Read this blog to learn more about the challenges of ransomware, why organizations are adopting MDR, and the need for talented cyber experts.|Read this blog to learn more about the challenges of ransomware, why organizations are adopting MDR, and the need for talented cyber experts. Combating Ransomware with MDR Services Pondurance November 1, 2021 Facebook X (Twitter) LinkedIn Copy link Cybersecurity breaches have been headline news throughout the COVID-19 pandemic. Organizations experience increasing threats from cybercriminals across industries, including healthcare, banking and financial services, with ransomware at the forefront of these attacks. Executives are challenged with how to protect the data of customers and patients against such threats. More and more, using managed detection and response (MDR) services is the answer. But what is MDR and how can it help? Lyndon Brown, Chief Strategy Officer, talks about ransomware and explains how MDR services can combat threats in The Security Ledger Spotlight podcast with host Paul Roberts. Lyndon discusses the challenges of ransomware, why organizations are adopting MDR and the need for talented cyber experts. The challenges of ransomware Ransomware is malware that allows cybercriminals to gain access to an organization’s data and block access to the data unless a ransom is paid, usually in the form of cryptocurrency. “Cybercriminals use ransomware because that’s where the money is”, says Lyndon. Using ransomware is a monetary strategy for them to get rich quick, and cryptocurrency as a payment is difficult to trace. “It really only takes a few mistakes by an organization to be susceptible and vulnerable to an attack,” says Lyndon. “In fact, the large Colonial Pipeline attack was caused by a single compromised password.” Enter the adoption of MDR Early on, managed security service providers focused on device management kept behind a physical perimeter, such as a firewall or antivirus product, to stop a cyber threat. But today, with the cloud and widespread information sharing, MDR providers focus on the cybercriminal before they get to the door. MDR proactively performs detection and response capabilities by leveraging advanced techniques, such as artificial intelligence and machine learning, and performing threat hunting. Lyndon discusses how a quality MDR provider should offer 360-degree visibility across an organization’s infrastructure to close gaps across endpoints, logs, networks and the cloud and should be able to manage response from end to end. Humans are needed Technology alone is not enough to solve cybersecurity issues. Organizations also need humans to detect and respond to complex security threats. “There’s somebody at a keyboard somewhere in the world trying to figure out…how to gain access to an organization’s assets to either monetize them or further their nation-state goals,” says Lyndon. “As long as you have that, someone on the other [side], you need humans on this side.” Many organizations are struggling to find cybersecurity talent, and when they do, the candidates demand competitive salaries. Lyndon discusses the importance of attracting, developing, retaining and advancing talented cybersecurity experts who have a depth and breadth of experience in industry verticals. Cybercriminals have increased the number of threats to organizations across all industries, and ransomware is a favorite among bad actors. Learn more about how MDR services can provide a comprehensive solution for companies to combat these threats. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn about obligations for HIPAA compliance when How HIPAA Regulations Affect Online Tracking Pondurance January 27, 2023 Facebook X (Twitter) LinkedIn Copy link The Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services (HHS) has issued clarification on obligations for HIPAA-covered entities and business associates (regulated entities) under the HIPAA Privacy, Security, and Breach Notification Rules (HIPAA Rules) when using online tracking technologies. By definition, tracking technologies are apps used to collect and analyze information about how users interact with regulated entities’ websites or mobile apps when the information collected through tracking technologies or disclosed to tracking technology vendors includes protected health information (PHI). “Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosure of PHI to tracking technology vendors or any other violations of the HIPAA Rules.” Regulated entities are not permitted to use tracking technologies where impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules would occur. “Regulated entities cannot use or disclose PHI, without an individual’s written authorization, only as expressly permitted or required by the HIPAA Privacy Rule. See 45 CFR 164.502(a).” There are several challenges, starting with the fact that many regulated entities did not contemplate how services and tools, including tracking technologies, they use for measuring web statistics, web and app usage, and other well-intended purposes may improve the user experience. But first, let’s explore if the tracking technology creates a connection between users and their PHI. Like personally identifiable information (PII) regulations, it’s important to consider data classified as individually identifiable health information (IIHI) including an “individual’s medical record number, home or email address, or dates of appointments, as well as an individual’s IP address or geographic location, medical device IDs, or any unique identifying code. ” The brief clarifies this, in concept, as two general use cases that are authenticated users (including apps on PCs, mobile devices, and smartphones) and unauthenticated users. User-authenticated webpages, mobile apps that store and pass the user identification, or any scenario that requires users to log in or provide their identities before they are able to access the webpage or app, typically create a scenario where all data is associated with a user and is regulated by HIPAA. Unauthenticated access to data is typically “Webpage(s) that do not require users to log in before they are able to access the webpage, such as a webpage with general information about the regulated entity like their location, services they provide, or their policies and procedures. Tracking technologies on regulated entities’ unauthenticated webpages generally do not have access to individuals’ PHI; in this case, a regulated entity’s use of such tracking technologies is not regulated by the HIPAA Rules.” Two primary exceptions where tracking technologies are used on website or apps include: Registration or submittals, even without login, that may include PHI and create a connection to the user. Collection of an individual’s email address and/or IP address when the individual visits a regulated entity’s webpage to search for specific healthcare information (e.g., disease, health issue) or available appointments. Thus, the regulated entity is disclosing PHI to the tracking technology vendor. You can see in this example how, over time, HIPAA may be expanded to cover non regulated information providers using tracking technologies that may create a connection between a medical condition and user, although PII state laws may already cover this situation. Assuming the technology is embedded or necessary for business purposes, and authenticated or meets the unauthenticated exception definition, a critical step is to establish a business associate agreement (BAA) with any tracking technology vendors that meet the definition of a business associate. “The BAA must specify the vendor’s permitted and required uses and disclosures of PHI and provide that the vendor will safeguard the PHI and report any security incidents, including breaches of unsecured PHI, to the regulated entity, among other requirements.” Consistent with standing HIPAA BAA guidance, if a regulated entity does not want to create a business associate relationship with these vendors or the chosen tracking technology vendor will not provide written satisfactory assurances in the form of a BAA that it will appropriately safeguard PHI, then the regulated entity cannot disclose PHI to the vendors without the individuals’ authorizations. This article is for informational purposes only and is not a legal interpretation or guidance. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

