Good morning — you’re reading The Closer, the 10-minute cheat sheet that turns markets, moves, and misfires into signals you can actually use.

This week, you’ll find why Trump’s tariff bluff could redraw supply chains, what Powell’s split Fed says about inflation bets, and how “camera on + 3-bullet recap” is quietly becoming the global default for high-stakes coordination. We did a deeper dive on four big trends in cybser security ahead of Black Hat USA next weekend.

What’s moving this week:

• Trump’s all-in tariff freeze to woo Beijing
• Powell vs. the doves vs. the clock
• Apple’s first “Apple Intelligence” earnings test
• Big oil’s quiet deal closing moment
• Black Hat USA opens with zero-day fireworks

Plus: a tactical classic from Toyota on flagging problems fast—and why sunlight still buys you the most trust-per-second.

— Bradley

5 Reads That Smart Operators Are Clicking This Week

1. Samsung lands $16.5B AI chip deal with Tesla

EVs aren’t just battery platforms—they’re AI inference engines now. This is Samsung’s biggest foundry win in years, and a signal that Tesla wants vertical control over autonomy. Financial Times

2. Trump freezes export controls to win over China

In a surprise gambit, Trump paused tech sanctions as part of a broader trade reset. Beijing’s response will shape Q4 risk premia across semis, luxury, and logistics. Financial Times

3. Inside the Fed’s quiet internal battle

Not all doves coo the same way. This piece unpacks why Powell’s “pause” isn’t unanimous—and why some insiders fear cutting too late or too fast. Wall Street Journal

4. OPEC+ bets big on demand resilience

More oil is coming—whether the market wants it or not. Saudi-led supply bumps aim to hold prices stable, but could reprice the entire forward curve. Bloomberg

5. The phishing playbook is evolving

Deepfakes + email = a new class of social engineering risk. This is a good primer for anyone who handles vendor payments or executive comms. Harvard Business Review

As Black Hat USA 2025 approaches, executives and board members are zeroing in on a handful of cyber threats that have surged in prominence. The following four trends are reshaping cyber risk profiles.

Ransomware Turns to Supply Chains and Vendors

Ransomware gangs are no longer limiting their schemes to single targets – they’re infiltrating the software supply chain to attack many victims at once. Recent analysis highlights how criminals like the Cl0p group have exploited trust in third-party vendors and widely used software tools, turning these into “gateways for disruption” across entire customer ecosystems . One study found 41.4% of ransomware attacks now start through a third-party partner or supplier , allowing a single breach to cascade into multiple companies.

Real-world cases bring this evolution to life. In late 2024, a new ransomware outfit dubbed “Termite” hacked Blue Yonder, a major supply-chain software provider, and claimed to steal 680 GB of data . The attack didn’t stop at Blue Yonder – it disrupted its clients’ operations. A UK supermarket’s warehouse management system went down, and Starbucks had to temporarily revert to manual scheduling when Blue Yonder’s platform became unavailable . These ripple effects show why boards must treat vendor cyber risks as their own. A partner’s weak security can quickly become your business outage or data breach. Robust third-party risk management and visibility into vendor defenses are now essential safeguards .

AI Deepfakes Supercharge Fraud and Social Engineering

The rise of generative AI is enabling a new class of highly convincing scams. “Deepfakes” – realistic but false audio, video, or images – have emerged as a potent social engineering tool. In a recent survey of U.S. and U.K. firms, just over half of businesses reported being targeted by deepfake-powered financial scams, and 43% actually fell victim . A stunning 85% of finance professionals now see these AI-driven impersonation attacks as an “existential” threat to corporate security .

