From Data Breach to Cyber Resilience with Managed Detection and Response (MDR) Pondurance October 17, 2025 Facebook X (Twitter) LinkedIn Copy link A data breach—or even a near miss—does more than interrupt operations. It exposes security vulnerabilities, such as outdated systems, unpatched devices, or weak access management. And in a highly connected organization, a single compromised system can ripple through the business and cause widespread disruption. Poorly handled, a breach can undermine customer trust, damage reputation, and strain already limited resources. Unfortunately, many midsize organizations find themselves caught in a cycle of reacting to problems as they arise instead of addressing the root causes. As we’ll discuss in this first article in our new series, managed detection and response (MDR) provides a way to break out of that cycle. Breaches Reveal Gaps in People, Processes, and Technology When a breach occurs, most organizations are left asking: Where did our defenses fail? What should we fix first? Who can help us? The answer usually isn’t simple, because incidents highlight issues across three areas: People: Staff can fall for phishing and social engineering attacks. Security teams may be overloaded with alerts and unable to focus on the most important ones. Processes: Policies and compliance requirements often exist on paper but aren’t applied consistently. Without updated incident response plans or regular tabletop exercises, organizations aren’t ready to act quickly. Technology: Legacy systems, weak segmentation, and inconsistent authentication controls leave open doors for attackers. Even when tools like EDR or SIEM are in place, they require expert monitoring and response to be effective. This mix of challenges explains why many midsize organizations struggle after a breach. What’s needed is an approach that brings these three pillars—people, process, and technology—together in a practical, ongoing way. A trusted MDR service can provide this approach, minimizing your breach risks and securing your organization against new and emerging threats. How Pondurance MDR Reduces Breach Risks Pondurance MDR is a proactive service that helps prevent attacks or contain their impact.. SOC analysts, supported by a cloud-native platform, work alongside your existing security tools to quickly detect, validate, and remediate threats. Here’s how: Clearer Visibility Pondurance MDR pulls together information from endpoints, networks, cloud services, and identity systems. This unified view makes it easier to spot unusual behavior, such as lateral movement across systems, that might be missed if data stayed siloed. 24/7 Monitoring A U.S.-based Security Operations Center (SOC) provides continuous, 24/7 monitoring as an extension of your team. Experienced analysts use advanced detection tools, global threat intelligence, and their expertise to triage, validate, and respond to threats in real time. This persistent coverage ensures security continuity and timely response, even outside regular business hours. Prioritizing What Matters By correlating activity and applying a risk lens, Pondurance analysts focus on the events that pose the greatest threat. This reduces noise for internal teams and ensures the most dangerous activity gets attention first. Active Investigation and Containment When suspicious activity is found, security analysts validate it, investigate root causes, and can help take immediate steps to contain the threat. That may include isolating a compromised device or shutting down malicious connections before damage spreads. Guidance and Continuous Improvement Pondurance MDR clients also receive ongoing assessments through tools like MyCyberScoreCard , which measures an organization’s security against frameworks such as NIST. These reviews highlight strengths, identify weak areas, and provide concrete next steps—so organizations can track improvement over time instead of standing still. Integrated Response Support Pondurance also provides incident response services , which allows collaboration with the SOC team during investigations. And because Pondurance is tool-agnostic, we can help improve your security posture and create a future-state roadmap based on findings and industry best practices. From Reactive to Resilient Cyber resilience does not mean eliminating risk altogether. Instead, it’s about lowering the chance of an incident, containing the damage when one does occur, and enabling recovery without prolonged disruption. An MDR service strengthens midsize businesses not only through stronger technology, but also through improved processes and human expertise. As a result, your employees can work in a more secure environment, leadership gains clearer visibility into risks, and IT and security teams gain space to focus on long-term improvements rather than constant emergencies. The reality is that another breach attempt will come. The key question is whether your organization will be prepared to handle it. Pondurance MDR offers a sustainable path forward, shifting the focus from crisis response to resilience. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Why Everyday Cybersecurity Habits Still Matter Pondurance October 5, 2026 Facebook X (Twitter) LinkedIn Copy link Cybercriminals are often looking for the simplest way into an organization. Sometimes that opportunity comes from a weak password or an unexpected authentication request. In other cases, it may be an old account, an exposed application, or a tool that still has more access than it needs. That is the idea behind this year’s Cybersecurity Awareness Month theme, “Don’t Make It Easy for Them.” The National Cybersecurity Alliance recommends several core cybersecurity behaviors , including using strong passwords and a password manager, enabling multifactor authentication, recognizing and reporting scams, and keeping software updated. These practices remain important because attackers continue to look for opportunities that are easy to overlook during the course of normal work. Everyday behavior shapes security Employees interact with technology constantly throughout the workday. They sign into applications, approve login requests, share files, connect new tools, and respond to messages from coworkers and vendors. Most of those actions feel routine. That familiarity is exactly what can make them valuable to an attacker. A request to approve an MFA prompt may look like a minor interruption. A new application may appear harmless. A password reset may seem ordinary. A message from a familiar name may feel trustworthy. Attackers take advantage of that routine. The human element continues to play a major role in cybersecurity incidents. According to the 2026 Verizon Data Breach Investigations Report , social engineering and credential misuse remain important parts of the breach landscape even as vulnerability exploitation has become a leading initial access method. Employees are often in a position to spot something unusual before a technical control ever sees it. Familiar tools can become risky Some of the most damaging attacks involve technology organizations already trust. The Pondurance digital forensics and incident response team has recently seen an increase in attacks involving compromised remote monitoring and management tools. These platforms give IT teams powerful capabilities to manage systems remotely. When an attacker gains access to the same tool, those capabilities can be turned against the organization. Stolen credentials or weak authentication may provide the initial opening. From there, an attacker can move quickly because the tool already has legitimate access throughout the environment. This type of activity is a useful reminder that access deserves regular attention. Employees and administrators should know which systems they use, what permissions those systems have, and whether that access is still appropriate. Small decisions can create meaningful barriers Security awareness often comes down to what happens in a few seconds. An employee pauses before approving an unexpected login. Someone reports a message that feels slightly unusual. A team lets IT know that an old application is no longer being used. An administrator removes access that belonged to a previous role. Those actions may seem small, yet they can remove the exact opportunity an attacker is looking for. AI is making this even more relevant. As Pondurance experts discuss in How AI Is Changing the Cyber Threat Landscape and What To Do About It , artificial intelligence can help threat actors research targets, personalize social engineering, and move through parts of the attack process more quickly. Attack speed may increase, while many of the best defenses still begin with awareness and good judgment. Access should change when the business changes Organizations are constantly evolving. Employees take on new responsibilities. Teams reorganize. Vendors come and go. New applications are introduced. Old ones fade into the background. Security controls do not always keep pace with those changes automatically. An account created for a short-term project may still exist months later. An employee may retain access from a previous role. A third-party integration may remain connected long after anyone remembers why it was approved. These situations can quietly expand the number of ways an attacker might gain access. Regular reviews help reduce that exposure, but employees also play a role by speaking up when something no longer belongs in the environment. Pondurance explores this idea further in Cybersecurity 101: Uncomfortable Truths About Agentic AI Security , including the importance of reducing unnecessary exposure as attacks become increasingly automated. Security works best when people notice what feels off Employees do not need to become cybersecurity experts. They do need enough context to recognize when something feels unusual and the confidence to report it. That may be an unexpected login request. It may be a new tool asking for more access than expected. It may simply be a process that feels different from how work is normally done. Those moments matter because attackers often depend on routine behavior going unquestioned. Cybersecurity Awareness Month is a useful reminder that stronger security can begin with something as simple as noticing what does not belong. Make it harder: This week, encourage employees to report anything that feels unusual, even if they are not certain it is malicious. Build stronger security around your people Employees can stop many attacks early, but awareness is only one layer of a strong cybersecurity program. Pondurance helps organizations strengthen security around their people with managed detection and response, incident response, risk management, and cybersecurity expertise designed to reduce risk across the environment. Learn more about Pondurance and explore ways to strengthen your cybersecurity program. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Cyberattacks tied to Iran are rising amid military tensions. Learn what happened in the Stryker attack and the cybersecurity steps organizations should take now. Cybersecurity 101 - Iran Cyber Attacks Michael DeNapoli March 12, 2026 Facebook X (Twitter) LinkedIn Copy link March 16, 2026 Update: An unnamed source with familiarity of the incident has reported that the attack against Stryker was carried out by a threat actor who gained administrative access to InTune (Microsoft's enterprise device management platform in M365); initiating a wipe of all managed devices throughout the company. This would align with an official statement from Stryker noting that no malware was deployed within their organization. While no imminent or ongoing cyber threat activity is good news, the recent cyber attacks against American companies in light of the military action in Iran and the surrounding area has many Pondurance customers (and lots of other people) especially worried. That worry is not without reason, and so in a special edition of Cybersecurity 101 we'll take a deeper look into what is happening and what your organization can do to protect itself. Note that this article is not answering one specific reader question, but rather addresses numerous questions that we've received in the last several days, and so the format is a bit different from our usual here at Cyber101. "How likely is a cyber attack from Iran?" Unfortunately, extremely likely. One such attack has already happened that we're aware of, and it's likely many others have happened but not made the news. Iran is a known state sponsor of cyber threat activity, and the country as a whole has been performing cyber attacks against other countries and companies in those countries for many years now. The recent military action has seen a ramping up of outgoing cyber attacks, so we should expect to see more. "What attacks have happened so far?" One major cyber attack tied directly to the ongoing military action in Iran has been discovered, and more are likely to come to light in upcoming weeks. Stryker, a multi-national manufacturer of medical equipment, was rendered nearly entirely offline by a devastating cyber attack in the early morning hours of Tuesday, March 11, 2026. Few hard details are known, but here is what we do know at this time: Around 2-3AM US Eastern Time on March 11, the majority of Stryker's Windows desktops, laptops, and servers along with mobile devices and tablets were "wiped." This means that all data, settings, and other information on those devices was destroyed. The process appears to have occurred over a very short period of time - within about six hours. It is suspected that data was also stolen from the organization. Handala, a known "hacktivist" group aligned with Iran and pro-Palestinian causes, claimed responsibility for the attack. They stated that the attack was performed in retaliation for a US bombing mission that had taken place two days before the cyber attack itself. Handala is a known threat actor group, responsible for many attacks against US and Israeli government organizations and private companies in the last few years. They tend to favor spearphishing tactics, targeting specific individuals within an organization to attempt to gain access to accounts, data, and systems. Once in, they favor data theft followed by the destruction of local data (a.k.a. "wiper" attacks). In many cases they will later leak the data they steal. This threat actor is not financially motivated, but rather politically driven, and as such requests for a ransom are rarely seen. Their goal is major disruption, defacing of public-facing systems, and leaking data to embarrass/hinder their victims' operations. What we do not yet know: While Handala is a known threat actor group tied to Iran, there is no official confirmation that they were the group that performed the attack against Stryker. In the past, threat actor groups have fraudulently claimed responsibility for attacks they did not perform. The exact method of attack is not known. Handala (if they were indeed the attackers) does favor wiper-type attacks, but does not traditionally target mobile devices and tablets due to the additional attack complexity required to perform such an action. If this is Handala, then this represents an escalation in their attack technique toolkit. No details of what data was stolen, or if that data will be publicly released, has yet been confirmed. "What can I do to prevent an Iranian attack?" This question is easier to answer. First, ensure you have patched and updated as many known vulnerabilities within your organization's systems, applications, and platforms as you possibly can. If this requires downtime, take it. If this requires reboots, do them. Now is not the time for organizations to allow users to refuse to reboot their laptops to apply an update. Many threat actor groups, including those from Iran, specifically target vulnerabilities in public-facing systems like email platforms, VPN solutions, firewalls, and other systems, so this step is crucial to protect the organization. Refresh user Security Awareness Training with a quick email to all staff. We've attached a template for such an email below that you can use and edit as you see fit. Monitor all security controls and logs for any evidence of suspicious activity. Pondurance customers can rely on us to handle that for you, as we're always monitoring any systems that we can see. If you're not a Pondurance customer (or a customer of another Managed Detection and Response company), then be highly aware of any alerts or tickets created by your endpoint anti-malware, firewalls, VPN solution, Office365/Google Workspace, etc. Attack methodologies that have been witnessed in previous Iranian cyber attacks have been detectable, and usually quickly enough to prevent significant damage to the organization. Prepare an Incident Response Plan. Bring together all contact information (email, phone, Messenger/Whatsapp/Signal info) for all persons you need during an emergency. Remember this is not only technical team members. Senior leadership, legal counsel, marketing/PR team members and others will also need to be part of this plan. Set up alternate communication paths outside of the organization's usual email/Teams/Slack/etc. in case those systems are rendered unusable. Get agreement ahead of time on when/if taking the company offline is acceptable in light of potential total compromise, what recovery plans are and how long they will take to run through, how to involve insurance and other third-parties, how you will alert customers and partners, etc. Finally, don't ignore warning signs. If something looks suspicious, it must be investigated. Better to confirm more false positives during times of military action than risk a total compromise of the organization. A final note: Don't panic. Whenever a major global event happens, it is normal for everyone to be on-edge, nervous, and prone to panic. You must ensure that does not happen. The threat is real, but can be dealt with by a prepared organization. Panic leads to mistakes that can create situations where none exist, or make an existing situation extraordinarily worse and more difficult to deal with. No matter what, stay calm. Deal with any suspicious activity following your current protocols. Isolate systems which are acting oddly. Deny requests for the addition of new add-ons, applications, etc. until the current situation passes. Do this rationally, carefully, and calmly to prevent accidentally making a situation worse, or creating a brand new situation to deal with. Email Template for End Users: To all employees: As you are all no doubt aware, the recent military actions in Iran and the surrounding region have led to an increase in cybersecurity threat activity and attacks. We are asking you to take extra caution while this action is happening to protect the organization, our data, our customers, our partners, and yourselves. This extra caution doesn't require you to be better with technology or become cybersecurity experts; just to remain calm and be aware that threat activity can occur. If you receive an email or text message with an attachment or link that you are not directly expecting, confirm with the sender that they sent you that message before you interact with it. Do this by manually sending an email directly to your contact at the sender's company or by phone. Always remember that major companies, including those that do business with us, don't require that you click a link to perform an action. You can open your browser, go to the page of the company/government agency/application in question, log in, and find the information or forms you need on the site. If you receive a phone call from IT, our customers, our partners, or anyone else that is unexpected or not a normal part of your job; politely let them know that you will call back and then hang up. Call the customer, partner, etc. using the officially available contact information. This ensures that the person on the other end of the line is who you believe they are, and not a threat actor. Note that IT will never require you to tell them your password or require you to give them a One-Time Passcode or other Multi-Factor Authentication information. This also holds true for company messaging systems like Teams/Slack/Zoom/etc. - IT will not require you to give them your passwords or tokens via messaging chat or voice/video call. Whenever you're in doubt, politely let the person know you will call them back and then end the voice/video call or text chat session. Reach out the person or group through official information sources like our internal directory, and know that you are speaking with the person you believe you are. If you see unusual activity in any company communication system - email, Slack/Teams, Messenger apps, etc. - report it to IT immediately. We'd rather deal with false alarms than miss a potential threat action against the company. Suspicious activity may include a user asking for login information, for access to systems or applications, for you to install an add-on or extension to an application or browser, etc.; but use your best judgment. The IT and Cybersecurity teams are working diligently to protect our organization, and are taking additional steps to defend our systems and applications - and you as well. You may see evidence of these measures, such as the inability to log into a system for short periods, and we'll apologize in advance if that happens. Reach out to IT with any questions, or if you lose access to a system or application you usually work with, and we'll get it corrected quickly for you. Please be especially aware that our IT team will be applying updates and patches to many systems and applications. Because of this, some systems may be temporarily unavailable, or your laptop or desktop may need to reboot to allow the process to happen. We will alert you before such events so that you know they will happen, but it is required and necessary for them to happen. When your