Network Sensor Metadata Provides Context and Alert Enrichment The Value of a Network Sensor Pondurance November 22, 2024 Facebook X (Twitter) LinkedIn Copy link As the cybersecurity world evolves, organizations are increasingly reliant on technology and devices such as network sensors to protect their digital environments. Network sensors measure network performance, connectivity, and service availability, and they provide real-time and historical data for network administrators. These valuable devices also actively monitor network traffic for unusual activity and potential threats and trigger alerts on those activities and threats. A network sensor provides three core functions including generating security alerts, providing metadata , and enabling full packet capture to identify malicious activity. Though all three functions are important, the metadata component is key to fully understanding what’s happening on a network. In a recent webinar , Erik Mogus, Director of Product Management at Pondurance, discussed the role of the network sensor and explained how metadata gives context to an event and provides alert enrichment for security operations center (SOC) analysts. Context The more data points that analysts have, the better decisions the analysts can make. And better decisions from the analysts can lead to the generation of better tickets. Erik believes that the litmus test on the criticality of an alert ticket is: “Do I wake somebody up at 3 in the morning to notify them of this?” To make the determination about whether to wake a client, it’s important to understand the context — the who, what, where, when, and how — of the data. At Pondurance, the SOC team can integrate network data across endpoint detection and response (EDR) solutions, logs, or clouds. An EDR alert is sent when an action is malicious but not blocked. The metadata — which describes what happened two minutes before the event, during the event, and two minutes after the event — provides the context to determine the event’s significance. Metadata is also collected for logs and clouds, with an alert sent for suspicious and malicious activity for host events. If there’s an alert on an EDR, log, or cloud, the team can pull the metadata into that specific case and efficiently leverage it to understand the significance of the event. Alert enrichment The combination of an alert and metadata can create “enriched alerts” for clients. To illustrate the value of metadata, Erik used the example of a malicious domain detection, where a user clicks a phishing email with a known bad domain and an alert generates indicating that the user has clicked a malicious domain. However, a typical alert does not tell the SOC analyst whether something meaningful has occurred as a result of the user’s action. The analyst needs the combination of the alert and the metadata to reveal the bigger picture. Erik explained that SOC analysts need to know the answers to several questions to better understand the relevance of a malicious domain detection event. Which domain name did the host attempt to resolve? Did the domain name resolve? Did the host successfully connect? How did the host behave after connecting? Why else might this event have occurred? Where is this event occurring across all clients? A typical alert can sometimes answer these questions, but when an enriched alert generates, the analyst can always find the answers. With metadata, the SOC team can track the full event from minutes before, during, and minutes after the event to determine if something bad happened and the significance of it. “If we see this event, and we see the domain did resolve, the host did connect to it, the host did download traffic from that IR (incident response), and it’s spraying the inside of your network, we’re pretty confident something very bad is happening,” said Erik. “Without that network metadata, it’s almost impossible to be able to put all of that together to determine what the criticality of that event is.” Conclusion Cybersecurity continues to evolve, and network sensors are increasingly valuable devices for detecting activity and threats on the network. Learn more about Pondurance’s network sensor and the criteria that Erik and SOC analysts use to determine what activity and threats warrant a middle-of-the-night wake-up call. Watch the video. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

haveibeenpwned.com aggregates data breach notifications to help users understand their data and data breaches to protect against threats.|haveibeenpwned.com aggregates data breach notifications to help users understand their data and data breaches to protect against threats. Data Breach Notifications With haveibeenpwned.com Pondurance September 24, 2021 Facebook X (Twitter) LinkedIn Copy link Data breaches are frequently occurring, and the scale to which they affect organizations and users is massive. Oftentimes, organizations receive data breach notifications via third parties after the incident. As an organization, how are you supposed to react to this type of communication? For those that need more knowledge into which of your accounts have been affected, we recommend using Have I Been Pwned (HIBP). It is a free online tool that can help organizations and individuals learn if their accounts are compromised. It aggregates the data of compromised accounts to help users and organizations better protect themselves from the risks of cyberattacks. Conducting Domain Searches To get started, go to the HIBP website here and verify that the domain belongs to your organization. Data Breach Notification Actions and Considerations Understand the extent of the breach by searching for the compromised website here . This will include a list of data such as breach date and compromised data. It is important to note whether usernames and passwords appear in the compromised data section of the breach. View the data provided by HIBP to find the accounts that are compromised and understand the impact of the breach within the environment. This will also give a scope of compromised users to address in future steps. If the compromised data includes passwords and usernames , we recommend that you review the last password change date for that user account to ensure that the account has had a password change or rotation since the date of the breach. If there is uncertainty regarding the password change , we recommend that the password immediately be reset to ensure that the account cannot be accessed via stored credentials on the compromised website. We recommend that staff caution users who utilize work emails when registering for websites for personal use to help avoid the likelihood of appearing in this style of breach. We also recommend that staff educate users not to utilize the same password for personal use as they do for business use. For all data breach notifications that contain a more recent breach and critical information such as a password that was leaked, be sure to review the user’s login activity in your user management consoles. For users who perform critical functions or are considered VIP users , we recommend that they sign up here to be notified if their accounts are found in a future breach. When in doubt, Microsoft has great recommendations regarding password policies and management to follow, including: Maintain an 8-character minimum length requirement. Don’t require character composition requirements (e.g., *&^%$). Don’t require mandatory periodic password resets for user accounts. Ban common passwords to keep the most vulnerable passwords out of your system. Educate your users to not reuse their organization passwords for non-work-related purposes. Enforce registration for multifactor authentication. Enable risk-based multifactor authentication challenges. Are you interested in learning more about protecting your personal information and curating a safer experience online? Download our Employee Security Awareness Checklist for the best practices for online security. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn how AI is making phishing and social engineering attacks more convincing, and why employee awareness, verification, and quick reporting matter more than ever. Recognizing Social Engineering in the Age of AI Pondurance October 14, 2026 Facebook X (Twitter) LinkedIn Copy link For years, employees have been trained to recognize phishing by looking for familiar warning signs: a misspelled word, an unusual greeting, or a message that simply doesn't sound like something a colleague would write. Now, with artificial intelligence (AI) in the mix, those warning signs still have value but are becoming less reliable. AI gives threat actors an easier way to create polished messages that resemble everyday business communications. A phishing email can reference the right company, use natural language, and sound remarkably similar to a legitimate request. Use of AI changes what employees need to focus on to recognize social engineering scams. A convincing message can still lead to danger Social engineering attacks succeed when an employee is persuaded to take an action that benefits the threat actor. A message — received via email, text, chat, or another familiar communications channel — may ask an employee to log in, approve an authentication request, review a document, or change information associated with a business process. AI makes it simpler for threat actors to prepare those messages and do it convincingly. As Pondurance experts discuss in How AI Is Changing the Cyber Threat Landscape — and What To Do About It , threat actors can use AI to research potential targets and create more believable social engineering attempts. With AI, the quality of the writing is no longer a useful measure of whether a message is safe. The message may be well written either because an actual co-worker sent it or because a threat actor had access to the tools and information needed to make it convincing. Context matters more than polish Employees usually have an advantage that threat actors don't have: an understanding of how work normally gets done. Employees know whether a manager typically asks for certain information by email, whether the IT team normally sends login instructions through chat, and whether a vendor usually handles a request in a particular way. An unusual context can be one of the strongest signs that something is wrong. Thus, a message deserves more attention when the request feels out of place for the situation. Also, an unexpected sense of urgency can be meaningful, particularly when the employee is being pushed to act before there's time to verify the request. Employees don't need to analyze every message like a security investigator. Instead, simply taking a brief pause to consider whether the request fits the situation can be enough to interrupt an attack. When a request feels unusual, verification through a separate, trusted communications channel can help. Employees should be encouraged to call a known number or start a new conversation with the alleged sender of the message to halt the threat actor's control over the interaction. Authentication can be an element of a social engineering attack Some attacks are convincing because they use legitimate technology. As an example, the Pondurance detection engineering team recently highlighted an incidence of device code phishing , a tactic where a threat actor directs an employee through a legitimate authentication experience and gains access to the network as the user of the device. In device code phishing, an employee may recognize the login page, and the authentication process may work exactly as expected. In this particular incident, the threat actor convinced the employee to enter a code or start a login process that was never requested. A login request that appears without explanation should stop an employee from taking any further action. Also, when a multifactor authentication prompt arrives but the employee is not actively signing into an account, the employee should stop. Routine authentication should always have context. Social engineering has moved beyond the traditional phishing email Threat actors are finding ways to make employees participate more directly in malware delivery. One example is a ClickFix attack , where employees may encounter a fake technical error, security check, or captcha that instructs them to copy a command and run it on their computers. The instructions may resemble ordinary troubleshooting, which makes them difficult to recognize. Pondurance explains the tactic in Cybersecurity 101: A Whole New World of Malware Delivery . A ClickFix attack works because employees believe they are resolving a problem. But unexpected technical instructions should raise a red flag, particularly when a website requests that an employee open a command line tool or make a security-related change on a device. Organizations should implement policies that allow any employee who is unsure about a potential social engineering attack to easily consult the IT team before continuing. Reporting can be as important as recognizing the attack Even