The schemes often involve criminals mimicking executives or vendors to trick employees. In one 2024 case, scammers posed as a company’s CFO in a live video call, using an AI-generated likeness and voice, and succeeded in siphoning $25 million via fraudulent transfers . (Another plot targeted advertising giant WPP with a fake CEO video, though that attempt was foiled .) Deepfake technology erodes the trust barriers – an email from “the CEO” or even a face on a Zoom call can be fabricated, making it harder for staff to discern fraud. This trend matters for boards because it threatens the integrity of approvals and payments. Losses from AI-driven fraud could reach $40 billion by 2027 in the U.S. alone, according to Deloitte . Businesses should respond by tightening verification processes (especially for fund transfers), training employees to spot deepfake red flags, and using AI tools to detect synthetic media. The age-old mandate of “trust, but verify” now applies to voices and video as much as written communications.

The SEC’s 4-Day Breach Disclosure Clock

A new U.S. Securities and Exchange Commission rule is fundamentally changing how companies handle cyber incidents. Public companies must now disclose any “material” cyber breach within four business days of determining it occurred . This compressed timeline – part of SEC regulations that took effect in late 2023 – forces firms to swiftly assess an incident’s impact and report it in an 8-K filing. There are few exceptions (only if national security is at risk), meaning most major hacks can’t be quietly swept under the rug.

The rule’s impact is already visible. In the first half-year of the mandate, about 41 companies disclosed cyber incidents via SEC filings – and only 15 of those were under the mandatory material disclosure item, with the rest reported voluntarily under a non-material category . This suggests many companies are erring on the side of transparency even if they’re unsure of full impact. (The SEC in May 2024 actually advised companies to use the voluntary disclosure route for minor incidents, after observing some over-reporting .) Crucially, the era of delayed or opaque breach reporting is ending. Investors, regulators, and the public will quickly know when a significant attack hits a public company. For boards, this raises the stakes: they must ensure robust incident response plans that can determine impact fast and draft accurate disclosures under tight deadlines. Failing to comply can bring penalties – the SEC has already fined one company $2+ million for internal control lapses around a past ransomware attack – and reputational fallout. Beyond the 8-K rule, the SEC now also requires annual reporting on management’s cyber risk oversight , meaning directors will be held accountable for how seriously they take cybersecurity. In short, cyber incidents have fully graduated from IT issues to boardroom issues, with regulatory teeth behind that shift.

Attacks on Industrial Technology (OT) Hit Home

From factory floors to pipelines and ports, operational technology (OT) and industrial control systems are facing a wave of cyberattacks – with consequences that leap from the digital realm into the physical world. A joint industry report logged 68 cyberattacks in 2023 that caused actual physical disruptions to industrial operations . These incidents range from halted production lines to pipeline shutdowns and power outages. Notably, 80% of the disruptive attacks were attributed to ransomware infiltrating OT environments . In other words, the same extortionate malware plaguing office networks is now literally turning out the lights or stopping the assembly line. Another 15% of these incidents were linked to hacktivists, often tied to geopolitical conflicts – a reminder that nation-state or political motives also put critical infrastructure in the crosshairs.

No industry is immune. Manufacturing has been a prime target (three-quarters of industrial firms reported at least one intrusion in the past year ), but attacks have also hit energy, transportation, and water systems. A high-profile example came in mid-2023, when a ransomware attack forced Japan’s busiest port, Nagoya, to shut down for two days . The port could not process cargo, causing knock-on delays in automotive exports. Toyota, for instance, had to suspend operations at a packaging facility for parts after the malware triggered a systems glitch . In the U.S., memories of the 2021 Colonial Pipeline incident – where a pipeline was preemptively shut to contain an attack, spurring fuel shortages – still loom large. For business leaders, these episodes underscore that cyberattacks can jeopardize core operations and safety, not just data. The potential losses from downtime in industrial sectors (and, in worst cases, the risks to human safety or the environment) make OT security a board-level concern. Companies are investing in segregating IT and OT networks, specialized monitoring for industrial systems, and incident response drills that contemplate worst-case scenarios like prolonged production outages. The bottom line: as factories, utilities, and supply chains get smarter and more connected, threat actors are finding footholds – and the cost of unpreparedness can be measured in both dollars and physical disruption.

If you love The Closer, you’ll also love Whale Hunting, where the team at Project Brazen explore the hidden world of money and power every week.