Cybersecurity incident response is key to fighting cyberattacks. Learn the basics of IR and how to reduce the impact of potential threats.|Cybersecurity incident response is key to fighting cyberattacks. Learn the basics of IR and how to reduce the impact of potential threats. How to be Resilient Against Cyberattacks With Incident Response (IR) Pondurance September 23, 2021 Facebook X (Twitter) LinkedIn Copy link Ransomware attacks continue to evolve, while cybercriminals are finding new techniques to extort more funds than ever from healthcare, government, manufacturing, education, and private sectors worldwide. These high-profile attacks stress the importance of cybersecurity incident response (IR) and IR planning to identify, prevent and respond to business disruptions and avoid millions in losses. But what is cybersecurity incident response, and why is it important? After reading this blog, you will understand the basics of IR and how a comprehensive and tested response plan can help get you through an incident in a more efficient and resilient fashion. What Is Cybersecurity Incident Response (IR)? Cybersecurity incident response is a methodical process an organization uses to handle a cyber threat . The goal of IR is to help an organization quickly detect and respond to threats to minimize damage and reduce recovery time and costs. According to the National Institute of Standards and Technology, there are four critical phases in IR: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity.* Setting the framework in an incident response plan for your company sets the stage if an incident does occur because you’ll be prepared to tackle the incident with the steps outlined and get back to normal operations in a timely manner. An IR plan gets all the right people involved from the start, assigns roles, and advises on what to do and at what stage in terms of responding to the attack with your security operations center (e.g., shutting off power to all servers to prevent the attack from growing). Why You Need Incident Response When a cybersecurity incident is not adequately handled, it can have very damaging outcomes, including data loss, high costs, and harm to your organization’s reputation. The time to identify and mitigate threats is of the essence when it comes to outlining an IR plan. An organization must understand that the objective is to have a team in place that can quickly mitigate and restore business operations as fast as possible. An effective cybersecurity incident response strategy’s goal is to: Identify the threat. Minimize loss. Fix vulnerabilities. Restore operations. Strengthen security to avoid future attacks. IR is a crucial component to any organization, regardless of industry and size. Ransomware attacks can cost an organization upward of $4.4 million per incident.** What You Can Expect From an Incident Response Vendor Some organizations cannot completely eradicate cyber threats on their own. IR can be overwhelming, which is why many organizations turn to managed detection and response (MDR) providers and MSSPs for the planning and execution of their IR plan. The clock is ticking once they identify a threat, and organizations need specialized cybersecurity experts to help them respond to a compromise. Ransomware groups can go from entry to total encryption of your system within an hour. Some common entry methods are: 1) email attachments or links, 2) legitimate credentials that were stolen, and 3) exposed remote desktop protocol services or unpatched remote access devices. With Pondurance as your cybersecurity incident response partner, you are better prepared to successfully mitigate threats and always have a team of experts armed with leading technologies to respond and mitigate even the most sophisticated cyberattacks. Should you experience or suspect a breach, you have access to the Pondurance IR team. Our team goes to work, quickly utilizing our proprietary technology suite and experienced team of responders, handlers, and forensic specialists to respond to the incident. We work with you to identify, contain, eradicate, and recover from the breach and communicate with you and your stakeholders every step of the way. Pondurance’s IR approach combines our industry-leading MDR platform with our experienced team of threat hunters to provide: Identification – Identify and detect an incident as soon as possible. Containment – Stop the incident and reduce impact. Eradication – Eliminate the threat and prevent recurrence. Recovery – Return to normal operations and conduct a post-breach investigation. Pondurance delivers IR services and guides organizations every step of the way. Learn more about IR planning in our eBook Incident Response Planning . Sources * Computer Security Incident Handling Guide , NIST, August, 2012. ** Cost of a Data Breach Report 2021 , IBM, 2021. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Cyberattacks are increasing in scale, making organizations question how to defend themselves against cybercrime. Learn how in this blog.