AI in Healthcare: Reap the Rewards, Reduce the Risks Pondurance July 8, 2025 Facebook X (Twitter) LinkedIn Copy link In healthcare settings, AI can be both an ally and enemy . According to the World Economic Forum , AI has the potential to expand access to critical healthcare services, improve diagnostics, detect diseases sooner, and speed up administrative tasks. With AI’s limitless potential, it’s no surprise that the generative AI market in healthcare could reach nearly $17 billion by 2034 . Source: Market Research Future AI also has its downsides, from perpetuating biases of underrepresented groups to enabling sophisticated cyberattacks . In this fourth article on helping midsize healthcare organizations manage breach risks, Stacey Oneal, PhD , a senior security consultant at Pondurance, shares how providers can mitigate AI-powered threats—and benefit from AI’s limitless potential. Read the other articles in our healthcare series: ▸ Bridging the Compliance-Data Breach Gap in Healthcare ▸ Ensuring Patient Care in an Era of Ransomware ▸ Practical Strategies for Vendor Risk Management in Healthcare Q: What are the greatest security and privacy concerns for healthcare organizations using AI? Stacey: AI can enhance diagnostic capabilities by analyzing large amounts of patient data to detect patterns and improve treatment. However, there’s concern that this same data could be misused—such as by insurance companies to deny coverage based on predictive health analytics. On the privacy side, wearable devices—like smartwatches—collect sensitive health data that could be scrutinized or used unfairly. And advances in real-time patient monitoring raise additional questions about data integration and surveillance. Then, of course, AI enables cybercriminals to more easily deceive users and break through an organization’s security defenses. From social engineering and phishing to deepfakes and adversarial attacks , AI-powered threats are especially difficult to detect and remediate. Q: What can healthcare providers do to mitigate privacy, security, and breach risks around AI? Stacey: The strategies for protecting against AI risks are very similar to safeguarding against any other kind of cyber risk. If you’re already using some of the following best practices, then you’re on the right path to ensuring the safe and secure use of AI in your organization. Implement zero trust architecture. Unlike traditional models that assume anyone inside the network is trustworthy, zero trust architecture operates on the principle of “never trust, always verify.” It enforces least-privilege access and requires users and systems to continuously revalidate access, even within trusted environments. This approach limits exposure and potential damage in the event of unauthorized access. Zero trust architecture helps protect against AI threats in a complex healthcare ecosystem. Source: NIST Zero Trust Networks . Strengthen governance within your organization. You need strong policies around how AI is used, tested, and monitored. This includes integrating frameworks like the NIST AI Risk Management Framework into existing policies and procedures to ensure responsible and secure AI implementation. Encourage AI training and certifications for your security team. For example, ISACA has launched new AI-specific certifications, including one focused on auditing AI systems . These are designed for professionals with existing credentials like CISA and help build needed expertise in AI oversight. Building a workforce skilled in AI governance and auditing is essential as AI becomes more embedded in your healthcare operations. Provide continuous monitoring . Like any software or digital system, AI tools require ongoing monitoring for anomalies and other emerging risks. Keeping systems updated and identifying abnormal behavior helps reduce the impact of potential threats. Create a business case for your cybersecurity budget. Security teams are often seen as cost centers, which makes it necessary to frame cybersecurity and AI risk management as a form of insurance. Demonstrating how these measures prevent costly incidents can help justify investment and gain executive buy-in. Q: Given the complexity of healthcare operations, it’s impossible to monitor every system. How can providers best protect against AI security and privacy risks in these environments? Stacey: Network segmentation and data labeling help you identify what types of data live in which parts of your network, so you can focus your security resources where they’re most needed. Sensitive data—like anything covered by HIPAA—needs more protection than, say, billing information, which comes with a different set of concerns than patient privacy. Q: In a previous article , we discussed the gap between compliance and security. How do you see the relationship between these two objectives? Stacey: As I always say, compliance is not security; it’s just a baseline that creates a shared foundation and instills trust that organizations are implementing security controls. True security goes beyond compliance to identify and address real vulnerabilities and threats—including AI-based threats. Once you’ve achieved compliance, your next focus should be strengthening your cybersecurity program. Q: Midsized health care organizations have often limited cybersecurity budgets and resources. How can they best address new and emerging AI risks? Stacey: A trusted cybersecurity partner can supplement an internal team’s capabilities with tools and expertise they would not otherwise have access to. For example, Pondurance managed detection and response (MDR) solution helps healthcare organizations eliminate breach risks by stopping attacks—whether from AI or other sources—before they can do harm. Our team of experienced SOC analysts and cloud-native platform complements your existing security tools, technologies and resources. Together, we can rapidly detect, validate, and remediate threats to protect your organization from risks and harm. We also assist with AI governance and compliance, to help set up clear policies, procedures, and a secure architecture. Ongoing oversight is key—organizations need checks and balances, regular audits, and advisory support to ensure AI is integrated safely and in line with compliance standards, whether they’re adopting AI or protecting against its risks. We don’t replace an organization’s internal experts or policies and procedures. Rather, we work with what you have, offering recommendations to improve your organization’s overall cybersecurity program. Final Thoughts AI has endless potential to transform healthcare, from logistics and diagnostics to treatment and administrative tasks. The goal is to harness AI’s potential while mitigating its cyber threats and breach risks. Because, as a Dark Reading article said, “AI is…a tool that can be used for and against us.” Get your copy of “ A Midsize Organization's Guide to Reducing Breach Risks in 2025 ” playbook. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Discover why Pondurance has been recognized as a "Best Place to Work" for 2025! Learn about our commitment to a supportive workplace culture and our dedication to providing exceptional cybersecurity solutions for midmarket organizations. Pondurance Receives Recognition as a Best Place to Work for 2025 Pondurance January 7, 2025 Facebook X (Twitter) LinkedIn Copy link We are pleased to announce that Pondurance has been honored as a "Best Place to Work" for the second consecutive year by Built In. This esteemed recognition underscores our commitment to cultivating a positive workplace culture and providing our team with competitive rewards. Pondurance delivers world-class MDR services to industries facing today's pressing cybersecurity challenges, including ransomware and complex compliance requirements. As the first and only MDR specifically engineered to eliminate breach risks, we leverage our advanced platform and experienced team of analysts to continuously hunt, investigate, validate, and contain threats. This approach allows your team to focus on what matters most: securing regulated data and mitigating vulnerabilities effectively. We are proud to be included on the following lists for 2025: 100 Best Places to Work in Washington DC 100 Best Midsize Places to Work in Washington DC These accolades are a testament to the hard work and dedication of every member of the Pondurance team. Their contributions are what make our company an exceptional place to work. We extend our sincere gratitude to our team for their efforts in shaping an engaging and supportive workplace environment. As we move forward, we remain dedicated to enhancing our culture and supporting our employees in their professional growth. We invite you to celebrate this achievement with us! Please visit our LinkedIn post to show your support and join the conversation. Thank you for being an essential part of our journey, and we look forward to achieving new milestones together! Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Many midsized organizations underuse their security tools. Learn how MDR from Pondurance keeps them tuned, monitored, and ready against evolving threats. How MDR Makes Your Security Tools Work Better Pondurance October 21, 2025 Facebook X (Twitter) LinkedIn Copy link Many midsized organizations have invested in solid security tools—endpoint protection, email filtering, firewalls, identity controls. Yet many remain exposed to cyber risk because those tools aren’t configured or maintained to their full potential. Out-of-the-box settings are designed for broad usability, not for your organization’s specific environment. Without tuning and continuous oversight, they provide only partial protection and leave your organization vulnerable to cyber-attacks. In this second article in our new series, we’ll share how managed detection and response (MDR ) provides the people and expertise to manage, monitor, and adjust your tools so they perform as intended and keep pace with evolving threats. Three Signs You Need an MDR Service 1. Default configurations remain unchanged. Many organizations deploy security tools with default settings. These configurations often leave unnecessary functions active—such as PowerShell v2 or Windows MSHTML —that attackers can exploit. Because tuning requires time and specialized knowledge, these features may remain enabled, exposing systems to unnecessary risk. MDR brings the expertise to safely disable or restrict unused functionality without interrupting business operations. 2. Security configurations lag behind evolving threats. Integrations that were safe a year ago may now pose risks. For instance, integrations with third-party applications or old operating systems can become weak points if not reviewed and updated. Most midsized teams don’t have the bandwidth to continually test and adjust every control. MDR provides continuous monitoring and tuning to ensure defenses remain current. 3. Limited confidence in overall security posture. Even well-run IT teams can struggle to know whether controls are appropriately configured or whether legacy systems are adequately protected. MDR offers visibility into where protections are working and where compensating controls are needed, building practical assurance that defenses align with real-world risks. What MDR Does An MDR service such as Pondurance provides continuous visibility and expert oversight, helping ensure your security tools work as intended. Core functions include detection, validation, and response: Detection: Using telemetry and threat intelligence, security operations center (SOC) analysts identify suspicious activity across endpoints, networks, and cloud systems. Pondurance MDR works with your existing systems—including identity, cloud, and IoT—to strengthen protection without requiring expensive replacements. Validation: Pondurance MDR detects, confirms, and disrupts threats in one process. SOC analysts review each alert to understand its context and reduce false positives that cause alert fatigue. Response: When a verified threat appears, the MDR team isolates, contains, or disrupts it to stop a potential breach before it happens. For Pondurance, the typical time to remediation is under 15 minutes. How vCISO and Incident Response Complement MDR MDR is one component of a broader cybersecurity framework. Pondurance offers complementary virtual chief information security officer (vCISO) and incident response (IR) services that address strategy and recovery needs. vCISO: Defining priorities and execution A vCISO evaluates business processes, compliance requirements, and risk tolerance to build an appropriate security strategy. This includes advising on policies such as SSL decryption or which legacy services can safely be disabled. For example, some systems—such as specialized medical equipment or manufacturing tools—must run on outdated software for business or regulatory reasons. The vCISO role provides the “why” behind security decisions, aligning technical measures with business priorities. MDR: Operationalizing detection and response MDR translates that strategy into daily operations. It configures tools, monitors for anomalies, and adjusts controls in real time. When the vCISO identifies risks that can’t be fully eliminated—such as outdated systems—MDR applies technical safeguards to minimize exposure. Incident response: Managing containment and recovery If a breach occurs, the Pondurance incident response team investigates, identifies root causes, and restores operations. Our full-service team integrates with your internal response plans, insurance policies, and legal team to fit your specific requirements. And because SOC analysts already monitor your environment, the incident response team can act quickly and effectively. Collaboration among these three services ensures strategy, execution, and recovery remain connected rather than isolated efforts. From Tools to True Security Security tools are only as effective as the people managing them; however, many midsized organizations and smaller enterprises lack the expertise and time to do so. MDR closes that gap by ensuring your existing controls are properly configured, continuously updated, and actively monitored. When paired with advisory and incident response services, MDR forms part of an ongoing cycle of detection, prevention, and improvement. The result isn’t a static defense but a resilient system that adapts to real-world conditions and evolving threats. Organizations that invest in this integrated approach gain clarity on where they stand, confidence in how they respond, and assurance that their security tools are doing what they’re meant to do—protect the business. See how Pondurance MDR can protect your organization against breach risks: From Detection to Defense: Eliminating Breach Risk Through Active Response. Read the first article in this series: From Data Breach to Cyber Resilience with Managed Detection and Response (MDR) Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Explore how AI, IoT, and human elements escalate breach risks for midsize firms and learn strategies to mitigate them. How New Cyber Threats and the Human Factor Escalate Breach Risks for Midsize Companies Pondurance January 29, 2025 Facebook X (Twitter) LinkedIn Copy link Data breach risks are soaring. The amount and types of sensitive personal information collected multiply every day: personally identifiable information (PII), protected health information (PHI), biometrics, and information from smart devices and social media, to name a few. Two categories of risk make it easier for malicious actors to launch cyber-attacks on this data, increasing the likelihood of unauthorized exposure—a data breach. Technological vulnerabilities from sources like artificial intelligence (AI) and the Internet of Things (IoT) generate a never-ending flow of threats. Human and organizational factors must also be considered. When it comes to data breaches, mid-market organizations have the same cybersecurity and human risk factors and regulatory requirements as larger enterprises. However, they often lack the funding and in-house expertise to address these risks and compliance obligations as effectively. Without the proper resources at hand, midsized companies in fact face greater breach risks than larger businesses. To minimize breach risks , midsized companies must understand how both cyber threats and the human factor impact the security of their data and systems: Cybersecurity Risk Factors The rapid rise of artificial intelligence (AI) AI is everywhere. One survey reports that 77% of companies are using or exploring the use of AI, and 83% say it’s a top priority in their business plans. Indeed, AI has the power to help businesses transform how they work and spur innovation. But it also creates immense privacy and security risks that evolve as AI itself evolves. Some threats include: Increase in social engineering and phishing attacks, due to enhanced cybercriminal capabilities from generative AI. Malware that can elude traditional security measures. There’s even malware that uses machine learning to change behavior based on its target environment. Deepfakes, which are videos, photos, or audio recordings that appear to be real but have been manipulated with AI . Even non-technical bad actors can quickly and cheaply generate convincing deepfake content , which can be used to threaten an organization’s brand, impersonate executives, and launch effective phishing attacks. Behavioral tracking and surveillance, which can be used for purposes like marketing and employee monitoring . These uses could have serious privacy and legal implications. The plague of ransomware Cybercriminals are targeting smaller companies—not just enterprises—for ransomware attacks. And they’re paying the highest price for it. A Sophos study found that even the smallest organizations are regular targets, with 47% hit by ransomware in the last year. The lower and mid-market organization also had the greatest uptick in overall recovery costs, from $885,018 to $2.885 million—a $2 million increase. Ransomware, a malicious type of software that blocks access to systems and data until the target company pays up, has advanced, creating even greater threats to organizations unprepared for such an attack. Double-extortion ransomware uplevels the typical ransomware attack. Malicious actors encrypt sensitive customer or patient data and threaten to publish it on the dark web, sell it, or permanently block