As retail businesses expand, so does the attack surface. Get insights about cybersecurity in retail and helpful resources in this blog. The State of Cybersecurity in Retail Pondurance December 1, 2022 Facebook X (Twitter) LinkedIn Copy link Most industries are learning to navigate new operations post-pandemic. To respond to shoppers’ needs, many retailers are offering a mix of brick and mortar and e-commerce stores. But as retail businesses expand, so does the attack surface. Every single outlet, store, website, and social media account is a potential target. Here are cybersecurity statistics on the retail industry that may or may not surprise you, as well as helpful resources for your retail business: Most cyberattacks in the retail industry are financially motivated The retail industry experienced 629 confirmed incidents and 241 breaches with confirmed data disclosures in 2021, according to Verizon’s 2022 Data Breach Investigations Report . Of these attacks, 98% were financially motivated. Retailers collect valuable data like consumer information and payment card data, making them prime targets for bad actors. Now, the introduction of contactless payment and more online buying options has created an expanded attack surface, making it increasingly challenging for retailers to protect customer data. Find out why many retailers are turning to managed detection and response (MDR) services to defend against cyberattacks and learn what MDR services can do for your retail business. The retail industry experienced its highest rate of ransomware attacks The retail industry experienced its highest rate of ransomware attacks last year, reporting a 75% increase over the previous year. In all, 77% of retail businesses were hit by a ransomware attack in 2021, up from 44% in 2020. The growing threat of ransomware is an unsettling trend for retailers. Threat actors exploit vulnerabilities in retailer networks to install ransomware, encrypt systems, and freeze transactions until the retailer pays a ransom, leading to huge financial losses and damage to the retailer’s reputation. Educating your employees and implementing cyber hygiene practices are critical to reducing human error, but investing in the right cybersecurity tools, hiring highly trained cybersecurity analysts, and implementing 24/7 monitoring are key to mitigating ransomware attacks. Find out what motivates cybercriminals and how you can reduce ransomware attacks . The shortage of skilled cybersecurity workers is impacting the retail industry An estimated 4.1 million people work as cybersecurity professionals worldwide, including 1.14 million U.S. workers, yet the workforce must increase by 65% to defend against cyber threats, according to the (ISC)2 2021 Cybersecurity Workforce Study. Technology alone cannot stop motivated attackers. Modern MDR providers know that human attackers must be confronted by human defenders. Though technology is important, 24/7 detection and response paired with skilled threat hunters to manage alerts is the only way to protect your business. Small and midsize businesses have a particularly difficult time keeping talent due to limited budgets and fewer opportunities for advancement, according to a Forrester study . As a result, many retailers rely on external partners to provide around-the-clock protection. Check out the Forrester study to learn how businesses are evolving their cybersecurity practices and operations to alleviate the cyber talent shortage. More internet-connected devices are being used in retail businesses Over 84% of businesses use Internet of Things (IoT) devices , but less than 50% of them have taken the necessary steps to secure these devices. While these devices bring many benefits to the retail industry, they also pose serious threats that businesses must work to minimize. The pandemic shifted many retailers’ strategies and sped up digitization, namely through the integration of IoT devices. However, none of the potential gains from IoTs will be realized if the devices, communications, and data are not secured. IoT security must be a pivotal piece of the design of any IoT implementation and should be considered as a foundation of the overall solution. Learn how to evaluate IoT devices and discover the best practices for integrating them into your business. Social attacks are the most common threats to retailers Social attacks, like phishing and pretexting, have been on the rise over the last few years in the retail industry, up 29% this year . Phishing and social engineering scams are sophisticated and can trick the wariest users if their guard is let down even momentarily. For bad actors seeking valuable credit card and payment data, these attacks are one of the easiest ways to gain access to your system. One of the best ways to prevent phishing is to train your employees on how to recognize a phishing email . Most retail organizations lose revenue due to ransomware attacks Over 90% of retail businesses hit by ransomware reported that the attack impacted their ability to operate, while 89% reported that the attack caused them to lose business or revenue . The greatest threat to retail organizations is operation shutdown and loss of revenue. As ransomware attacks on retailers continue to rise, so does the average ransomware payout. Opportunistic attackers are capitalizing on this fact, and targeting individual retail stores and small chains. One of the main ways bad actors gain access to networks is through compromised domain controllers. While there is no single “silver bullet” that will fully protect your business from all ransomware, protecting your domain controller is a critical step to mitigating your risk . Retailers face significantly more threats during the holiday season Cybersecurity should always be top of mind, but it’s especially critical during the holidays. Last year’s holiday sales grew 14%, reaching $886.7 billion , while e-commerce fraud attempt rates rose by 19% . In today’s cyber environment, threats pose a challenge for every industry, and retailers are on the hit list for bad actors, especially during the holidays. Training your employees on the best security awareness practices and staying on top of compliance requirements are important but not always enough to combat today’s cyber threats. Read this blog, Retailers Prepare for the Holiday Season — and Cybersecurity Threats , for common threats to retailers and ways to boost your defenses during the holiday season. Cryptojacking attacks are on the rise Cybercrime is a profitable business for threat actors, with a cost that is growing 15% year over year and is expected to reach more than $10.5 trillion by 2025 . Bad actors can generate huge sums of money very quickly by infecting an e-commerce or retail business. While malware is commonly the gateway to cryptojacking attacks, other common vectors include brute force attacks, exploited software vulnerabilities, and infected plug-ins. As long as malicious scripts can run local commands on a machine, attackers can use this access to start mining cryptocurrency. But your retail business can fight back by learning ways to identify and prevent cryptojacking attacks . More businesses are seeking and achieving PCI DSS compliance The percentage of businesses maintaining full compliance improved from a low 27.9% in 2019 to 43.4% in 2020, according to Verizon’s 2022 Payment Security Report . Every organization working with cardholder data (CHD) must implement security policies, technology, and processes to ensure its systems are protected from breach and theft of CHD. With the rise in cyberattacks on every industry, many retailers are seeking help to maintain full compliance and combat these threats. Find out how to identify areas of risk and maturity related to Payment Card Industry Data Security Standard (PCI DSS) compliance at your retail business. These statistics highlight some of the many challenges retailers face in the current threat landscape. Use these statistics and resources to acknowledge cyber lessons learned and take steps to improve your own security posture. Learn how Pondurance retail services can integrate with the team and technology at your brick-and-mortar or e-commerce business to strengthen your cybersecurity posture and protect against cyber threats. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Each month, Pondurance provides updates on the current cybersecurity threat landscape, notable vulnerabilities and more. Read our blog to get the insight from last month. Novel Threat Tactics, Notable Vulnerabilities, and Current Trends for April 2024 Pondurance May 17, 2024 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In April, the team discussed threat intelligence, vulnerabilities and trends, security operations center (SOC) engineering insights, threat hunting, and detection engineering. Threat Intelligence The Senior Manager of Digital Forensics and Incident Response (DFIR) discussed the recent surge of third-party compromises within the cybersecurity landscape and what companies can do to protect against these attacks. Typically, in a third-party compromise, a threat actor gains access to a company’s sensitive data through a vendor, contractor, or supplier. These high-risk, high-impact attacks are often unexpected, though they are statistically quite likely, and can present a significant financial impact to downsteam customers of the third party. For example, Change Healthcare, a payroll and health information clearinghouse, recently experienced a ransomware attack that financially impacted 94% of hospitals , according to an American Hospital Association survey. Third-party compromises can occur as ransomware attacks, data theft, insider threats, supply chain compromises, and more. The Senior Manager of DFIR suggested a few measures to help companies prevent an impact from a third-party compromise: Minimize your exposure. Wherever possible, your company should use good IT security practices, employ least privileges, and implement security controls to keep the third party’s presence as minimal as possible. Limit your IT footprint. It’s often difficult for a company to quantify and understand what its exposure is to a third-party compromise. Limiting where your data lives, internally and externally, can help your company better understand your risk and employ controls to manage it. Understand your interconnections. Your company needs to know which third parties you rely on for services, where your data resides, and how your data is processed. In addition, you want to know which third-party applications exist in your environment and have a plan in place to mitigate the risk of compromise from those applications. Vulnerabilities and Trends The Vulnerability Management Program Team Lead reviewed notable vulnerabilities from April. As many as 2,500 vulnerabilities were disclosed, and nine of those vulnerabilities were high risk. Of those nine, four were known to be exploited in the wild on products including: JetBrains TeamCity. The JetBrains vulnerability (CVE-2024-27198) involved an authentication bypass that led to a second vulnerability, allowing an authenticated attacker to execute code on the impacted device. Also, a directory traversal vulnerability (CVE-2024-27199) allowed the attacker to see unauthorized content. JetBrains released a patch on March 3. The very next day, the researchers released proof of concept codes on the internet. Fortinet. The SQL injection vulnerability (CVE-2024-48788) impacted Fortinet endpoint management service software, leading to remote code execution on vulnerable systems. Patches were released on March 12. On March 21, Horizon3 researchers released proof of concept codes. Apple. Two vulnerabilities (CVE-2024-23225 and CVE-2024-23296) affected the entire Apple ecosystem, from watches to iPhones. These vulnerabilities involved arbitrary read and write issues within memory that could result in memory loss or information loss due to memory being overwritten, code being run on the device, or malware being placed on the device. The most significant new vulnerability that the team saw in April was the Palo Alto command injection vulnerability (CVE-2024-3400) that impacts PAN-OS Global Connect versions 10.2, 11.0, and 11.1. The vulnerability allows the threat actor to execute code with root privileges on the firewall. From there, a cron job is