|Cyberattacks are increasing in scale, making organizations question how to defend themselves against cybercrime. Learn how in this blog. Fighting Back Against Cybercrime. Learn From Our Experts. Pondurance October 21, 2021 Facebook X (Twitter) LinkedIn Copy link American companies have seen a sharp increase in large cyberattacks in 2021, including the SolarWinds hack , the Colonial Pipeline crisis, the Microsoft Exchange Server exploit and the Babuk ransomware attacks. These cyberattacks have left companies of every size and industry asking questions. What is the U.S. government doing to defend against cybercriminals? How do we defend our companies against cybercrime? What cybersecurity tools and solutions can help us to fight back? Niloofar Razi Howe, Chair of the Board of Directors, and Lyndon Brown, Chief Strategy Officer, provide answers to these important questions and offer their perspectives on cybercrime and today’s complex cybersecurity landscape in The Next Phase of Cybersecurity podcast with host Max Gurtain. Niloo and Lyndon discuss powerful topics such as: Motivations and strategies of cybercriminals. Our adversaries are stealing our defense secrets, personal information and intellectual property, and they are profiting from these crimes without penalty. Cybercriminals are taking advantage of vulnerabilities within the U.S. system and are using out-of-date laws and regulations, such as our infrastructure surveillance regulation, against us. “There is no silver bullet,” says Niloo. “It will be a hundred different things we have to do simultaneously to make a dent in the issue. We need to do more, faster.” Niloo offers a few suggestions for how to make that happen. The talent shortage. Across the industry, there’s a massive talent shortage. Niloo talks about the hard work that cyber experts are doing in the industry and discusses some innovative options for encouraging new people into the industry and bringing experienced talent back to cybersecurity. Ways to defend against attackers. Defenders can never let their guard down against cybercriminals. The private sector needs to stay vigilant and understand that any company can be a target. Niloo also explains how government must do its part to hold countries accountable for harboring cybercriminals. Company pain points. Lyndon discusses the issues that keep executives up at night: budgets , the increasingly brazen behavior of attackers, compliance issues and the challenges of maturing their cybersecurity programs. Cybersecurity approaches. Best practices for effective cybersecurity have evolved as the scale of attacks has evolved. Companies need to understand the current cyber landscape and know which products and services work best for their needs. “The attack landscape is drastically increasing, and the average business simply does not have the threat intelligence or the human capital to not only keep the attackers out but also deal with attackers once they gain access,” says Lyndon. He discusses products and services that companies will want to consider to protect their data. Cybercriminals are launching more sophisticated attacks, and any company can be a target. Learn what you can do to make a dent in the fight against cybercrime . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Despite advancements in technology, the human element in cybersecurity is critical to defending complicated cyber threats in real-time. The Human Element: The Key to a Successful Cybersecurity Strategy Pondurance April 21, 2023 Facebook X (Twitter) LinkedIn Copy link Organizations are turning to new technology, evolving security strategies, machine learning, and artificial intelligence (AI) to improve their cybersecurity posture in today’s landscape. In the midst of these technological advancements, it can be easy to lose sight of the most important factor in cybersecurity — the human element. Without a human-centric approach, many organizations lack the fundamental skills to defend themselves against the most sophisticated attacks, such as the Solarwinds breach that occurred in 2020. The Human Element of Cybersecurity A common pain point organizations continue to face is the lack of skills in the cybersecurity community. In fact, in a recent study, 70% of cybersecurity professionals stated their organizations are negatively impacted by the shortage of internal cyber skills and expressed increasing difficulty keeping their existing workforces engaged. However, midsize and enterprise organizations are not the only ones suffering from a lack of talent. A senior cybersecurity official at the Department of Homeland Security described the challenges associated with recruiting skilled cybersecurity talent as a “national security issue.” Threat actors are humans. They leverage advanced technology such as machine learning and AI to both discover and take advantage of new vulnerabilities found in software, networks, and infrastructure. It’s important that organizations understand that technology alone can’t stop attackers; it’s critical to invest in a cybersecurity workforce that can keep up with sophisticated threats. However, it takes significant time, money, and training to attract, retain, and develop these teams. As a result, organizations are turning to managed detection and response (MDR) services as a cost effective means of integrating the human element into their cybersecurity strategies. According to Gartner, by 2025 nearly 50% of organizations will be using MDR services to protect their business. While armed with technology, cybersecurity teams need to be “people taking care of people”. Real-Time Alerts Backed by Human Intelligence Proficient alert management is a critical factor in climbing up the Detection and Response Maturity Model. Unfortunately, the vast majority of alerts go uninvestigated due to limited internal expertise — the human element — to both verify and block confirmed threats in real time. Triaging alerts can be a difficult task, especially when 41% of organizations are seeing upwards of 10,000 alerts every day, which puts them at a major risk of alert fatigue. Real-time alerts backed by human intelligence can be achieved by utilizing a 24/7 MDR service that can act as an extension of an organization’s existing security team or as its only security team. The experts are tasked with investigating what happened on