experienced employees can be fooled by a convincing message, but the actions taken after the initial incidence can make a significant difference in the outcome of the attack. If an employee realizes that he or she clicked on a suspicious link or approved an unexpected request, reporting the activity quickly gives the security team a chance to investigate while the incident is still developing. Pondurance's threat intelligence team has emphasized the value of "phishing amnesty," where employees are encouraged to report mistakes quickly without fear that they will be punished for coming forward. Phishing amnesty creates a healthier security culture and gives defenders another source of visibility. After all, the employee who clicked the link may also be the first person who realizes something is wrong that requires the immediate attention of the IT team. Employees need to trust their instincts Threat actors can create AI-enabled social engineering messages that look polished enough to pass a quick visual inspection. However, employees bring something deeper to the situation: familiarity with the people, processes, and tools they use every day. That familiarity can help them instinctively recognize when a request seems suspicious. Cybersecurity Awareness Month is a good opportunity for organizations to make employees aware that a convincing message is not automatically a trusted message. This week, organizations should ask employees to take actions that make it harder for threat actors to succeed, including pausing when a request feels unusual and verifying it through another trusted communications channel before taking action. A stronger security backstop can help Employees can't recognize every social engineering attempt, especially as attacks become more convincing due to AI, but there are ways to better the odds of success. Pondurance helps organizations strengthen the layers around their people through managed detection and response, incident response, risk management, and cybersecurity expertise designed to identify suspicious activity before it develops into a larger incident. Learn more about Pondurance and explore the many ways organizations can strengthen security to keep employees safe from cyber threats. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Cybersecurity 101: The Mythos Mystique Michael DeNapoli April 24, 2026 Facebook X (Twitter) LinkedIn Copy link Many, many readers have been asking about the recent announcements from Anthropic (the makers of Claude and other AI products) about its new Mythos model and Project Glasswing, which is leveraging that model. There are extremely differing opinions on Mythos - is it the most dangerous evolution of tooling in cybersecurity, or a positive impact as a defensive awareness and compensating controls approach. But let's go over the foundational basics first. Key Points Anthropic is developing a new AI model called Mythos for its premier product line, Claude. Mythos turned out to be an incredibly good threat researcher, finding vulnerabilities in many products across the technology world. Mythos has even discovered how to use those vulnerabilities to attack, creating concern in the cybersecurity world. However, only a select group of vendors have been provided with access to Mythos so they can create patches for their products. No actual threat actors have access to Mythos in any way. Mythos will not be intentionally publicly available until Anthropic has placed guardrails that, in concept, prevent Mythos from being used for cyber attacks. Bloomberg (and other news agencies) reported on April 21, 2026 that a small number of other persons have had access to Mythos via a 3rd-party vendor. Anthropic has not confirmed the validity of the research done by these news outlets, instead stating: "We're investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments." TheRegister later reported that unauthorized parties may indeed have accessed the platform in a limited capacity through a 3rd-party vendor. We will update this article as new information is available on the potential unauthorized access to Mythos. What is Mythos? Mythos is not a new product; it’s the next-generation model for Claude, Anthropic’s flagship Large Language Model (LLM) product line. Earlier versions of Claude are available publicly, which you can sign up to use on Anthropic’s website . Claude, Claude Code, and Claude API all allow users to ask questions on just about any topic, and develop code in multiple programming languages. These products run on top of a model, similar to how a car runs on an engine. Models are the underlying data systems and code that allow an artificial intelligence to “think” (though that’s a gross oversimplification). To date, Anthropic has created four large language models (LLMs) for Claude, and released three: ● Haiku: The fastest and cheapest of Claude models, Haiku is used primarily for chatbots and other use cases where speed is critical, and little reasoning is required. If a chatbot is pulling from knowledge bases and websites, then Haiku will get the job done. ● Sonnet: More expensive, and not as fast as Haiku, Sonnet analyzes and correlates information. Use cases include generating code in multiple development languages, adding context to messages in Slack or other platforms, and automating workflows without a ton of branching decision trees. ● Opus: This is the most expensive of the currently available models, built to deal with deep reasoning, making decisions, and handling things that require multiple steps with branching decision pathways. Opus is typically used to build agentic AI systems, for example. ● Mythos: This next-generation model extends the abilities of Opus significantly. It can reason faster, decide with more complex branching paths, and handle more concurrent operations. Mythos is not yet available to the general public, and won’t be for some time to come. Bottom line: Mythos is simply the next iteration of Anthropic’s AI model development. Eventually, it will be available in Claude and any other format that Anthropic makes publicly available. The company will certainly introduce new services and products based on Mythos in the future, while other 3rd parties will leverage the model for new services. Why is everyone alarmed over Mythos? When Mythos was developed to the point it could accept input (usually known as “prompts”), Anthropic found something remarkable: Mythos was extremely good at performing cybersecurity operations, even though it was not specifically built to do so. In fact, Anthropic and many cybersecurity experts got a sneak peek, and had significant concerns. The issue isn’t that Mythos can understand and make decisions on cybersecurity issues, it’s that Mythos can actually find new weaknesses in software, and then successfully exploit them for attack purposes. And it can do this all on its own once given the right sequence of prompts. Defining vulnerabilities and exploits A vulnerability is a weakness in something, such as a software program, a laptop or mobile device’s operating system, or even in a piece of hardware like the laptop itself. Vulnerabilities are the potential to make the application, system, or device do something that the original developers didn’t intend for it to do. An exploit is the series of steps necessary to use that vulnerability to perform something the system, application, or device isn’t meant to do. This usually involves programmatically accessing the vulnerable thing in a very specific way. It can lead to outcomes such as crashing systems or otherwise making resources unavailable, giving someone unauthorized access to data and/or settings, stealing data, or any other operations that are not meant to be possible. Threat researchers (both within vendor organizations and independent groups) will frequently identify new vulnerabilities after hours, days, or even weeks of experimenting on any given application or system. With this information, system developers and vendors can patch their systems to eliminate the vulnerability. Threat researchers may even take significant time to develop an exploit for the vulnerability, giving the developers and vendors an example they can use to better develop the patch. Threat actors and groups can also discover vulnerabilities and code exploits. Of course, they don’t give the developers or vendors any notice before they start using that knowledge to attack organizations, but it still takes these actors and groups significant time to figure out the vulnerability and build out the exploit to form a working attack, often weeks or months. A zero-day vulnerability is a vulnerability that becomes disclosed by a vendor/developer before the vendor or developer can build a patch to block an exploit. “Zero day” means that the vulnerability is disclosed to the general public without a patch, starting the clock on how long it’ll be before someone starts exploiting it and launching an attack. Mythos is hyperfast at finding vulnerabilities and creating exploits When properly prompted, Mythos can: Analyze an operating system, application, or other system for potential vulnerabilities Find unknown vulnerabilities Develop and run exploits against those vulnerabilities Mythos can do all this far more quickly than traditional threat researchers or threat actors can. In short, it could identify zero-day vulnerabilities and create exploits to use in attacking them, sometimes in minutes. As you might guess, this set the cybersecurity world on fire. Because of the potentially explosive nature of Mythos, Anthropic immediately began to mitigate the potential for damage. The company: Delayed the potential release date of Mythos and announced that Opus (the current top-of-the-line model) would continue. Only Anthropic can choose which people and organizations access Mythos today and in the near future. While some reporting has stated that others gained access to Mythos (see above), this has not yet been confirmed and is being denied by Anthropic. Created Project Glasswing. For this project, Anthropic gave limited access to Mythos to about 50 cybersecurity researchers and providers of major operating systems, applications, and hardware. The intent behind this project is to help ensure that anything Mythos could find (and it can find a lot) would already be visible to those who could then immediately and effectively patch their systems. Most critically, Anthropic has pledged to not release Mythos to the general public until they can build “guardrails” into the model. These guardrails would prevent Mythos from accepting prompts that would enable users with a Claude subscription to find new vulnerabilities and build new exploits. While there’s no announced timeframe for this, Anthropic has (as mentioned above) committed to limiting access to Mythos until this is completed. What does this mean for your organization Anthropic’s actions have had two major impacts for nearly every organization on the planet. Specifically: By limiting access to Mythos only to participants in Project Glasswing, Anthropic has allowed the technology to be put to good use. Vendors, developers, and researchers can now make their products and systems safer than ever - though we can expect to see many vendors releasing patches in the coming weeks. One hope is that many vulnerabilities will be found and vendors will be given the chance to redesign or provide patches before they become publicly known or exploited. While we will address this topic in a separate article, there is an important aspect to remember relative to Mythos … There are 15-30 major frontier models like Claude, 200-500 notable open source models, and thousands of Research & Experimental models in play. Mythos isn’t likely the only one out there that has this capability … and if it is it is only days, maybe weeks, and certainly not months and years before other engines and models can do this. Many of the participants in Project Glasswing are defensive cybersecurity vendors, several of which your organization may already use. Microsoft, CrowdStrike, and others are confirmed participants, which means these vendors can build patches into their security tools that block exploits Mythos may discover. While the full list of participants has not been released publicly, many could be security vendors you use along with hardware manufacturers, Operating System developers, and application platform vendors. If so, you will benefit from the intelligence and information these vendors gain from Project Glasswing and Mythos. Pondurance is also keeping a close eye on Mythos and the results of Project Glasswing. Since we already partner with the leaders in the cybersecurity space (Microsoft, CrowdStrike, SentinelOne, and others), we’ll benefit from the research, patching, and methodologies that the project creates. One of the main reasons we choose the partners we do is because we know that they’ll remain at the forefront of emergent technologies like Mythos. When new threat signals and intelligence are discovered, the managed detection and response tools we use will also be able to evolve. AI is accelerating threats. Your defenses need to keep pace. See how Pondurance delivers continuous monitoring, threat detection, and expert response to protect your organization. Explore the platform or request a demo . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn the key differences between MSSP vs MDR vs SIEM, plus which solution is right for your organization in this blog. Read here. MDR, MSSP, and SIEM: Which Is Right for You? Pondurance March 3, 2022 Facebook X (Twitter) LinkedIn Copy link With the rise in cybercrime, companies are looking for the best solution to protect against cyber threats. Most companies choose from one of three different security solutions: managed security services provider (MSSP), SIEM, and managed detection and response (MDR). More and more often, they are choosing MDR as the preferred security solution to stay safe from cyberattacks. In fact, technological research and consulting firm Gartner predicts that one-half of all organizations will use MDR services to monitor, detect, and respond to threats by 2025. In Chapter 4 of our new eBook Managed Detection and Response (MDR) for Dummies , we compare these three security solutions to help you decide what’s best for your company. We explain the key differences between MDR vs. MSSP vs. SIEM, which activities you must manage with each service once implemented, and why MDR is gaining ground as a security solution. MSSP This entry-level security solution can tackle some of the specific tasks of your information security workload. For example, an MSSP service can secure your network and evaluate security controls on your devices or it can configure your firewalls, run vulnerability scans, and validate policies for your virtual private network. Such tasks are helpful, especially if your company doesn’t have a dedicated cybersecurity staff. But is an MSSP able to fully protect your company from a sophisticated data breach or cyberattack? We explain why it’s important to understand the limited visibility of an MSSP and know how that limitation can result in undetected activity in your cyber environment. SIEM The SIEM platform collects relevant data from multiple security systems and forwards the data to a centralized management and analysis system. One of the best features of SIEM is that it collects data from so many sources, providing broad rather than limited visibility. However, such broad visibility can cause problems when an abundance of data leads to an overload of alerts. We’ll explain the pros and cons of broad visibility, discuss what you need to know about alert fatigue and false positives, and tell how SIEM uses machine learning and artificial intelligence to analyze data. MDR Great cybersecurity protection requires advanced technology, such as machine learning and artificial intelligence, and experienced security professionals. That’s where MDR excels. MDR uses both tools and humans to capture, integrate, and analyze data from multiple sources. Security professionals perform full scope analysis to detect novel attack patterns and proactively respond to attackers. In this section, we discuss how MDR integrates security silos, explain how MDR expands the scope of analysis to networks, endpoints, logs, and cloud environments, and tell why you must have humans in the loop to defend your company from cyberattack. Conclusion Cybercrime is a serious threat. You need to know the best way to protect your company from data breaches and attacks. Learn about the three most common security solutions and discover which option is right for your business. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Ransomware Attack Revisited and Lessons Learned Pondurance May 9, 2025 Facebook X (Twitter) LinkedIn Copy link A ransomware attack can shut down an organization’s ability to function. And when that organization is a hospital, protected health information can be compromised and lives can be at risk. But an attack doesn’t have to be devastating. Hancock Health, a 20-plus location independent health system in Indiana, experienced a ransomware attack in 2018 and, with assistance from its cybersecurity provider and legal counsel, was able to navigate the cyberattack with minimal harm. In a recent webinar, Steve Long, CEO at Hancock Health, and Ron Pelletier, Founder and Chief Customer Officer at Pondurance, discussed what happened before, during, and after the incident and offered lessons learned for future cyber resilience. The initial attack Hancock Health was preparing for a winter storm on a Thursday in January, just before a holiday weekend. That night, Steve received a text explaining that messages had appeared on the hospital computers indicating that the system had been encrypted by SamSam ransomware . The organization was “averagely prepared” for a cyber incident. Hancock Health received the Most Wired award three times in a row for excellence in healthcare IT, maintained a comprehensive privacy program and cybersecurity program, and had an incident response plan in place that focused on patient safety, patient data security, and restoration. The organization quickly activated the incident response plan. First, Hancock Health shut down all network and desktop systems, including the manual shutdown of 1,200 devices, and posted signs for employees to stay off the network. In hindsight, Steve and Ron suggested that it’s not always a good idea to shut down every computer during a ransomware attack. “There’s always a lot of forensic evidence, very valuable evidence, that can remain behind with a powered-on machine,” said Ron. Today, the incident response plan provides guidance to keep the systems up and running during a cyber incident. Lesson learned: Keep your network on during a ransomware attack to gather forensic evidence. Next, executive leadership members established an incident command center and began notifying people of the situation. They needed to contact the board of directors and call off all nonessential employees. However, they lacked access to their files and could not use the company email. Fortunately, Hancock Health used BoardEffect, an internet-based communications solution, so Steve was able to contact the board members using that service. The organization also used messaging platforms Diagnotes and Live Process to communicate with employees, though many employees used their work emails as the preferred contact method. The team had to locate employee cell phone numbers to contact those employees. Lesson learned: Set up a system to contact board members and employees using their cell phones or personal emails. The leadership team contacted key parties including Hall Render, legal counsel for Hancock Health. The attorney instructed the team to call the FBI for advice and engaged cybersecurity provider Pondurance to initate a forensics investigation. Team members also contacted their cyber liability insurance provider but were unable to talk with someone there. When the insurance provider called back, he instructed Hancock Health not to use Hall Render and Pondurance because they were not impaneled. However, because the investigation was ongoing, the provider allowed it. Lesson learned: Make sure you can use the parties you want to use during a cyber incident. Throughout the incident, patient care continued. Hancock Health had to ensure that patient-faced equipment was not affected, briefly divert emergency room (ER) care until processes were established and stabilized, and convert the staff to paper documentation. “We never stopped being a hospital,” said Steve. “We were a hospital the entire time. Babies were born, surgeries were done, and ER visits were completed because hospitals are not computers. They are people taking care of people.” Forensic investigation A forensics investigation involves four stages: identification, containment, eradication, and remediation. In the identification stage, the Pondurance team determined how the threat actors got in the network, what they were doing, and how long they were there, primarily because Hancock Health had an abundance of logs to review. The team could see which emails were opened, what the threat actors viewed, and even what they hovered over or clicked on. Since a ransomware attack can trigger state and federal privacy laws, including HIPAA, it was important for Hancock Health to determine based on forensic evidence whether a breach happened in violation of the law. Using the logs, Pondurance positively determined there was zero exfiltration of data, meaning the data remained inside the system the entire time, and no violation occurred. Lesson learned: Logging is absolutely essential. The containment stage is where many victims of cyberattacks get into trouble. Often, organizations want to move directly to restoration to get the business running again. But an organization must fix the hole in the system that allowed the threat actors to gain access. Without containment, the threat actors can walk right back in. Pondurance identified how the threat actors got in, fixed the vulnerability to contain the network, eradicated the threat actors, and only then worked toward remediation. Ransom payment The threat actors provided specific directions on how to pay the ransom demand. The organization could either purchase the decryption keys and decrypt the system or not purchase the keys and restore from backup. To pay or not to pay? At the time, Steve was unclear if Hancock Health had backups. But even if they existed, he knew it would take days to perform the backups. The hospital would lose $1.5 million to $2 million per day during backups, so the leadership team decided to pay the ransom. When paying a ransom to a threat actor, an organization is always concerned about the possibility that the threat actor won’t deliver even if the ransom payment is made. However, the FBI explained that it all depends on the “integrity” of the threat actor. Of course, an organization can never completely trust a threat actor, but this particular threat actor had a reputation of delivering the keys upon payment. The payment required bitcoin, which meant, in 2018, Hancock Health had to purchase bitcoin through a bank. Since it was a holiday weekend, team members had to complete the transaction by end of day Friday. Otherwise, they couldn’t pay the ransom until Tuesday. Hancock Health secured the bitcoin at 4:45 p.m. that afternoon and precisely followed the directions for payment. Early Saturday morning, Hancock Health received the decryption keys — 1,400 keys, to be exact, because there were 1,400 devices that each required a separate key. The Pondurance team made sure that each key was viable and nothing malicious was placed on the system. The ransom amount was four bitcoins at $14,000 each for a total of $56,000 — a small amount compared with ransom payments for the healthcare industry today. In 2024, the average healthcare ransom payment was $900,000, and Change Healthcare paid the largest ransom of $22 million that year, according to The HIPAA Journal . “I’m not going to say never pay the ransom,” said Ron. “You may not have a choice when there’s a lot at stake. Steve went through the risk analysis. You determine that this is the best course of action — we’re going to get these keys back, we’re going to get things in order, get back in business. So that’s what was done. But certainly, today might be a little bit different in terms of the amounts.” Cyber resilience Following the attack, Hancock Health partnered with Pondurance for its managed detection and response services to rapidly detect and respond to threats. Pondurance offers an advanced technology platform integrated with SentinelOne endpoint detection and response, has a 24/7 U.S.-based security operations center (SOC), and provides vulnerability management service . Together, Hancock Health and Pondurance debriefed on lessons learned, identified and implemented the next steps needed to proactively reduce incidents, updated the incident response plan, and took a holistic approach to minimize potential harms. They wanted to make a strategic, dynamic, and ongoing effort to avoid risk, prevent actions, and respond to threats. In particular, they evaluated the attack surface, vulnerabilities, and proactive capabilities to reduce incident risks. These measures included: Conducting an enterprisewide risk analysis Developing and implementing a remediation plan Regularly updating and patching software and systems Implementing multifactor authentication Employing a vendor management program Performing annual penetration testing Conducting annual workforce training Steve stressed that the team is the key to a successful cyber response: “You need to have people who say, ‘this is a period of time where we need to devote ourselves wholly to this place.’ We did not go to sleep for, I think, about 50 hours during this. You have to be dedicated. You have to be selfless. … You have to be honest because, if you’re not honest, you do not make it through this. And you have to have a great partner like Pondurance.” Lesson learned: The key to cyber success is a team that’s dedicated, selfless, and honest. Always a new threat The cyber environment is constantly evolving, and a well-prepared organization is one that can readily respond. So, in May 2023, when the electronic medical record suddenly became unavailable and the cloud hosting service indicated an interruption in service, Hancock Health was prepared to respond. The team traced the issue to an attempted loading of Cobalt Strike onto the cloud network via a hospital computer. The SEO poisoning attack was initiated via Gootkit installation when an experienced department director downloaded an online file from a supposedly legitimate source. The work done to harden the defenses from the 2018 ransomware attack allowed the team to identify and intervene much more quickly this time. The entire incident lasted only 36 hours with no exfiltration, loss of control, or ransom demand, and downtime was limited only to the electronic medical records. “That’s resilience,” said Ron. “Resilience is not prevention. You want to be able to prevent, but you have to be prepared to respond. You have to have the right things in place to be able to see what’s going on so that you can take dynamic action and response to be able to thwart it and take it away.” Lesson learned: You can’t prevent a cyber threat, but you can properly respond to one for a better outcome. Lastly, Steve recalled that Hancock Health was averagely prepared for a cyber incident in 2018, having taken all the typical cybersecurity measures. After experiencing the latest threat in 2023, he believes the amount of money it costs to be very well prepared is not that much more and is well worth it. Steve encourages companies in healthcare and all industries to take similar actions to stay resilient against a potential cyberattack. Lesson learned: The cost to be very well prepared versus averagely prepared is not much more, and it is worth it. Conclusion Hancock Health has experienced its fair share of firsthand cyberattacks. However, the organization has turned those negative experiences into lessons learned for a more resilient cyber posture moving forward. Hear the full story as Steve and Ron revisit the attacks and share the valuable lessons learned. Watch the webinar. Ready to strengthen your cybersecurity strategy? Download our playbook for essential insights and actionable steps to enhance your organization's defenses. Get the Playbook Now! About Our Contributors: Steve Long and Ron Pelletier Steve Long: Steve Long is the President & CEO of Hancock Health in Greenfield, Indiana. With over 30 years of experience as a healthcare executive, Steve has held leadership roles in a diverse array of hospital settings, including for-profit and not-for-profit institutions, academic medical centers, large hospital systems, independent community hospitals, and military hospitals. His extensive career includes key positions at notable organizations such as the University of Iowa Healthcare, MD Anderson Cancer Center in Texas, and Aurora Healthcare in Wisconsin. Ron Pelletier: Ron Pelletier is the original Founder of Pondurance, having started the company from his basement in 2008. Ron has over 25 years of cyber security advisory experience. He started his career as an officer in the US Army, followed by nine years with Big Four firm, EY. As a strong consensus builder and customer advocate, Ron is focused on evangelizing the Pondurance brand as well as customer success. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn how BEC attacks are evolving in healthcare and what organizations can do to improve detection, prevention, and response. Understanding the IOCs, Attack Techniques, Preventative Measures, and Do's and Don'ts of a BEC Attack Pondurance May 12, 2026 Facebook X (Twitter) LinkedIn Copy link Business email compromise (BEC) attacks involve unauthorized threat actors gaining access to a legitimate email tenant through social engineering tactics, including emails, texts, phone calls, QR codes, and other communication tools. Last year, organizations experienced a 30% increase in BEC attacks, according to data from SureFire Cyber. The number of BECs is expected to increase as additional tactics continue to evolve. The financial impact of these scams can be significant since most successful BEC attacks involve vendor payment redirection, executive impersonation, and payroll diversion. BECs remain one of the top financial cybercrime categories, and financial losses can be even greater for healthcare organizations than companies in other industries. Threat actors often target healthcare organizations due to the large volume of financial transactions, reliance on email for billing and procurement, storage of sensitive protected health information, operational urgency with a staff that's likely to act quickly, and the prevalence of legacy IT systems and staffing shortages. Abbey Mirelli, Incident Response Manager, and Brook Weiss, Incident Response Consultant, both on the Pondurance team, recently presented valuable information on BECs for a Health-ISAC Navigator Program. They discussed the indicators of compromise (IOCs), attack techniques, preventative measures, and the do's and don'ts of a compromise. Indicators of compromise IOCs are forensic data or evidence that shows threat actors have already infiltrated an environment, and the incident response team uses that evidence in an investigation to figure out what happened. The team explained how threat actors are looking to compromise administrative accounts with elevated privileges that they can use to set up mailbox connectors for additional mail flow, assign delegated access and permissions to other mailboxes, or register additional applications. When a threat actor has admin access, it adds to the risk and impact of a BEC attack and, when used to its full advantage, makes the attack more complex. Once the threat actors have gained admin access, a few actions typically occur. The team explained that threat actors may contact the user with: an unexpected IT support call or Teams meeting, instructions to install remote access software, requests to approve multifactor authentication (MFA) prompts or enter credentials, and other social engineering scams. Also, the threat actors may change an existing contact to a domain that they control so they can maintain visibility into the environment and possibly inject themselves back into the conversation. In addition, after compromising an email account, threat actors often use spoofing , or pretending to be another user or device to gain unauthorized access or sensitive data. The primary IOCs that the incident response team looks for during an investigation include logins from new countries or unusual locations, logins that would require an impossible travel itinerary for one person, logins from virtual private networks or cloud hosting providers, multiple failed logins followed by a successful one, sign-ins at unusual hours, and new user agents or devices. Attack techniques Threat actors use a number of different techniques to execute a BEC attack, including phishing, document sharing, vishing, and mass spam emails. The team explained that the techniques are continuously evolving as threat actors try to blend in and evade the attention of employees as they make their moves. Phishing , the primary technique threat actors use to compromise email accounts, uses fraudulent messages to deceive targets into revealing sensitive information such as credentials, passwords, or bank account numbers for malicious use. Typically, the messages encourage targets to click on a malicious link, expose login credentials, or allow other access to the network. As much as 56% of organizations were impacted at least one time by phishing-related incidents, according to the 2026 Kaseya Cybersecurity Outlook Report. In the past, phishing emails were often identifiable as fraudulent due to poor grammar and awkward language. Today, artificial intelligence (AI) allows threat actors to create convincing emails with little effort or expertise. Threat actors now use AI to personalize the content of the emails and write the text. Threat actors are creative in their phishing exploits, using spear-phishing, pharming, whaling, and more. The team discussed a few specific types of phishing campaigns to look out for. Zipline phishing . Users reach out by legitimate means, such as a Contact Us online form, and threat actors respond by attaching a zip folder that contains a malicious payload. Tycoon MFA phishing . Threat actors send malicious emails using a phishing kit, directing users to spoofing organization domains. In October 2025, Microsoft Defender blocked over 13 million such emails from hundreds of threat actor groups. The low price of the phishing kit has dramatically lowered the barrier to entry for threat actors. SharePoint/OneDrive emails . These attacks target industries that rely on document sharing, such as consulting, finance, and construction. A typical email fraudulently alerts the user that a document has been shared and contains a link to view the document. Vishing . These attacks use emails to alert users about a missed call or new voicemail and include a link to play the voicemail message. The link usually leads to a phishing page or login. Mass spam emails. Following a compromise or once they know they will be caught, threat actors often send a fraudulent email, similar to the one used to gain initial access, to a mass group of people. The goal is to find more potential victims. Preventative measures While threat actors relentlessly try to obtain user credentials, organizations need to know what they can do to lower the risk of BEC attacks. There are many anti-phishing tools on the market; however, the tools still leave gaps in protection. But there are actions organizations can take to fill the gaps and minimum the risks. FIDO2 . This phishing-resistant MFA method offers protection against BEC attacks. FIDO2 has a key stored in the hardware token that the user must use to log in to the email environment. When threat actors try to intercept the login credentials, they fail because their spoofed webpage will not recognize the key. Audit logging. Audit logging analysis differs depending on the environment used. Microsoft 365 Unified Audit Log can be used to analyze data for up to six month for all licenses and up to one year for licenses E5 and above — but it must be turned on. Google Workspace and on-premises environments also have audit logging capabilities but are often more limited. Registration of applications. Only administrators should register applications in the environment, keeping threat actors from having access to them. Separation of admin accounts. Admin accounts should be logged in to only when conducting admin activities. For all other activities, the administrator should use a day-to-day account that is not privileged. Session length. The length of an admin account session should be kept to a minimum to prevent an extended stay for a threat actor. For example, if a session for an admin person persists for three months, the threat actor can also persist in that session for three months. User training. The team stressed the importance of providing comprehensive user training and allowing employees to readily report suspicious behavior or stolen credentials. The do's and don'ts of a compromise As much as 70% of organizations expect a phishing attack in the next year, according to the 2026 Kaseya Cybersecurity Outlook Report. If a phishing or BEC attack does happen, organizations need to know what to do — and what not to do — to stay safe and improve the quality of the incident response investigation. Do's: Immediately reset the account password and revoke any active sessions. Review the user's MFA devices. Revert any modified financial configurations to their original state and notify the internal team. Review and delete any suspicious or unauthorized inbox rules. Confirm that the MFA has been reconfigured and that the new setup uses phishing-resistant methods. Perform a mass password reset, if possible. Make certain that the threat actors are not continuing to use the privileges of the compromised account after they are kicked out. Don'ts: Don't panic. Contact the bank to freeze accounts or attempt a wire recall. Don't delete the mailbox of the impacted email. Don't assume that only one account is impacted. Don't ignore financial systems or others that tie back to Microsoft 365, especially ones with MFA set up as the email account. Don't be convinced that MFA can fully stop a BEC attack. Conclusion BEC attacks are on the rise and are expected to continue to increase as additional tactics continue to evolve. The financial impact can be significant, particularly in healthcare, but it doesn't have to be when employees know how to recognize BEC attacks and the organization implements preventative measures to minimize the risk of harm. For more detailed information about BEC attacks, watch the webinar . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Phishing With SVGs, Vulnerabilities and Trends, SOC Insights, and LogScale Tips for October 2024 October 2024 Novel Threat Tactics, Notable Vulnerabilities, and Current Trends Pondurance November 22, 2024 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In October, the team discussed threat intelligence, notable vulnerabilities and trends, security operations center (SOC) updates, and SOC engineering insights. Threat intelligence The Senior Incident Response Consultant on the Digital Forensics and Incident Response team explained how threat actors weaponize scalable vector graphic (SVG) files — two-dimensional, XML-based vector images typically used in graphic design — and discussed ways clients can mitigate the risk of attack. Threat actors can use an SVG file to deliver malware via phishing in two different ways. First, as a JavaScript download, an SVG file contains embedded URLs that deliver or execute malware or malicious code when the user opens it. Second, as an HTML embedded object, an SVG file leverages the href or xlink:href functions within the SVG standard and loads a remote resource within the local file or page to present as a phony login site without showing the URL to the user. Both are examples of ways threat actors take normal files available to the public and find ways to weaponize them to serve their financially motivated goals. To stay safe, clients can proactively take action to prevent or look out for the weaponization of SVG files. The Senior Incident Response Consultant suggested several actions to mitigate the risk: Block SVG attachments Train users to be wary of files that end in .svg (and .htm and .html files too) Implement branded login screens to help users distinguish a fake login page from a real one Educate users on the risk of email attachments Restrict execution of JavaScript within browsers and applications Keep browsers and other applications up to date Vulnerabilities and trends The Vulnerability Management Program (VMP) Team Lead reviewed notable vulnerabilities from September. Approximately 2,800 new vulnerabilities were disclosed, which is back to normal for 2024 but down from the 5,200 vulnerabilities seen last month. Twenty-six of those 2,800 vulnerabilities were high risk, and six of those 26 were known to be actively exploited in the wild, including four zero-day vulnerabilities on Microsoft and one vulnerability each on Ivanti and Veeam. In addition, seven more vulnerabilities have proof-of-concept codes available on the internet. In September, 79 vulnerabilities were addressed during Microsoft Patch Tuesday. Among those 79, seven had a critical severity level, and four were actively exploited zero-day vulnerabilities on Microsoft products, including Microsoft Edge, Windows Publisher, Windows SmartScreen, and Windows Installer. The VMP Team Lead talked in detail about two specific exploitations that happened in September: The Windows MSHTML platform spoofing vulnerability (CVE-2024-43461) was chained with a previously patched Microsoft zero-day vulnerability (CVE-2024-38112) and successfully executed by the financially motivated Void Banshee APT group. In this attack, an HTA file appeared as a PDF to the user. When the user clicked on it, code was executed and payloads were downloaded onto the system. Then, Atlandia infostealer malware was deployed on the system to look for and exploit stored passwords, credit card data, and cryptocurrency wallet information. Clients should apply both the July and September security updates to ensure that they are protected. Four different vulnerabilities worked together to exploit the Common UNIX Printing System (CUPS). One vulnerability (CVE-2024-47076) allowed the threat actor on the system to send malicious data from the Internet Printing Protocol to the CUPS system. The second one (CVE-2024-47175) allowed the threat actor to inject data into a temporary PostScript Printer Description (PPD) file. The third one (CVE-2024-47176) allowed the threat actor to send malicious packets that caused the system to connect to an external threat actor-controlled URL. The fourth one (CVE-2024-47177) allowed the system to execute commands embedded in the malicious PPD file. These four vulnerabilities can result in the takeover of a system and loss of critical data, so clients should apply the patches and upgrades, particularly if they have remote workers. In October, 118 vulnerabilities were reported and addressed during Microsoft Patch Tuesday. Among those 118, five were zero-day vulnerabilities, and two were known to be actively exploited. To reduce the likelihood of a successful cyberattack, the team recommends that clients focus their efforts on applying the Microsoft patches as they are released. SOC updates The SOC Director discussed recent cybersecurity trends that the SOC team observed in September. Credential stuffing attacks . These attacks are trending steady. During an attack, a threat actor takes a large number of usernames and passwords, finds a login page on the internet, and blasts every single username and password combination on that login page. Fortunately, Okta and Microsoft 365 have built-in protections against credential stuffing attacks. Okta uses adaptive multifactor authentication (MFA) and risk-based authentication, and Microsoft 365 has a similar feature under Azure Active Directory Identity Protection. Ransomware . These attacks are still trending steady. The team consistently sees threat actors using ransomware. Social engineering help desk calls . The SOC experienced a slight drop-off in these attacks in September but still saw enough of them to label the activity as steady. Threat actors always look for the weakest link, and right now, they perceive that to be help desks. Phishing emails are trending steady, with the vast majority linking to credential harvesting web pages. The use of artificial intelligence services, such as ChatGPT, is making phishing emails harder to detect due to more convincing language and correct grammar. To stay protected against phishing threats, the team recommends enabling MFA and offering user awareness training . SOC engineering insights The SOC Technical Advisor started by briefly reinforcing the importance of disclosing crown jewels, such as hosts, IP addresses, VIP lists, and honey tokens . He also discussed new functionality that allows the team to further tailor alerts, even on a temporary basis, for sets of users or systems. In particular, if clients know that a user is going to be traveling abroad, the client can provide the dates of travel so that the team can mute the alerts for that time period. Next, the Detection Engineer explained how to conduct searches in LogScale and provided numerous examples. All documents on LogScale are available free to clients with no login required. Clients can go to library.humio.com and search for anything they need. He offered numerous tips for searches including: Specify which repo or log you are searching for. Clients that have the Pondurance network sensor and are shipping logs to LogScale can use either #repo=xxx-log or #repo=xxx-network to significantly increase their search speed and reduce the load on LogScale. (Note that xxx equals the client code.) The team reminds clients that the network can search only seven days of data and the log typically can search only 30 days of data. Write a better query. Clients should place #repo in the first line of the query and start all subsequent lines with the pipe symbol, aka the vertical bar. They may need to cast a “wide net” at first by searching against the @rawstring field and then narrowing the search more and more. The @rawstring field contains each log’s data on one line in a JSON format . The Detection Engineer showed several examples of how to construct such a search. Choose a field/value. In LogScale, three dots appear next to every field. When clients click on those dots, they can choose to match a value, match a regular expression (regex), exclude a value, or select a field. At this step, remember to remove the @rawstring field. Choose a shortcut. Clients can also select group by value, exclude value in query, or match value in query. See what fields are available. Clients can use Fieldset() to see what specific fields are available. Field set only returns the names of fields and does not return counts or key value pairs. For counts on fields, clients can use Fieldstats(). Note that field names are case sensitive. The Detection Engineer showed several examples of how to narrow a search for a particular word in a field name. The team highly recommends that clients check out the LogScale tutorial for more information about conducting searches. LogScale provides a hands-on experience where users can learn and practice using sample data. LogScale also recommends the following best practices for clients: Limit the search time frame as much as possible Narrow down the result set starting with a tagged field (one starting with #) Continue to filter the dataset with remaining field values that exist After filtering what to see, filter what not to see (the NOTs) Use any regex needed to further filter the filter Transform the data using functions such as math, evaluation, format, etc. Use the aggregate functions, such as sum(), top(), or groupby(), to aggregate the data Perform any final visualization processing such as sorting or table functions Next month The Pondurance team will host another webinar in November to discuss new cybersecurity activity. Check back next month to read the summary. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

What is C-Day? Learn how quantum-era data collection, harvest-now-decrypt-later strategies, and hidden exposures could reshape cybersecurity risk. C-Day. Here's Why It May Be the Most Important Cybersecurity-Quantum Concept You've Never Heard. Doug Howard June 3, 2026 Facebook X (Twitter) LinkedIn Copy link In my first article in this series; The Quantum Clock Is Ticking ; I introduced two concepts that will serve as the analytical backbone for everything that follows. Q-Day: the moment quantum computing achieves the capability to break modern encryption at scale. A defined, planned-for event that the NSA, CISA, and NIST have all acknowledged in public guidance. A threat serious enough that NIST finalized an entirely new suite of post-quantum cryptographic standards in 2024. A timeline that artificial intelligence is actively compressing in ways the current public consensus has not yet fully absorbed. And C-Day: my original framing for the moment that is, in my assessment, more immediately dangerous than Q-Day itself. C-Day is Capture Day. The moment adversaries shift from opportunistic data theft, grab what you can and monetize it now, to strategic, quantum-anticipatory collection. Systematic harvesting of encrypted data today, stored with institutional patience, waiting for the quantum capability that will eventually render that encryption meaningless. The cryptographic community has warned for years about "harvest now, decrypt later" (HNDL). Michele Mosca and others framed that timing risk. C-Day is a name for the strategic inflection point inside HNDL: the moment adversaries shift from opportunistic capture to strategically deliberate, quantum-anticipatory collection. In that first article, I argued that C-Day is not a future event. For the adversaries who most stand to benefit from quantum capability, C-Day has already occurred. The collection is active. The Silent Window, the period between C-Day and Q-Day, is not a warning period. It is an operational reality. Today’s article goes deeper. I want to examine C-Day not as an abstract concept but as a framework with distinct operational scenarios, each carrying different risk profiles, different detection challenges, and different implications for how security leaders need to think and act right now. Why This Framework Matters Before I walk through the scenarios, let me be direct about why I believe C-Day deserves its own named framework rather than being folded into the existing "harvest-now-decrypt-later" language that practitioners use. Naming matters in security. The moment we gave a name to advanced persistent threats, boards started allocating budgets to defend against them. The moment we named ransomware as a category distinct from malware, organizations started building response playbooks specific to it. Language creates accountability. Frameworks create action. The harvest-now-decrypt-later concept has existed in practitioner circles for years. It has not generated the organizational urgency it warrants, in part because it describes a behavior rather than a moment. C-Day names the strategic inflection point: the shift in adversarial intent from tactical to generational (i.e. from immediately usable to strategically held for a future event). That shift changes everything about how you should assess your current exposure, how you should prioritize your security investments, and determine how urgently you should be acting. The C-Day → Silent Window → Q-Day construct gives security leaders and boards a mental model with a beginning, a middle, and an end. Most organizations are mentally living in the middle