Week of January 12, 2026: IonQ and Cbus name CISOs, and Microsoft disrupts the RedVDS fraud service

What mattered to security leaders in the week of January 12, 2026? Two organizations created or expanded CISO roles: quantum computing company IonQ moved Leslie Kershaw into a corporate CISO post, and Australian superannuation fund Cbus hired Martyn Bayly for a newly created one. Microsoft also announced legal action against RedVDS, a rent-a-server service linked to about $40 million in reported US fraud losses, and Cisco shipped fixes for an email appliance flaw exploited since late November.

IonQ moves Leslie Kershaw into a corporate CISO role

On January 14 IonQ said Leslie Kershaw, previously at its IonQ Capella unit, would take a newly expanded role as chief information security officer, reporting to incoming chief information officer Katie Arrington, who joins from the Department of War. Kershaw's remit covers federal and commercial cybersecurity requirements and both enterprise cyber and physical security. The company cites her past service as Cyber Technical Director for Space DELTA 6 in the US Space Force. The appointment record is on CISO Tribune. (IonQ)

Cbus creates a CISO seat and hires Martyn Bayly

Cbus, a $105 billion Australian superannuation fund, appointed Martyn Bayly as chief information security officer in a newly created role, Super Review reported on January 13. He will lead the fund's cyber security function as part of a wider set of senior hires in governance and finance. The trade title framed the move as a response to intensifying cyber risk across the superannuation sector. Retirement savings make an attractive target, and a dedicated CISO gives the board one accountable owner. The record is on CISO Tribune. (Super Review)

Microsoft takes legal action against the RedVDS cybercrime service

Microsoft announced coordinated legal action in the US and the UK to disrupt RedVDS, which for as little as $24 a month rented criminals disposable virtual machines running unlicensed Windows, as part of a wider operation with Europol and German authorities. Microsoft ties the service to about $40 million in reported US fraud losses since March 2025, and says more than 191,000 organizations worldwide had accounts compromised or fraudulently accessed starting in September 2025, with real estate firms handling escrow and closing payments among the frequent victims. Payment-change verification by phone remains the cheapest control against this kind of fraud. (Help Net Security)

Cisco patches the AsyncOS email appliance flaw exploited since November

Cisco shipped security updates for Email Security Gateway and Secure Email and Web Manager appliances fixing CVE-2025-20393, an AsyncOS flaw in the Spam Quarantine feature that lets unauthenticated attackers run commands as root. Cisco had disclosed exploitation on December 17, 2025, and suspected Chinese attackers had been using it since at least late November; Talos found custom backdoors and a log-purging tool on some appliances. Only devices with Spam Quarantine exposed to the internet were compromised. Teams that rebuilt appliances in December still need the fixed release. (Help Net Security)

UK NCSC, CISA and FBI publish secure connectivity principles for OT

On January 14 CISA, the FBI and international partners joined the UK's National Cyber Security Centre, which led the effort, in releasing Secure Connectivity Principles for Operational Technology. The guide gives OT owners and operators a framework for designing connectivity so that remote monitoring and analytics links do not become paths for intrusions that could cause physical harm or disrupt essential services. CISA also pressed OT manufacturers and integrators to adopt secure-by-design practices. (CISA)

An exploited Windows information disclosure bug opens the Patch Tuesday year

CISA added CVE-2026-20805, a Microsoft Windows information disclosure vulnerability, to the KEV catalog on January 13 on evidence of active exploitation. Information leaks of this kind are often chained with other bugs, so the entry is a reason to push the January cumulative update ahead of schedule. (CISA)

Delinea agrees to acquire StrongDM

Delinea signed a definitive agreement to buy StrongDM, combining its privileged access management products with StrongDM's just-in-time runtime authorization and developer-oriented access model, according to Help Net Security's January 15 report. The companies pitch the result as a path toward zero standing privilege that does not require customers to rip out existing PAM tools. Buyers already running either product should ask how licensing will change after the deal closes. (Help Net Security)