the network, understanding what it means, and taking prompt action against cyberthreats. When the Human Element Meets Technology & Processes While there is no substitute for human intelligence, understanding how to apply the human element to an organization’s existing technology stack and processes is essential to rapidly detect, analyze, investigate, and actively respond to threats. Most organizations are turning to MDR services for an optimized approach to integrating the human element with their technology and internal processes. Technology is still a valuable tool to ensure 360-degree visibility across an organization’s digital landscape, allowing organizations to detect threats and anomalies that a sophisticated actor could evade. However, the technology must be managed and monitored by an MDR service that can integrate the human element, technology, and mature processes to act as a remote SOC ingesting logs, packets, and endpoint data and applying expertise, analytics, and threat intel to detect and proactively block threats throughout the customer’s environment. Real-time cybersecurity defense backed by human intelligence is a critical piece that organizations are missing to succeed in today’s threat landscape. Learn more about selecting an MDR provider with our 5 Things to Consider When Choosing an MDR Provider eBook. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Stay ahead in cybersecurity with this blog. Explore top trends, critical vulnerabilities, and expert threat hunting tactics for robust protection. Cybersecurity Trends, Notable Vulnerabilities and Threat Hunting Tactics Pondurance July 27, 2023 Facebook X (Twitter) LinkedIn Copy link As part of our ongoing efforts to support our clients, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. Over the past few months, the team discussed notable vulnerabilities and trends, provided a threat intelligence review, and explained some recent threat hunting tactics. Vulnerabilities and trends The Vulnerability Management Team Lead, kicked off the client webinar with a look at Microsoft’s Patch Tuesday releases for May 9, which included 38 vulnerabilities. Three of those vulnerabilities were zero-day exploits: 1) a vulnerability in the Win32k driver that allowed for elevation of privileges to the system, 2) a secure boot bypass call that allowed the attacker to install an affected boot policy, and 3) a Windows object linking and embedding remote code execution that enticed a victim to open an email using a vulnerable version of Outlook software. The team discussed recent new findings seen in vulnerability scans. In particular, threat actors have exploited a remote code execution vulnerability in the Microsoft message queuing service to target specific applications, such as financial services, e-commerce, and sales automation software. This form of attack showed up on internal vulnerability scans for almost every client in May. The Pondurance team recommends several strategies and configuration changes to combat such vulnerabilities in client networks. These include: Splitting off workstations and servers and running them in separate scans Running a discovery scan in Nexus and performing manual target discovery work Scanning only selected assets, rather than scanning hundreds of assets over several nights Increasing the scanning window Deploying multiple virtual machines for internal scans In addition, the vulnerability management team is looking at ransomware cases. Specifically, the team is investigating vulnerable installations of flawed Veritas backup software found on the internet. Threat intelligence review The Security Operations Center discussed recent updates to the #StopRansomware Guide , a comprehensive resource to help businesses reduce the risk of ransomware attacks by using best practices. The updates included recommendations to prevent common initial infection vectors, an expansion of the ransomware checklist with threat hunting tips for detection analysis, recommendations to address cloud backups and zero-trust architecture, and many others. The SOC team also provided an in-depth look at the BlackCat ransomware group, known as ALPHV, which continues to increase its number of observed victims. As many as 8,300 organizations have fallen victim to ALPHV in the last 60 days, according to Recorded Future News. And if the mere number of victims is not enough to cause alarm, some of the ransom demands have exceeded $2 million. In addition, the team identified the top four hashes associated with ALPHV and suggested that the hashes used in the attacks appear to be tied together, leading cyber defenders to the conclusion that the various groups are working in unison. “These threat actors are getting the bands together again and creating a supergroup even,” -Pondurance SOC. Recent Threat hunting tactics The Security Operations Center Team Lead, continued the discussion about ALPHV, identifying potential scenarios around the group’s known execution chains and explaining how the Pondurance team hunts for indicators of compromise (IoCs) generated during the group’s attacks. The Team Lead explained that the first method of attack for ALPHV is the exploitation of an unpatched exchange server. The group uses different tactics, techniques, and procedures during the attack life cycle, which can include: Using net.exe to collect system and network information Gathering active directory environment information via tools such as ADRecon and AdFind Dumping credentials via local security authority processes that allow them to steal credentials Using the credentials to move laterally in the system to escalate and elevate privileges Exfiltrating data using tools like MegaSync