access if the ransom payment is not made. Another trend, ransomware-as-a-Service (RaaS), makes it easier for less tech-savvy bad actors to launch a ransomware attack, which increases the likelihood of such an attack. The Harvard Business Review notes the many ways developers can franchise their malware, from a simple purchase, as a monthly rental, or splitting the ransom money. Threats in the cloud Using cloud storage makes good business sense for midsize organizations; it’s accessible, cost-efficient, convenient, and scalable. It’s no surprise that more than 60% of the world’s corporate data is stored in the cloud —and that cyber attackers are after that data. In fact, more than 80% of data breaches involved data stored in the cloud, according to a 2023 IBM report . The cloud is noted for security, but misconfiguration can make it an easy target, according to MIT professor Stuart Madnick . Cloud technology is evolving, and IT teams lack the experience to properly secure data in the cloud. Madnick said hackers are able to access cloud data and services in part because of misconfigurations such as not changing default settings, unrestricted ports, and unsecured backups. Danger on the edge: the Internet of Things (IoT) Smart devices, from watches to industrial control systems, are a part of everyday life at home and work. Today, there are more than 24 billion active internet of things (IoT) and operational technology (OT) devices. IoT devices can add business value and reduce complexity and cost for many industries, from manufacturing to healthcare. However, they also create significant cyber risks that can lead to a data breach. For example, doctors often remotely monitor patient health with wearable devices, generating massive amounts of data that’s stored, managed, and analyzed in the cloud . As we’ve seen, misconfiguration can make the cloud an easy target for cybercriminals. Similarly, IoT devices not properly developed or secured create vulnerabilities that can lead to service disruption, data theft, or data or service manipulation. In the above healthcare example, the cloud and IoT device create double vulnerabilities for hackers to exploit. Often, smart devices have weak default passwords and login information, leaving them open to password hacking and brute-forcing —the use of trial-and-error to guess login information or encryption keys, or to find a hidden web page. The increased number in IoT devices has also increased the risk of malware and ransomware to exploit these devices. Another risk is a distributed denial of service ( DDoS ) attack. This occurs when cybercriminals use hijacked devices as an attack base to infect more machines or hide malicious activity. IoT devices also increase data privacy risks . They collect, send, store, and process an enormous amount of personal data, which can be shared with or sold to third parties. Human and Organizational Risk Factors A deficit of cybersecurity talent While cyber threats continue to escalate, the pool of cybersecurity talent is shrinking. Globally, there is a shortage of nearly 4 million cybersecurity professionals , with more than 500,000 in the United States alone. Factors such as unclear career paths, outdated training, high-cost certifications, and job stress deter people from choosing a cybersecurity career, the World Economic Forum reports. Those who do choose to work in cybersecurity can earn an average starting salary of over $130,000 yearly —potentially too costly for midsized organizations to pay. Distributed teams In 2020, the world went remote almost overnight, and working from home became the norm. Even though the pandemic has ended, remote and hybrid work are commonplace. A distributed workforce, while more convenient and flexible, increases an organization’s cyber risks . Employees can remotely access company systems and data through the cloud using multiple devices—even personal ones—and via home networks that may be less than secure. All this creates more access points, which expands the attack surface for cybercriminals and makes network monitoring much more complex. In addition, remote work expands physical security risks, such as leaving a work screen open in a public place. Distributed data It’s a business necessity for an organization to share data with third parties, such as suppliers, partners, vendors, and business associates. This can include sensitive personal information like customer payment data and electronic protected health information (ePHI). While data sharing is an accepted and necessary practice, companies don’t have control over a third party’s cybersecurity programs—which may not be as robust. In fact, a security vulnerability at a single vendor creates vulnerabilities for all their customers. In Q3 2024, supply-chain attacks increased 203% over the previous quarter. 2023’s MOVEit hack exemplifies the devastating and ongoing risks from a third-party breach. A zero-day vulnerability in Progress Software’s MOVEit managed file transfer app created a breach affecting the sensitive data of millions of people, including the possible theft of insurance and financial information. More than 2,500 organizations were affected, including well-known brands like the BBC, British Airways, Ernst & Young, and Amazon. Open data across the organization Employees throughout an organization must have access to sensitive data, such as electronic health records, to do their job. Employees are often a significant source of breach risk. Verizon’s 2024 Data Breach Investigations Report found that 68% of breaches involved “a non-malicious human element,” like becoming a victim of a social engineering attack or making a mistake. Social engineering attacks such as phishing emails can lead to business email compromise (BEC) , which can lead to financial loss or the unauthorized sharing of sensitive data. Minimizing Breach Risk amid Cyber Threats and Organizational Realities The fast-changing nature of cyber threats combined with the human element can be overwhelming when considering how to minimize breach risks. It requires addressing both sets of risk factors and how they relate. Pondurance can help. We are the only managed detection response (MDR) cybersecurity service designed from the ground up to minimize data breach risk for mid-market organizations. Our platform provides a complete set of technologies and tools, backed by an always-on concierge security operations center (SOC), for protection before, during and after incidents. Have a third party, vendor, or business associate adopting AI? Request an MDR demo . Have a vendor using AI? Get a third-party risk assessment today. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

This blog discusses what prevention measures are required for your company to get accepted for cyber insurance. Read now! Applying for Cyber Insurance: Prevention Measures Required To Get Accepted Pondurance October 31, 2023 Facebook X (Twitter) LinkedIn Copy link Companies of all sizes know that cyber insurance premiums come with a high price tag. Premiums have increased every quarter over the last several years, according to the Global Insurance Market Index, and ransomware is the primary reason for the increased prices. Two-thirds of all companies suffered a ransomware attack within the past year, according to Sophos’ The State of Ransomware report. The report also found that the average ransom payment was more than $1.54 million in 2023, and the average cost to recover from an attack — not including the ransom payment — was $1.82 million. As a result, cyber insurance providers feel the rise in premiums is justified. With the large number of ransomware attacks, companies consider the protection of a cyber insurance policy to be a necessity. Yet, cyber insurance providers want to minimize their losses. As a result, the application process for insurance is lengthy and comprehensive. Providers are only offering cyber insurance to companies that have prevention measures in place to reduce the risk of a cyberattack. To get accepted for cyber insurance, companies need to be prepared for the application process — and that can mean proactively implementing proper cyber measures prior to application. A few of the core qualifications for cyber insurance that every cyber insurance provider will ask about include the use of multifactor authentication (MFA), managed detection and response (MDR), digital forensics and incident response (DFIR), and employee training. MFA Across the board, cyber insurance providers want to know that your company has MFA in place. MFA requires multiple methods of authentication to verify an account user’s identity during login. MFA’s layers of security make it harder for a bad actor to access a targeted account. Types of MFA include knowledge factors such as passwords, personal identification numbers, and security questions; possession factors such as tokens, key fobs, and badges; and inherence factors or biological traits such as retina