. We don't just consult—we partner with you to design, plan, and execute solutions that drive your business forward. Let us help you navigate the complex world of IT and compliance with confidence.

The rapid integration of AI tools into scientific research is creating new challenges for transparency and institutional...
04/11/2026

The rapid integration of AI tools into scientific research is creating new challenges for transparency and institutional integrity. Recent studies examining manuscripts submitted to JAMA Network journals found AI usage increased from 1.71% to 5.97% over just 27 months, with most authors leveraging these tools to improve writing quality. Similarly, BMJ journals reported 5.7% of submissions disclosed AI utilization.

These figures likely underrepresent actual usage. Self-disclosure depends on clear institutional guidelines, consistent enforcement, and researcher awareness of when AI assistance crosses from acceptable editing to substantive contribution requiring acknowledgment.

The implications extend beyond academic publishing. Healthcare organizations, SaaS companies, and research institutions face similar challenges across their operations: employees using AI tools for documentation, analysis, and decision support without clear governance frameworks defining acceptable use, disclosure requirements, and quality verification processes.

Three organizational priorities emerge from this data:

Establish Clear AI Use Policies: Define what constitutes acceptable AI assistance versus substantive AI contribution across different work contexts. Vague guidance leads to inconsistent practices and compliance gaps.

Implement Disclosure Mechanisms: Create standardized processes for documenting AI tool usage in work products, whether research manuscripts, clinical documentation, or software development artifacts.

Build Verification Workflows: AI-assisted outputs require human review processes calibrated to the risk level of the content. Medical research, clinical decisions, and security configurations demand rigorous verification; internal documentation may require less scrutiny.

At Jacobian Engineering, we help healthcare organizations and research institutions develop comprehensive AI governance frameworks that address these challenges. Our policy development services establish clear boundaries for AI tool usage while our compliance programs create the documentation and monitoring infrastructure needed to maintain transparency and meet regulatory expectations.

The 5-6% disclosure rates in medical journals represent early indicators of a broader transformation. Organizations that establish governance frameworks now will be better positioned to capture AI productivity benefits while maintaining the integrity standards their stakeholders expect.

A new study published by JAMA Network analyzed over 105,000 manuscript submissions across 13 medical journals to assess ...
04/09/2026

A new study published by JAMA Network analyzed over 105,000 manuscript submissions across 13 medical journals to assess author disclosure of artificial intelligence use. Since implementing disclosure requirements in August 2023, only 3.3% of authors reported using AI tools—though this figure increased significantly over the study period.

The most commonly disclosed AI applications were language refinement and statistical model development. While these disclosure rates likely underrepresent actual AI use, the study highlights an important trend: organizations across industries are grappling with how to track, govern, and document AI tool usage within their operations.

For healthcare technology companies and SaaS organizations, this research carries significant implications. Regulatory bodies and compliance frameworks are increasingly scrutinizing how organizations implement and govern AI tools. Whether your team uses AI for code generation, documentation, data analysis, or operational workflows, the expectation for transparency and accountability is growing.

The JAMA study reveals a fundamental challenge: without clear policies and reporting mechanisms, organizations cannot accurately assess the scope of AI use within their operations. This blind spot creates risk—from compliance gaps to questions about data handling, intellectual property, and output accuracy.

Healthcare organizations face particular pressure, as AI-generated content in clinical documentation, research submissions, or patient communications may intersect with HIPAA requirements and institutional review standards. SaaS companies pursuing SOC 2 or HITRUST certification must demonstrate governance over the tools and technologies their teams employ.

Practical steps organizations should consider:

- Develop clear AI acceptable use policies that define approved tools and applications
- Implement disclosure requirements for AI-assisted work products
- Establish review processes for AI-generated outputs, particularly in regulated contexts
- Document AI governance practices as part of broader compliance programs
- Train staff on organizational expectations and documentation requirements

At Jacobian Engineering, our compliance management services help organizations develop and implement AI governance frameworks that integrate with existing security and compliance programs. We work with healthcare technology companies and SaaS organizations to build policies that address emerging regulatory expectations while maintaining operational flexibility.