and Rclone Gathering domain configuration, intellectual property, personally identifiable information, and protected health information to use as a form of double extortion A second attack method involves the use of compromised credentials, purchased on the black market, to gain initial access to a victim’s environment. Once the group has access, ALPHV collects system information to learn everything necessary to move laterally throughout the network, dropping and installing legitimate software. Then, the threat actor continues working on credential theft, attempting to escalate and elevate privileges. Ultimately, ALPHV will execute BlackCat malware to receive the ransom payment. The Pondurance team has many tactics to proactively and retroactively hunt a threat actor such as ALPHV. Several IoCs that the team hunts are: Common hashes, executables, dynamic-link libraries, and file names Parent-child process relationships, specifically looking at the AdFind tool Rclone executing at the command line Network-based signatures Impackets run as a service on an endpoint Modification of firewall and remote desktop rules Endpoint detection and response agents For more information check out our latest blogs Experiencing a breach? Contact Us Emergency IR Hotline: 888.385.1720 Email: dfir@pondurance.com Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Taking a risk-based approach to cybersecurity is one of the most impactful strategies to protect against cyberattacks. Learn more in our blog! CEO Discusses MDR Service With a Risk-Based Approach Pondurance May 3, 2024 Facebook X (Twitter) LinkedIn Copy link Every organization has its own combination of cyber risks, including endpoints, internet-connected devices, apps, employees, third-party vendors, and more. Year after year, the risks continue to grow more complex and new threats emerge as threat actors become more sophisticated and the use of artificial intelligence aids their efforts. There’s not much an individual organization can do to change the evolving cyber landscape, but every organization can control its own cybersecurity strategy. Taking a risk-based approach to cybersecurity is one of the most impactful strategies to protect against cyberattacks. A risk-based approach to cybersecurity focuses on the specific risks of a organization, taking into consideration what the organization wants to accomplish and what it wants to protect. Organizations that use risk-based cybersecurity benefit from the approach. These organizations find over 50% of incidents within one day, stop three times more attacks outright, and see impactful breaches reduced from 76% to 28%, according to an Accenture cybersecurity report . Doug Howard, CEO at Pondurance, believes managed detection and response (MDR) providers should take a risk-based approach to cybersecurity and offered his perspective in a recent video interview with Tom Field, Senior Vice President at Information Security Media Group. Doug discussed several aspects of Pondurance’s risk-based approach including: Cyber risks. Cyber risks include blind spots, gaps, and weaknesses in the network that make an organization vulnerable to threat actors. These vulnerabilities can include an expanded attack surface, new employees with a lack of phishing training, and improper implementation of multifactor authentication (MFA) on a network, to name a few. A risk-based cybersecurity approach will identify your organization’s unique cyber risks, prioritize the most important risks, and find the most impactful ways to protect your organization against those risks. “There are different kinds of risk,” says Doug. “Our definition is specifically around cyber risk. We focus on making sure that the areas of risk associated with you doing business in the digital world are addressed, so you can lower risk on a continuous basis.” Compliance. Cybersecurity regulations continue to evolve with strict requirements for heavily targeted industries, such as healthcare, financial services, and retail, at both the federal and state levels. For example, the Gramm-Leach-Bliley Act imposes federal cyber regulations on financial institutions, and the New York Department of Financial Services cybersecurity regulation has some overlap as it imposes state rules on New York financial institutions . The laws require that organizations meet basic standards to ensure the security of their information systems to protect consumer data. Doug briefly discusses the importance of putting in place basic standards for cybersecurity, such as implementing MFA and staying current on patch management, to protect a client’s environment. He also explains the compliance implications of knowing where critical data is on your network and understanding how your organization would be affected if that data were compromised. Questions for MDR providers. Today, most MDR providers claim they have a risk-based approach to cybersecurity, but do they? The only way to know for sure is to ask the tough questions. Does the provider know precisely where your critical data is located on the network? Does the provider know your vulnerabilities? Does the provider understand the risks of your users? Doug discusses these questions and others that you should ask to determine whether an MDR provider is truly using a risk-based approach to protect your organization against cyberattacks. Client benefits. A quality MDR provider will help clients embrace a risk-based approach to get the most out of their cybersecurity programs. At Pondurance, the risk-based approach drives everything the team does. As the first and only MDR provider to be built around a risk-based approach, the Pondurance team believes it is the best strategy to protect clients from threats and reduce their exposure to attacks. Doug explains how Pondurance partners with clients for the long term to keep cyber risks from having a negative impact on their organizations. Your organization has cyber risks, and it’s important to know what those risks are and how they could affect your organization if a cyberattack occurs. Learn more about Pondurance’s risk-based approach to cybersecurity. Watch the video here . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

