The Coeus Chronicle: Volume 1, Issue 7 (July 2026)
July is showing how quickly the rules around technology can change. The government has paused the next phase of CMMC while leaving the underlying security obligations in place, a massive phishing study provides new evidence that recurring security training changes behavior, and the cost of AI is beginning to look less like software licensing and more like a utility bill.
The Omen
Signals of Change
CMMC Hits the Brakes, Not Reverse
On July 13, the Department of War immediately suspended CMMC Phase II requirements that had been scheduled to take effect November 10 and launched a 60-day review of the certification program. The Department cited compliance costs and barriers affecting small and non-traditional defense suppliers. But the pause did not eliminate the underlying cybersecurity obligations: Phase I self-assessment requirements remain in force, and defense contractors and subcontractors are still required to protect covered defense information.
Coeus Perspective: CMMC timelines and certification mechanics may change, but the security problem they are intended to address has not. Contractors that build around durable controls, evidence, and continuous protection are better positioned than organizations that treat compliance as a one-time exercise aimed at a specific audit date.
Coeus Insight: Do not unwind CMMC preparation because a deadline moved. Continue strengthening the controls, documentation, evidence, and remediation process behind the requirement so the organization is prepared when the revised path becomes clear.
The Proven Path
Strategies for Today
Security Training Actually Works
Security awareness training is often treated as a compliance obligation, but new industry data shows what happens when it becomes an ongoing program instead. KnowBe4’s 2026 Phishing by Industry Benchmarking Report analyzed 42 million simulated phishing tests across 14.8 million users at 64,000 organizations. Before training, 33.2% of users were considered likely to engage with a phishing attempt. After 90 days of recurring training and simulations, that fell to 20.1%, and after one year it fell to 4.2%, a 79% reduction in phishing susceptibility.
Coeus Perspective: People are not a security control that can be configured once. Attack techniques change, employees change, and habits fade. Short, recurring education reinforced by realistic simulations gives employees repeated opportunities to recognize new tactics and build better instincts.
Coeus Insight: Measure whether employees are becoming harder to fool over time. Security awareness should be a continuous improvement program, not an annual completion statistic.
Source: KnowBe4, “2026 Phishing by Industry Benchmarking Report,” July 7, 2026.
The Horizon
Preparing for Tomorrow
AI Is Getting a Meter
For years, business software budgets have been built around predictable per-user licenses. AI is introducing a different model. In July, Gartner warned CFOs that token consumption is becoming a meaningful operating expense and recommended token metering to connect AI usage with business value. McKinsey separately reported that 93% of respondents in its enterprise AI FinOps survey had exceeded their AI budgets, with costs becoming harder to predict as organizations move from occasional prompts to automated and agentic workflows.
Coeus Perspective: The economics of AI increasingly resemble cloud computing more than traditional software. Model choice, token consumption, context size, API calls, automation frequency, and agent behavior can all change the cost of performing the same business task. A flat license price may no longer tell you what an AI-enabled process actually costs. AI FinOps may become as normal as cloud cost management. Businesses should know which AI workflows are consuming resources, who owns them, what guardrails apply, and what the resulting business outcome is worth. The goal is not to use the fewest tokens. It is to make sure growing AI consumption produces measurable value.
Coeus Insight: Start measuring AI by the cost of producing a useful business outcome, not simply by the cost of a license or an individual token. Visibility into usage and value will become increasingly important as AI moves into automated workflows.
Sources: Gartner, “How CFOs Can Control AI Token Costs Before They Drive Budget Variances,” July 8, 2026; McKinsey & Company, “The Cost of Intelligence: How CIOs Can Manage AI Demand at Scale,” July 20, 2026.
The Agora
Meet Coeus
Arizona Aerospace Summit
In Person | July 15 | Tucson Convention Center | Table 38
Arizona’s aerospace, aviation, defense, space, advanced manufacturing, government, and technology communities are coming together this month at the Arizona Aerospace Summit. Coeus Consulting will be exhibiting alongside organizations from across the state’s aerospace ecosystem to discuss the technology and cybersecurity challenges facing growing aerospace and defense businesses, including CMMC readiness, managed IT, cloud, and security.