scans, fingerprint scans, and voice authentication. Last year, cyber insurance providers required companies to have MFA to qualify for cyber insurance. This year, insurers are taking that requirement one step further. Now, providers need to know that companies have MFA and, more importantly, that it has been implemented. “Early on, insurance providers would ask, ‘Do you have multifactor authentication?’” said Doug Howard, CEO at Pondurance. “Companies would answer ‘yes,’ but come to find out, the companies had it but never implemented it or implemented it only on VPN (virtual private network) and no other system. Now, the questions on the insurance applications are getting deeper. Providers want to know that you’re using MFA in a way that will actually protect your company against bad actors.” MDR Insurance providers want to see companies partnering with MDR providers, and having MDR services is a minimum requirement for many insurance providers. Working with an MDR provider can reduce the likelihood that your company will experience a cyber incident and can demonstrate to cyber insurance providers that your company is taking responsible steps to pursue comprehensive defense strategies. Modern MDR providers monitor networks 24/7, discover suspicious activity, and launch mitigation measures if an incident occurs. MDR services combine technology and humans to monitor, alert, investigate, and proactively respond to cyber threats for clients. These services also decrease dwell time — the time from when a bad actor enters an environment until the bad actor is removed — and, ultimately, reduce the cost of a breach. “Cyber insurance providers want to know that companies have the technology, processes, and people already in place to protect against an attack,” said Doug. “MDR services can provide the full visibility, testing and analysis, and talented humans needed to reduce your cyber risk. As a result, MDR has become a standard requirement for cyber insurance.” DFIR DFIR involves digital forensics, which is data collection to determine what happened during an attack, and incident response , which is action taken following an attack. DFIR teams deploy at a moment’s notice to intercept attacks, save electronic evidence, perform damage control, and determine what is needed for secure restoration. When you work with a DFIR firm, your company can lower its risk profile and improve its ability to secure cyber insurance. Every minute counts after an attack, and companies that have a DFIR team already in place are ready to immediately respond to a compromise, minimize losses, and prevent future incidents. “If your company has an incident and you’re proactively partnering with a DFIR team, you’re way ahead in terms of response and recovery,” said Doug. “A DFIR partner will already be familiar with your company and understand what’s important to you. The team can contain the incident, determine exposure through forensic analysis, and quickly restore your normal operations.” Employee Training Every company should educate employees — both staff and managers — about the importance of data privacy and the potential cyber threats that they may encounter. When employees are well educated on cybersecurity practices, a company faces less likelihood of a data breach. And that’s what cyber insurance providers want to see. During the application process, all providers will ask if your company performs cybersecurity awareness training at least once every year. They also want to know how often your company conducts phishing training since phishing is such a common way for bad actors to infiltrate a company’s system. “Many bad actors target employees through phishing attempts,” said Doug. “So it’s critical to educate employees year-round about how to detect malicious email links and keep your company’s systems safe from attack.” Conclusion Cyber insurance providers only offer insurance to companies that have prevention measures in place to reduce the risk of a cyberattack. Your company needs to be prepared for the application process by proactively implementing such measures prior to application. To learn more about how to get approved for cyber insurance, check out our blog Improve Your Qualifications for Cyber Insurance: 4 Things To Know . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Follina, a/k/a CVE-2022-30190, is nothing to take lightly. What it is, what to watch for and mitigations to help keep this zero-day at bay. Critical Diagnosis: What You Can Do To Mitigate the Scourge of Microsoft CVE-2022-30190 Pondurance June 1, 2022 Facebook X (Twitter) LinkedIn Copy link Well, like clockwork, another critical vulnerability has been found in a widely used product. This time it comes in the form of a zero-day code execution exploit involving the Microsoft Support Diagnostic Tool (ms-msdt) protocol within Microsoft Office. This zero-day exploit was discovered and reported on May 27 by security researcher “nao_sec”, but was discovered to have been exploited by attackers as early as April of this year. This vulnerability, tracked as CVE-2022-30190, can be exploited to achieve code execution when opening or previewing Word documents and \rich text format (.rtf) files within Microsoft Word. This is different from the traditional code execution security analysts are used to seeing that requires a click to enable macros to run. This exploit, instead, runs whether macros are enabled or not. Furthermore, researchers have identified zero-click exploits on all versions of Microsoft Office products, including the most up-to-date channel of Office365 products . Several researchers report that an embedded payload can be executed when a weaponized .rtf file is previewed in Windows Explorer , and an .rtf exploit can also bypass Word’s protected mode protections. Technical Details Colloquially dubbed Follina, the exploit itself uses the ms-msdt diagnostic tool protocol to query a malicious URL, which is loaded and interpreted to achieve code execution with equivalent privileges of the parent Office process. This is achieved by leveraging the Word remote template feature to reach out for a malicious HTML file, which is loaded using the ms-msdt URL scheme. Once loaded, this HTML file is then interpreted and calls the Native PCWDiagnostic pack using the IT_BrowseForFile parameter, ultimately resulting in code execution via PowerShell. Malicious use of msdt.exe has been previously documented . So what does this mean? This is an evolution of Maldoc threats that already exploit Microsoft tools like Word and Excel to infect systems. This new method requires no additional authorization from the user other than opening (and in some cases, simply previewing) the file. Additionally, vendor detection on exploit files found in the wild (and Proof of Concepts – POCs – developed by researchers) is poor. One can expect this to become part of most attackers’ arsenal moving forward and should take measures against it. This is being actively weaponized and exploited, and therefore, poses a significant risk to an organization, even one with up-to-date detection and mitigation strategies. Mitigations Unfortunately, at the time of this blog post, Microsoft has not published an official patch yet; however, they have published a Microsoft Security Response Center (MSRC) blog suggesting workarounds . In short, Microsoft suggests disabling the ms msdt URL protocol (used to interpret the malicious external HTML) via a registry key modification. Other researchers have gone further, suggesting: Disabling “ Troubleshooting Wizards ” VIA Group Policy Object (GPO) . Using Defender’s attack surface reduction capabilities, one can activate a rule to block all office applications from creating child processes . Removing the ms msdt handler entirely via registry key modification. With these mitigations, your mileage may vary based on your organization’s needs. Expect things to change rather rapidly over the next few days, so keep an eye out for any talk of improved mitigations (or ways your mitigation can be bypassed). What about detections? Unfortunately, many researchers have found current endpoint detection and response (EDR) and antivirus (AV) technologies are somewhat limited in their ability to detect Follina exploits. However, they do follow a pattern that can be identified by threat hunters. Expect detection capabilities to improve moving forward, but obfuscation and encoding within commands can be expected to change and improve from the attacker’s perspective as well. Active threat hunting can help mitigate that. Do you have an EDR with process auditing? Look for systems in your environment spawning msdt.exe as a child process of winword.exe, excel.exe, outlook.exe, or powerpnt.exe. A similar parent-child process hunt can be performed looking for conhost.exe sessions or other processes with the parent process sdiagnhost.exe. Similarly, keep an eye out for any network connection events spawned by the sdiagnhost.exe process not reaching