The trajectory is clear: AI transparency requirements will expand beyond academic publishing into broader business operations. Organizations that establish governance frameworks now will be better positioned as regulatory expectations mature.

Anthropic's recently released Claude Cowork research preview contains a significant vulnerability that allows attackers ...
04/07/2026

Anthropic's recently released Claude Cowork research preview contains a significant vulnerability that allows attackers to exfiltrate user files through indirect prompt injection, and the flaw remains unpatched despite being acknowledged by Anthropic.

The attack chain is straightforward. When a user connects Cowork to a local folder and uploads a file containing a hidden prompt injection, the malicious payload can manipulate Claude to upload sensitive files to an attacker-controlled Anthropic account using curl commands. The injection exploits an allowlisted path to the Anthropic API, bypassing the VM's network restrictions. No human approval is required.

What makes this particularly concerning is how easily the injection can be concealed. Attackers can hide malicious prompts in .docx files using 1-point white-on-white text with minimal line spacing, effectively invisible to users who open the document. The vulnerability was originally disclosed by security researcher Johann Rehberger and has been confirmed to work against both Claude Haiku and the more resilient Claude Opus 4.5.

Anthropic's response places the burden on users to "avoid granting access to local files with sensitive information" and watch for "suspicious actions that may indicate prompt injection." For a tool designed for general users, this guidance is inadequate.

The broader concern is Cowork's integration footprint. The platform connects to browsers, MCP servers, and can execute AppleScripts, send messages, and access daily workflow tools. Each integration point expands the attack surface where sensitive data intersects with untrusted inputs.

Organizations incorporating AI agents into workflows should implement several protective measures: restrict AI tool access to non-sensitive directories, establish data classification policies that define what information AI assistants can access, review files from external sources before processing them through AI tools, and monitor for unexpected network activity from AI-enabled applications.

Jacobian Engineering's application security assessments evaluate how AI-integrated tools handle sensitive data and test for prompt injection vulnerabilities that traditional security tools miss. We help organizations establish secure boundaries for AI agent deployments before these tools gain access to critical business information.

The rapid deployment of AI agents into enterprise workflows is outpacing the security controls needed to protect them. Organizations adopting these tools should treat them as high-risk integrations requiring the same security scrutiny applied to any third-party application accessing sensitive data.

OpenAI is reportedly developing advertising capabilities for ChatGPT that would prioritize sponsored content directly wi...
04/05/2026

OpenAI is reportedly developing advertising capabilities for ChatGPT that would prioritize sponsored content directly within AI-generated responses. Ad mockups include displaying sponsored information in a sidebar alongside the main response window, with AI models potentially configured to ensure sponsored content appears in answers.

An OpenAI spokesperson confirmed the company is exploring ads, stating they're examining "what ads in our product could look like" while claiming any approach would "respect" the trusted relationship users have with ChatGPT.

The core concern here is not just advertising. It's the underlying data infrastructure that makes personalized advertising possible. ChatGPT likely knows more about users than traditional search engines. The conversational nature of AI interactions means users often share detailed context about their work, decisions, challenges, and intentions that they would never enter into a search query.

For organizations in regulated industries — healthcare, financial services, legal — this raises immediate questions about data handling, consent, and third-party risk. When employees use ChatGPT for business tasks, what information is being collected? How might that data support advertising models? What disclosures are required when AI recommendations may be influenced by commercial relationships?

The shift from utility tool to advertising platform fundamentally changes the risk profile of any AI service. Organizations that have incorporated ChatGPT into workflows need to reassess their vendor risk evaluations and data processing agreements.

Jacobian Engineering's privacy compliance services, spanning GDPR, CCPA, and sector-specific regulations, include third-party vendor assessments that evaluate how AI platforms handle sensitive business data. We help clients develop governance frameworks that address AI tool usage, data classification requirements, and appropriate use policies before regulatory guidance catches up to technological change.