created that runs every minute, which accesses an external server containing commands that are executed via a batch file. The commands pull down code to establish a Python backdoor on the impacted system, and a second Python script runs to establish persistence. Palo Alto released patches on April 14, which should be applied immediately, though there was limited exploitation in the wild. If your company suspects a compromise, you can submit a technical support ticket to Palo Alto. Also, Nessus has released a single plug-in as a version check to detect this vulnerability. SOC Engineering Insights The SOC Engineering Lead discussed the Palo Alto vulnerability in greater detail. The team was tracking the threat, hunting for indicators, and fortunately, got a copy of the web shell. The team decoded the web shell and found some legible code. The web shell showed that the initial Python code is Base64 encoded and dropped, which is a binary-to-text encoding scheme that threat actors often use to hide their activity in a system. The code puts outputs of shell commands on a cascading style sheet that is part of the HTML documentation, and the command output is written as a comment that’s not visible to viewers. Also, one function in the code erases the output of the command from the cascading style sheet file as it is rewritten to ensure that the original version is restored with no evidence of a compromise. The team continually watches for indicators of this vulnerability and looks for any evidence of the malicious code on client networks. Threat Hunting The SOC Director talked about upward and downward trends that the team is currently monitoring on client networks. Ransomware is the most prevalent malware attack, as usual, and probably the most costly and dangerous threat in the cyber environment. Phishing emails with a financial lure are still on the rise. The team is seeing an increase in ACH, wire, and tax lures in phishing emails, with a majority of phishing emails linking to credential harvesting web pages and not involving malware. The use of artificial intelligence services, such as ChatGPT, is making phishing emails harder to identify due to more convincing language and correct grammar. Following a successful attack, team members often see the creation of auto-forward rules, which they alert on for every client. To reduce the risk of an attack, the team suggests using multifactor authentication for all user accounts and implementing user awareness training. Malware delivery via phishing emails has increased since the beginning of the year. These attacks usually occur through links in the body of emails, link attachments, and PDF attachments that contain JavaScript, ActionScript, or AutoRun that lead to a malicious website. Also, password-protected documents and zip files are often associated with these attacks. The team recommends blocking password-protected files at the email gateway, but it’s important for companies to fine-tune the blocking to assure that valid business documents are not blocked. Malware delivery via drive-by websites has been decreasing over the past several months, though it’s still a threat. The team encourages companies to continue patching operating systems and applications and offering user awareness training to employees. Detection and Engineering The Detection Engineer discussed the specific devices used to execute physical device attacks . He set the stage with a history of these devices and told how Cottonmouth, a USB port surveillance device used to gain remote access to a targeted network, was developed in 2009 by the National Security Agency at a per-device cost of $20,000. Since then, new devices —such as Rubber Ducky, O.MG Cable, USB Ninja Cable, and other alternatives — have been developed at drastically reduced costs, some as low as $6. Rubber Ducky . This USB plug-in device looks like a normal flash drive but acts as a keyboard, using keystroke injection as its attack method. Once inserted, it holds the same privileges as the current logged-in user of the computer. The device has built-in storage for commands and, within seconds, can type out the commands. The commands attack the target, get the Wi-Fi passwords, and write the passwords to a file. Then, another command reads the file to put the data onto the USB drive. The device exfiltrates data using the caps lock and numb lock features on the keyboard. O.MG Cable . This device is a tiny, hidden implant in a USB cable. Like Rubber Ducky, the device uses keystroke injection to run commands on the targeted computer. Once inserted, it can jiggle the mouse 1 pixel to keep the computer screen from locking, so the threat actor can access the computer at a later time. The device can self-destruct, or wipe itself clean, leaving no evidence of the attack, and it has geofencing capabilities to ensure that the attack hits the intended target. USB Ninja Cable . This cable device has two push buttons used to remotely trigger the malicious payload, or it can be used on a timer. Once inserted, the device can exfiltrate data through an internal Wi-Fi or Bluetooth chip. Other alternatives. Though not as sophisticated as the devices mentioned above, there are more than 20 other physical devices available, such as ATtiny85, Adafruit, Raspberry Pi, and Arduino, that are easy to program and inexpensive to buy. As a defense against physical device attacks, the team recommends user awareness training for all employees. In particular, employees need to know that they should never plug in an untrusted USB device. Blocking USB devices is also a smart option. And, as always, restricting administrative rights is a best practice to protect against an attack. Next Month The Pondurance team will host another webinar in May to discuss new cybersecurity activity. Check back next month to read the summary. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn how healthcare organizations can utilize risk-based cybersecurity to assess third-party cyber risks effectively. Assessing Third-Party Risk in the Healthcare Sector Pondurance Facebook X (Twitter) LinkedIn Copy link Many organizations rely on third parties, including vendors, partners, suppliers, and contractors, to keep their operations up and running. Often, third parties are granted access to an organization’s critical systems, networks, and sensitive data, putting the organization at risk of a cyberattack or data breach originating with the third party. Any vulnerability or gap in the cybersecurity of the third party can provide an opening for a threat actor to access an organization’s digital assets and networks. Healthcare organizations are particularly vulnerable to the risk posed by third parties because they handle and process large volumes of protected health information (PHI), including Social Security numbers, birthdates, medical histories, and financial information. According to Black Kite’s Annual Third-Party Breach Report 2024 , the healthcare sector was the most common victim of third-party data breaches, making up one-third of all incidents in 2023. And recently another major health data breach involving third-party services firms made headlines. As a result, assessing third-party risk is of utmost importance to healthcare organizations to properly safeguard PHI and any other sensitive data. Healthcare organizations need to know when to address cyber risk with third parties and how to evaluate the strength of a third party’s risk management. When to address third-party risk Cybersecurity threats are a concern for every healthcare organization, large and small, and every third party that healthcare organizations do business with. Third-party risk is a serious consideration for any new business relationship, so when beginning a business engagement, your organization should promptly address the cyber risk of the third party. “The best time to ensure a vendor meets security and compliance requirements is prior to purchase by reviewing the vendor’s processes and controls available and alignment with the practice expectations and needs,” said Dustin Hutchison, Chief Information Security Officer and Vice President of Services at Pondurance. He insists that healthcare organizations of any size should focus on ensuring that required security controls are in place by having a conversation with the vendor before purchase and including those requirements in the contract agreement. That way, your organization can select third parties that pose less risk or can mitigate the risk before doing business with that third party. In addition, a healthcare organization should perform ongoing, periodic risk assessments as the business relationship continues and following any significant change to the organization’s network. How to evaluate a third party’s cyber risk Organizations in the healthcare sector work, on average, with 15.5 third-party vendors , according to a 2023 Close Encounters of the Third (and Fourth) Party Kind study. The study also reported that 98.3% of all organizations , healthcare and otherwise, have a relationship with at least one third party that suffered a data breach in the last two years. So how does a healthcare organization evaluate which third parties are safe to do business with? A vendor risk assessment is required. A vendor risk assessment is a process that evaluates the risks —operational, financial, compliance , security, and reputational — posed to your healthcare organization by third parties. Organizations often perform vendor risk assessments using questionnaires to evaluate a third party’s cyber processes and policies related to those risks. Your organization needs to ask important questions such as: Does the third party use a cybersecurity framework (CSF) such as NIST CSF? Has the third party ever experienced a data breach? Is the third party fully compliant with statutory regulations such as HIPAA ? Has the third party ever paid fines or penalties for noncompliance with regulations? Getting accurate and appropriate answers to these questions and others is important to the process. “Healthcare organizations should have higher expectations of their vendors and third-party providers, especially when patient data is in scope,” Dustin said. “The leadership of the organizations purchasing and using third-party solutions must support a robust vendor risk management program and understand that not all risk can be transferred to a third party, especially considering reputation damage and the loss of customer confidence.” Dustin believes that managed detection and response providers, like Pondurance, should use a risk-based approach to cybersecurity to keep healthcare organizations safe from cyberattacks and data breaches. A risk-based approach focuses on an organization’s unique cyber risks and considers what an organization wants to accomplish and what it needs to protect. Once a risk assessment identifies an organization’s cyber risks, the organization prioritizes those risks to protect the data and assets that matter most to the organization. “Organizations are going to have different requirements, but establishing a strong program baseline for all of their third parties should be the norm,” Dustin said. “Being able to demonstrate an aggressive vulnerability management program with appropriate access controls, auditing, and proactive detection and response goes a long way.” Conclusion Healthcare organizations rely on third parties to keep their operations up and running, yet any vulnerability or gap in the cybersecurity of the third party can provide an opening for a threat actor to execute a cyberattack or data breach. That’s why assessing third-party risk is critical to keeping the healthcare sector safe from threats. Watch Dustin’s recent webinar Risk-Based Approach to Cybersecurity and Compliance to learn more. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