out to an official Microsoft resource. Also, if you have command line auditing enabled (either in EDR or in event logs), look for IT_BrowseForFile, as it is not a common parameter. SentinelOne Kibana Query Language (KQL) queries can be found here . Signatures EmergingThreats has published a signature to detect potential exploitation attempts in their open rule set with the message “ET EXPLOIT Possible Microsoft Support Diagnostic Tool Exploitation Inbound (CVE-2022-30190.)” Other reports seem to be regarding targeted attacks, leveraging the following domains: Tibet-gov.web[.]app Xmlformats[.]com Sputnikradio[.]net Joe Security has a YARA rule for command line auditing. SecurePeacock wrote this Sigma rule . @kostastsale wrote a Sigma rule for detection as well. Looking for evidence of previous execution? The PCW.debugreport.xml file within %localappdata%\Diagnostics and %localappdata%\ElevatedDiagnostics (depending on the level of privileges the exploit achieved) has been reported to contain the payload in some instances, which can be useful for historical threat hunts. The hkcu\software\microsoft\office\16.0\common\internet\server cache registry key can also be queried for all URLs contacted via Office. Note that this is an HKCU (current user) key and, therefore, is user-specific. Also note this contains legitimate URLs as well. Final notes This exploit is reminiscent of the Log4j exploit identified in late 2021, wherein an underlying subsystem with an external connection functionality was similarly exploited to achieve code execution. In that case, the quick-and-dirty solution seemed to be to disable the functionality entirely as a long-term solution was developed. In the case of the Log4j exploit, the first round of patches didn’t fully mitigate the threat, and we should account for that possibility in this case as well. P.S.: Security researchers should be cautioned against blindly running reportedly benign POC exploits during their exploration of this particular vulnerability, as several have been reported to drop Cobalt Strike beacons . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

March's monthly threat intelligence newsletter from Pondurance March Cyber Threat Download™ Pondurance March 11, 2025 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. Threat trends Our team has noted certain trends in recent attack methods focused on intrusion, operational disruption, or financial harms to organizations. The following trends are increasing or steady in frequency, as these types of attack continue to prove successful for malicious threat actors. Ransomware . As usual, these attacks are still the most prevalent threat on the internet. The team is seeing manual deployment of ransomware — versus automated deployment — where the threat actor has to break into the network and stage, deploy, and execute the ransomware. Manual deployment allows minutes to tens of minutes for the team to get out in front of an attack. Recently, a new ghost ransomware has been seen in the wild. Phishing emails . These attacks are trending up, particularly with tax season in full swing and government actions making headlines. Most phishing emails link to credential harvesting webpages, with successful attacks resulting in Office 365 mailbox access where the threat actors create mailbox rules to cover their tracks. To reduce the risk of phishing threats, the team recommends enabling multifactor authentication (MFA) and offering user awareness training to all employees. Credential stuffing attacks . These attacks, also known as brute force attacks, are trending steady. Okta and Microsoft 365 have immediate countermeasures to deploy against credential stuffing attacks. Okta uses adaptive MFA with behavioral detection and dynamic zones, and Microsoft 365 uses Azure Active Directory Identity Protection, which includes conditional access and smart lockout features. Also, Pondurance can take proactive action to restrict an account, for a quicker response time. Social engineering help desk calls are trending way down. In fact, the team hasn’t seen or heard of any help desk call compromise in recent months. The lack of attacks may be due to user awareness training and more robust help desk validation processes. Concerned about the rising threat of ransomware, phishing, or VPN exploits? Request a demo of Pondurance's proactive cybersecurity solutions today and stay ahead of the threat curve. Incident response learnings As a recent exploit, lone wolf actors have recently been using email bombing in their ransomware and data exfiltration efforts. In this social engineering attack, a threat actor sends hundreds to thousands of spam emails to a target user. Then, 15-20 minutes later, the threat actor, posing as an IT person, contacts the user using one of three methods: Microsoft Quick Assist. The user launches Quick Assist (Ctrl+Win+Q), a legitimate tool that can bypass endpoint detection and response, and provides a code to grant a remote session on the computer. Then, the threat actor loads a fake page for the unwitting user to click on. Once the user clicks on the page, the threat actor runs a tool such as FileZilla to remotely exfiltrate the closest file share — in 24 minutes or less! One month later, the user will receive an extortion email. Run command. The user enables Run command (Win+R), a legitimate tool that allows the user to quickly open a program, file, or folder by typing in a command (Ctrl+V). In an email bombing attack, the threat actor hijacks the user’s clipboard so that the typed command is automatically copied to the clipboard. From there, it installs a backdoor on the backend. Phone call. The user receives an email with a phone number to a fake call center. Once on the call, the user receives instructions to download a tool such as Zoho Assist or ScreenConnect to allow remote management. Exploitation of virtual private network (VPN) logins, particularly SonicWall and Fortinet, is a common theme right now. The team sees threat actors using valid username-password combinations to log in to VPNs. In most cases of exploitation, MFA or single sign-on that enforces MFA is available but not implemented. Once the threat actors directly log on to the VPN, they use attacks such as Kerberoasting to exploit service accounts and then log on via remote desk protocol to any servers they can access. With these VPN exploit cases, the team often finds that VPN logs are only retained for a span of 24 hours to seven days. Instead, the team recommends that clients preserve and centralize their logs. The use of the Godzilla web shell is currently a trending form of exploitation. Godzilla opens a shell code launcher with commands written to memory — rather than written to disks or logs as with JavaScript and PowerShell — and performs process injection to launch shell code within that process. The threat actors use Advanced Encryption Standard to create the web shell and can launch any sort of shell code to pull off the attack. Then, they install remote monitoring and management tools, bring in tools like Advanced IP Scanner, and steal the service accounts and exfiltrate data. Notable vulnerabilities Approximately 4,000 vulnerabilities were disclosed in January, and this number is expected to slowly increase over time. As many as 33 of the 4,000 disclosed vulnerabilities were high risk, and five were actively exploited. There was one proof-of-concept exploit impacting Windows lightweight directory access protocol discovered on the internet. As many as 159 reported vulnerabilities were addressed during Microsoft Patch Tuesday in January. Among those 159, 10 were critical, and eight were zero days. Three of the zero days are particularly notable: Fortinet authentication bypass vulnerability . Exploitation of this vulnerability initially occurs through the JavaScript console interface. From there, the threat actor creates a new administrator account with VPN access, modifies existing accounts, makes changes to the firewall settings, and adds a VPN tunnel into the internal network. The threat actor also may steal credentials through DCSync. Ivanti Connect Secure vulnerability . This buffer overflow vulnerability, exploited by China-based espionage groups, targets particular industries. The exploitation begins with automated scanning to find vulnerable devices that are accessible over the internet. Once a device is accessed, the threat actor disables the SELinux security module running in the Linux kernel. The threat actor remounts some file systems for write access, which allows downloading and installation of additional malware. The threat actor may also deploy web shells to gain control over the compromised systems. GFI KerioControl product vulnerability . This carriage return line feed vulnerability can occur when user input is not sanitized correctly, meaning the line feed characters are not removed. For the exploit, the threat actor crafts a malicious URL and sends a phishing email to the