Organizations should review their AI acceptable use policies now, before advertising features roll out. The time to establish data governance controls around AI tools is before the platform economics shift, not after.

A barely perceptible delay revealed a significant threat. Amazon recently discovered a North Korean operative working as...
04/03/2026

A barely perceptible delay revealed a significant threat. Amazon recently discovered a North Korean operative working as a contract system developer after security monitoring flagged unusual keystroke input lag exceeding 110 milliseconds, indicating the company laptop was being remotely controlled from overseas.

Amazon's Chief Security Officer Stephen Schmidt shared details of this case and a sobering statistic: Amazon has thwarted more than 1,800 DPRK infiltration attempts since April 2024, with attempts increasing 27% quarter-over-quarter. The laptop in question was located in Arizona, where a woman facilitating fraud on behalf of North Korean workers was later sentenced to prison.

Standard U.S.-based remote workers exhibit keystroke latency in the tens of milliseconds. The additional lag from transcontinental remote access, even through sophisticated VPN chains, created a measurable anomaly that quality security software identified.

Schmidt's key observation: "If we hadn't been looking for the DPRK workers, we would not have found them."

This threat extends far beyond Amazon. North Korean IT workers are actively targeting U.S. corporations across all sectors, using stolen identities, proxy interviewers, and laptop farms to gain employment. Their objectives range from generating hard currency for the regime to espionage and potential sabotage.

The challenge for most organizations is that detecting these threats requires continuous monitoring and behavioral analysis capabilities that many lack. Remote work has become standard, making geographic verification through network telemetry essential rather than optional.

Organizations should evaluate their current visibility into endpoint behavior, including keystroke patterns, network latency anomalies, and remote access indicators. Background verification processes should be examined for susceptibility to proxy candidates. Security teams need clear escalation paths when behavioral anomalies surface.

Jacobian Engineering's managed security operations provide the continuous monitoring and behavioral analysis capabilities that organizations need to detect sophisticated infiltration attempts. Our 24/7 monitoring services help SMBs and SaaS companies implement enterprise-grade threat detection without building these capabilities in-house.

The 110-millisecond gap that exposed this infiltrator was only visible because someone was actively looking for it. In an era of distributed workforces and nation-state threats, passive security postures leave organizations exposed to risks they cannot see.

Attackers have discovered a new social engineering attack vector that bypasses traditional security controls entirely: w...
04/01/2026

Attackers have discovered a new social engineering attack vector that bypasses traditional security controls entirely: weaponizing AI platform trust.

Huntress researchers disclosed a campaign on December 5, 2025 where the Atomic macOS Stealer (AMOS) is being delivered through poisoned search results that surface fake ChatGPT and Grok conversations. The attack is devastatingly simple. A user searches for something routine, "clear disk space on macOS," and Google surfaces what appear to be legitimate AI troubleshooting conversations hosted on chatgpt.com and grok.com.

These are not impersonation sites. They are real conversations on legitimate platforms, created by attackers and SEO-poisoned to rank highly. The conversations use professional formatting, reassuring language, and code blocks with Terminal commands presented as safe system cleanup instructions. When users copy and paste these commands, they execute a multi-stage infection chain that harvests passwords, escalates to root privileges, and deploys persistent malware.

The technical ex*****on is sophisticated. The Terminal command decodes a base64-encoded URL that fetches a malicious bash script. This script presents a fake password prompt, silently validates credentials using macOS Directory Services (dscl -authonly), and then uses those credentials for privilege escalation via sudo. AMOS establishes persistence through LaunchDaemon mechanisms and includes trojanized versions of cryptocurrency wallet applications like Ledger and Trezor that harvest seed phrases.

What makes this campaign significant is how it exploits layered trust. Users trust search engines to surface vetted results. They trust chatgpt.com and grok.com as legitimate domains. They trust the familiar formatting of AI conversations. This attack does not break any of these trust layers. It weaponizes all of them simultaneously.