In August's SOC webinar, Pondurance provides an update on the current cybersecurity threat landscape and notable vulnerabilities. Novel Threat Tactics, Notable Vulnerabilities, and Current Trends for August Pondurance September 26, 2024 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In August, the team discussed threat intelligence, notable vulnerabilities and trends, security operations center (SOC) updates, and SOC engineering insights. Threat intelligence The Senior Manager of Digital Forensics and Incident Response (DFIR) discussed the risk of insider threats within an organization. Most cybersecurity programs are focused on preventing initial compromise or attack from outside the organization, but insiders can cause serious harm. The DFIR team groups insider threats into three categories: Identity theft. The team investigates identity theft with two types of actors in mind. These are unauthorized employees who get hired based on falsified documents and authentication information and espionage actors who are covertly involved in corporate espionage, extortion, or IP theft. Willing insider. This bad actor is often a disgruntled employee who seeks to cause damage to the organization itself. The damage could involve instigating a financial situation that will cause a negative impact to the organization or creating operational disruption. Unwitting insider. This employee ignores established security policies due to negligence or as directed by a malicious external actor. The external actor may convince the employee to grant access; then, once access is granted, the external actor can circumvent other security controls in place. The employee is unlikely to report the action, possibly causing much greater damage than expected. When the DFIR team investigates an insider threat case, evidence collection must be covert. Physical evidence may be unavailable, so investigators must rely on externally available data such as logs or backups. One of the team’s main goals is to achieve containment or mitigate any continued risk, and the outcome may take time since most organizations don’t have an access management system that allows the team to quickly identify the assets and evidence for an investigation. The team suggests several best practices to keep an insider threat from impacting your organization: • Use stringent background checks and authenticate documentation when hiring • Implement granular auditing of your internal, authorized, day-to-day user activities to establish a pattern of normal behavior • Establish granular access control and an access management strategy to understand where an employee could potentially cause harm • Enforce a separation of duties for critical processes and components of your security controls • Reinforce the activity of least privilege, including performing a regular access review of internal users and identifying where an employee might creep outside the initial scope of engagement • Enforce mandatory periodic leave to ensure visibility into the activities of all employees Vulnerabilities and trends The Vulnerability Management Program (VMP) Team Lead reviewed notable vulnerabilities from July. As many as 2,500 vulnerabilities were disclosed, and nine of those vulnerabilities were high risk. Of those nine, five of the vulnerabilities were known to be exploited in the wild on products including ServiceNow, Secure Shell (SSH), GeoServer, Acronis Cyber Infrastructure, Apache HTTP Server, Cisco Secure Email, Progress Telerik Report Server, and Exim. The VMP Team Lead talked in detail about the ServiceNow vulnerability , which is actually three vulnerabilities chained together to breach networks and conduct large-scale exfiltration of data and sensitive files. Two of the vulnerabilities (CVE-2024-4879 and CVE-2024-5217) allow the threat actor to achieve unauthenticated remote code executions, and the third vulnerability (CVE-2024-5217) allows the threat actor to gain access to multiple files stored on the affected server. The ServiceNow vulnerability targets government entities, energy sector companies, data centers, and software developers, making observers suspect that these bad guys may be nation-state actors aiming to steal trade secrets. Tens of thousands of vulnerable systems are still accessible for exploitation over the internet. Throughout July, the team saw a notable trend where vulnerabilities were being exploited well after the release of patches. Examples of this trend include the Log4Shell vulnerability (CVE-2021-44228), patched in December 2021, that impacts the Log4j library and the SSH vulnerability (CVE-2024-6387) that was disclosed in July. In August, the VMware ESXi hypervisor vulnerability (CVE-2024-37085) was exploited to deploy ransomware by numerous threat actors, including Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest. This authentication bypass vulnerability in VMware ESXi can be deceiving as it has a medium range Common Vulnerability Scoring System score of 6.8, which doesn’t rank as a high or critical threat. However, the score is only that low because the vulnerability requires the threat actor to have existing permissions in the organization’s active directory. If the threat actor indeed achieves those permissions, the attack can be quite critical as the threat actor then has full administrative access rights over the VMware environment. The team strongly recommends that organizations apply patches and take any mitigation steps required. To wrap up, the VMP Team Lead discussed that a whopping 90 reported vulnerabilities were addressed on Microsoft Patch Tuesday in August, and six of them were actively exploited zero-day vulnerabilities. The team stresses the importance of staying current on applying the Microsoft patches each month. SOC updates The SOC Director discussed recent cybersecurity trends that the SOC team observed in July. Credential stuffing attacks . These attacks, which are much like password sprays or brute force attacks, are on the increase. During an attack, the threat actor takes a large number of usernames and passwords from a spreadsheet, loads them into some type of automation, hits the login page, and tries every single username and password combination. Fortunately, Okta and Microsoft 365 customers have built-in protections against credential stuffing attacks. For example, Okta uses dynamic zones so that a user can allow anyone coming from within the United States but can deny someone from outside the country. Ransomware . Trending steady, ransomware is still the most prevalent malware attack that the team experiences in the wild. Social engineering tactics . The SOC sees a steady trend in compromises that originate from social engineering help desk calls. As always, the team recommends that organizations use strict verification procedures and continue with user awareness training. Phishing emails are prevalent, with a vast majority linking to credential harvesting pages. Successful credential harvesting attacks usually involve access to Microsoft Office 365 mailboxes. The SOC Director discussed how Pondurance recently overhauled inbox rules to more accurately detect phishing threats. He also suggested that risk can be drastically reduced by enabling multifactor authentication for all accounts and offering user awareness training to employees. SOC engineering insights The Manager of SOC Engineering introduced Pondurance’s new dashboard and provided an overview of its many features. The dashboard was built to give analysts a clear view of traffic going through the network sensors and to provide greater insights for clients with network sensors. Dashboard features include details and rich data that can help users troubleshoot issues on the network and investigate security issues, all with more than 30 different modules relating to various protocols. For example, the dashboard has a domain name system (DNS) lookup that shows DNS requests, the DNS response, and SSL certificates; connections that let users see how much traffic is transmitted; status codes that display what is in the HTTP request header; and much more. As an extension of a discussion from the July SOC webinar , the Manager of SOC Engineering reviewed how the SOC team, working closely with the DFIR team, uses encounters from attacker-in-the-middle phishing and business email compromise cases to understand the context of a threat and compute a risk score. From there, the team is able to escalate threats based on that risk score to keep clients better protected. As always, the team asks clients to share their “crown jewels,” including important hosts, significant IP addresses, VIP lists, honey tokens, and anything distinct to the network that can help it protect against threats. Next month The Pondurance team will host another webinar in September to discuss new cybersecurity activity. Check back next month to read the summary. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Immutable backups help protect organizations from ransomware by preventing backup data from being altered or deleted. Learn why they matter. Cyber101: What Are Immutable Backups, and Why Are They Important? Michael DeNapoli July 29, 2026 Facebook X (Twitter) LinkedIn Copy link A reader asked, “I’m hearing about ‘immutable’ backup. What is that, and why is it becoming so widely advised?” Let’s dive in. Most of us are familiar with backing up important data. We either manually make a copy of that data on removable media or the cloud, or use software to have it happen automatically. This allows for recovery in the case that the original data is deleted, the machine it’s on is no longer usable, or if it gets encrypted by threat activity like ransomware. Many of us are also familiar with the more common forms of backup operations. Full backups do what their name says - all data that is getting backed up is copied over, regardless of if it had been backed up in the past. Incremental backups copy over only files which have been changed since the last time those files were backed up (or the first time they’re seen if they’re new files). Versioned backups retain one or more previous versions of a file for a specific amount of time after they’ve been changed. The majority of common backup tools available on both consumer and commercial markets will support these backup operation types; and in fact many online storage platforms can do versioned backups these days. Immutable backups don’t change these types of backup operations directly, but rather change how that backed up data can be accessed, deleted, or changed. With standard backup tools and methods, anyone with the ability to administer the backup system can delete backups, change them, or stop them from happening at all. This is necessary, as keeping very old data that no longer serves any useful purpose (either because it’s no longer being used, or it’s no longer needed for regulatory purposes, etc.) just means additional expense in the form of used storage space. Immutability is a term used to indicate that something cannot be altered. For example, the past is immutable - nothing that we do can actually change events that have already occurred. In backup technology, immutability means that the data which has been backed up cannot be altered or deleted by anyone except under incredibly specific circumstances. While it is possible to delete an immutable backup, it requires significant levels of administrative authority, and also typically will be time-gated so that the delete operation doesn’t happen for a period of time (e.g. 30 days). This gives backed up data a form of permanence beyond what more traditional backup systems can offer. The reason immutable backups are important is that threat actors have realized that - with enough time and skill - they can corrupt and/or encrypt the backup copies of critical organizational data. Doing so means that the organization cannot restore from those backups, which increases the chance that the organization will pay the ransom the threat actors are demanding to decrypt all the data they’ve encrypted. Threat actors who are financially motivated (which are currently in the majority) are definitely working to do everything they can to ensure they receive ransom payouts, and so corrupting or encrypting backups is becoming a key component of modern ransomware attacks. Immutable backups do have a drawback, however - storage space and the costs associated with it. Because the backups never get deleted except under specific and highly controlled circumstances, pruning backups (removing older/outdated backup copies) to conserve storage space in cloud systems or external storage platforms is not something you can regularly perform with immutable backup systems. Therefore, it’s necessary to allocate much more storage space in whatever platform you’ll use to store the backups, and that means that more budget will have to be applied in order to pay for the additional storage costs. Additionally, the nature of immutable backup solutions also means that extra time has to be spent to manage the backup processes. Pruning is still required, but has to be properly authorized (which is a multi-step and multi-administrator process), and then scheduled 30 days or more in advance. As the pruning window comes around to the present day, additional multi-step/multi-administrator processes have to be performed to authorize the final deletion of the data. While cumbersome, these steps are required to ensure that only the organization’s authorized administrators can ever delete the data - and even then they must work within strict safeguards to ensure it’s not deleted accidentally or by a rogue administrator. Finally, immutable backup solutions do typically cost more than standard backup tools. The price difference is variable depending on the vendor, but in most cases it requires holding the immutable backups in vendor cloud platforms and/or on vendor-provided appliances and storage, so the cost difference can be significant. In summary, immutable backups are a valuable component of the modern ransomware recovery technique landscape. The nature of how they work may make it fiscally or operationally difficult for many companies to implement them, but organizations which have the staff and budget necessary should absolutely bring immutability into their backup tool-kit. About the Author: Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