apps need to be restarted or your laptop rebooted, please do so as quickly as possible. Do not wait until end of business day, but finish up your current call or meeting, then restart/reboot. Stay safe, protect yourselves and your families from cyber threat actors, and help protect this organization, our customers, and our partners as well. About the Author: Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn how agentic AI is accelerating cyberattacks and what organizations can do to strengthen defenses against faster, more advanced threats. Agentic AI in the Hands of Threat Actors Has Created an Imbalance in Cybersecurity Pondurance April 20, 2026 Facebook X (Twitter) LinkedIn Copy link Organizations are taking artificial intelligence (AI) to the next level by rapidly adopting agentic AI. As much as 73% of organizations are using or developing agentic AI in cybersecurity, up from 59% the prior year, according to Cyber Security Tribe's Annual State of the Industry Report 2026 . Agentic AI's autonomous capability allows organizations to accomplish complex goals with little or no human oversight, increasing productivity and efficiency. That sounds positive for businesses, and it is, but threat actors are also adopting agentic AI — and weaponizing the technology against organizations. Over 98% of cybersecurity leaders reported that AI, including both generative AI and agentic AI, has been used in cyberattacks against their organizations, according to Osterman Research Group. While threat actors can prompt generative AI to conduct activity such as write email content for phishing scams, create fake images, and generate code for malware, agentic AI is the looming threat. Autonomous agentic AI can help threat actors exploit victims with greater speed, scale, and efficiency than ever seen before. Human cyber defenders are having a hard time keeping pace, creating an imbalance in the cybersecurity equation that, at present, seems to tilt in favor of the threat actors. Advantages for threat actors Threat actors know that cyberattacks are a numbers game, and if they try to infiltrate victims' networks enough times, the odds are with them that some human will finally make a mistake and let them in. With agentic AI, the odds get even better because threat actors can move at machine speed as they relentlessly exploit organizations on a large scale. Of course, speed and scale, and even innovation, increase the odds that the bad guys will succeed. Threat actors are still using many traditional tactics, such as phishing campaigns, credential harvesting, and ransomware attacks, when targeting victims, but AI has accelerated the pace of the attacks. An attack that used to take days or weeks to complete now only takes hours or minutes. Unit 42's Global Incident Response Report 2026 found that threat actors need only 72 minutes to go from initial access to data exfiltration, which is four times faster than 2025. In addition, threat actors using agentic AI are exploiting newly disclosed vulnerabilities at high speed. The Cybersecurity Infrastructure Security Agency requires federal agencies to patch critical vulnerabilities within 15 days of initial detection. However, Unit 42 reports that threat actors are scanning for vulnerabilities within 15 minutes of a Common Vulnerabilities and Exposures announcement to identify and exploit the flaw — before defenders even have time to patch. But speed isn't the only thing driving these threat actors to use agentic AI. The scale of attacks is far greater. Threat actors are using agentic AI to perform reconnaissance and attempt initial access on hundreds, thousands, or millions of targets at once, in different industries and countries. The technology has the ability to learn from its mistakes, switch tactics as needed, and keep trying to exploit targets, which further increases the number of attacks. Because agentic AI doesn't sleep, threat actors can continue conducting attacks 24/7. In addition, agentic AI and generative AI tools themselves have become vectors of compromise, increasing the attack surface for threat actors. Agentic AI also is allowing threat actors to innovate and adapt with new types of cyberattacks and traditional tactics with new twists. A few examples include: Prompt injection attack . These cyberattacks allow threat actors to conceal malicious prompts in legitimate data, emails, and websites to trick generative AI into taking specific actions such as leaking personally identifiable information or forwarding private documents. Polymorphic malware . Using agentic AI, threat actors can create malicious software, including viruses, worms, trojans, or ransomware, that can constantly change or morph its code to evade signature-based detection methods. LLM jacking . In this attack, threat actors steal cloud credentials to large language model (LLM) services and sell them for malicious use. Disadvantages for defenders Threat actors using agentic AI are indeed moving at high speed, and most defenders are struggling to keep up, making cybersecurity a reactive rather than proactive endeavor. After all, traditional tools and procedures, such as perimeter defense, reactive monitoring, and approval processes, were developed for attacks that took time to unfold. But now, cyberattacks happen in just hours or minutes , and often, traditional methods are no longer enough to defend against them. When it takes just one human error to allow a threat actor into the environment, the odds are stacked against the defenders. There are a few particular areas of cybersecurity, including manual workflows, alert fatigue, and fragmented visibility, where defenders are lagging behind threat actors who use agentic AI. Defenders need to take a close look at these slow-moving areas of defense and contemplate how changes could improve their capabilities. Manual workflows. Cybersecurity teams often work in silos, each focusing on its own specific role within an environment. But if teams don't work together in a big picture way, it can slow down response time. The security operations center (SOC), vulnerability management, incident response, and all other teams must work in lockstep to streamline the process.Most organizations today have a playbook and/or incident response plan to follow when a cyberattack occurs, but such plans were written for the days when attacks moved slower. Organizations are still working from these outdated plans, which may include obsolete training, policies, and procedures that don't take into account the speed and scale of attacks in the age of agentic AI. Defenders also are slowed down because they must incorporate organizational guardrails and governance frameworks in their workflows. They have to comply with federal and state regulatory requirements or face harsh penalties and legal action, whereas threat actors break the rules and don't look back. Alert fatigue. Most SOC teams have too many alerts, and a large percentage of those alerts are false positives, leading defenders to experience alert fatigue . The average organization generates 4,330 security alerts per day , and SOC analysts only investigate 37% of them, according to the Ponemon Institute's 2026 State of SecOps Report . That means, on average, 63% of the alerts generated each day are not being investigated. There are not enough hours in the day for a team to attend to every alert or even prioritize such a large number of alerts. The situation becomes increasingly difficult as teams experience ongoing challenges in hiring. Fragmented visibility. Once, threat actors entered networks from traditional perimeter entry points and moved in predictable patterns, dwelling in the network for an extended time frame. Today, threat actors most often gain initial access to networks by logging in with stolen credentials, then moving laterally across the network at machine speed. As evidence of the increase in this tactic, credential theft increased by 50% in the second half of 2025 compared to the first half, according to Recorded Future's 2025 Identity Threat Landscape Report . Unfortunately, traditional monitoring tools have a difficult time recognizing lateral movement, and threat actors often go undetected as they move across networks, endpoints, and the cloud. Conclusion Agentic AI is helping organizations accomplish complex goals with little human intervention, but it's also helping threat actors improve their speed, scale, and efficiency during cyberattacks. As threat actors move at machine speed, defenders are having a hard time keeping up, creating an imbalance in the cybersecurity fight. To fight agentic AI with agentic AI, Pondurance has launched Kanati , the industry’s first agentic AI SOC designed for autonomous operations within a managed detection and response service. Kanati replaces alert-driven, error-prone workflows with a coordinated system of AI agents that operate continuously throughout the full threat life cycle. To learn more about Pondurance's Kanati, visit pondurance.com or email kanati@pondurance.com to learn more or request a demo. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Critical infrastructure cybersecurity challenges might be solved through CMMC. Learn more about solving CI cybersecurity issues in this blog.|Critical infrastructure cybersecurity challenges might be solved through CMMC. Learn more about solving CI cybersecurity issues in this blog.|Critical infrastructure cybersecurity challenges might be solved through CMMC. Learn more about solving CI cybersecurity issues in this blog. Critical Infrastructure (CI) Cybersecurity: Is CMMC the Answer? Pondurance July 15, 2021 Facebook X (Twitter) LinkedIn Copy link I was recently asked about critical infrastructure (CI) cybersecurity challenges and if Cybersecurity Maturity Model Certification (CMMC) could be the answer. Within the defense community, the CMMC framework is sending a clear message to Defense Industrial Base (DIB) companies: If you want to do business with the U.S. Department of Defense (DoD), you must prove that you can meet a series of cybersecurity standards that are deemed essential. Assessed against five maturity levels, the more best practices you meet, the more opportunities you can potentially bid on. However, if you can’t satisfy the most fundamental of these requirements, you’re out of the game. Suffice it to say, there is much at stake. The DIB’s 100,000-plus systems integrators, tech service providers, and other suppliers represent $394 billion in annual awards.* The sector, however, appears ripe for major compromises, as the number of newly reported common IT vulnerabilities for the DIB rose to 17,305 in 2020 from 14,645 in 2017.1 At least 37 DIB businesses, in addition to federal government agencies, were impacted by the 2020 SolarWinds breach.