without understanding that the beginning has already passed for many of them. That misunderstanding is costing them time they cannot recover. The Facts The evidentiary case for C-Day as an active, ongoing operation is not circumstantial. It is documented in public disclosures, intelligence community warnings, and the forensic record of some of the most significant breaches of the past decade. Salt Typhoon. Disclosed in late 2024, Salt Typhoon is arguably the most significant telecommunications infrastructure compromise in U.S. history. Chinese state-affiliated actors maintained persistent, undetected access inside major U.S. telecommunications carriers, in some cases for years before discovery. The targets included lawful intercept systems, the very infrastructure used to monitor communications under court order. The strategic value of that access, in a quantum context, extends well beyond the dwell period. Communications collected through that access, stored and encrypted by classical standards for indefinite periods of time, become a permanent intelligence asset on Q-Day. The OPM Breach. In 2015, the U.S. Office of Personnel Management disclosed a breach affecting 21.5 million individuals, virtually everyone who had applied for a federal security clearance over the preceding decade. The data included Standard Form 86 submissions: deeply detailed personal histories covering foreign contacts, financial circumstances, mental health disclosures, past substance use, and family member information. This is not data with a two-year shelf life. A foreign intelligence service holding detailed files on 21.5 million individuals who held or applied for U.S. security clearances is sitting on a generational intelligence asset. The quantum decryption of any encrypted communications tied to those individuals is a force multiplier on an already catastrophic breach incident. SolarWinds. The 2020 SolarWinds compromise affected approximately 18,000 organizations, including nine federal agencies and the top-tier of U.S. defense contractors, through a compromised software update that granted attackers privileged access to network monitoring infrastructure. Dwell time in many environments was measured in months. In a number of cases, the full scope of what was accessed was never definitively established. What was collected, and in what form, by adversaries with the patience to store and decrypt it later? That question does not have a public answer. These are the operations we know about. They were each, in their own way, a C-Day event: a moment when adversaries collected data whose full strategic value was not understood at the time of discovery, and may not be fully understood for another decade. The more consequential question is what the operations we do not know about now may look like in the future? How many threat actors continue to store data which was exfiltrated in the thousands of attacks that succeed each month? How many hands does that data pass through on dark web markets and in other data-sharing/selling operations? The Three Scenarios C-Day is not a single event with a single profile. It manifests in at least three distinct operational scenarios, each requiring a different detection and response posture. Scenario 1: Known Exfiltration This is the category most security leaders have some mental model for. A breach occurs. Eventually, sometimes quickly, sometimes after months or years of adversary dwell time, it is discovered. Incident response is initiated. The scope of what was accessed is assessed, to the extent forensics allows. Notifications are issued. The incident is closed. In a pre-quantum world, this lifecycle has a natural end. In a post-C-Day world, it does not. Every breach that resulted in the exfiltration of encrypted data, communications, files, database records, network traffic captures, is a potential quantum time bomb. The breach may be closed in the conventional sense. The data is not gone. It is in adversary hands, encrypted by standards that will not survive Q-Day, waiting. The OPM breach is closed in the conventional sense. SolarWinds is closed in the conventional sense. Salt Typhoon's disclosed elements are closed in the conventional sense. None of them are closed in the quantum sense. That distinction is not being made in most organizations' risk frameworks, and it should be. Security leaders need to revisit their historical breach inventory with a specific question: what was exfiltrated that carries long-shelf-life strategic value, and is it protected by encryption standards that quantum will break? That assessment does not exist in most organizations today. It needs to. Scenario 2: Unknown Exfiltration This is the scenario that keeps practitioners with national security backgrounds, including me, awake at night. It is the one I believe carries the greatest risk for the largest number of organizations, and it is the one that existing security frameworks are least equipped to address. Unknown exfiltration refers to persistent, low-and-slow collection operations that have never triggered a detection event. No alert. No anomaly flagged. No forensic artifact recovered in an incident investigation. Silent access, maintained over extended periods, systematically collecting data with a precision and patience that avoids every tripwire in a conventionally instrumented environment. These operations are not hypothetical. The intelligence community has documented the existence of nation-state collection capabilities specifically designed to operate below the detection threshold of enterprise security tools. The adversaries executing C-Day Scenario 2 are not using commodity malware. They are using custom tooling, living-off-the-land techniques, and operational tradecraft developed over years of trial and refinement – some of it in environments exactly like yours. The absence of a known breach is not evidence of security. For any organization holding data with long-term strategic value, defense contractors, financial institutions, healthcare systems, energy infrastructure operators, legal firms handling sensitive M&A or litigation, the probability of Scenario 2 exposure should be treated as non-zero and evaluated accordingly. The sophistication of the adversaries executing this doctrine makes detection by conventional security tooling genuinely difficult. AI-native detection platforms with continuous behavioral learning are not a luxury in this environment. They are the mechanism by which Scenario 2 becomes discoverable rather than permanently invisible. Scenario 3: Structural Exposure The third scenario requires no breach at all. No intrusion. No malware. No compromised credentials. Just infrastructure and patience. Encrypted internet traffic transits networks. It passes through internet exchange points, undersea cable landing stations, telecommunications infrastructure, cloud provider backbone networks. Nation-state actors with the collection infrastructure of a signals intelligence apparatus, and several of them do, do not need access to your environment to collect your encrypted communications. They need access to the infrastructure your communications traverse. This is not a theoretical capability. The documents disclosed by Edward Snowden in 2013 established that bulk collection of internet traffic at infrastructure level is a real, operational capability that has been deployed at scale. The United States has this capability. China has this capability. Russia has this capability. Others either already have it, or are developing it. Any organization whose communications transit infrastructure is subject to nation-state collection, which in practice means any organization communicating over the public internet, carries some degree of Scenario 3 exposure. The encryption protecting those communications is sufficient against today's adversaries. It is not sufficient against a Q-Day-capable adversary processing a stored archive of collected traffic. Who Is Most Exposed Not all organizations carry equal C-Day risk. The adversaries executing this doctrine are strategic actors with finite collection capacity. They prioritize targets whose data has the highest long-term value. The highest-risk categories are not surprising, but the framing matters: Defense contractors and the defense industrial base. Not because of what they know today, because of what they will know over the next decade. Technical specifications (and their evolution over time), program data, acquisition intelligence, and personnel information with security clearance implications all carry strategic value that compounds over time. Financial institutions. Transaction records, trading algorithms, and M&A intelligence are obvious targets. Less obvious but equally significant: the cryptographic infrastructure protecting interbank communications and settlement systems is exactly what nation-state actors with commercial disruption objectives would want to understand before Q-Day. Healthcare systems and pharmaceutical companies. Clinical trial data, drug development pipelines, and patient records at scale. Collective intelligence on millions of people brought together by breach events across hundreds of regional healthcare organizations. In the case of government healthcare programs, the intersection of medical and personnel data creates dossier-level intelligence on millions of individuals. Data 5, 10 or more years from now has great value and consequences. Legal firms. The firms handling sensitive litigation, M&A transactions, and government contracting disputes hold the most sensitive communications of some of the most consequential organizations and individuals in the world – protected by attorney-client privilege but not by quantum-resistant encryption. Can you imagine the impact of all the case law being exposed? Details of settlements, information under privilege, informant information, and more. Critical infrastructure operators. Energy, water, and transportation systems. The strategic value of understanding these systems' functionality and vulnerabilities over a decade-long horizon, before quantum capability is deployed offensively, is self-evident. In short, any data on anyone and anything that will be equally and/or more valuable in 10 years than it is today. That framing is the correct risk filter. If that data is compromised, the C-Day risk posture deserves serious attention. As much of it has already been compromised, the C-Day risk is real and needs serious attention. The Adversarial Calculus I want to be precise about why this doctrine makes rational strategic sense for the adversaries most likely to execute it. A nation-state actor with a ten-year planning horizon, a sustained national investment in quantum computing, and the collection infrastructure to harvest encrypted data at scale faces an extraordinarily favorable risk-reward calculation. The cost of collection, in relative terms for a state-level actor, is low. The technical risk of the collection operation is manageable with sophisticated tradecraft. The downside of discovery is diplomatic friction, which these actors have demonstrated tolerance for repeatedly. The potential upside is a future library of decrypted communications covering a decade of legal, geopolitical, military, commercial, and intelligence activity such a repository would represent a strategic asset of incalculable value. The impact would dwarf anything revealed by Snowden by orders of magnitude. There is no rational case for a sophisticated nation-state actor with quantum ambitions not to be executing C-Day operations. The question is not whether they are. The question is how long they have been doing it, how comprehensively, and whether any of their collection has touched your environment. The Howard Projection By 2027 , a major public breach disclosure will include forensic evidence of quantum-anticipatory data collection. The first time C-Day Scenario 2 is publicly named, forensically documented, and attributed to a nation-state actor. This will be the disclosure event that forces enterprise quantum risk from theoretical budget conversation to operational board imperative. Organizations that have not yet initiated post-quantum planning will face the same pressure they faced in the 72 hours after the first major ransomware event hit a peer organization. By 2028 , the U.S. and Western aligned intelligence community will declassify or acknowledge, in sufficiently specific terms, that nation-state quantum-anticipatory collection has been active against targets for a period of no less than five years. The disclosure will not include operational specifics. It will not need to. The acknowledgment alone will be sufficient to trigger a regulatory and litigation cascade that reshapes the cyber liability landscape. By 2029 , cyber insurance underwriters in the U.S. and EU will incorporate C-Day exposure assessment, specifically cryptographic inventory completeness and evidence of post-quantum migration progress, into standard policy underwriting for organizations in defined high-risk sectors. Organizations without a documented program will face