For this month’s employee spotlight, we spoke with Braden McCann who fell into the cybersecurity industry by accident.|For this month’s employee spotlight, we spoke with Braden McCann who fell into the cybersecurity industry by accident. Meet Pondurance: Braden McCann Pondurance June 10, 2021 Facebook X (Twitter) LinkedIn Copy link For this month’s employee spotlight, we spoke with Braden McCann who has helped our healthcare customers at Pondurance for almost four years. What led you to your career choice in cybersecurity? I ended up in technology somewhat by accident. I studied biology and math as an undergraduate with the intention of going to medical school. I had no idea at the time I would end up working closely with healthcare in an entirely different capacity. While in college, I worked for a small, local IT company — starting out with basic help desk and hardware repair and eventually getting into some larger projects and server administration. After graduating, I decided to stay on the technology path and got a job working for a division of Jack Henry & Associates that was responsible for network infrastructure and security. That was around the same time that I met Landon Lewis, Pondurance’s Chief Technology Officer, and really liked what he was doing at Pondurance. I continued learning more about cybersecurity at Jack Henry and worked on my MBA in the evenings. After a few years, I had the knowledge and confidence to ask Landon for a job so that I could be on the cutting edge of the industry. I haven’t looked back since. What is a typical day like for you? Every day is different, thankfully. It’s always a juggling act of planned meetings, unplanned meetings, and trying to stay on top of communications and contracts in between. Most of my clients and prospects are in a state of constant change, much like the security industry itself. We work with clients on an ongoing basis to reduce risk as their technology and business processes evolve. Many organizations are undergoing their own version of the digital transformation, which includes meaningful impacts to their security postures. I help align the right Pondurance expertise and solutions to those challenges for both new and existing customers. What is your proudest accomplishment in your career to date? My proudest accomplishment has been our work with healthcare organizations in Indiana. As we have all been recently reminded, healthcare is a vital industry that we all need to function well. Healthcare delivery organizations are tasked with an incredibly important and challenging role and rely heavily on technology to perform it. Hospitals can’t tolerate any downtime without potential risk to patients and even population safety. They have plenty to worry about without worrying about ransomware, business email compromise, regulatory fines, reputation damage, etc. I’m proud to have put together a promotional program for healthcare that numerous hospitals have taken advantage of that has allowed them to offload their security concerns to us in a cost-effective manner so they can focus on patient care. What advice have you been given that stuck with you? You have to be empathetic to be good at sales. If you are genuinely empathetic to your prospect and/or customer’s needs, and you understand the use cases and limits of your solution, then everything else will follow. When you care, you listen well. When you care, you ask good questions and immerse yourself in their world. In cybersecurity, we sell to very intelligent, very sophisticated buyers who can pick up on how invested you are in helping them solve their problems and how well you actually understand the problem, which matter a lot in a long-term strategic partnership. What advice would you give to others looking to enter the technology field? Develop a mindset of lifelong learning. This is applicable in every industry, as few to none are static, but is especially true in cybersecurity. The technology landscape changes quickly and so does the threat landscape. The number of security tools, services, vendors, and frameworks has grown and evolved rapidly. Educating customers and prospects is a key part of the job so you have to set time aside every day to stay on top of changes and understand how your peers are responding to them. Interested in joining the Pondurance team? View our current openings! Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Threat actors are blending in with legitimate tools. Discover the latest DFIR findings, critical vulnerabilities, Patch Tuesday updates, and DRM insights. July Cyber Threat Download™ Pondurance July 20, 2026 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. DFIR insights Threat actors are opportunistic and stealthy, and recently, the digital forensics and incident response (DFIR) team has seen threat actors doing an even better job of blending into environments. Threat actors are avoiding the use of custom malware and instead using living-off-the-land attacks where they abuse legitimate tools that are already in the environment to gain access. Tools such as ScreenConnect, AnyDesk, TeamViewer, and Splashtop — common technologies that organizations use — are a few of the favorite tools threat actors repurpose for malicious use. Also, they often install and use their own versions of these tools in the attacks. The team discussed how remote access tools are used in almost every case where a threat actor obtains unauthorized access and suggested ways to strengthen the change control. Organizations may want to require approval and documentation to deploy or use remote access tools in an environment and should periodically validate deployed tools against approved inventories. Also, organizations should maintain an approved software inventory. In the inventory, they should track authorized remote access and administrative tools, document approved versions and deployment methods, and be sure to remove any tools that they no longer need. Notable vulnerabilities As many as 6,984 newly disclosed vulnerabilities were reported in May, and the team expects that number to rise to over 7,000 next month. Of those 6,984 vulnerabilities, there was known exploitation of 41 of them, including Microsoft, Adobe, Cisco, and Palo Alto. Online proof-of-concept codes were made available for 32 of the vulnerabilities, increasing the likelihood that threat actors will exploit the products. As monthly trends, the team discussed the large number of vulnerabilities and proof-of-concept codes available. Threat actors are now using artificial intelligence (AI) to look for vulnerabilities, which drives the numbers up, and the availability of online proof-of-concept codes lowers the barrier for threat actors exploiting the vulnerabilities. The team also sees a continued exploitation of old vulnerabilities, particularly healthcare and manufacturing clients that run older operating systems that can't be patched. These clients need to carefully consider alternative ways to protect against exploits. The team highlighted the Palo Alto vulnerability that was added to the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities Catalog on May 6. The vulnerability impacts specific PAN-OS versions including the PA-Series (for a hardware-based firewall) and VM-Series (for a virtual firewall), but Panorama, Prisma Access, and Cloud Next-Generation Firewall were not impacted. The exploit is a buffer overflow vulnerability with out-of-bound memory writes, which is a coding error that occurs in the user-ID authentication portal. For the exploit, the portal and any response pages must be enabled and reachable from the public internet. A China-backed threat actor group first exploited the vulnerability in April. Threat actors gained access and carried out tasks, such as sending messages and deleting files, to cover up evidence of the exploit. Following that, they executed active directory enumeration and dropped products that allowed them to tunnel from the compromised system to their own control server to connect the systems and circumvent any firewall block that would stop the inbound connection. The exploit was especially difficult because the threat actors used legitimate open-source tools to connect to their infrastructure and conducted their interactive session over weeks rather than hours, making automated alerting less likely. The team recommends that clients read the security advisories for the firewall patch carefully before applying it. Also, mitigation steps may be necessary before fully patching the device because applying a firewall patch can be a lengthy and involved process that requires approvals, scheduling a maintenance window, sending notifications, and downtime. During Microsoft Patch Tuesday in May, as many as 130 reported vulnerabilities were addressed with 30 critical vulnerabilities and no zero-day exploits. Then, during Microsoft Patch Tuesday in June, 206 reported vulnerabilities were disclosed, including 37 critical vulnerabilities and three zero days. The team recommends that organizations apply timely patches following the Microsoft Patch Tuesday announcements. DRM use Companies that produce digital products and services need to control access to their intellectual property and copyrighted materials. Digital rights management (DRM) is a collection of technologies used to control access to digital content, including copying, sharing, printing, and distribution. Azure Rights Management, Google Workspace DLP, and Denuvo are a few of the many products that provide DRM principles and capabilities. As an example of DRM use in the PC video game industry, the team discussed how Denuvo makes video games difficult to pirate. Denuvo uses four stages to safeguard products: a hardware check to verify a legitimate user, cold encryption to prevent reverse engineering of the code or bypass of the antitampering protection, code obfuscation to make it difficult to analyze a game's code, and dynamic code decryption to protect the code using a unique key. But DRM is different from encryption alone. Encryption answers the question, "Can you get in?" DRM answers the question, "What can you do once you are in?" Encryption focuses on data that is in transit and at rest. It scrambles data so only someone with the correct key can access it. After access, DRM steps in, placing cryptographic controls on the file or data to restrict what the user can do with it. DRM technologies follow several key security principles: Authentication - Verify who the user is. User restrictions - Determine what the user has permission to do with the information. Limit actions - Keep users from performing actions that they don't have a right to do, such as copying and pasting or taking screenshots. Track activity - Know who opened a file, when it was accessed, and what actions were taken. About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our