Platform Overview
See why Penlink is the global leader in AI-powered digital intelligence and investigations
Penlink Academy
Your complete destination for Penlink training, with live sessions, on-demand modules, and certifications designed to give professionals the tools and confidence to succeed in real investigations.
By Terry Pell, Chief Customer Officer, Penlink
Every October, Cybersecurity Awareness Month gives the industry a reason to ask a simple question: are we doing everything we can to protect what we’ve built? For agencies and organizations managing large volumes of sensitive data, that question deserves more than a passing nod. Infrastructure protection isn’t a checkbox exercise — it’s the foundation everything else depends on, from operational continuity to public trust.
This is especially true for organizations managing evidentiary or investigative data, where materials sitting on a server may one day be scrutinized in a courtroom. Below are a few practices worth revisiting as we head into October — some familiar, some less commonly discussed, but all foundational to a strong security posture.
Organizations holding evidentiary or investigative materials face a heavier burden than most. Beyond the usual risks of unauthorized access or data loss, there are chain-of-custody expectations, audit trail integrity requirements, and often extended retention periods — all of which widen the window in which something can go wrong.
The numbers back this up. Verizon’s 2026 Data Breach Investigations Report found that exploiting known software vulnerabilities has overtaken stolen credentials as attackers’ top entry point, now behind roughly a third of breaches. Fewer than three in ten known critical vulnerabilities studied were fully patched, and typical patch times have stretched past six weeks. The gap between “we know about the weakness” and “we fixed it” is widening — and that’s the gap attackers exploit.
Role-based access control and the principle of least privilege remain two of the most effective, least glamorous tools available. Not everyone who touches a platform needs — or should have — access to its most sensitive data layers. Taking access control to the next level, NIST’s Zero Trust Architecture guidance (SP 800-207) offers a solid framework, and it’s worth revisiting even for teams that feel they’ve already “done” access control once.
Here’s a recommendation that doesn’t get enough airtime: the names you give your servers, storage buckets, and folder structures matter more than most teams realize. A server labeled “evidence-server-01” or “case-files-prod” provides anyone conducting reconnaissance on your network a roadmap before they’ve breached anything.
We’re told not to make our bank password “Chase2026!” or our work login “AcmeCorp#1.”A password shouldn’t announce what it unlocks. The same logic applies to infrastructure. A server named “evidence-server-01” or a bucket named “case-files-prod” does exactly what “Chase2026!” does: it tells an attacker where to spend their time. Consider a non-attributable naming convention — sometimes called opaque asset labeling — so names reveal nothing about the provider, function, content, or sensitivity. This isn’t a replacement for access controls or encryption; it’s one overlooked layer in a defense-in-depth strategy. NIST SP 800-53/SC-38 and CISA guidance on reducing reconnaissance value are useful starting points.
Encryption is the control that still works after the others have failed. Role-based access controls assume the attacker came through the front door; opaque naming assumes they’re still looking.
Encryption works best as a set of layers, each covering a failure the others don’t. Disk and volume encryption protects hardware that leaves your control — a drive pulled from a decommissioned server, a stolen workstation, and media disposed of without proper sanitization. It operates while the volume is unmounted; once the system boots, the disk decrypts transparently for everything running on it. Database-level encryption narrows the exposure further, protecting the data files themselves so that a data file copied out of the storage layer, or a file-level backup landing in unintended storage, is unreadable without the corresponding key. TLS 1.2 or higher covers the third exposure: data moving between systems, where interception, downgrade attacks, and man-in-the-middle positioning are the realistic threats. Together these three cover the drive, the file, and the wire. The gap they leave, data in use by an authenticated session, is the one that access controls, continuous monitoring, anomaly detection, and audit trail review exist to close.
As just mentioned, continuous monitoring and real-time anomaly detection close the loop, catching unusual access as it happens rather than in a post-incident review weeks later. IBM’s 2026 Cost of a Data Breach Report found organizations still take an average of roughly eight months to identify and contain a breach — a pace that’s actually slowed even as breach costs hit a global record. Organizations using AI and automation for prevention and response closed breaches about two months faster and at nearly two million dollars less cost than those without. Detection speed is one of the biggest levers an organization has over what a breach ultimately costs. CISA’s incident response guidance is a strong reference point for building out this capability.
As Cybersecurity Awareness Month approaches, we’d encourage every agency we work with to take a fresh look at their own posture. To make sure you’re doing everything you can to stay protected, reach out to your Penlink Customer Success Specialist or our Customer Support Team — we’re glad to help you think it through.
The Department of Homeland Security announced the results of a nationwide crackdown on human trafficking coordinated around the 2026 FIFA World Cup. Homeland Security Investigations (HSI), the DHS Center for Countering Human Trafficking, and federal, state, and local partners arrested 905 suspects and rescued 180 victims — 150 adults and 30 juveniles — across World Cup host cities.
xxxxx
A multi-agency investigation in Volusia County, Florida, has led to the dismantling of a major fentanyl and methamphetamine trafficking network, with 49 people arrested and hundreds of grams of narcotics seized.
The Nebraska State Patrol says a routine traffic stop earlier this month led to what investigators believe is the largest drug seizure in the agency’s history. Governor Jim Pillen joined NSP to detail the case, along with a second, unrelated stop that turned up stolen commercial equipment.
Foreign influence campaigns increasingly pair disinformation with cyber intrusion. This post looks at what that convergence means for investigators tracking coordinated state-linked activity.
Outlaw motorcycle gangs operate through networks that cross state lines and jurisdictions. This post looks at what it takes to investigate them effectively.