coverage exclusions and/or significant premium increases for quantum-related breach events. The market will not wait for regulatory compulsion. It will price the risk before regulators mandate disclosure of it, or exclude it in material ways. By 2035 , the C-Day operations of 2018 through 2030 will be acknowledged as the defining intelligence collection campaigns of the early twenty-first century. They will be viewed as the digital equivalent of the most consequential Cold War espionage operations, with damage that compounds as quantum capability matures and the collected library becomes progressively more readable. The organizations that understood and acted on C-Day risk in the 2024–2028 window will be studied alongside those that adopted cloud security frameworks seriously in 2010. The ones that did not will share a different historical category. What Comes Next In the next installment of this series, I will address the technical foundation of why Q-Day is not just a threat to encrypted data in transit. It is a threat to the cryptographic infrastructure that underpins digital trust itself. Certificates, digital signatures, identity infrastructure, code signing, PKI. The architecture of online security was built for a world without quantum. Understanding exactly how quantum breaks that architecture and what NIST's 2024 post-quantum standards do and do not solve, is the prerequisite for the risk reduction framework I will lay out in my fifth article in this series. The Silent Window is active. C-Day, for many of the organizations reading this, has already passed in one or more of its three forms. The question that matters now is not whether you were exposed. It is whether you are still being exposed, and what you are doing about it. About the Author: Doug Howard is the CEO of Pondurance, an AI-powered managed detection and response firm providing MDR, digital forensics and incident response, and cyber advisory services. He previously served in the U.S. Air Force and held roles at the Pentagon. He writes on cybersecurity, artificial intelligence, and emerging threats at the intersection of national security and enterprise risk. This is the second article of the series "The Quantum Clock Is Ticking." The first article is available at pondurance.com/blog/the-quantum-clock-is-ticking . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Managed security services are often "one size fits all", ignoring the unique needs of your SMB. Pondurance tailors its MSS offerings to your business needs. Learn more.. Pondurance Delivers Managed Security Services as Dynamic as Your Business Pondurance April 1, 2022 Facebook X (Twitter) LinkedIn Copy link Last year, I was presented with an opportunity to learn a new skill. One of the walls in my house had become damaged to the point that the only sensible solution was to tear out what remained of the mangled Sheetrock and start fresh. “This is something I can handle,” I told myself. I’m a handy guy. YouTube has more than enough content to fill any knowledge gaps I might have. I was going to hang a wall. I bought all my materials and got to work. The end result was … well, it was a wall. But that was the most flattering description I could give it. It looked terrible. Every seam was visible. It turns out, cutting sheet rock precisely and working with joint compound are things that take a lot of practice and experience to master, and the people I saw on YouTube, making it look so easy, had already put in those hundreds of hours. It was my first try, and I ended up having to hire an experienced tradesman to fix what I had done. When the job was finished, it looked great! Later, the person I hired informed me that it would have been cheaper if I had just hired him to do the job from scratch because of the time it took him to undo my poor craftsmanship. Not so great. My problem was, I had not been truly focused on my desired outcome. I thought my desired outcome was to have a new wall in my house. This was sort of true, but the outcome I actually wanted was to have a new wall that looked professionally done, with no visible seams or rough patches of spackle. I got there in the end, but at great extra cost. As a cybersecurity professional, I was extra disappointed in myself because this is a lesson I should have already learned, having seen similar scenarios play out in my working life. For many small to midsize businesses, maintaining a strong cybersecurity posture can be a daunting task, oftentimes well outside of the scope of their in-house expertise. They need a guide, a partner or sometimes even a full-service security provider to help ensure their data and infrastructure are properly protected. They need to hand the putty knife over to a craftsman instead of going it alone. So, they turn to managed security service (MSS) providers for help. But seeking help is only the first step. Organizations must also carefully assess what kind of help they need based on what they intend to achieve. In the recently published Gartner® Market Guide for Managed Security Services,* the analyst firm notes that “Differentiation and comparison between MSS providers can be hard for buyers to quantify, as service capabilities and delivery models vary greatly from provider to provider.” Apart from providing a list of 40 representative vendors, the report recommends that: “Security and risk management (SRM) leaders responsible for security operations should: “Focus on the specific security needs of their business when approaching security service providers, looking specifically at the individual markets for managed detection and response (MDR), vulnerability assessment (VA) and incident response (IR). “Separate consultative and service-driven requirements to ensure service delivery is as consistent as possible and customized capabilities are appropriately defined. “Define expected outcomes and required deliverables in detail, evaluating internal security response processes to identify how security services will be consumed. “Assess if existing managed service providers (MSPs) and ITO partners meet security technology management requirements before approaching dedicated security service providers.” Pondurance was recognized as a representative vendor in the 2022 Gartner Market Guide for Managed Security Services. We believe it’s because we can help you design and manage a cybersecurity posture with your business outcomes driving every step of the process. Whether you have already tried to put up your (fire)wall and realize you require more expertise or you need to build anew from the studs, we believe we offer a curated approach to design, build, and service implementation that ensures clients get the maximum value and, most importantly, maximum protection from their security spend. Get everything you need and nothing you don’t Another harsh lesson I learned from the tradesman who helped me with my wall was that I overpaid for materials in the first place. He told me that I had purchased a lot of commercial grade materials that far exceeded the requirements for what I was trying to do. I got what I needed but also a lot of things I didn’t. Clients researching MSS providers should take care not to make the same mistake I did. In this report Gartner mentions that “the typical buyer for the wider group of security requirements met by MSSs regularly request technology implementation and staff augmentation. They also have a wider desire to use third parties to accelerate the build of an internal security operations center (SOC) capability rather than look at longer term outsourcing options.” In our opinion, this can be tricky for SMB clients, particularly because the level of in-house cybersecurity capabilities varies drastically from client to client in that market, and there are so many MSS providers offering a “one size fits all” approach to MSS. Going with one of these could leave clients paying for a lot of services they don’t need. Pondurance offers solutions in four key areas of MSS: Managed Detection and Response Vulnerability Management Incident Response Advisory Services While our goal is to deliver proactive, personal, around the clock detection and response with 360-degree visibility into cyber environments, Pondurance works closely with clients to curate individual services or packages of service to fit each client’s unique requirements. We partner with clients to deliver only the technology and services required to fulfill the clients’ desired outcomes and ensure protection across their IT infrastructure. Technology alone cannot defeat adversaries: An outcome-focused approach brings people, processes, and technology together to solve the biggest cybersecurity challenges Our people and the expertise we bring to process and technology are why we believe our approach is perfect for small and midsize business clients looking for a security partner to provide guidance, technology and services tailored to their specific needs. Our highly skilled analysts, threat hunters and incident responders can help you build the right security posture for your environments, then we back that with 24/7 monitoring to detect and respond to threats, while providing guided recommendations in service of your desired business outcomes. Our curated approach offers you: Best-in-class detection and response through machine learning backed by humans. Our elite U.S.-based cybersecurity team has decades of experience protecting organizations from the most sophisticated cyber threats. We are the only MSS provider that applies the dynamic defense methodology by using our MDR platform to identify and prioritize threats. This method enables us to provide specialized protection by understanding an organization’s unique infrastructure and what to prioritize in terms of alerts and threats. Pondurance MDR, IR, vulnerability management and consulting services are the core capabilities any organization needs to minimize business risk, mitigate threats and accelerate its security maturity. With our expertise and curated approach to building a security strategy, you can be sure you are getting an MSS provider that puts your organization first and remains focused on your business goals. Before I embarked on my drywall project, I wish I would have realized that there are times when things are best left to the experts. Construction is one of them, and cybersecurity is certainly another. Schedule a demo to learn more about Pondurance and see why we are mentioned in this Gartner Market Guide for Managed Security Services. *Gartner, Market Guide for Managed Security Services, Pete Shoard, Mitchell Schneider, John Collins, Al Price, 16 March 2022 Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Gartner is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Software vulnerabilities are one common cause of cyberattacks. Learn what is vulnerability management and how it can protect against threats.|Software vulnerabilities are one common cause of cyberattacks. Learn what is vulnerability management and how it can protect against threats. Vulnerability Management Is Critical To Preventing Cyberattacks — What You Need To Know Pondurance August 26, 2021 Facebook X (Twitter) LinkedIn Copy link It only takes one unpatched vulnerability to result in a costly data breach, ransomware or malware attack. The National Institute of Standards and Technology (NIST) logged more than 18,000 vulnerabilities in 2020, and more than half were critical or of high severity.