SOC, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Explore the evolving landscape of cybersecurity in 2026, focusing on AI, cyber insurance, and adversarial tradecraft that shape future risks and responses. A Perfect Storm: Cyber Predictions and the Pursuit of Resilience for Mid-Market Organizations in 2026 Doug Howard January 5, 2026 Facebook X (Twitter) LinkedIn Copy link 2026 is the year of the perfect storm for cybersecurity leaders. Multiple factors will collide, creating conditions that amplify risk, compress response timelines, and raise expectations across the board. Four forces, in particular, are shaping outcomes. First, adversarial tradecraft continues to evolve at a speed we’ve never seen before. Second, artificial intelligence is accelerating both offensive and defensive capabilities. Third, cyber insurance is increasingly shaping how security programs are designed and justified. Finally, regulations are becoming more specific, more enforceable, and based less on assumptions. Midmarket organizations that understand and apply foundational principles to their cybersecurity program will be best prepared to ride the waves of volatile change—and even come out ahead. Achieving cyber resilience will depend not only on a broad detection and response framework, but also on having an experienced 24/7 operations team to ensure rapid, intelligent response to advanced threats. Rapid Evolution of Adversarial Tradecraft Threat actors act faster, smarter, and with greater impact than ever before. The time between vulnerability disclosure and exploitation has collapsed, especially for identity systems and internet-facing infrastructure. What once took months now happens in days, and in some cases hours. As a result, organizations are losing the luxury of slow detection or delayed response. Another issue is the unidentified and unexploited vulnerabilities that will now be uncovered continuously. At the same time, attacks are no longer isolated events. Modern intrusions are typically multi-staged and tightly coordinated. A phishing email leads to identity compromise, which enables access to cloud environments and ultimately results in data theft, extortion, disruption, or the big bad ransomware. Compounding the problem, advanced techniques are becoming commoditized. Capabilities that once required elite expertise are now embedded in readily available toolkits, expanding the pool of effective adversaries. Ransomware and Extortion Continue to Evolve Ransomware illustrates this shift clearly. Encryption alone is no longer the primary objective for threat actors; rather, it’s the first step. Most malicious campaigns now combine data theft with operational disruption, using regulatory exposure, reputational damage, and downtime as leverage. Attackers are increasingly selective, targeting organizations with weak identity controls, insufficient backup strategies, or untested incident response processes. Third-party access paths, including managed service providers and SaaS administrative privileges, remain particularly attractive because they offer scale and are trusted. Identity and the Cloud Are the Primary Battlegrounds Identity and cloud environments sit at the center of this activity. Identity-based attacks now dominate breach paths, whether through token theft, MFA fatigue, or social engineering of support teams. In cloud environments, risk has moved beyond basic misconfiguration toward excessive permissions, privilege escalation, and lateral movement. A survey by Cisco’s identity technology service Duo found that nearly 70% of IT and security leaders say they “lack full insight into identity vulnerabilities.” According to Duo, this may indicate significant weaknesses in organizations’ cybersecurity postures because “unseen identities and privileged accounts are high-risk blind spots.” Pressure Mounts across SMB and Mid-market Organizations These pressures affect organizations of all sizes. Attackers still prefer high-return targets with limited security depth, but the broader implication is that continuous detection and response is becoming an expectation rather than an enhancement. Cyber insurance carriers, regulators, and customers increasingly demand that security operations run around the clock. AI as an Offensive and Defensive Force Artificial intelligence accelerates the speed with which adversarial attacks evolve. According to Team8’s 2025 CISO Village Survey , 25% of CISOs said they experienced an AI-generated attack within the past year—a statistic that most likely does not fully represent the true number of AI-driven threats. AI enables social engineering campaigns to become more convincing and scalable. Attackers use AI to personalize messaging, adapt tone and language, and embed realistic business context. Voice and video impersonation introduces new risks to financial approvals and IT workflows, reducing the reliability of traditional verification processes. AI also shortens the path from discovery to exploitation. Automated reconnaissance, configuration analysis, and exploit adaptation reduce friction across the attack lifecycle. Malware development and intrusion techniques benefit as well, allowing lower-skill operators to achieve outcomes that once required significant expertise. AI on Defense On the defensive side, AI offers meaningful advantages when applied carefully. It can accelerate triage by summarizing incidents, clustering alerts, and highlighting likely next steps. It can assist detection engineering by helping teams normalize data and refine hypotheses. It can also enrich threat intelligence, making it easier to connect activity across campaigns and environments. AI will continue to evolve as a defensive tool beyond monitoring and alerting into an active, infrastructure-orchestrated response. The Human + AI Operating Model However, AI does not remove the need for human judgment in most cases. Hallucinations during investigations can mislead response efforts. Overconfidence in vendor claims without measurable outcomes introduces blind spots. Poorly governed prompts and integrations create new data exposure risks. For these reasons, the most effective operating model is one where AI amplifies human analysis rather than replaces it—a model that will be critical for security operations centers (SOC) in 2026. “AI-powered cybersecurity tools alone will not suffice,” says Michael Siegel, director of cybersecurity at MIT Sloan . “A proactive, multi-layered approach—integrating human oversight, governance frameworks, AI-driven threat simulations, and real-time intelligence sharing—is critical.” This human element matters even more as incident response and digital forensics (DFIR) increase in importance. When an event occurs, organizations need experts who can interpret evidence, assess material impact, coordinate response actions, and communicate clearly with legal teams, insurers, regulators, and executives. Automation accelerates response, but accountability and decision-making remain human responsibilities. Cyber Insurance as a Security Driver Cyber insurance continues to influence security programs because underwriters increasingly demand proof rather than promises. Claims experience is driving tighter coverage definitions, higher retentions, and broader use of sub-limits, particularly for ransomware, extortion, and incident response costs. Currently, looser-than-normal standards and low premiums are creating an extremely competitive market for cyber carriers; however, this will normalize over time as conditions for new policies and renewals tighten, and claims rates continue to increase. This will result in higher premiums and tighter approval requirements to cover the increased claims. Market signals already reflect this shift. Capacity is being reassessed, underwriting scrutiny is increasing, and baseline control requirements are becoming non-negotiable. Insurer Beazley is reported to be reducing its U.S. cyber coverage due to increasing claims and falling policy prices. Beazley’s goal is to maintain underwriting discipline and rate adequacy, even amid unsustainable rates in the cyber insurance market. In 2026, buyers will need to treat insurance questionnaires like audits. Security, risk, and finance teams must collaborate earlier on policy language, claim scenarios, and renewal readiness. Continuous control validation becomes both a competitive advantage and a prerequisite for coverage. This will also further define requirements for not just specific technologies, but for specific vendors and validated deployments. Regulation and Its Ripple Effects Regulations, such as PCI, HIPAA, and CMMC , as well as those in most U.S. states and territories, are slowly but surely evolving—although they struggle to adapt quickly to meet new security threats. That being said, regulators have more specific requirements, more predictable enforcement, and a greater focus on proof of execution. PCI DSS 4.0.1 , for example, became enforceable on March 31, 2025. The new rules include expanded MFA requirements, updated password rules, and new requirements that address anti-phishing threats. In the face of increased enforcement, organizations must demonstrate governance, incident reporting readiness, third-party risk discipline, and secure cloud and software practices. Boards will demand clearer visibility into cyber risk. Organizations must formalize risk acceptance and measurement. Incident reporting obligations will drive improvements in logging, retention, and response playbooks. Vendor oversight must expand through contractual requirements and continuous monitoring expectations. While compliance does not equal security, regulatory pressure often unlocks funding for foundational controls. Mature organizations treat compliance as a baseline and build operational capability above it. A Return to First Principles To navigate this perfect storm, organizations must return to basics. Rick Howard , author of Cybersecurity First Principles: A Reboot of Strategy and Tactics , captures the objective succinctly. Organizations of all sizes must “reduce the probability of material impact due to a cyber event over the next three years.” From this perspective, progress does not start with buying more tools. It starts with understanding what you already have. Organizations must assess and inventory their information technology (IT) infrastructure to understand what they have and if they are capable of protecting it. They must identify where their most critical data and systems—their crown jewels—reside, because not all assets carry equal risk. Next comes optimization. Many organizations already own sufficient security technologies, but have not fully implemented or operationalized them. Improving configuration, coverage, and day-to-day use often reduces risk more than purchasing something new. For instance, we find the majority of organizations we work with can significantly improve their cybersecurity posture by auditing and updating their Microsoft 365 configuration. Finally, there is the reality of continuous operations. Even well-configured environments will experience failures. Reducing material impact requires the ability to detect threats quickly, respond decisively, and recover efficiently. That capability depends on a 24/7, human-led, AI-enabled security operations model that combines automation with expertise. It also depends on access to experienced digital forensics and incident response professionals who can guide organizations through high-pressure moments with clarity and discipline. The Cyber Storm of 2026 It’s hardly a prediction, but rather a logical forecast to say 2026 will have several major global cyber events. While significant events occurred in 2025, we can assume that more and higher-impact cyber threats will drive major industry and global technology outages in 2026. Now, to guess what major events will occur, let's try a little predictive crystal-ball sorcery and watch for the following: At least one cloud service provider disruption will cascade across industries, not because of a single exploit, but due to a compound failure: identity compromise, misconfigured automation, and delayed human response. The outage will last 24 hours or longer, not mere minutes. We’ll see a supply-chain attack that bypasses traditional malware defenses entirely, leveraging legitimate software updates and signed binaries while abusing OAuth tokens and API trust relationships. We’ve already seen small instances of this in the wild. A major AI issue will be detected in at least one LLM, causing trust issues in the business applications built on that platform. It’s also likely that an outage to a major LLM will have businesses rethinking single-vendor strategies—much like we’ve seen with cloud and other infrastructure dependencies. Ransomware will continue, but the defining shift will be data manipulation over data destruction—quietly altering backups, logs, and transactional records weeks before detonation. Organizations will discover the breach only when restoration fails, not when systems go dark. Finally, regulatory pressure will spike after a highly visible breach exposes how few organizations can clearly articulate what happened, when, and why. This demand for change will most likely be driven by individuals and small businesses unable to access their own financial funds. AI will be at the center of this issue in some way. The storm forming ahead will not be solely addressed with technology. Rather, CISOs and their information security teams must combine human wisdom with tools and software to successfully address complex operational challenges with clarity, focus, and execution. Midmarket organizations that ground their programs in fundamentals, strengthen the human element within their organization or through trusted partners, and invest in continuous readiness will be best positioned to withstand what’s coming. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