** In response to increasing cyber threat issues, the DoD has unveiled CMMC with the goal of safeguarding controlled unclassified information (CUI) — protected information or data created or possessed by the government or another entity on the government’s behalf — throughout its supply chain. Examples of CUI include technical data, personally identifiable information, and information marked For Official Use Only. Defense leaders are implementing the framework through a phased rollout approach from fiscal years 2021 through 2025. Under CMMC , contractors must undergo assessments to prove that they can sufficiently perform cybersecurity capabilities. These practices and processes fall within 17 domain categories, adapted from the National Institute of Standards and Technology (NIST) Special Publication 800-171 and other sources. These domains include situational awareness, access control, risk management, incident response, recovery, and system and information integrity. DIB businesses are seeking to earn certifications across different maturity levels, starting at basic cyber hygiene and taking on more comprehensive and challenging requirements from there. As part of CMMC’s flow-down requirements, subcontractors are also subject to the assessment and certification process. It remains to be seen how significantly CMMC, and its set of requirements, improve the critical infrastructure industry’s cybersecurity posture. But if it proves successful during its initial rollout, then why wouldn’t the government, through its various agencies, leverage CMMC as a model for CI sectors as a whole, not just DoD suppliers? After all, there were nearly 400 reported CI ransomware attacks in 2020, up from 207 in 2019.*** Among CI security professionals, 55% indicate that cybercriminals have increasingly targeted their organizations since the pandemic began.**** Within the global utilities sector, two-thirds of organizations say that sophisticated attacks are a top challenge, but just 31%, perhaps optimistically, rate their readiness to respond and contain a breach as high. Today, there is no standard security certification framework for assessing CI. As a result, there is an uneven patchwork of compliance guidelines that a given organization may be measured against. For example, within the energy sector, NERC CIP, is applicable to all bulk power system owners and operators, while other CI sectors are not held to any defined standards. Establishing a common set of tiered requirements for all critical infrastructure would greatly reduce complexity and ensure that larger swaths of infrastructure have appropriate security controls in place. Could CMMC be that standard? Facing the impending CMMC rollout, many small businesses have complained that the associated security requirements are too onerous based on budget and size. Certainly, federal acquisition offices must develop a model to help smaller businesses that would otherwise struggle to comply (e.g., setting aside funding to help qualifying companies meet the standards). But once these challenges are addressed, an across-the-board designation of CMMC as a requirement for all CI sectors could lead to two immediate and substantial benefits: A ready-made set of standards. CMMC isn’t an idea that’s still in the drawing board stages. It’s rolling out — now. There is no reason to start from scratch in developing new requirements for a CI-wide standard. Its requirements are readily transferable to CI sectors outside of the DIB, so regulators and procurement agencies should take full advantage of the work that has already been accomplished. A single source of compliance . Instead of forcing companies to jump through multiple cybersecurity compliance hoops to do business, they’d only have to focus on CMMC. If there are flaws within the framework, government and private industry leaders can fix a single standard as opposed to bringing on a new set of requirements to manage. Ultimately, demonstrably elevating the critical infrastructure cybersecurity posture as a whole would emerge as the third — and most meaningful — benefit. If regulation is deemed too heavy-handed, it could begin by requiring it for all federal contractors, whether they handle CUI or potentially impact the availability of key services that the federal government relies on. While this would not immediately cover all CI members, it certainly would put a dent in the problem. CI members and their suppliers would have to improve the way they protect systems, respond to incidents, and manage risk. If not, they would lose business or a competitive advantage. By successfully complying with a refined CMMC, and handling the necessary blocking and tackling, they would be able to stay in the game while keeping critical infrastructure safely protected. Have questions about CMMC? Learn more from our CMMC Resources . Sources: * NDIA Vital Signs 2021 , NDIA, 2021. ** SolarWinds hack was ‘largest and most sophisticated attack’ ever: Microsoft president , Reuters, Feb 2021. *** Critical Infrastructure Ransomware Attacks , Temple, Jun 2021. **** White Paper: The Critical Convergence of IT & OT Security in a Global Crisis , Claroty, 2021. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Read this blog to get a better understanding of the history of cybercrime, the resulting cyber threat landscape, and how to respond.|Read this blog to get a better understanding of the history of cybercrime, the resulting cyber threat landscape, and how to respond.|Read this blog to get a better understanding of the history of cybercrime, the resulting cyber threat landscape, and how to respond. A Guide to Cybercrime’s Transformation and How To Respond Pondurance June 24, 2021 Facebook X (Twitter) LinkedIn Copy link I was recently asked by Security Magazine to share thoughts on the history of cybercrime, its evolution and the resulting cyber threat landscape it created. Transformation dominates corporate agendas. Organizations continue to invest significant sums into the cloud, automation, analytics, and artificial intelligence (AI) to accelerate productivity, improve market offerings, and enhance customer experiences. Disruptive brands such as Uber, Tesla, Airbnb, and Netflix have forced traditional industries to rewrite their playbooks. And the pandemic has prompted a massive deployment of online collaboration solutions and practices to accommodate today’s work-from-home environment. At the same time, however, a less discussed industry transformation is well underway. Cybercrime is a $6 trillion annual industry , which would qualify it as the world’s third-largest economy after the U.S. and China. The FBI’s Internet Crime Complaint Center (IC3) annual cybercrime report analyzed 791,790 fraud and theft complaints from 2020 alone. There is a great deal of money to be made, and cybercriminals are adopting new strategies, business models, and tools to compete in this increasingly competitive market. In fact, the evidence would suggest that the pace of innovation among cybercriminals has outpaced that among defenders. Given the shifting and potentially destructive market dynamics, here is a guide for C-suite executives and other decision-makers to use to understand the history of cybercrime and the resulting, more daunting cyber threat landscape it created: They are outsourcing more than ever. Government warnings of nation-state espionage exploiting SolarWinds and Microsoft Exchange server software emphasized the reportedly coordinated efforts of different teams of intrusion experts attributed to Russian and Chinese actors, respectively. Yet, adaptive collaboration is hardly limited to foreign intelligence services or their proxies. As in legitimate business circles, collaboration increasingly drives this machine, with criminals flocking to the dark web and other underworld gathering areas to share insights and resources while acquiring more formidable capabilities. They realize that, as a combined unit, they are stronger than they are as individual, siloed operations. As a result, adversaries of all types are focusing on core competencies and outsourcing the rest. They can readily pull this off due to the availability of ransomware-as-a-service providers, who sell or lease their ransomware variants to affiliates or customers who license them to perform an attack. There are also what are called initial access brokers who exploit networks and then sell this access to the highest-paying buyer. They are able to monetize … everything. Thanks to ransomware , the bad guys no longer need to figure out how to get to customer credit card accounts to steal money. With cryptocurrencies making it easy to anonymize, authorize, and conduct payout transactions, they can monetize pretty much anything of value to victim corporations, including proprietary data, employee human resources information, e-commerce systems, protected health information (PHI), etc. While availability has always been part of security, along with confidentiality and integrity, this move raises the stakes. If an organization can’t make direct deposits into employees’ bank accounts because their payroll servers are currently hijacked by a ransomware attack, for example, C-suite executives will feel more pressure to give in to the demand. Thus, cybercriminals are enriching themselves more than ever via the monetization of everything. They don’t care how big a victim corporation is or what industry it’s in. As indicated, this new cybercrime operating model is expanding this underground economy through tight collaboration among thieves. They don’t need to target large companies only or stick to those within a particular, familiar industry. Through this criminal supply chain and the advancement of automated tools, these threat actors can move down-market and target thousands of midsize organizations instead of taking their chances against a few large financial services firms. They’re able to leverage automated scans to find businesses that are running outdated software or exposing risky ports or services. C-suite executives and top decision-makers will struggle to defend against this new cybercrime operating model if they fail to adapt their defensive operative approach. The strategies of cooperation, innovation, and specialization leveraged by attackers must be similarly adopted by the organizations tasked with defending against them. That’s why their leaders should carefully consider partnering with a managed detection and response (MDR) provider. MDR is essentially a security-as-a-service involving the hiring of an external team to monitor networks around-the-clock and launch mitigation and prevention measures when suspicious activity is detected. In its most advanced and fortified state, MDR includes threat hunting and response capabilities that combine the latest technologies, machine and human intelligence (or authentic intelligence), and expertise to stay one step ahead of attackers regardless of how their M.O. is shifting. MDR enables companies to offload much or most of their security burden and focus on what they do best. Given that this simply makes good business sense, adoption is soaring: One-half of organizations will be using MDR services to contain threats by 2025, according to a projection from Gartner. Among those already investing in MDR, 72% are decreasing the time it takes to resolve attacks by 25% to 100%, according to research from IBM. Competitive interest has always fueled the drive toward transformation. “Greatness is not a function of circumstance. Greatness, it turns out, is largely a matter of conscious choice,” author Jim Collins notes in his book, Good to Great . As companies explore new investments and strategies for the cloud, mobility, AI, infrastructure, etc., they cannot lose sight of the reality that cybercriminals are also constantly seeking emerging techniques, tools, and resources to build a bigger and better machine. By forming the right MDR partnerships, organizations gain a team that lives and breathes security and maintains capabilities designed to thwart the latest attack methods. This allows C-suite executives and decision-makers to focus on transforming and digitizing their businesses while gaining the protection they need. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