* This is the highest number of vulnerabilities NIST has seen to date. Software vulnerabilities are one of the main sources of cyberattacks, such as REvil ransomware’s supply chain attack against Kaseya Ltd. and the Accellion vulnerability that affected healthcare data . Organizations are under a lot of pressure to stay secure and compliant while cyberattacks are increasing. When managing vulnerabilities and the alerts that come with them, how do you know which ones pose the biggest risk? And which should you prioritize first? What is a vulnerability? A vulnerability is a weakness that can be exploited by a threat actor. The actor uses any means possible to gain unauthorized access or privileged control to an application, network, service, endpoint, or server. Examples include exploiting communication ports open to the internet and unsecure configurations of either outdated software or operating systems (OS). Attackers scour systems to find these vulnerabilities, gain access, and infect systems with malware or encryption that leads to severe ransomware attacks. Vulnerabilities that are abused by attackers often result in: Theft of sensitive data. Harm to systems and applications. Ransomware and/or malware infection (along with ransom demands). Regulatory violations. Damage to an organization’s reputation and negative media exposure. It’s critical to patch vulnerabilities to reduce risk but with a large number of daily alerts, it’s hard to understand which to prioritize first. How are vulnerabilities defined? The National Vulnerability Database (NVD) , maintained by the NIST , is the most popular repository of vulnerability information. This is an open, standards-based effort using the security content automation protocol (SCAP) standard, which has a few components: Common vulnerabilities and exposures (CVE) – Each CVE enumerates and defines a specific vulnerability that could be subject to an attack for public knowledge. Common configuration enumeration (CCE) – A CCE is a list of system security configuration issues used to improve workflow by facilitating fast and accurate connecting configuration data across multiple information sources and tools. Common platform enumeration (CPE) – CPE is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise’s computing assets. They are used to describe what a CVE or CCE applies to. Common vulnerability scoring system (CVSS) – CVSS is an open standard scoring system to assign scores to a vulnerability that indicates its severity. It offers visibility into prioritizing remediation efforts and resources according to the threat. Scores range from 0 to 10, with 10 being the most severe. Many public sources of vulnerability definitions exist and are freely available, such as Microsoft’s security updates. Additionally, several vendors offer access to private vulnerability databases via paid subscription. What is vulnerability management? Vulnerability management is the process of identifying, categorizing, prioritizing, and resolving vulnerabilities in digital assets such as applications, servers, endpoints, cloud infrastructure, servers, etc. Vulnerability management is one of the most proactive methods to identify weaknesses within your digital assets. These weaknesses can pose a threat to your digital ecosystem and, if addressed early, can reduce risks to your digital ecosystem. Every year, new vulnerabilities are discovered and require skilled security analysts to prioritize, patch, or reconfigure these weaknesses and proactively address vulnerabilities before they are utilized for a cyberattack. Organizations serious about the security of their environment should implement vulnerability management into their cybersecurity strategies to provide the highest levels of security posture possible. While mitigating threats is a reactive process where the threat must be actively present, vulnerability management is proactive , identifying and prioritizing potential threats to close the security gaps that exist before attackers take advantage of them. What is the vulnerability management process? Every new vulnerability introduces risk to the organization. So, a defined process is often used to provide organizations with a way to identify and address vulnerabilities quickly and continually. At a high level, the processes below make up vulnerability management—each with its own subprocesses and tasks. Discovery: You can’t secure what you’re unaware of. The first step of vulnerability management is to take an inventory of all your digital assets such as endpoints, servers, IPs, applications, and operating systems. This will help you identify and prioritize the weakest facets of your digital infrastructure. Discovery should be performed regularly on an automated schedule including: Threat and vulnerability updates. External scans. Internal vulnerability scans. Penetration testing. Prioritize: Discovered assets need to be categorized into groups and assigned a risk-based prioritization based on criticality to the organization. Assess: Establishing a risk baseline for your point of reference is important as vulnerabilities are remediated and risk is eliminated. Assessments provide an ongoing baseline over time and give your organization insight into which vulnerabilities to prioritize. Remediate: Based on risk prioritization, vulnerabilities should be remediated through patching or reconfiguration. Your team needs to understand that vulnerabilities and threats require different remediation responses depending on the types. Software vulnerabilities can be patched and reconfigured to reduce risk. Verify: Validation of remediation is accomplished through additional scans and/or IT reporting. Finally, reporting is a critical component to include in your vulnerability management program. Key stakeholders like IT, executives, and the C-suite all need to understand the current state of risk around vulnerabilities and tactical recommendations on how vulnerabilities need to be addressed. Reviewing and producing tactical reporting on vulnerabilities identified and remediated will help security teams stay up to date on the latest vulnerabilities and health of your ecosystem. Executives need a summary of the current state of vulnerability. A weekly report of common CVEs and threats can help your security team fine-tune systems, whereas a monthly external and quarterly internal report can give more insight into the types of vulnerabilities that were identified and remediated. The C-suite needs high-level reporting such as simple risk assessment reports across your list of inventoried assets. These reports are critical to provide a high-level view of the value vulnerability management brings to the business. A strong vulnerability management program is a continual life cycle of identifying, categorizing, prioritizing, and remediating vulnerabilities across the entire organization. Human error and misconfigurations continue to be leading causes of data breaches. In fact, 16% of data breaches in 2020 were caused by vulnerabilities in third-party software, while 19% of data breaches were caused by cloud misconfigurations, highlighting the value of having a comprehensive vulnerability management program.** For organizations that need an effective vulnerability management program, Pondurance offers Pondurance VMP, a comprehensive vulnerability management service that continually identifies, categorizes, prioritizes, and helps resolve vulnerabilities. We enable you to stay confident that vulnerabilities are promptly discovered and remediated, protecting you from attackers looking to exploit these vulnerabilities, without placing a burden on your internal staff. Learn more about VMP. Sources: * Research reveals increase in critical, low complexity vulnerabilities , SecurityBrief, Feb 2021. ** Cost of a Data Breach Report 2021 , IBM, 2021. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770) Nate Hall, Riley Stauffer, Will Gadzinski July 22, 2025 Facebook X (Twitter) LinkedIn Copy link CISA is tracking active exploitation of CVE-2025-53770 , a new remote code execution vulnerability impacting on-premise SharePoint servers. This variant of CVE-2025-49706—publicly known as “ToolShell”—allows unauthenticated attackers to access SharePoint content, internal configurations, and execute code remotely. Organizations should assess exposure and take action. Who is affected: Organizations running on-premise Microsoft SharePoint servers —especially those not fully patched or lacking network segmentation—are at high risk. This includes: Enterprises with internal SharePoint collaboration portals Government agencies using on-premise deployments for sensitive documentation Healthcare, legal, and financial sectors, where internal document management is critical SMBs that self-host SharePoint without dedicated patch management Why it matters: The “ToolShell” exploit (CVE-2025-53770) allows unauthenticated remote code execution , which means attackers don’t need credentials to access SharePoint, steal data, or move laterally across your environment. CISA recommends the following actions to reduce the risks associated with the exploitation of vulnerable Sharepoint servers: Isolate any potentially affected systems and review them for indicators of compromise. Install the latest Security patches available, including any emergency patches released in response to CVE-2025-53770. As of the time this article was being written, emergency patches are available for: Microsoft SharePoint Server Subscription Edition - Patched in Build 16.0.18526.20508 (Update KB5002768) Microsoft SharePoint Server 2019 - Patched in build 16.0.10417.20037 (KB5002754). Microsoft Sharepoint Server 2016 - Patched in build 16.0.5513.1001 (KB5002760) Review IIS logs for suspicious POST requests to “ /_layouts/15/ToolPane.aspx?DisplayMode=Edit” indicating potential CVE-2025-53770 exploitation. Review available logging for the presence of the IPs 107.191.58[.]76, 104.238.159[.]149, or 96.9.125[.]147 , particularly between July 18-19, 2025 . Update intrusion prevention system and web application firewall rules to block exploit patterns and anomalous behavior. For more information, see CISA’s Guidance on SIEM and SOAR Implementation . Implement comprehensive logging to identify exploitation activity. For more information, see CISA’s Best Practices for Event Logging and Threat Detection . Immediate Next Steps: Proactive & Reactive Patch Immediately Ensure all SharePoint servers are updated with the latest security patches from Microsoft addressing CVE-2025-53770 and its variant CVE-2025-49706. Review Sharepoint systems for IOCs Perform a forensic review of any potentially affected systems to determine if they have been compromised due to the vulnerability. Take remediation steps in response as appropriate, including engaging SIRP if IOCs are detected. Rotate Sharepoint Machine Keys Pondurance has observed exploitation activity targeting Sharepoint Machine Keys, which would allow for continued access to the Sharepoint environment post-patch. Organizations should proactively rotate their Sharepoint machine keys . Restrict Network Access Limit SharePoint server access to internal networks or through VPN only. Avoid exposing them directly to the internet. Monitor for IOCs Look for signs of ToolShell activity, such as unexpected PowerShell execution, new services, or suspicious outbound traffic from SharePoint servers. Implement EDR/XDR Deploy Endpoint Detection & Response tools on SharePoint servers to monitor for any signs of lateral movement or post-exploitation activity. Review Logs & Configurations Audit access logs, service accounts, and privileges to ensure compliance with relevant regulations and ensure the security of sensitive information. Look for anomalies and disable unnecessary features or services. Pondurance Protective Actions Taken (MDR Service): Pondurance has added IPs known to have engaged in the exploitation of this vulnerability to our Blocklist for clients who subscribe to it. If you are not currently subscribed to it and are interested, please reach out to us via Scope for assistance. Pondurance has also developed Process and HTTP-related detections for identifying exploitation and post-exploitation behavior related to this vulnerability that may have been successful for clients who send us those logs. Pondurance has also deployed Endpoint detections to SentinelOne for our managed clients on the Complete tier as well as to CrowdStrike our managed clients. Authors: Nate Hall Nate Hall is a senior cybersecurity executive with over a decade of experience specializing in Digital Forensics and Incident Response (DFIR), serving clients across insurance, private equity, and Fortune 100 sectors. He has a proven track record of driving revenue growth, scaling incident response programs, and building high-performing technical teams equipped to handle complex and high-stakes cyber events. Trusted by legal counsel, insurers, and enterprise executives alike, Nate excels at advising stakeholders through crises while ensuring alignment between cybersecurity initiatives and broader business objectives. His expertise encompasses risk management, compliance, governance, and the development of robust security strategies that protect critical organizational assets. Riley Stauffer is a Principal Incident Response Consultant with over 12 years of experience in cybersecurity. The first six years of his career were spent serving in the United States Navy, where he operated as a Network Intelligence Analyst supporting both the National Security Agency (NSA) and United States Cyber Command. During that time, he was assigned to a Cyber Protection Team focused on defending critical Department of Defense (DoD) networks. Over the past six years, Riley has led and executed a wide range of Digital Forensics and Incident Response (DFIR) engagements, including nation-state intrusions, ransomware attacks, business email compromises, insider threats, and complex network intrusions. Will Gadzinski Will Gadzinski is the Director of the Pondurance Digital Forensics and Incident Response team, where he has led numerous investigations into ransomware incidents, data theft, extortion, and more. From spending the majority of his career in the Aerospace sector, Will is familiar with the unique balance that an organization must achieve to preserve operational mission requirements while maintaining confidence in their security posture. In his previous role as a Security Analyst, Will led incident response and forensics on some of the most notable cyber events in recent times at NASA’s Langley Research Center. Will has a Bachelor of Science in Intelligence Analysis from James Madison University. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026