October Cyber Threat Download™ Pondurance October 29, 2025 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. Social engineering scams Social engineering scams, such as phishing, are on the rise. The digital forensics and incident response (DFIR) team shared techniques that threat actors use to deceive targets and the classic signs that clients should look out for. These include: Unsolicited requests for credentials or multifactor authentication codes, particularly urgent ones. Calls from a familiar caller ID. A generic greeting with no specific last name or a skipped introduction. Suspicious links to a login via phone or email. Calls to personal cell phones. Unexpected calendar invites. The team also explained how threat actors are conducting reconnaissance to know exactly who they need to target, obtain cell phone numbers, and learn personal details to convince targets to take a specific action. The team discussed a DFIR investigation where John from the bank fraud division placed phone calls to two targeted employees that ultimately resulted in 11 fraudulent wire transfers totaling $1.9 million. The exploit used reconnaissance tactics and many of the classic signs of social engineering. Clients need to recognize these classic signs and stay vigilant. Alert volume The security operations center (SOC) handles a large volume of alerts. During the first three weeks of September, the SOC team worked through approximately 11,000 individual alerts across all client environments! Less than 10% of the alerts resulted in escalations. The team discussed how it minimizes the volume of alerts and reviewed the preventative controls clients can use to minimize their risks. Team members rely on feedback loops with clients. First, they raise a finding in the Scope tickets. Then, they follow up or, in an escalation, include a question to confirm what they re seeing, such as: Is this something we can expect to see for this user? Or is this application permitted in your environment? The answer from the client allows the team to fine-tune its detection rules. Once the team tunes the alerts, it knocks down the volume, allowing time to focus on meaningful escalations and detections and conduct in-depth hunting and analysis. The team also relies on log information; improvements in its rule logics and tactics, techniques, and procedures; and rule logics enhancements by third-party vendors of endpoint detection and response (EDR) solutions and antivirus software. Clients can help minimize the alert volume in numerous ways: Patch management. Keep applications and software up to date, maintain an asset inventory, run periodic vulnerability scans, and adhere to a patching schedule. Identity and access management. Identify which employees need access to what assets and make sure that access is only given to those employees. Endpoint protection. Make sure that the endpoint protections, such as EDR software, antivirus protection, BitLocker, and FileVault, are up to date. Network security. Implement firewall policies and set up segment critical system networks to keep critical systems within the network separate from each other. Data protections. Employ data loss prevention, access control, and secure backups. User training. Offer ongoing user awareness training to all employees to reduce their risks of error when interacting online. Secure configurations. Disable unused ports and protocols and close doors and windows that are not needed. Application security. Create a list of approved applications, including versions, and keep those approved applications up to date. Notable vulnerabilities Approximately 3,600 vulnerabilities were newly disclosed in August — a dropoff from recent months — and 18 of those disclosed vulnerabilities were actively exploited. Eight proof-of-concept codes were released on the internet, making the information available for threat actors to use to exploit vulnerabilities. As a trend in August, the team saw a combination of end-user applications showing up in vulnerability scans, new vulnerabilities impacting Chromium-based browsers, vulnerabilities on lesser-known products like 7-Zip, and automated scanning tools being maliciously used to search for vulnerabilities. During Microsoft Patch Tuesday in August, 107 reported vulnerabilities were addressed. Of those 107, 13 vulnerabilities were critical, and there was one zero day that was a privilege elevation vulnerability. Multiple patches were released for the affected products. The team briefly discussed two of the critical vulnerabilities: Citrix NetScaler and Gateway appliances . This memory overflow vulnerability exploited preauthentication remote code execution on specific versions of NetScaler ADC and Gateway appliances. The vulnerability allows threat actors to drop a web shell to access the device and allow for persistence. Then, they can move laterally, exfiltrate data, and possibly execute a full network compromise. Patching is required since a workaround is not available. WinRAR . This path traversal vulnerability allows threat actors to hide and deploy malicious files as it incorrectly handles the ../ in file names. The exploit, used by Russian group RomCom, starts with a phishing email from a supposed job applicant that includes an RAR attachment disguised as a resume. Once the email recipient opens the attachment, a malicious shortcut file is placed in the Windows startup folder. Then, other files are placed in temporary directories where they’re unlikely to be found. Execution chains of this vulnerability were first observed in mid-July, including the Mythic command-and-control agent, SnipBot backdoor, and RustyClaw downloader, all of which involved the LNK file. During Microsoft Patch Tuesday in September, 84 reported vulnerabilities were addressed, a downturn from previous months. Of those 84, eight were critical vulnerabilities, and two were zero-day exploits. One zero day was a Windows Server Message Block privilege elevation vulnerability . The other zero day was a denial-of-service vulnerability on Newtonsoft.json, a product that interacts with the SQL server. Microsoft released patches for the zero days and critical vulnerabilities, including Microsoft Office, Windows Graphics Component, and Hyper-V. New asset inventory module The team is always working to improve the process and, starting in October, will add a new asset inventory module in Scope. An asset inventory is the foundation for proactive threat exposure management and will be offered as part of the standard services at no cost. The module provides a centralized, accurate, and risk-rated view of all known assets to help organizations prioritize by asset risk. At launch, the service will be available to clients in the eVMP program and clients with access to CrowdStrike and SentinelOne consoles. The team will integrate with a handful of data providers that will pull in the data, and clients also will be able to manually upload and edit their own asset details, in bulk or individually, to keep the inventory accurate and complete. In the module, clients will see key details, such as asset name, data provider, and risk score, and can click on any asset for deeper context. The drill-down views connect alerts, tickets, and vulnerabilities to an asset to allow clients to see the asset’s history, related risks, and patterns over time. The risk score page includes the components that make up the Risk Score — a proprietary risk scoring mechanism that is calculated using alerts, vulnerabilities, observed threats, and known defenses to give clients a clear, prioritized sense of which assets pose the greatest exposure for the organization. Following launch, the team will continue to add functionality for sidecar agents, motor data sources, analysis workflows, and other automation. The team welcomes feedback from clients on the new module. About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our SOC, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape.  Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Cybersecurity 101: A Spectrum of Threats Michael DeNapoli November 25, 2025 Facebook X (Twitter) LinkedIn Copy link One of the most common questions we get here at Pondurance is, "What kind of threat activity can we protect against?" The question holds more weight than most people think, and is one that more organizations should think about much more often. It's true that not all threats can be blocked, there will always be some forms of threat activity that can slip through even the best defenses. Even so, the vast majority of malicious cyber activity can be blocked from impacting your company. Let's dive a little deeper into this topic using a spectrum - or scale - that was shared with this author many years ago by Allison Giannotto - a.k.a. Snipe of SnipeIT . Allison started out her career as an IT wiz who slowly moved into cybersecurity due to the needs of the company she was working for, and has seen the science of cybersecurity - and the way threat actors work - evolve over the last few decades. During that time, she came to the realization (which others also have arrived at) that not all malicious activity is considered equal. Some threats are much easier to dodge, while others are almost impossibly hard. Working with a limited budget and even more limited staff, she leveraged this straight-forward "1 to 10" spectrum to determine where to assign resources to have the greatest effect on the safety of the companies she worked for. Level 1 - Non-targeted, non-specific "spray-and-pray" email threat: These are the phishing and other forms of threat email we all see on a daily basis. They generally don't even specify their target by name, and use a copy-and-paste method to send the same exact email, SMS, or other messages to hundreds of thousands of people hoping for someone to open the attachment/click on the link. Example: Various phishing emails/texts. Level 2 - Targeted and/or personalized email threats: These can be "spear-phishing" attacks where a threat actor goes after a specific target, or a mail-merge where usernames and real names are inserted into the email or other messaging (SMS, What'sApp, etc.) to make it more likely to get the user interaction they want. Example: Phishing emails which are personalized with information about you or your company. Level 3 - User behavior manipulation: Threat actors purchase space on advertising networks and may even set up fake sites to trick a user into interacting with content that isn't what they think it is. This leads to malicious downloads and other threat activity. Example: "Sponsored" links that lead to pages which contain malicious downloads and/or code. Level 4 - Targeted user behavior manipulation: Much like Level 5, but here the threat actor is specifically