For organizations, this represents a fundamental shift in threat awareness. Traditional security training focuses on suspicious emails, unknown downloads, and warning dialogs. This campaign succeeds because the behavior appears completely normal.

Jacobian Engineering's security awareness training programs help organizations address this evolution. Our training emphasizes critical evaluation of all external instructions, including AI-generated content, and builds the skeptical mindset needed when any source requests Terminal access or administrative credentials.

The takeaway: platform trust is not content trust. AI assistants hosted on legitimate domains can still serve malicious instructions. Defenders need updated training programs, behavioral monitoring for anomalous Terminal and sudo usage, and clear policies about executing commands from external sources.

Malware no longer needs to impersonate legitimate software. It just needs to impersonate help.

A circulating phishing campaign targeting Steam users demonstrates why the presence of HTTPS alone should never be trust...
03/30/2026

A circulating phishing campaign targeting Steam users demonstrates why the presence of HTTPS alone should never be trusted as a security indicator.

The attack uses a fraudulent login page that looks virtually identical to Steam's legitimate site, complete with a valid SSL certificate and the familiar padlock icon. For years, users have been taught that HTTPS equals safety. Attackers know this, and they've adapted.

Obtaining SSL certificates is trivial. Free certificate authorities issue them in minutes with minimal verification. The padlock confirms that your connection to a server is encrypted. It says nothing about whether that server is legitimate. A phishing site with HTTPS simply means your stolen credentials are transmitted securely to the attacker.

What to verify instead: Check the actual URL character by character — attackers use lookalike domains (stearn.com, steam-login.com, steampowered.net). Consider how you arrived at the page; if you clicked a link from Discord, email, or social media, navigate directly to known URLs instead. Be suspicious of unexpected authentication prompts, especially those offering free items, urgent account warnings, or trade requests. And if your password manager doesn't autofill credentials, pause — it won't recognize a fake domain.

Gaming platforms are high-value targets. Steam accounts often contain significant game libraries, tradeable items worth real money, and linked payment methods. A compromised account can lead to financial theft, social engineering of your contacts, and permanent loss of digital assets.

At Jacobian Engineering, we help organizations build resilience against these attacks through security awareness training programs that teach employees to recognize sophisticated phishing attempts. Our social engineering campaigns test your team's defenses with realistic simulations, including credential harvesting sites, to identify vulnerabilities before attackers do.

The padlock icon was never meant to indicate trust. It indicates encryption. Understanding that distinction is the first step toward better security hygiene.

The Illinois Department of Human Services (IDHS) has disclosed a significant security incident: an internal mapping webs...
01/15/2026

The Illinois Department of Human Services (IDHS) has disclosed a significant security incident: an internal mapping website containing residents' personal information was publicly accessible from April 2021 through September 2025...more than four years!

The exposure affected over 700,000 individuals. Specifically, 672,616 Medicaid and Medicare Savings Program recipients had their addresses, case numbers, and demographic data exposed. An additional 32,401 individuals receiving Division of Rehabilitation Services had names, addresses, and case statuses publicly viewable. The website was intended for internal use to assist with resource allocation.

Perhaps most concerning: IDHS has stated it cannot determine whether anyone actually accessed the exposed data during this extended window. This uncertainty compounds the incident's severity and underscores a fundamental gap in security monitoring and logging capabilities.

This incident illustrates several systemic issues common in public sector healthcare organizations:

Configuration management failures caused internal tools to be exposed to the public internet without proper access controls, representing a basic security hygiene breakdown. These misconfigurations often persist because they don't trigger alerts unless proper monitoring exists.

Extended detection timelines led to four years of exposure before discovery, suggesting insufficient vulnerability scanning, pe*******on testing, and security assessments. Regular external security evaluations would likely have identified a publicly accessible internal application.

Logging and monitoring gaps resulted in the inability to determine data access, indicating inadequate audit logging—a direct HIPAA Security Rule requirement under the Audit Controls standard (§164.312(b)).