As retail businesses expand, so does the attack surface. Get insights about cybersecurity in retail and helpful resources in this blog. The State of Cybersecurity in Retail Pondurance December 1, 2022 Facebook X (Twitter) LinkedIn Copy link Most industries are learning to navigate new operations post-pandemic. To respond to shoppers’ needs, many retailers are offering a mix of brick and mortar and e-commerce stores. But as retail businesses expand, so does the attack surface. Every single outlet, store, website, and social media account is a potential target. Here are cybersecurity statistics on the retail industry that may or may not surprise you, as well as helpful resources for your retail business: Most cyberattacks in the retail industry are financially motivated The retail industry experienced 629 confirmed incidents and 241 breaches with confirmed data disclosures in 2021, according to Verizon’s 2022 Data Breach Investigations Report . Of these attacks, 98% were financially motivated. Retailers collect valuable data like consumer information and payment card data, making them prime targets for bad actors. Now, the introduction of contactless payment and more online buying options has created an expanded attack surface, making it increasingly challenging for retailers to protect customer data. Find out why many retailers are turning to managed detection and response (MDR) services to defend against cyberattacks and learn what MDR services can do for your retail business. The retail industry experienced its highest rate of ransomware attacks The retail industry experienced its highest rate of ransomware attacks last year, reporting a 75% increase over the previous year. In all, 77% of retail businesses were hit by a ransomware attack in 2021, up from 44% in 2020. The growing threat of ransomware is an unsettling trend for retailers. Threat actors exploit vulnerabilities in retailer networks to install ransomware, encrypt systems, and freeze transactions until the retailer pays a ransom, leading to huge financial losses and damage to the retailer’s reputation. Educating your employees and implementing cyber hygiene practices are critical to reducing human error, but investing in the right cybersecurity tools, hiring highly trained cybersecurity analysts, and implementing 24/7 monitoring are key to mitigating ransomware attacks. Find out what motivates cybercriminals and how you can reduce ransomware attacks . The shortage of skilled cybersecurity workers is impacting the retail industry An estimated 4.1 million people work as cybersecurity professionals worldwide, including 1.14 million U.S. workers, yet the workforce must increase by 65% to defend against cyber threats, according to the (ISC)2 2021 Cybersecurity Workforce Study. Technology alone cannot stop motivated attackers. Modern MDR providers know that human attackers must be confronted by human defenders. Though technology is important, 24/7 detection and response paired with skilled threat hunters to manage alerts is the only way to protect your business. Small and midsize businesses have a particularly difficult time keeping talent due to limited budgets and fewer opportunities for advancement, according to a Forrester study . As a result, many retailers rely on external partners to provide around-the-clock protection. Check out the Forrester study to learn how businesses are evolving their cybersecurity practices and operations to alleviate the cyber talent shortage. More internet-connected devices are being used in retail businesses Over 84% of businesses use Internet of Things (IoT) devices , but less than 50% of them have taken the necessary steps to secure these devices. While these devices bring many benefits to the retail industry, they also pose serious threats that businesses must work to minimize. The pandemic shifted many retailers’ strategies and sped up digitization, namely through the integration of IoT devices. However, none of the potential gains from IoTs will be realized if the devices, communications, and data are not secured. IoT security must be a pivotal piece of the design of any IoT implementation and should be considered as a foundation of the overall solution. Learn how to evaluate IoT devices and discover the best practices for integrating them into your business. Social attacks are the most common threats to retailers Social attacks, like phishing and pretexting, have been on the rise over the last few years in the retail industry, up 29% this year . Phishing and social engineering scams are sophisticated and can trick the wariest users if their guard is let down even momentarily. For bad actors seeking valuable credit card and payment data, these attacks are one of the easiest ways to gain access to your system. One of the best ways to prevent phishing is to train your employees on how to recognize a phishing email . Most retail organizations lose revenue due to ransomware attacks Over 90% of retail businesses hit by ransomware reported that the attack impacted their ability to operate, while 89% reported that the attack caused them to lose business or revenue . The greatest threat to retail organizations is operation shutdown and loss of revenue. As ransomware attacks on retailers continue to rise, so does the average ransomware payout. Opportunistic attackers are capitalizing on this fact, and targeting individual retail stores and small chains. One of the main ways bad actors gain access to networks is through compromised domain controllers. While there is no single “silver bullet” that will fully protect your business from all ransomware, protecting your domain controller is a critical step to mitigating your risk . Retailers face significantly more threats during the holiday season Cybersecurity should always be top of mind, but it’s especially critical during the holidays. Last year’s holiday sales grew 14%, reaching $886.7 billion , while e-commerce fraud attempt rates rose by 19% . In today’s cyber environment, threats pose a challenge for every industry, and retailers are on the hit list for bad actors, especially during the holidays. Training your employees on the best security awareness practices and staying on top of compliance requirements are important but not always enough to combat today’s cyber threats. Read this blog, Retailers Prepare for the Holiday Season — and Cybersecurity Threats , for common threats to retailers and ways to boost your defenses during the holiday season. Cryptojacking attacks are on the rise Cybercrime is a profitable business for threat actors, with a cost that is growing 15% year over year and is expected to reach more than $10.5 trillion by 2025 . Bad actors can generate huge sums of money very quickly by infecting an e-commerce or retail business. While malware is commonly the gateway to cryptojacking attacks, other common vectors include brute force attacks, exploited software vulnerabilities, and infected plug-ins. As long as malicious scripts can run local commands on a machine, attackers can use this access to start mining cryptocurrency. But your retail business can fight back by learning ways to identify and prevent cryptojacking attacks . More businesses are seeking and achieving PCI DSS compliance The percentage of businesses maintaining full compliance improved from a low 27.9% in 2019 to 43.4% in 2020, according to Verizon’s 2022 Payment Security Report . Every organization working with cardholder data (CHD) must implement security policies, technology, and processes to ensure its systems are protected from breach and theft of CHD. With the rise in cyberattacks on every industry, many retailers are seeking help to maintain full compliance and combat these threats. Find out how to identify areas of risk and maturity related to Payment Card Industry Data Security Standard (PCI DSS) compliance at your retail business. These statistics highlight some of the many challenges retailers face in the current threat landscape. Use these statistics and resources to acknowledge cyber lessons learned and take steps to improve your own security posture. Learn how Pondurance retail services can integrate with the team and technology at your brick-and-mortar or e-commerce business to strengthen your cybersecurity posture and protect against cyber threats. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Each month, Pondurance provides updates on the current cybersecurity threat landscape, notable vulnerabilities and more. Read our blog to get the insight from last month. Novel Threat Tactics, Notable Vulnerabilities, and Current Trends for April 2024 Pondurance May 17, 2024 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In April, the team discussed threat intelligence, vulnerabilities and trends, security operations center (SOC) engineering insights, threat hunting, and detection engineering. Threat Intelligence The Senior Manager of Digital Forensics and Incident Response (DFIR) discussed the recent surge of third-party compromises within the cybersecurity landscape and what companies can do to protect against these attacks. Typically, in a third-party compromise, a threat actor gains access to a company’s sensitive data through a vendor, contractor, or supplier. These high-risk, high-impact attacks are often unexpected, though they are statistically quite likely, and can present a significant financial impact to downsteam customers of the third party. For example, Change Healthcare, a payroll and health information clearinghouse, recently experienced a ransomware attack that financially impacted 94% of hospitals , according to an American Hospital Association survey. Third-party compromises can occur as ransomware attacks, data theft, insider threats, supply chain compromises, and more. The Senior Manager of DFIR suggested a few measures to help companies prevent an impact from a third-party compromise: Minimize your exposure. Wherever possible, your company should use good IT security practices, employ least privileges, and