A Fact-Based Opinion Series on Quantum Computing and Cybersecurity The Quantum Clock is Ticking Doug Howard May 21, 2026 Facebook X (Twitter) LinkedIn Copy link There is a moment coming that the intelligence community has quietly named Q-Day — the day a quantum computer becomes powerful enough to break the encryption protecting virtually everything we do online. Financial transactions. Government communications. Corporate intellectual property. Military command and control. All of it secured using cryptographic standards that quantum computing will render obsolete. Most security leaders are aware of Q-Day in the abstract. Very few are acting on it with the urgency it demands. And almost none are grappling with the concept I want to introduce in this series - one I believe is more immediately dangerous than Q-Day itself. I call it C-Day. "C-Day is not a future event. For sophisticated nation-state actors, C-Day has already happened. The breach is silent. The damage is invisible. And the detonator is set." - Doug Howard C-Day is the capture day - the moment adversaries shift from opportunistic data theft to strategic, quantum-anticipatory collection. The deliberate, systematic harvest of encrypted data today, stored with patience, waiting for the quantum capability that will eventually decrypt it. Here is the critical point: C-Day is not a future event. For sophisticated nation-state actors, C-Day has already happened. The breach is silent. The damage is invisible. And the detonator is set. This is the first in a series of articles I'm writing on quantum computing and its implications for cybersecurity over the next 25 years. My goal is straightforward - to provide a fact-based, analytically grounded perspective on how quantum will reshape the threat landscape, with specific, dated projections I am willing to stand behind. Not hedged speculation. Not vendor positioning. A practitioner's forward-looking assessment, informed by decades in national security, cybersecurity operations, and executive leadership. Let me start with the foundation. What Quantum Computing Actually Is Classical computers - every laptop, server, and smartphone on the planet - process information in binary: ones and zeros, on or off. Every calculation is a sequence of bits in one of two states. A classical bit has no states beyond that binary limit, it must be either a zero or a one. Quantum computers operate on fundamentally different physics by introducing the quantum bit, or qubit, which can exist in a superposition of multiple states simultaneously. Two entangled qubits (quantum-linked particles that influence each other) can represent four states simultaneously. Four qubits can therefore represent 16 states simultaneously.The processing power scales exponentially with each additional qubit. For most computational tasks that we perform today, this distinction is academic. Quantum computers are not universally faster than classical machines - they are specifically advantaged for certain categories of problems. One of those categories happens to be the mathematical problems that underpin modern encryption. We will expand on this in more detail in this series on Quantum. RSA encryption - the standard protecting the majority of internet communications - derives its security from the computational difficulty of factoring very large numbers. A classical computer factoring a 2048-bit RSA key would require longer than the age of the universe. A sufficiently advanced quantum computer running an algorithm developed by mathematician Peter Shor in 1994 (which has already been proven on smaller calculations) could accomplish it in hours. Possibly minutes, at sufficient scale. That is Q-Day. Where We Are on the Timeline The honest answer is that we do not know precisely when Q-Day arrives - and anyone claiming certainty in either direction is not being straight with you. What we know with confidence: IBM has deployed processors exceeding 1,000 qubits. Google has demonstrated quantum supremacy for specific computational tasks. IonQ is pursuing commercial quantum computing on a roadmap measured in years, not decades. China's national quantum program - including the Jiuzhang photonic quantum computer - represents a state-level investment that is not constrained by commercial timelines or shareholder expectations. The standard industry projection puts the timeline for the development of cryptographically relevant quantum capabilities (i.e. a machine capable of breaking RSA-2048 at operational scale) at somewhere between 7 and 15 years from now. That range comes from credible researchers and institutions resulting in NIST actions to finalize post-quantum cryptographic standards in 2024 and the National Security Agency took it seriously enough to mandate migration timelines for national security systems to adopt the Commercial National Security Algorithm (CNSA) 2.0 . But that 7–15 year estimate was derived largely without accounting for one variable that has changed dramatically in the past three years: artificial intelligence. AI Is Compressing the Timeline The hardest unsolved problems in quantum engineering are not theoretical. They are engineering problems like qubit