product administrator. Once the product administrator clicks on the link, a malicious disk image file uploads to the system and lands in the software updates folder of the carrier control product, ultimately granting root access to the firewall system. In February, 67 reported vulnerabilities were addressed during Microsoft Patch Tuesday. Of those 67, three were critical vulnerabilities, and four were known zero days, including two escalation of privileges vulnerabilities, a hash disclosure vulnerability, and a security feature bypass vulnerability. The team recommends maintaining an ongoing, robust patching program to address these issues. Focus on device code phishing attacks Device code phishing is a relatively new MFA bypass technique being used by Storm-2372, a Russia-backed group of threat actors. The group is targeting the IT, defense, higher education, telecommunications, and energy sectors, primarily in the United States and Europe. A device code phishing attack begins with a social engineering campaign using a third-party messaging app, such as Telegram, Signal, or Microsoft Teams, to build a rapport between the user and threat actor. The ultimate goal is to convince the user to accept an invitation to an online meeting. Once the user accepts the invitation, the threat actor requests a device code from the meeting service and sends the code to the user. Then, the user is taken to a legitimate device code authentication page to log in with credentials and enter the threat actor-generated code. The threat actor captures the authentication tokens and uses them to access the user’s account. Now, with full access to the compromised account, the threat actor can gather sensitive data for use in future attacks and extortions and send additional phishing emails from the account to lure potential new victims. To prevent device code phishing attacks, organizations should offer user awareness training to all employees, require MFA to disrupt the entering of a device code, and monitor login data for all user accounts. About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our security operations center, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Educational organizations are a particularly attractive target for cybercriminals. See how Pondurance and E&I's partnership can help. Pondurance Announces Partnership With E&I Cooperative Services Pondurance May 8, 2024 Facebook X (Twitter) LinkedIn Copy link The vast majority of cyberattacks are executed for financial gain, and that means that any organization, regardless of size, industry, or current in-house capabilities, can become a victim of cybercrime. Educational organizations are a particularly attractive target for cybercriminals, especially from phishing and ransomware attacks, due to their valuable personal data on students and lack of resources and cybersecurity staffing. Research and consulting firm Gartner reports that “(e)ducation typically employs the least number of security employees when compared to other industries.” But that’s where a new partnership between E&I and Pondurance can help. Pondurance, a national cybersecurity firm that provides an array of comprehensive services to clients, was recently selected to partner with E&I Cooperative Services , a procurement cooperative serving the education industry. Now, existing E&I members can receive cybersecurity services from Pondurance via the cooperative, and prospective clients of Pondurance can join E&I to take advantage of the special pricing, programs, and benefits that come with membership. Work with Pondurance Pondurance is the first and only managed detection and response (MDR) provider to be built on a risk-based approach to cybersecurity. The approach focuses on the specific cyber risks of an organization and considers what the organization wants to accomplish and what it needs to protect. Using this approach, the Pondurance team helps organizations identify their cyber risks, prioritize the risks, and find the most impactful ways to protect organizations against those risks. Once the team has that understanding, it can customize a bundle of services that allows a organization to achieve its cybersecurity and compliance goals. Services include virtual chief information security officer leadership, MDR services, incident response services, penetration testing, vulnerability management, tabletop exercises, risk assessments, awareness training, and more. Pondurance’s team of highly skilled professionals uses technology, automation, and advanced analytics to gather specific threat intelligence and provide relevant data. Team members gain insights on potential cyber threats and assess how to plan, recognize, respond to, and mitigate a threat. They limit an organization’s cyber risk exposure and ensure that the organization can confidently respond to a cyber crisis. In addition, the team integrates the organization’s tools and technology with the Pondurance platform to assure that there are no security gaps and no inefficiencies from overlapping capabilities. “Pondurance is proud to partner with E&I Cooperative Services,” says Ron Pelletier, Founder and Chief Client Officer at Pondurance. “We look forward to offering our risk-based approach and full suite of services to protect E&I members from cyber threats and reduce their exposure to attacks.” Become and E&I Member E&I is a member-owned, nonprofit cooperative exclusively focused on serving the education industry. The organization is equipped with the knowledge, experience, and passion to meet the specialized needs of education procurement. E&I helps nearly 6,000 member institutions make informed, analytics-driven decisions. The benefits of membership include: Skipping the request-for-proposal process. E&I vets its partners so members can focus on more strategic initiatives. Tapping into aggregated spend. E&I negotiates better terms and pricing on contracts for better purchasing power for members. Accessing competitively solicited contracts. E&I’s portfolio of contracts spans most categories including technology, residence life, research, and healthcare. Meeting compliance needs. The member-driven, competitive solicitation process complies with generally accepted procurement standards. Optimizing the spend. E&I uses a member’s purchasing data to reduce costs, bring more spend under contract, and maximize control and efficiencies. Taking advantage of e-procurement. Members reap the benefits of e-procurement through the no-cost online platform and other platforms. Containing costs and driving revenue. Members benefit from supplier-driven rebates, financial incentives, and the patronage program, which distributes funds at year-end. Handling supplier management. E&I handles regular supplier and contract performance reviews to save members time and money. Receiving local support from industry experts. A nationwide team of member representatives understands member needs to ensure member satisfaction and success. Educational organizations can join the E&I cooperative at no cost and with no minimum purchasing requirements. Once becoming a member, an organization can receive the added benefits of membership — including special pricing, programs, and benefits for using Pondurance as a cybersecurity provider. Learn More The education industry is an attractive target for cybercriminals, but the new partnership between E&I and Pondurance offers members the opportunity to work hand in hand with a trusted partner to stay protected against cyber threats. Learn more about the benefits of membership and how to join E&I today. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Are you looking to achieve CMMC compliance? See how working with Pondurance as a CMMC C3PAO can help you save money and achieve compliance.