implement security controls to keep the third party’s presence as minimal as possible. Limit your IT footprint. It’s often difficult for a company to quantify and understand what its exposure is to a third-party compromise. Limiting where your data lives, internally and externally, can help your company better understand your risk and employ controls to manage it. Understand your interconnections. Your company needs to know which third parties you rely on for services, where your data resides, and how your data is processed. In addition, you want to know which third-party applications exist in your environment and have a plan in place to mitigate the risk of compromise from those applications. Vulnerabilities and Trends The Vulnerability Management Program Team Lead reviewed notable vulnerabilities from April. As many as 2,500 vulnerabilities were disclosed, and nine of those vulnerabilities were high risk. Of those nine, four were known to be exploited in the wild on products including: JetBrains TeamCity. The JetBrains vulnerability (CVE-2024-27198) involved an authentication bypass that led to a second vulnerability, allowing an authenticated attacker to execute code on the impacted device. Also, a directory traversal vulnerability (CVE-2024-27199) allowed the attacker to see unauthorized content. JetBrains released a patch on March 3. The very next day, the researchers released proof of concept codes on the internet. Fortinet. The SQL injection vulnerability (CVE-2024-48788) impacted Fortinet endpoint management service software, leading to remote code execution on vulnerable systems. Patches were released on March 12. On March 21, Horizon3 researchers released proof of concept codes. Apple. Two vulnerabilities (CVE-2024-23225 and CVE-2024-23296) affected the entire Apple ecosystem, from watches to iPhones. These vulnerabilities involved arbitrary read and write issues within memory that could result in memory loss or information loss due to memory being overwritten, code being run on the device, or malware being placed on the device. The most significant new vulnerability that the team saw in April was the Palo Alto command injection vulnerability (CVE-2024-3400) that impacts PAN-OS Global Connect versions 10.2, 11.0, and 11.1. The vulnerability allows the threat actor to execute code with root privileges on the firewall. From there, a cron job is created that runs every minute, which accesses an external server containing commands that are executed via a batch file. The commands pull down code to establish a Python backdoor on the impacted system, and a second Python script runs to establish persistence. Palo Alto released patches on April 14, which should be applied immediately, though there was limited exploitation in the wild. If your company suspects a compromise, you can submit a technical support ticket to Palo Alto. Also, Nessus has released a single plug-in as a version check to detect this vulnerability. SOC Engineering Insights The SOC Engineering Lead discussed the Palo Alto vulnerability in greater detail. The team was tracking the threat, hunting for indicators, and fortunately, got a copy of the web shell. The team decoded the web shell and found some legible code. The web shell showed that the initial Python code is Base64 encoded and dropped, which is a binary-to-text encoding scheme that threat actors often use to hide their activity in a system. The code puts outputs of shell commands on a cascading style sheet that is part of the HTML documentation, and the command output is written as a comment that’s not visible to viewers. Also, one function in the code erases the output of the command from the cascading style sheet file as it is rewritten to ensure that the original version is restored with no evidence of a compromise. The team continually watches for indicators of this vulnerability and looks for any evidence of the malicious code on client networks. Threat Hunting The SOC Director talked about upward and downward trends that the team is currently monitoring on client networks. Ransomware is the most prevalent malware attack, as usual, and probably the most costly and dangerous threat in the cyber environment. Phishing emails with a financial lure are still on the rise. The team is seeing an increase in ACH, wire, and tax lures in phishing emails, with a majority of phishing emails linking to credential harvesting web pages and not involving malware. The use of artificial intelligence services, such as ChatGPT, is making phishing emails harder to identify due to more convincing language and correct grammar. Following a successful attack, team members often see the creation of auto-forward rules, which they alert on for every client. To reduce the risk of an attack, the team suggests using multifactor authentication for all user accounts and implementing user awareness training. Malware delivery via phishing emails has increased since the beginning of the year. These attacks usually occur through links in the body of emails, link attachments, and PDF attachments that contain JavaScript, ActionScript, or AutoRun that lead to a malicious website. Also, password-protected documents and zip files are often associated with these attacks. The team recommends blocking password-protected files at the email gateway, but it’s important for companies to fine-tune the blocking to assure that valid business documents are not blocked. Malware delivery via drive-by websites has been decreasing over the past several months, though it’s still a threat. The team encourages companies to continue patching operating systems and applications and offering user awareness training to employees. Detection and Engineering The Detection Engineer discussed the specific devices used to execute physical device attacks . He set the stage with a history of these devices and told how Cottonmouth, a USB port surveillance device used to gain remote access to a targeted network, was developed in 2009 by the National Security Agency at a per-device cost of $20,000. Since then, new devices —such as Rubber Ducky, O.MG Cable, USB Ninja Cable, and other alternatives — have been developed at drastically reduced costs, some as low as $6. Rubber Ducky . This USB plug-in device looks like a normal flash drive but acts as a keyboard, using keystroke injection as its attack method. Once inserted, it holds the same privileges as the current logged-in user of the computer. The device has built-in storage for commands and, within seconds, can type out the commands. The commands attack the target, get the Wi-Fi passwords, and write the passwords to a file. Then, another command reads the file to put the data onto the USB drive. The device exfiltrates data using the caps lock and numb lock features on the keyboard. O.MG Cable . This device is a tiny, hidden implant in a USB cable. Like Rubber Ducky, the device uses keystroke injection to run commands on the targeted computer. Once inserted, it can jiggle the mouse 1 pixel to keep the computer screen from locking, so the threat actor can access the computer at a later time. The device can self-destruct, or wipe itself clean, leaving no evidence of the attack, and it has geofencing capabilities to ensure that the attack hits the intended target. USB Ninja Cable . This cable device has two push buttons used to remotely trigger the malicious payload, or it can be used on a timer. Once inserted, the device can exfiltrate data through an internal Wi-Fi or Bluetooth chip. Other alternatives. Though not as sophisticated as the devices mentioned above, there are more than 20 other physical devices available, such as ATtiny85, Adafruit, Raspberry Pi, and Arduino, that are easy to program and inexpensive to buy. As a defense against physical device attacks, the team recommends user awareness training for all employees. In particular, employees need to know that they should never plug in an untrusted USB device. Blocking USB devices is also a smart option. And, as always, restricting administrative rights is a best practice to protect against an attack. Next Month The Pondurance team will host another webinar in May to discuss new cybersecurity activity. Check back next month to read the summary. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn how healthcare organizations can utilize risk-based cybersecurity to assess third-party cyber risks effectively. Assessing Third-Party Risk in the Healthcare Sector Pondurance Facebook X (Twitter) LinkedIn Copy link Many organizations rely on third parties, including vendors, partners, suppliers, and contractors, to keep their operations up and running. Often, third parties are granted access to an organization’s critical systems, networks, and sensitive data, putting the organization at risk of a cyberattack or data breach originating with the third party. Any vulnerability or gap in the cybersecurity of the third party can provide an opening for a threat actor to access an organization’s digital assets and networks. Healthcare organizations are particularly vulnerable to the risk posed by third parties because they handle and process large volumes of protected health information (PHI), including Social Security numbers, birthdates, medical histories, and financial information. According to Black Kite’s Annual Third-Party Breach Report 2024 , the healthcare sector was the most common victim of third-party data breaches, making up one-third of all incidents in 2023. And recently another major health data breach involving third-party services firms made headlines. As a result, assessing third-party risk is of utmost importance to healthcare organizations to properly safeguard PHI and any other sensitive data. Healthcare organizations need to know when to address cyber risk with third parties and how to evaluate the strength of a third party’s risk management. When to address third-party risk Cybersecurity threats are a concern for every healthcare organization, large and small, and every third party that healthcare organizations do business with. Third-party risk is a serious consideration for any new business relationship, so when beginning a business engagement, your organization should promptly address the cyber risk of the third party. “The best time to ensure a vendor meets security and compliance requirements is prior to purchase by reviewing the vendor’s processes and controls available and alignment with the practice expectations and needs,” said Dustin Hutchison, Chief Information Security Officer and Vice President of Services at Pondurance. He insists that healthcare organizations of any size should focus on ensuring that required security controls are in place by having a conversation with the vendor before purchase and including those requirements in the contract agreement. That way, your organization can select third parties that pose less risk or can mitigate the risk before doing business with that third party. In addition, a healthcare organization should perform ongoing, periodic risk assessments as the