error correction, logic gate fidelity, and qubit stability at scale. These are precisely the categories where the application of AI and machine learning is demonstrating accelerating capability. Google DeepMind's AlphaQubit model, published in 2024, achieved state-of-the-art quantum error correction through machine learning - outperforming the best human-designed algorithms. This is not an isolated result. AI is being applied across the quantum development stack: optimizing circuit design, accelerating materials discovery for more stable qubit architectures, improving calibration systems that currently require significant manual engineering effort, and more. The compounding effect of AI-accelerated quantum development is not yet reflected in most public timeline projections. My assessment: the 7–15 year window is an optimistic estimate built on yesterday's assumptions. Organizations and analysts treating 2035 as a safe planning horizon are making a material error. The timeline is moving, and it is not moving in our favor. C-Day: The Threat Already in Motion Here is where I want to introduce the framework that will run through this entire series. The quantum threat is typically framed as a future event - something to prepare for before Q-Day arrives. That framing is dangerously incomplete and ignores the strategic behavior of the adversaries who have the most to gain from quantum capability. Nation-state actors - particularly China's Ministry of State Security and affiliated advanced persistent threat groups - operate on planning horizons that make most corporate strategic plans look myopic. They do not need quantum capability today to benefit from it. They need collection infrastructure today, and patience. The doctrine is known in practitioner circles as harvest-now-decrypt-later. I call the moment it becomes systematic and strategic “ C-Day” - the capture day . It is my original contribution to this framework, and I introduce it specifically because the existing terminology fails to communicate the strategic significance of the collection moment. Q-Day gets the attention. C-Day is where the actual damage happens and, in fact, may already be happening. The evidence that C-Day has already occurred is not circumstantial. The Salt Typhoon operation - disclosed in 2024 - revealed Chinese state actors maintained persistent access inside U.S. telecommunications infrastructure for years, in some cases undetected. The 2015 US Office of Personnel Management breach exfiltrated 21.5 million personnel records, including detailed security clearance files with a shelf life measured in decades. The SolarWinds supply-chain attack compromised 18,000 organizations with dwell times measured in months. In each case, the full value of what was collected was not understood at the time of discovery - and in the quantum context, may not be fully understood for another decade. Those are the known operations. The more significant threat is what I call C-Day Scenario 2: the persistent, low-and-slow collection operations that have never triggered a detection event, never surfaced in a forensic investigation, never appeared in a threat intelligence feed. Silent collection at scale. Patient adversaries building a library of encrypted data that becomes a strategic asset on Q-Day. The C-Day → Silent Window → Q-Day construct is the framework I will use throughout this series. It is not hypothetical. The Silent Window is active right now. The question for every security leader reading this is not whether Q-Day is coming. It is what was collected on C-Day - and how much collection is still happening at this moment. The 25-Year Arc This series will track quantum's impact across a 25-year horizon, divided into five phases. The Silent War (Now - 2028). C-Day operations active across multiple nation-state actors. AI compressing the quantum development timeline in ways not yet reflected in public consensus. Post-quantum cryptographic standards are available but enterprise adoption is still nascent. The breach is ongoing; but most organizations do not know it. The Capability Threshold (2028 - 2033). First credible nation-state quantum capability sufficient for targeted attacks on high-value encrypted systems. Not public. Not commercial. But operationally real. Its existence will be inferred from behavior, not by announcement. The Public Reckoning (2033 - 2038). Commercial quantum capability reaches the demonstration threshold. The C-Day collection operations of the 2020s become the enforcement cases, breach disclosures, and possible litigation of the 2030s. Consequential exposure of regulated data, intellectual property, damaging information and more could become prevalent. Some of the data will be dated and useless, but often still regulated. Regulatory frameworks scramble to catch up. Quantum-Native Architecture (2038 - 2048). Security infrastructure is redesigned from the ground up. The quantum internet begins replacing classical secure communications for critical infrastructure. AI-native, quantum-enhanced detection and response becomes the baseline expectation. The New Normal (2048+). Quantum capability commoditized. Classical encryption is legacy infrastructure. The threat landscape operates at a fundamentally higher order of complexity than today - with the same dynamic of continuous offense-defense evolution, scaled beyond current imagination. Each phase carries specific implications for security leaders, boards, and the organizations they are responsible for protecting. I will address each in detail across this series. The Howard Projection I want to be direct about something. This series will include specific, dated predictions - not hedged observations, not