For healthcare organizations handling protected health information, this serves as a critical reminder that compliance is not a checkbox exercise. HIPAA's Security Rule explicitly requires regular risk assessments, technical safeguards, and audit controls—precisely the areas where this incident reveals deficiencies.

Jacobian Engineering's managed compliance services, including those that specialize in HIPAA protection, help healthcare organizations identify these gaps before they become multi-year exposures. Our comprehensive risk assessments evaluate technical safeguards, access controls, and monitoring capabilities against Security Rule requirements, while our HITRUST validated assessments ensure organizations can demonstrate compliance when it matters most.

The four-year exposure window in Illinois represents the difference between proactive security management and reactive incident response. Organizations that conduct regular security assessments and maintain continuous compliance monitoring significantly reduce both their risk profile and potential regulatory exposure.

This week's threat landscape demands immediate attention from security teams. Multiple critical vulnerabilities are unde...
12/19/2025

This week's threat landscape demands immediate attention from security teams. Multiple critical vulnerabilities are under active exploitation, and the window between disclosure and weaponization continues to shrink.

Apple Zero-Days Under Active Attack

Apple released emergency patches for two zero-day vulnerabilities actively exploited in targeted attacks. CVE-2025-14174 (memory corruption) and CVE-2025-43529 (use-after-free) can both be triggered via malicious web content to achieve arbitrary code ex*****on. CVE-2025-14174 also affects Google Chrome through the ANGLE graphics library. Evidence suggests commercial spyware vendors are weaponizing these flaws. Updates are available for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari.

WinRAR Exploitation by Multiple APT Groups

CVE-2025-6218, a path traversal vulnerability in WinRAR (CVSS 7.8), is being actively exploited by at least three distinct threat actors: GOFFEE, Bitter, and Gamaredon. CISA has added this to the Known Exploited Vulnerabilities catalog with a December 30 remediation deadline for federal agencies. Any organization using WinRAR should prioritize this update immediately.

OAuth and AitM Phishing Campaigns Targeting SSO

A new adversary-in-the-middle campaign targets organizations using Microsoft 365 and Okta for single sign-on. The attack hijacks legitimate SSO flows to bypass MFA protections that aren't phishing-resistant. A related technique dubbed "ConsentFix" tricks users into pasting OAuth authorization codes into attacker-controlled pages. These attacks happen entirely within the browser, evading traditional endpoint detection.

Additional Critical Vulnerabilities

The .NET SOAPwn vulnerability enables remote code ex*****on through unexpected HTTP client proxy behavior, allowing webshell uploads and PowerShell script drops. React2Shell (CVE-2025-55182, CVSS 10.0) is seeing widespread exploitation by multiple China-nexus threat actors delivering various malware payloads.

**What Organizations Should Do Now**

Prioritize patching Apple devices, Chrome browsers, and WinRAR installations. Audit SSO configurations and consider implementing phishing-resistant MFA methods. Review developer workstations for unpatched software that could serve as initial access vectors.

Jacobian Engineering's vulnerability management services help organizations systematically identify, prioritize, and remediate these emerging threats before attackers can exploit them. Our pe*******on testing engagements specifically validate that critical patches have been properly applied and that compensating controls are effective when immediate patching isn't feasible.

The velocity of exploitation continues to accelerate. What took weeks now takes hours. Organizations that treat patching as a routine IT function rather than a security imperative will find themselves perpetually behind the threat curve.

12/18/2025

Video breakdown of our latest research on synthetic vulnerabilities. Full article is in our recent post. Link in the comments.

Address

12060 Industry Boulevard #1025
Jackson, CA
95642

Opening Hours

Monday 9am - 5pm
Tuesday 9am - 5pm
Wednesday 9am - 5pm
Thursday 9am - 5pm
Friday 9am - 5pm

Telephone

(415) 644-8208

Website

Alerts

Be the first to know and let us send you an email when Jacobian Engineering posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Jacobian Engineering:

Shortcuts

Share

Category