business relationship continues and following any significant change to the organization’s network. How to evaluate a third party’s cyber risk Organizations in the healthcare sector work, on average, with 15.5 third-party vendors , according to a 2023 Close Encounters of the Third (and Fourth) Party Kind study. The study also reported that 98.3% of all organizations , healthcare and otherwise, have a relationship with at least one third party that suffered a data breach in the last two years. So how does a healthcare organization evaluate which third parties are safe to do business with? A vendor risk assessment is required. A vendor risk assessment is a process that evaluates the risks —operational, financial, compliance , security, and reputational — posed to your healthcare organization by third parties. Organizations often perform vendor risk assessments using questionnaires to evaluate a third party’s cyber processes and policies related to those risks. Your organization needs to ask important questions such as: Does the third party use a cybersecurity framework (CSF) such as NIST CSF? Has the third party ever experienced a data breach? Is the third party fully compliant with statutory regulations such as HIPAA ? Has the third party ever paid fines or penalties for noncompliance with regulations? Getting accurate and appropriate answers to these questions and others is important to the process. “Healthcare organizations should have higher expectations of their vendors and third-party providers, especially when patient data is in scope,” Dustin said. “The leadership of the organizations purchasing and using third-party solutions must support a robust vendor risk management program and understand that not all risk can be transferred to a third party, especially considering reputation damage and the loss of customer confidence.” Dustin believes that managed detection and response providers, like Pondurance, should use a risk-based approach to cybersecurity to keep healthcare organizations safe from cyberattacks and data breaches. A risk-based approach focuses on an organization’s unique cyber risks and considers what an organization wants to accomplish and what it needs to protect. Once a risk assessment identifies an organization’s cyber risks, the organization prioritizes those risks to protect the data and assets that matter most to the organization. “Organizations are going to have different requirements, but establishing a strong program baseline for all of their third parties should be the norm,” Dustin said. “Being able to demonstrate an aggressive vulnerability management program with appropriate access controls, auditing, and proactive detection and response goes a long way.” Conclusion Healthcare organizations rely on third parties to keep their operations up and running, yet any vulnerability or gap in the cybersecurity of the third party can provide an opening for a threat actor to execute a cyberattack or data breach. That’s why assessing third-party risk is critical to keeping the healthcare sector safe from threats. Watch Dustin’s recent webinar Risk-Based Approach to Cybersecurity and Compliance to learn more. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

In August's SOC webinar, Pondurance provides an update on the current cybersecurity threat landscape and notable vulnerabilities. Novel Threat Tactics, Notable Vulnerabilities, and Current Trends for August Pondurance September 26, 2024 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In August, the team discussed threat intelligence, notable vulnerabilities and trends, security operations center (SOC) updates, and SOC engineering insights. Threat intelligence The Senior Manager of Digital Forensics and Incident Response (DFIR) discussed the risk of insider threats within an organization. Most cybersecurity programs are focused on preventing initial compromise or attack from outside the organization, but insiders can cause serious harm. The DFIR team groups insider threats into three categories: Identity theft. The team investigates identity theft with two types of actors in mind. These are unauthorized employees who get hired based on falsified documents and authentication information and espionage actors who are covertly involved in corporate espionage, extortion, or IP theft. Willing insider. This bad actor is often a disgruntled employee who seeks to cause damage to the organization itself. The damage could involve instigating a financial situation that will cause a negative impact to the organization or creating operational disruption. Unwitting insider. This employee ignores established security policies due to negligence or as directed by a malicious external actor. The external actor may convince the employee to grant access; then, once access is granted, the external actor can circumvent other security controls in place. The employee is unlikely to report the action, possibly causing much greater damage than expected. When the DFIR team investigates an insider threat case, evidence collection must be covert. Physical evidence may be unavailable, so investigators must rely on externally available data such as logs or backups. One of the team’s main goals is to achieve containment or mitigate any continued risk, and the outcome may take time since most organizations don’t have an access management system that allows the team to quickly identify the assets and evidence for an investigation. The team suggests several best practices to keep an insider threat from impacting your organization: • Use stringent background checks and authenticate documentation when hiring • Implement granular auditing of your internal, authorized, day-to-day user activities to establish a pattern of normal behavior • Establish granular access control and an access management strategy to understand where an employee could potentially cause harm • Enforce a separation of duties for critical processes and components of your security controls • Reinforce the activity of least privilege, including performing a regular access review of internal users and identifying where an employee might creep outside the initial scope of engagement • Enforce mandatory periodic leave to ensure visibility into the activities of all employees Vulnerabilities and trends The Vulnerability Management Program (VMP) Team Lead reviewed notable vulnerabilities from July. As many as 2,500 vulnerabilities were disclosed, and nine of those vulnerabilities were high risk. Of those nine, five of the vulnerabilities were known to be exploited in the wild on products including ServiceNow, Secure Shell (SSH), GeoServer, Acronis Cyber Infrastructure, Apache HTTP Server, Cisco Secure Email, Progress Telerik Report Server, and Exim. The VMP Team Lead talked in detail about the ServiceNow vulnerability , which is actually three vulnerabilities chained together to breach networks and conduct large-scale exfiltration of data and sensitive files. Two of the vulnerabilities (CVE-2024-4879 and CVE-2024-5217) allow the threat actor to achieve unauthenticated remote code executions, and the third vulnerability (CVE-2024-5217) allows the threat actor to gain access to multiple files stored on the affected server. The ServiceNow vulnerability targets government entities, energy sector companies, data centers, and software developers, making observers suspect that these bad guys may be nation-state actors aiming to steal trade secrets. Tens of thousands of vulnerable systems are still accessible for exploitation over the internet. Throughout July, the team saw a notable trend where vulnerabilities were being exploited well after the release of patches. Examples of this trend include the Log4Shell vulnerability (CVE-2021-44228), patched in December 2021, that impacts the Log4j library and the SSH vulnerability (CVE-2024-6387) that was disclosed in July. In August, the VMware ESXi hypervisor vulnerability (CVE-2024-37085) was exploited to deploy ransomware by numerous threat actors, including Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest. This authentication bypass vulnerability in VMware ESXi can be deceiving as it has a medium range Common Vulnerability Scoring System score of 6.8, which doesn’t rank as a high or critical threat. However, the score is only that low because the vulnerability requires the threat actor to have existing permissions in the organization’s active directory. If the threat actor indeed achieves those permissions, the attack can be quite critical as the threat actor then has full administrative access rights over the VMware environment. The team strongly recommends that organizations apply patches and take any mitigation steps required. To wrap up, the VMP Team Lead discussed that a whopping 90 reported vulnerabilities were addressed on Microsoft Patch Tuesday in August, and six of them were actively exploited zero-day vulnerabilities. The team stresses the importance of staying current on applying the Microsoft patches each month. SOC updates The SOC Director discussed recent cybersecurity trends that the SOC team observed in July. Credential stuffing attacks . These attacks, which are much like password sprays or brute force attacks, are on the increase. During an attack, the threat actor takes a large number of usernames and passwords from a spreadsheet, loads them into some type of automation, hits the login page, and tries every single username and password combination. Fortunately, Okta and Microsoft 365 customers have built-in protections against credential stuffing attacks. For example, Okta uses dynamic zones so that a user can allow anyone coming from within the United States but can deny someone from outside the country. Ransomware . Trending steady, ransomware is still the most prevalent malware attack that the team experiences in the wild. Social engineering tactics . The SOC sees a steady trend in compromises that originate from social engineering help desk calls. As always, the team recommends that organizations use strict verification procedures and continue with user awareness training. Phishing emails are prevalent, with a vast majority linking to credential harvesting pages. Successful credential harvesting attacks usually involve access to Microsoft Office 365 mailboxes. The SOC Director discussed how Pondurance recently overhauled inbox rules to more accurately detect phishing threats. He also suggested that risk can be drastically reduced by enabling multifactor authentication for all accounts and offering user awareness training to employees. SOC engineering insights The Manager of SOC Engineering introduced Pondurance’s new dashboard and provided an overview of its many features. The dashboard was built to give analysts a clear view of traffic going through the network sensors and to provide greater insights for clients with network sensors. Dashboard features include details and rich data that can help users troubleshoot issues on the network and investigate security issues, all with more than 30 different modules relating to various protocols. For example, the dashboard has a domain name system (DNS) lookup that shows DNS requests, the DNS response, and SSL certificates; connections that let users see how much traffic is transmitted; status codes that display what is in the HTTP request header; and much more. As an extension of a discussion from the July SOC webinar , the Manager of SOC Engineering reviewed how the SOC team, working closely with the DFIR team, uses encounters from attacker-in-the-middle phishing and business email compromise cases to understand the context of a threat and compute a risk score. From there, the team is able to escalate threats based on that risk score to keep clients better protected. As always, the team asks clients to share their “crown jewels,” including important hosts, significant IP addresses, VIP lists, honey tokens, and anything distinct to the network that can help it protect against threats. Next month The Pondurance team will host another webinar in September to discuss new cybersecurity activity. Check back next month to read the summary. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Immutable backups help protect organizations from ransomware by preventing backup data from being altered or deleted. Learn why they matter. Cyber101: What Are Immutable Backups, and Why Are They Important? Michael DeNapoli July 29, 2026 Facebook X (Twitter) LinkedIn Copy link A reader asked, “I’m hearing about ‘immutable’ backup. What is that, and why is it becoming so widely advised?” Let’s dive in. Most of us are familiar with backing up important data. We either manually make a copy of that data on removable media or the cloud, or use software to have it happen automatically. This allows for recovery in the case that the original data is deleted, the machine it’s on is no longer usable, or if it gets encrypted by threat activity like ransomware. Many of us are also familiar with the more common forms of backup operations. Full backups do what their name says - all data that is getting backed up is copied over, regardless of if it had been backed up in the past. Incremental backups copy over only files which have been changed since the last time those files were backed up (or the first time they’re seen if they’re new files). Versioned backups retain one or more previous versions of a file for a specific amount of time after they’ve been changed. The majority of common backup tools available on both consumer and commercial markets will support these backup operation types; and in fact many online storage platforms can do versioned backups these days. Immutable backups don’t change these types of backup operations directly, but rather change how that backed up data can be accessed, deleted, or changed. With standard backup tools and methods, anyone with the ability to administer the backup system can delete backups, change them, or stop them from happening at all. This is necessary, as keeping very old data that no longer serves any useful purpose (either because it’s no longer being used, or it’s no longer needed for regulatory purposes, etc.) just means additional expense in the form of used storage space. Immutability is a term used to indicate that something cannot be altered. For example, the past is immutable - nothing that we do can actually change events that have already occurred. In backup technology, immutability means that the data which has been backed up cannot be altered or deleted by anyone except under incredibly specific circumstances. While it is possible to delete an immutable backup, it requires significant levels of administrative authority, and also typically will be time-gated so that the delete operation doesn’t happen for a period of time (e.g. 30 days). This gives backed up data a form of permanence beyond what more traditional backup systems can offer. The reason immutable backups are important is that threat actors have realized that - with enough time and skill - they can corrupt and/or encrypt the backup copies of critical organizational data. Doing so means that the organization cannot restore from those backups, which increases the chance that the organization will pay the ransom the threat actors are demanding to decrypt all the data they’ve encrypted. Threat actors who are financially motivated (which are currently in the majority) are definitely working to do everything they can to ensure they receive ransom payouts, and so corrupting or encrypting backups is becoming a key component of modern ransomware attacks. Immutable backups do have a drawback, however - storage space and the costs associated with it. Because the backups never get deleted except under specific and highly controlled circumstances, pruning backups (removing older/outdated backup copies) to conserve storage space in cloud systems or external storage platforms is not something you can regularly perform with immutable backup systems. Therefore, it’s necessary to allocate much more storage space in whatever platform you’ll use to store the backups, and that means that more budget will have to be applied in order to pay for the additional storage costs. Additionally, the nature of immutable backup solutions also means that extra time has to be spent to manage the backup processes. Pruning is still required, but has to be properly authorized (which is a multi-step and multi-administrator process), and then scheduled 30 days or more in advance. As the pruning window comes around to the present day, additional multi-step/multi-administrator processes have to be performed to authorize the final deletion of the data. While cumbersome, these steps are required to ensure that only the organization’s authorized administrators can ever delete the data - and even then they must work within strict safeguards to ensure it’s not deleted accidentally or by a rogue administrator. Finally, immutable backup solutions do typically cost more than standard backup tools. The price difference is variable depending on the vendor, but in most cases it requires holding the immutable backups in vendor cloud platforms and/or on vendor-provided appliances and storage, so the cost difference can be significant. In summary, immutable backups are a valuable component of the modern ransomware recovery technique landscape. The nature of how they work may make it fiscally or operationally difficult for many companies to implement them, but organizations which have the staff and budget necessary should absolutely bring immutability into their backup tool-kit. About the Author: Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

For this month’s employee spotlight, we spoke with Braden McCann who fell into the cybersecurity industry by accident.|For this month’s employee spotlight, we spoke with Braden McCann who fell into the cybersecurity industry by accident. Meet Pondurance: Braden McCann Pondurance June 10, 2021 Facebook X (Twitter) LinkedIn Copy link For this month’s employee spotlight, we spoke with Braden McCann who has helped our healthcare customers at Pondurance for almost four years. What led you to your career choice in cybersecurity? I ended up in technology somewhat by accident. I studied biology and math as an undergraduate with the intention of going to medical school. I had no idea at the time I would end up working closely with healthcare in an entirely different capacity. While in college, I worked for a small, local IT company — starting out with basic help desk and hardware repair and eventually getting into some larger projects and server administration. After graduating, I decided to stay on the technology path and got a job working for a division of Jack Henry & Associates that was responsible for network infrastructure and security. That was around the same time that I met Landon Lewis, Pondurance’s Chief Technology Officer, and really liked what he was doing at Pondurance. I continued learning more about cybersecurity at Jack Henry and worked on my MBA in the evenings. After a few years, I had the knowledge and confidence to ask Landon for a job so that I could be on the cutting edge of the industry. I haven’t looked back since. What is a typical day like for you? Every day is different, thankfully. It’s always a juggling act of planned meetings, unplanned meetings, and trying to stay on top of communications and contracts in between. Most of my clients and prospects are in a state of constant change, much like the security industry itself. We work with clients on an ongoing basis to reduce risk as their technology and business processes evolve. Many organizations are undergoing their own version of the digital transformation, which includes meaningful impacts to their security postures. I help align the right Pondurance expertise and solutions to those challenges for both new and existing customers. What is your proudest accomplishment in your career to date? My proudest accomplishment has been our work with healthcare organizations in Indiana. As we have all been recently reminded, healthcare is a vital industry that we all need to function well. Healthcare delivery organizations are tasked with an incredibly important and challenging role and rely heavily on technology to perform it. Hospitals can’t tolerate any downtime without potential risk to patients and even population safety. They have plenty to worry about without worrying about ransomware, business email compromise, regulatory fines, reputation damage, etc. I’m proud to have put together a promotional program for healthcare that numerous hospitals have taken advantage of that has allowed them to offload their security concerns to us in a cost-effective manner so they can focus on patient care. What advice have you been given that stuck with you? You have to be empathetic to be good at sales. If you are genuinely empathetic to your prospect and/or customer’s needs, and you understand the use cases and limits of your solution, then everything else will follow. When you care, you listen well. When you care, you ask good questions and immerse yourself in their world. In cybersecurity, we sell to very intelligent, very sophisticated buyers who can pick up on how invested you are in helping them solve their problems and how well you actually understand the problem, which matter a lot in a long-term strategic partnership. What advice would you give to others looking to enter the technology field? Develop a mindset of lifelong learning. This is applicable in every industry, as few to none are static, but is especially true in cybersecurity. The technology landscape changes quickly and so does the threat landscape. The number of security tools, services, vendors, and frameworks has grown and evolved rapidly. Educating customers and prospects is a key part of the job so you have to set time aside every day to stay on top of changes and understand how your peers are responding to them. Interested in joining the Pondurance team? View our current openings! Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026