Good day. The New York State Department of Financial Services issued new guidance yesterday, urging banks and insurers to tighten oversight of third-party service providers as supply-chain attacks rise.

The guidance clarifies existing obligations under NYDFS cybersecurity rules and shares best practices on vetting vendors, monitoring for risk and maintaining internal controls. While it doesn’t introduce new rules, it does stress that the onus is on regulated firms to make sure they’re properly overseeing their suppliers. 

Kaitlin Asrow, acting superintendent of NYDFS, said firms remain “ultimately accountable” for safeguarding consumer data, even when outsourcing.

Also today:

• Cyber badges for scouts.
• Dataminr buys ThreatConnect
• Auto insurers fined in New York.

Nearly Half of Fortune 100 Now Cite AI as Board Issue. According to an Ernst & Young report, 48% of Fortune 100 companies now regard artificial intelligence as a specific subject of board-level oversight, up from 16% last year. More than 40% say a board committee has direct responsibility for AI risks. (CFO Dive)

Dataminr to Acquire ThreatConnect. Dataminr announced it will buy threat-intelligence firm ThreatConnect in a deal valued at about $290 million in cash and equity. Dataminr raised $85 million in financing in March, which is characterized as pre-initial public offering funding at the time. (CyberScoop)

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten, James Rundle and Catherine Stupp. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.