crafting these advertisements and fake sites to lure the interaction of specific individuals (business leaders, healthcare professionals, etc.) or industries (legal, retail, manufacturing, etc.). Example: A sponsored link that pretends to be leading to an industry organization website, but instead leads to a credential stealing site. Level 5 - Exploiting known vulnerabilities: Here, a threat actor will create scripting and other automation to attempt to leverage a weakness in an operating system or other software that is well known. This automation lets them try to perform an exploit across thousands of organizations with little effort. The goal is to attack organizations that have not patched critical systems, and use that fact to gain a foothold for further spread within the organization for malicious purposes. Examples: Recently exploited vulnerabilities in hardware from Cisco, Juniper, Windows, MacOS, etc. Level 6 - Exploiting new vulnerabilities: It's possible that a threat actor may discover a vulnerability on their own, meaning that it isn't known to either the vendor of the software that is vulnerable or to anyone else yet. This requires a great deal of both research and luck, but means the attack will have a greater potential for success. Example: The NSO Group and their spyware software which takes advantage of previously unknown weaknesses in mobile phone operating systems to get itself installed. Level 7 - Advanced user manipulation: By combining many of the techniques so far, and adding in hands-on, real-time manipulation, threat actors can actively guide an attack by tricking personnel into performing actions that give the threat actor more access to systems. This can be tricking a help-desk employee into reseting a user password, or tricking a user into installing a browser extension or other software that opens a door into the organization. Examples: The recent threat activities of Scattered Spider, Shiny Hunters, etc. Level 8 - Exploiting inertia, process, and people directly: Threat actors can discover that outdated process and procedure have opened gaps in defenses around an organization - such as very weak Identity and Access Control. A business process that has not been able to modernize brings continued use of outdated systems along with it, which may have weaker overall controls and defenses that a threat actor can take advantage of - such as reliance on very old software. Example: Most supply-chain attacks, where the software or other solutions being perceived as "safe" led to weak security controls around said software. Level 9 - State-sponsored threat activity: When the unlimited budget and manpower of a nation or nation-state are brought to bear, few organizations can actually stop threat activity created by that actor. Nation-state threat actors can use hundreds of techniques and tactics over weeks or months to slowly chip away at defenses and find a way in to even the most secure organizations when neither time or money is a factor. Example: Stuxnet [[ https://en.wikipedia.org/wiki/Stuxnet ]]. Level 10 - Internal collusion: If one or more key personnel are on the payroll of the threat actors, then any defenses in place can simply be shut off, allowing for complete and total access to the organization. This also applies to collusion involving vendors and organizations who aren't part of your company, but instead sit between your company and the outside world - such as mobile carriers and device manufacturers. Example: The various actions of world governments working directly with mobile service providers . So how can you defend against all of these things, and should you? For Level 1 to Level 4 threats, everyone - companies and individual people alike - can and should defend against these types of threat activity. Learning to spot phishing and other forms of social engineering, keeping an eye out to ensure the site you're landing on is indeed the one you wanted to visit, and combining these methods with basic cybersecurity controls like anti-malware tools and a good email service provider can overcome these types of threats. It's still very possible one of these attacks will slip past one defense (like social engineering training), but it can then be caught by other layers. Especially for companies, layered defenses are critical in deflecting these types of attacks. User education combined with endpoint, network, and email security can allow for one layer to catch things if any other layer should fail. Layer 5 is where we begin to get into things that are generally handled at the company level - much more so than what an individual would have at home, for example. A comprehensive and well-prioritized vulnerability management program will allow the organization to recognize vulnerabilities that can be exploited to allow access to critical systems, and corporate policies to allow patching and upgrading when required combine together to add an additional layer of defenses. Managed Detection and Response (MDR) systems - like Pondurance - can be extremely helpful here. By looking for evidence of attempts to perform unusual or outright malicious actions (such as the steps required to exploit a vulnerability suddenly starting to get played out), MDR solutions can raise alerts to investigate - and help in the mitigation of - potential and actual threat activity. Layers 6 and 7 are where we talk about organizational policy and protocols being critical to defeating these forms of threat. Technology alone can't compensate for these forms of threats because they're either unknown vulnerabilities (and therefore there are no patches to apply), or the attacks rely on non-technological methods to work (like tricking IT employees into resetting passwords). Well-defined policy and procedures allows for these attacks to be detected through blocking inappropriate actions and/or quickly recognizing unusual behaviors and activities across the organization. MDR solutions can be a huge benefit here as well - identifying multiple events that add up to threat activity when seen a a collective group, even if any individual event might seem benign on its own. Layer 8 is all about not being stuck in a rut by inertia. "We've always done it this way," is a refrain that has led to more successful attacks than I'd care to count. People and process must evolve over time in the same way as technology does. If it doesn't, then an outdated way to manage user access can easily be leveraged by a threat actor to wedge open a digital door into the greater data-systems of the organization itself. Advisory services and regular assessments can identify when inertia is beginning to cause security holes to open up. Layers 9 and 10 are rarely defendable against - but are also exceedingly rare to ever encounter. A threat actor with a virtually unlimited amount of money and man-hours will find a way around defenses, policy, and procedures eventually. They simply have more than enough time and the necessary amount of people for more than enough effort to get through in the end. Collusion takes all of your defenses out of the equation entirely, opening the door to whatever the threat actor wants to do. The most common examples of this level of threat activity are digital warfare events like Stuxnet , and the various governmental agency agreements with mobile carriers exposed by Edward Snowden . These events were impossible to avoid entirely, but also so extremely rare that they were unheard of entirely before they occurred. Proper damage control plans and recovery methodologies are the only thing that organizations can do to ensure they can stay in business if/when they are impacted by one of these events - but the likelihood they ever will be impacted by one of these events is so low that 99% of organizations will never encounter them. Organizations cannot protect against every form of threat activity - nor can they entirely avoid being impacted by malicious actors. Even so, there are effective methodologies to prevent, limit, and derail threat activity in nearly every case. Knowing the spectrum of threat activity is a great first step into devising a plan to defend against it. About the Author: Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Organizations are facing increasing cybersecurity challenges. Learn why you should consider and MDR to help solve cyber pain points. Organization Pain Points: Why Look For an MDR? Pondurance February 24, 2022 Facebook X (Twitter) LinkedIn Copy link Cybersecurity is an increasing concern for organizations worldwide. In the PwC 25th Annual Global CEO Survey , CEOs ranked cyber risk as the No. 1 threat to growth, with healthcare close behind. Like many organizations, your company may find it challenging to fully implement or improve the comprehensive security coverage it needs to stay protected. But there are ways to address cybersecurity challenges head-on. In Chapter 3 of our new eBook Managed Detection and Response (MDR) for Dummies , we examine some common problems organizations face when trying to strengthen their IT security posture and how MDR often can resolve these problems. The challenges typically fall into two broad categories: organizational and technical. We dive into both categories to help you better understand the right solution for your business. Organizational challenges Having the right cybersecurity people to do the job is of utmost importance. More than 1 million people are currently employed in the U.S. cybersecurity workforce, but nearly 600,000 cyber opportunities remain open, according to Cyber Seek . The weighty demand for talented cybersecurity professionals has created many organizational challenges including: Building the security operations team. Lack of workers makes it difficult for organizations to build and keep in-house cybersecurity teams. We explain how the talent shortage is affecting businesses, particularly small to midsize organizations, and why MDR is an obvious solution. Meeting compliance and regulatory requirements. Regulations aren’t only for the financial services and healthcare industries. Legislatures enact new cyber laws and requirements each year, creating a need for additional workers who can keep companies in compliance. We briefly discuss these laws and requirements, including which industries must comply. Documenting processes during an attack. As part of operations management, you need to document incidents and learn from them. We outline the two primary hurdles that prevent organizations from implementing proper incident reporting procedures and explain how MDR can help you clear those hurdles. Technical challenges Modern cybersecurity tools are expensive, are tough to manage, and aren’t capable of doing what humans can. We detail a few common technology pain points and discuss the actions you can take to overcome these disadvantages: Security tools are hard to maintain. They can be difficult to deploy, integrate, operate, and maintain, and certifications are often needed to use them. However, MDR can provide these complex tools and the expertise required to put them to work. There’s a lack of visibility. Bad actors constantly find new ways to penetrate and control internal systems like yours. You need visibility across all organizations and tools to see the big, obvious problems and the small, unexpected ones. We discuss the three primary reasons why visibility is crucial yet so difficult to attain. Technology alone can’t deter attackers. Without human intervention , cyberattackers will work around your defenses. That means you need talented people as the foundation of your defense. MDR providers combine modern technology and human ingenuity to defend against attacks. Your company may face operational and technical cybersecurity challenges when trying to strengthen its IT security posture, but there is a solution. Learn more about these challenges and discover how MDR can provide the cyber talent and tools you need to stay protected. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Explore risk-based Managed Detection and Response | Experience 24/7 proactive cybersecurity with Pondurance. Ready to get started? Find out how Pondurance can eliminate breach risks with a quick, personalized demo. We promise, no hard sell. First name Business Email Last name GET A DEMO By submitting this form I agree with the Pondurance Terms of Use and Privacy Policy We will never sell your data SEE WHAT TO EXPECT HOW IT WORKS Pondurance has your back from Detection through Response Rapid Risk Assessment Identify your organization’s most critical assets and highest risk threats to pinpoint and prioritize quickly eliminating high risk exposures. Explore our process » Dynamic Defense Methodology We implement security controls and detection mechanisms that prioritize your unique risks and assets, with 360 visibility and 4D detection. Response & Recovery We start with rapid and accurate threat detection. Then isolate, contain, or disrupt imminent threats to stop breaches before they happen — with typical time to remediation under 15 minutes. 24/7 Threat Monitoring Our expert SOC analysts continuously monitor threat alerts, stay apprised of current threat trends, and continuously analyze world-class threat intelligence to stay ahead of emerging cyber threats. Not sure what you need? Download our Ultimate Guide to MDR READ FREE GUIDE HOME / SOLUTIONS / MANAGED DETECTION AND RESPONSE (MDR) MANAGED DETECTION & RESPONSE (MDR) Human judgement, at AI speed. Fully managed 24/7 detection and response for the agentic era. Pondurance MDR delivers a world-class SOC for an exceptional value — starting at $4.42/endpoint. SPEAK WITH AN EXPERT BUILD A QUOTE » See what our customers are saying 4.6 / 5 on Gartner Peer Insights 4.7 / 5 on G2 RISK-BASED MANAGED DETECTION & RESPONSE Stop breaches before they start with smart software and even smarter humans Your attack surface is expanding and becoming more vulnerable. Data breach risks are rising every day and your team feels the heat. Mid-sized organizations like yours are prime targets. Today’s cyberattackers aren’t only interested in capturing sensitive customer data like PII and PHI to monetize it. With ransomware on the rise, threat actors may aim to completely disrupt your ability to operate, shutting down your ability to deliver products and services for days — or even weeks. Pondurance MDR solutions is a proactive service to eliminate breach risks by stopping attacks before they can cause harm. Led by our experienced SOC analysts and powered by our best-in-class cloud-native Platform, we complement your existing security tools, technologies and resources to rapidly detect, validate, and remediate threats to protect your organization from risks and harm. 50% of all organizations will use MDR services by 2025 — Gartner Challenges & Pain Points Shortage of security talent makes internal resources expensive to hire and retain People matter — Technology alone cannot stop a motivated human attacker Data breach risks are rising every year, and it’s no longer just PII and PHI that needs protecting Regulatory, reputational and financial harm can be devastating — especially for vulnerable small and mid-sized organizations How Pondurance MDR Can Help Eliminate breach risks through always-on detection and response technology and SOC Integrate with your existing cybersecurity tools and people Demonstrate compliance with board level reporting Accelerate maturity of your security posture through continuous improvements PONDURANCE MDR FEATURES Technology and Human Intelligence working together 360° Threat Visibility 24/7 Threat Hunting Incident Response + Recovery 24/7 U.S.-based SOCs Reporting Risk Assessment 360° Threat Visibility Get total visibility at-a-glance. We partner with best-in-class EDR tools and ingest telemetry from all sources: endpoint, network, identity, cloud, app — even IoT. Keep tabs on AWS, Azure and Google Cloud environments with log and packet analysis via our Network Sensor. Our consumer-grade portal puts all your data, dashboards, analyses, alerts, and communications with the Pondurance SOC at your fingertips. WHY PONDURANCE Pondurance is the only MDR solution built to eliminate breach risks Consumer-class user portal Track tickets, view real time metrics, and collaborate with SOC analysts through a single, streamlined and intuitive user interface. With a glance at your dashboard, you’ll see the most relevant information about your networks. Speed of implementation Get up and running fast. Pondurance integrates with your existing security stack, minimizing downtime and disruption. We can meet you where you are in your cybersecurity journey, and adapt or scale our services as your needs mature in the future. Visibility across entire attack surface Get 360-degree visibility in our consumer-grade user portal. Ingest data from your entire attack surface — endpoints, network, identity, apps, cloud, and IoT — and view it in one centralized dashboard. Access to trusted advisors Our trusted security advisors can round out any gaps in your internal security resources. From a virtual CISO to our expert analysts and threat hunters, we work alongside your security team and counsel to provide personalized guidance, proactive insights, and 24/7 threat response. Proprietary risk analytics Cut through noise to surface the highest-risk threats first. As a modern MDR solution, Pondurance correlates telemetry across your environment with global threat intelligence to better validate and contextualize alerts. Integrate with existing infrastructure We believe you shouldn’t have to throw out existing tools and teams. Our team integrates your tools and technology with our platform to assure that there are no security gaps and no inefficiencies from overlapping capabilities. GET A FREE 30 MIN DEMO REAL CUSTOMER STORIES See what happened when… Threat actors gained entry to a U.S.-based healthcare organization’s shared human resources account using compromised user credentials. REAL CUSTOMER STORIES “Pondurance provided an all encompassing MDR solution in a cost effective package that gives us peace of mind as a true extension of our security staff.” — Manager of IT Operations and Security, Insurance REAL CUSTOMER STORIES “For a midsized organization, Pondurance MDR services play a crucial role in bolstering the capacity of security teams.” — Manager, IT Security and Risk Management, Retail REAL CUSTOMER STORIES “They immediately proved their value and earned our trust due to their immense expertise and guidance throughout the entire process.” — Steve Long, CEO, Hancock Health REAL CUSTOMER STORIES See what happened when… A large hospital’s system was infiltrated as a result of search engine optimization (SEO) poisoning and a remote access trojan went undetected by EDR. STILL HAVE QUESTIONS? Check out these Frequently Asked Questions Frequently asked questions Comparison campaign Arctic Wolf PHI FAQs General 1. Is alert triage purely automated — or does a human SOC analyst add insight? Every alert in the Pondurance platform is reviewed and triaged by a certified, U.S.-based SOC analyst who understands your unique risk profile and then works directly with your team. Automation supports our process — but real humans add the insight and context needed to reduce false positives and alert fatigue. 2. What happens when a threat is detected in your environment — and how fast? When a threat is detected, our SOC analysts jump into action. We immediately validate the threat to minimize false positives, contextualize it based on global threat intelligence, prioritize it based on your unique risk, and take immediate action to disrupt and contain it when possible. Then, we alert your team with actionable next steps. Unlike some providers, we don’t just send alerts — our SOC analysts help your team contain and resolve threats in real time. 3. Will you have direct access to dedicated U.S.-based SOC analysts? With Pondurance, you interact directly with the certified SOC analysts who are monitoring threats to your environment 24/7. They’ll get to know your name, your business, and your unique risk profile. While a “concierge” model sounds nice, it's really just a way to reduce the number of certified analysts and reduce the ratio of SOC analysts to customer accounts. 4. Can the vendor support your overall compliance and risk management needs? Pondurance was built to help mid-market organizations who handle PHI and PII meet all their cybersecurity needs and regulatory requirements, without straining internal resources. These organizations need more than MDR for threat detection, analysis and remediation and top-tier digital forensics and incident response (DFIR). Our full suite of advisory services — including risk assessment, penetration testing, compliance audits, and more — ensure you can eliminate risk efficiently and effectively, with one trusted provider. 5. How do you ensure you’re not overpaying for capabilities you don’t need? Pondurance tailors your solution based on size, risk, and existing tools you’re already using. Our flexible, volume-based pricing means you only pay for what you need — not bloated features you’ll never use. Unlike some providers who will sell you a one-size-fits-all “black box” MDR. Our platform includes unlimited user seats, your team can scale and collaborate freely — without tracking licenses or worrying about rising costs. STILL HAVE QUESTIONS? Check out these Frequently Asked Questions How do we get 24/7 coverage from your managed detection and response services? Pondurance’s security analysts are U.S. citizens based in the U.S. We work in shifts to operate 24/7. Our security operations centers are powered by highly skilled analysts, threat hunters, and incident responders that are always available to respond. We know it’s difficult to find and retain the right security talent, but we are able to compete for the best talent in the industry. We make our experts available to you with our services. Why should I choose Pondurance MDR over other services? There are many providers on the market and many options when shopping for a cybersecurity solution. With Pondurance MDR: Your data is your data, you have full access to it at all times. This means you get access to the same SIEM tools as our analysts. We provide guided personalized recommendations tailored to your specific cybersecurity needs, we’re not one size fits all! All of our analysts are US citizens and our SOCs are based in the US. Your data will never leave the US border. Our strong cybersecurity consulting practice enhances your MDR because we know the difference between compliance and security. We integrate with your existing security control investments so you don’t need to rip and replace! We will also provide end-to-end management of leading endpoint detection and response platforms, like Crowdstrike and SentinelOne. If you want more information on how we can fit with your current set up, reach out to us to talk to an expert, no hard sells. We promise! How long does MDR take to implement? We know that you want to get up and running with managed detection and response quickly! Once you sign up with us, you will be assigned to one of our implementation teams with both project management and technical professionals. They will quickly and efficiently get you up and running in about 4-6 weeks. During this time, we provide all tools, analytics, cloud setup and account access as well as walk you through internal deployments of hardware and virtual components including log forwarders and agents. You’ll be up and running quickly and will enjoy the added security of Pondurance MDR! Can we use our own endpoint detection and response vendor with your services? When you sign up for our managed detection and response services, you have a couple of options for managed endpoint detection and response vendors. You are welcome to keep your existing solution as we can ingest data from leading EDR platforms and create alerts. OR you may want to use one of our endpoint detection and response solutions that provides real time analysis conducted by trained individuals who can find things that tools tend to miss. Either way, your endpoint data is covered with our MDR services. Can you log data from on-premises and cloud? Yes! We can ingest data across endpoint, network, log and cloud environments. This includes: Remote laptops, tablets, mobile devices and desktops Data centers Machines in your office Data from cloud environments like AWS, Azure and Google Cloud Platform Software-as-a-Service data And Office 365 data We call this 360° visibility as we can ingest any data you would like us to monitor for a potential threat! With this added security, you will truly have a modern security program.