ranges designed to be unfalsifiable. Predictions I am willing to stand behind and be held accountable to over time. That is the only kind of projection that carries analytical value, the only kind worth publishing. For this first installment: By 2027 , post-quantum migration will be a federal contractor compliance requirement with enforcement teeth, cascading mandatory timelines into every organization operating within the defense industrial base. Organizations that have not begun will be scrambling to catch up under financial and regulatory pressure rather than strategic choice. By 2028 , at least one nation-state actor - most likely China - will achieve state-classified quantum capability sufficient for targeted attacks on legacy encrypted communications. This will not be publicly disclosed. Its existence will be inferred from how the intelligence community behaves: accelerated migration mandates, changes in classification practices, and the quiet urgency with which federal agencies begin treating post-quantum migration as a national security imperative rather than a compliance exercise. By 2029 , cyber insurance underwriters will begin requiring documented post-quantum cryptographic posture as a condition of coverage for organizations in high-risk sectors. The market will price quantum risk explicitly, and organizations without a documented migration program will feel it in their premiums before they feel it in a breach. By 2045 , classical public-key encryption will be effectively retired from critical infrastructure globally. The organizations that began post-quantum migration before 2030 will have done so on their own terms, with their own timelines, and at manageable cost. Those that waited will have done so under regulatory compulsion - or following a breach that made the decision for them. The clock is running. C-Day, for many organizations, has already passed. The question now is what you do with the time remaining in the Silent Window. In the next installment, I will go deep on C-Day - its three scenarios, the adversaries actively operating the doctrine, and why the most dangerous breach in your organization's history may be one you will never detect with classical security tools. About the Author Doug Howard is the CEO of Pondurance, an AI-powered managed detection and response firm providing MDR, digital forensics and incident response, and cyber advisory services. He previously served in the U.S. Air Force and held roles at the Pentagon. He writes on cybersecurity, artificial intelligence, and emerging threats at the intersection of national security and enterprise risk. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

What is MDR? The people and technology needed to defend your organization. Learn more about MDR cybersecurity offerings here. What Is MDR? Pondurance February 17, 2022 Facebook X (Twitter) LinkedIn Copy link Over the past two years, businesses, governments, and individual users have experienced a marked increase in cybercrime. The FBI reported that internet crime complaints from May 2020 to May 2021 jumped from 5 million to 6 million, according to Government Technology magazine. And cybercriminals aren’t expected to slow down anytime soon. Most experts agree that no organization or industry is completely safe from cyber threats, but there are ways to protect against an attack. More and more, organizations are turning to managed detection and response (MDR) services as a security solution. But what exactly is MDR? In Chapter 2 of our new eBook Managed Detection and Response (MDR) for Dummies , we discuss what MDR is, how it compares to other security solutions, and why it’s a strong choice to protect organizations like yours against cyber threats. You’ll learn: What MDR Offers MDR provides the integrated security tools needed to defend an IT infrastructure and the people required to manage and operate it. The tools might include network detection and response, endpoint detection and response, or a SIEM technology platform. But it’s most important that you have talented people available to put the security tools to work — and those people are now in short supply. Managed detection and response experts can handle monitoring, alerting, investigating, response planning, and more to defend against cyber threats. MDR services work for small and midsize organizations that can’t support a full cybersecurity team. It can also support larger organizations that want to add support to an existing team. Discover how managed detection and response can improve the incident detection and response life cycle, including the two metrics used for determining success, and understand why it’s crucial to have the right cybersecurity experts working to protect your organization. Which Security Solutions Are Available Each security solution available on the market today has unique offerings to accommodate different business needs. But there’s also some overlap in services. This overlap can make choosing a solution more challenging. In Chapter 2, you’ll learn about the most popular IT security solutions, including their benefits and drawbacks. In particular, we discuss SIEM, managed security service providers (MSSPs), and extended detection and response (XDR) solutions. How MDR Fits in the Market Managed Detection and Response provides positive results as a security solution for organizations of all sizes and industries. But how does it compare with the other security solutions available on the market today? How is MDR different from MSSPs? Why would you choose MDR over a SIEM or XDR solution? We have the answers. Find out what you need to know to choose the right solution to defend against cybercrime . You can bet that cybercriminals are scheming and exploring ways to cause harm to organizations like yours. But you have options. Learn all about MDR and compare it to other cybersecurity solutions to decide which solution would work best to protect your organization from a cyberattack. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