|Are you looking to achieve CMMC compliance? See how working with Pondurance as a CMMC C3PAO can help you save money and achieve compliance. CMMC Readiness Assessment: How Can a Registered Provider Organization (RPO) Help? Pondurance July 13, 2021 Facebook X (Twitter) LinkedIn Copy link Supply chain attacks continue to affect government and private sectors worldwide. These attacks are soft entries affecting more than just the supplier. The attack trickles down to the supplier’s customers, leading to broader incidents and severe ransomware demands from attackers. To further mitigate the rise in malicious attacks and unauthorized access to sensitive information, the Department of Defense (DoD) developed a framework to ensure contractors and subcontractors that handle controlled unclassified information (CUI) and do business with the DoD follow stringent cybersecurity guidelines. As a result, the DoD released details surrounding these guidelines, the Cybersecurity Maturity Model Certification (CMMC). The five-level CMMC framework drives suppliers and contractors of all sizes to contribute time, funds, and other resources to strengthen their cybersecurity strategies to meet compliance. Before submitting bids, an organization seeking certification (OSC) must identify the desired maturity level and then schedule a CMMC assessment with a certified CMMC third-party assessor organization (C3PAO). The CMMC C3PAOs are the only entities authorized to enter into contracts with the DoD to perform assessments. Upon completing an assessment, the auditors review the assessment and certify the organization for three years if the proper cybersecurity requirements are in place. Sounds easy, right! Organizations must understand there are limited CMMC C3PAOs available, which could lead to further delays if an OSC fails the audit the first time. Small and midsize businesses often find it more difficult than a larger enterprise to strengthen their cybersecurity defenses in-house due to budgetary constraints. To ensure the time, funds, and resources invested in obtaining a certification lead to success, OSCs can seek a Registered Provider Organization (RPO) with registered practitioners on the team to perform a readiness assessment and gap analysis. RPOs are authorized by the CMMC Accreditation Body (CMMC-AB) to provide consulting services to government contractors, subcontractors, and businesses to prepare for the CMMC assessment. Not all RPOs are created equal. It is critical for OSCs to properly vet vendors and make sure they are getting the most out of their investments and are asking the right questions: Is the RPO authorized by the CMMC-AB? Does the RPO have previous experience performing cybersecurity assessments and identifying critical security gaps? Does the RPO have deep knowledge of NIST 800-171 and other frameworks? Will the RPO provide you guided recommendations based on your desired CMMC maturity level? Does the RPO offer other services that satisfy many of the CMMC controls to help you maintain your certification while protecting your organization from today and tomorrow’s sophisticated cyber threats? Pondurance is an RPO authorized by the CMMC-AB to provide consulting services to help OSCs prepare for their CMMC assessments and provide guided recommendations on how to remediate vulnerabilities. Pondurance has decades of experience in compliance along with a range of regulatory frameworks such as HIPAA , CMMC, PCI DSS, FERPA, NERC CIP, NIST 800-53, ISO 27001/2, CMMC, and NIST 800-71. We believe the key to any good program is having a deep understanding of internal risk and third-party risk through assessments and monitoring. Learn more about our CMMC Services . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

When Cyber Threats Don’t Sleep: The Case for a 24/7 Security Operations (SOC) Pondurance November 17, 2025 Facebook X (Twitter) LinkedIn Copy link Threats to your business never stop. Malicious actors are always on the hunt for a vulnerability to exploit—whether that’s an unpatched system, human error, or other security lapse. These vulnerabilities escalate your breach risks by making it easier for adversaries to access your systems and data. Constant vigilance is essential to detecting and neutralizing threats before they can do harm. However, midsized organizations and smaller enterprises often lack the resources for always-on cybersecurity capabilities, leaving them exposed to increasingly sophisticated cyber-attacks. In this third article in our series, we’ll share how an outsourced 24/7 security operations center (SOC) works with your organization’s security team to proactively hunt for, triage, and disrupt threats before they can do harm. Read previous articles in this series: From Data Breach to Cyber Resilience with Managed Detection and Response (MDR) How MDR Makes Your Security Tools Work Better How SOC Analysts Turn Alerts to Action The first lines of defense against data breaches should be basic security policies and cyber-aware employees. Least privilege, system hygiene, role-aware training—all these are cybersecurity essentials, especially in environments where exposure is a common risk. Even so, it’s impossible to protect against every threat. If a control is bypassed—through an endpoint, cloud workload, or user action—the challenge is not receiving an alert but in determining its significance and response. For example, your SIEM or EDR may flag a suspicious executable or document, yet the alert alone rarely explains intent or scope. SOC analysts—who are often certified cybersecurity professionals — review these alerts to determine their potential for harm. They observe suspicious files in a secure sandbox, identifying key indicators that reveal the attacker’s goals, how the threat spreads, and what evidence it leaves behind. Analysts use these indicators to search for related activity across the environment and confirm whether the threat executed elsewhere. This human review uncovers patterns that automated tools may miss, and insights from multiple cases are added to a shared knowledge base to strengthen future detection and threat hunting. When Threats Masquerade as Legitimate Tools Many threats don’t look like malware. Attackers often use legitimate admin tools—such as remote access or management utilities—to blend in and avoid triggering antivirus alerts. Analysts look for unusual activity, like a first-time remote connection or an account acting outside its normal pattern, then use those clues to determine whether the activity is malicious. By continuously hunting across environments, they recognize these behaviors faster when they happen again. Attackers also disguise harmful code inside software that appears legitimate, including popular AI tools. This tactic targets developers and power users, making it important to collect telemetry from endpoints, identity systems and networks, and to have teams who track evolving attack techniques. Even with strong EDR coverage, an initial breach may not be immediately visible—especially when attackers exploit vulnerabilities without dropping malware. In those cases, analysts work backward from what they can see: unusual processes, network ports, or log entries. They use forensic methods to find the source of the breach and stop the attacker from moving deeper. EDR is still essential for host-level visibility and actions like isolating a device, but human investigation connects the dots and closes gaps that tools alone can’t catch. 4 Ways Pondurance SOC Improves Cyber Resilience Effective cybersecurity requires human expertise to interpret alerts, adjust detection logic, and act when something is wrong. Pondurance’s 24/7 SOC provides that operational maturity. 1. Continuous Monitoring by a U.S.-Based SOC Pondurance provides continuous monitoring from a U.S.-based SOC, ensuring that qualified analysts are available at all times to investigate alerts and take action. Local coverage minimizes communication delays and reduces handoff complexity during response. Analysts can isolate compromised endpoints, stop malicious activity, and guide containment as events unfold. 2. Real-Time Threat Intelligence and Adaptive Detection Threat activity changes quickly, and detection logic must evolve with it. SOC analysts continuously update detections using peer intelligence, public reporting, and threat research—even when campaigns are targeting other industries. New rules are applied proactively to account for shifts in attack patterns. Prioritization remains focused on active and emerging threats rather than legacy malware. 3. Focused Detection That Reduces Alert Noise Not every possible alert adds value. Pondurance applies a selective approach, enabling rules that are relevant to actual threats and client environments. Analysts validate context, adjust thresholds, and tune detections to reduce unnecessary noise—helping ensure that escalated alerts represent meaningful risk and support faster decision-making. 4. Visibility and Expertise Close Coverage Gaps Endpoint tools can miss activity that appears at the network or identity level, and some EDR tiers don’t log enough telemetry for full investigation. The SOC reviews existing coverage and recommends improvements such as deploying additional agents, adding network sensors, or enabling higher-tier logging. Clients also benefit from collective insights across environments and access to digital forensics and incident response support if a breach occurs. “We truly have middle-of-the-night visibility and the peace of mind that comes from knowing that someone is still looking at our data even after our analysts have gone home at the end of the day,” says Pondurance user Tobey Coffman, who is director of information security services at Ball State University in Ohio. “Let’s face it: Bad guys don’t care about business hours. If something happens at 2:00 am, it’s important to have the confidence that our vendor enables us to get on it right away.” Learn how Ball State grew its partnership with Pondurance from a single penetration test into a fully managed, 24/7 detection and response program. Check out the podcast . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026