October 2026 Security Posture

Originally posted May 6, 2026. Updated May 22, 2026 and October 2nd, 2026.

Schemata is committed to building secure software for the customers we serve. This is our final update on the vulnerability in our platform that a security researcher reported to us and that we patched on May 1, 2026.

The independent investigation into that vulnerability is complete. It identified no breach, no exposure of Controlled Unclassified Information or of personal information as defined by breach-notification laws, and no impact to our customers. Every finding from the investigation has been remediated. Below, we lay out what the investigation found, where we fell short, and what we have built since.

What happened

The vulnerability involved our API and could, under certain conditions, allow an authenticated user to access data belonging to other organizations on our platform. Once we received actionable details from the researcher on May 1, our team remediated the issue the same day, and the researcher independently verified the fix before publishing their findings.

We then engaged outside counsel and an independent third-party forensics firm to investigate. We also reported the matter to the relevant government authorities, voluntarily and out of an abundance of caution, and have since provided them with the investigation's conclusions. We stayed in direct contact with our customers most relevant to the disclosure throughout.

What the investigation found

The forensics firm examined our systems and logs, and counsel reviewed every document and record that could have been accessed. Their conclusions:

• No breach. Apart from the researcher's own testing, the investigation found no evidence that anyone targeted or exploited the vulnerability, and no evidence of malicious impact or any other unauthorized activity.
• No persistent access. The investigation found no evidence of maintained access or persistent activity in our systems, and confirmed that our same-day remediation was comprehensive and effective.
• Our other controls held. A broader review of our perimeter and infrastructure found that every automated scanning or high-velocity probe identified during the period was blocked by our existing security controls.
• No Controlled Unclassified Information. None of the material that could have been accessed constituted Controlled Unclassified Information (CUI) or other sensitive government information. The platform involved is not a system that hosts CUI, and none is stored there.
• No personal information. None of the information constituted personal information as defined by state breach-notification laws or federal PII standards.
• No disruption. There was no operational disruption to our business or to our ability to deliver for our customers, and no contract was lost or affected.

Where we fell short, and what we fixed

The vulnerability was real, and it was ours. We build software for people who train for and carry out serious work, and the security of what we build is our responsibility without qualification.

We also own the part of this that did not go well. The researcher first contacted us in December 2025. We did not engage with that outreach the way we should have, and it was not until May 1 that we received and acted on the specific details of the vulnerability. The technical fix took a day. The months before it are on us, and they are the real lesson of this incident: we had no vulnerability disclosure program, so a good-faith report had no clear place to land and no process behind it.

That gap is closed. We now operate a formal vulnerability disclosure program through Bugcrowd. Security researchers can submit findings at schemata.com/security/report. Every report is reviewed by our security team, and we follow coordinated disclosure practices. If the same message arrived today, it would reach the right people, with a process behind it.

What we have built since

In May we committed to three things. Here is where each stands.

• Vulnerability disclosure program. Live at schemata.com/security/report.
• Third-party penetration testing. Now a standing practice. We completed a full independent web application penetration test in August 2026 and have remediated its findings.
• Third-party security certifications. We have completed our CMMC Level 2 readiness work against the 110 controls of NIST SP 800-171 and are scheduled for an independent third-party CMMC Level 2 assessment later this month. We will update this page when the assessment is complete.

Alongside these, we centralized object-level authorization across our API so that access checks are enforced in one place for every endpoint, and we expanded logging and alerting so that anomalous access is flagged as it happens.

We are grateful to the research community that holds platforms like ours to a high standard, and to the customers and partners who worked with us while the investigation ran. Our commitment to all of them is that security at Schemata is now something we can show, not something we promise.

This closes our reporting on the incident. We will post one more update when the CMMC Level 2 assessment is complete.

For media inquiries, please contact press@schemata.com. For customer inquiries, please contact your account manager or security@schemata.com. To report a security vulnerability, use schemata.com/security/report.

James Brown, CEO, Schemata