How are honeypots and honeytokens used? And what do you need to know to get started? Find out in our blog.|How are honeypots and honeytokens used? And what do you need to know to get started? Find out in our blog. Honeypots, Honeytokens and Some Things to Consider Before Deployment Pondurance November 3, 2021 Facebook X (Twitter) LinkedIn Copy link Looking to lure cybercriminals to your doorstep? Enter honeypots and honeytokens. They are a safe environment to lure bad actors and see how they work. Specifically, honeypots are systems or servers that are meant to be attacked and honeytokens are tokens or objects that when interacted with would indicate an attack. What are honeypots and how are they used? There are various use cases for honeypots. One of the use cases is research. For example, one of the popular honeypots we’ve seen and used are SSH honeypots. SSH honeypots were put on the internet to observe what credentials the attackers or bots are attempting to use brute force or login to a system. One of our findings is that the attackers were using default credentials for some popular IoT devices. Additionally, we discovered that the attackers were deploying cryptocurrency miners or DDoS bots. Researchers also set up new honeypots for a new attack or threat. For example, if I’m aware that someone is compromising Exchange Servers, I could set up a vulnerable Exchange Server and see what the attackers do after compromising it. Another use case for honeypots is to detect an attacker inside of a network. From various reports and forensics incidents, we know that after initial compromise, some of the attackers like to scan the network and look for RDP and file shares. Implementing a honeypot for detecting signs of scanning would help us detect this behavior earlier in the attacker life cycle. There are various types of honeypots when it comes to interactivity. There are low and high interaction honeypots. Low interaction honeypots just provide basic functionality of a system they’re pretending to be. High interaction honeypots are very close to a real system that they’re pretending to be and provide a lot of functionality. The nature of having honeypot systems does increase your attack surface. A honeypot system is just another system and just another application that could also suffer from vulnerabilities or bugs. When considering deployment, attack surface and risk of deployment should be considered as well. What is a honeytoken? Honeytokens are objects such as API keys, files, etc. that when opened or used indicate that someone was able to access them. For example, a honeytoken could be an API key that is saved in a database somewhere and use of that key would indicate compromise of that database. Files can also be tokens as mentioned before. Certain file types will make a network connection when opened. This functionality can be used to detect a file being stolen and opened by an attacker. Things to consider before deploying honeypots There are some things you should consider before deploying a honeypot. What needs to get detected? Placement of the honeypot and the type of honeypot would depend on what your organization is hoping to detect. For example, are you attempting to detect insider threat, lateral movement, or credential compromise? Do the attacks you’re hoping to detect match what the real threat actors do? Knowing what specific attacks you’re trying to detect based on your threat model combined with intelligence about actions from real threat actors can be useful. Actions conducted by real threat actors may also differ from what a pentester may do (sometimes). Think about what specifically needs to be detected. We recommend reviewing your internal security testing reports, public incident response for forensics reports, and reports on threat actors to understand what the real attacks look like. Honeypot location Honeypot placement matters, especially for detecting certain threats or actions. A honeypot that’s exposed to the internet may be very noisy and may not spot threats specifically targeted at you. Honeypots placed internally can help look for post-compromise actions, depending on various other factors. Another thing to consider is making honeypots believable when it comes to placement. It would be beneficial if the honeypot and it’s properties (hostname, services, etc.) matched the environment it’s placed in. Honeypot discovery Think about how an attacker may discover the honeypot and what they have to compromise or what other work they have to do before they discover the honeypot. If discovery of the honeypot is too hard or too late in the attack lifecycle, its placement may need to be changed. Detection / Logging Logs from the honeypot should have enough information for an action to be taken, depending on how the honeypot is set up and how a threat actor interacts with it. Having fields such as username or IP could be useful. Depending on the honeypot or token, detection may differ based on the location of the hunt. Detection alerts could be generated from a SIEM or from a service that tells you that something used a token. Some ideas for cybersecurity honeypots and honeytokens Set up an internal RDP server Setting up an internal RDP server could be interesting. You could try to see who accesses it, if nobody is supposed to be accessing it. We’ve often seen threat actors bring in tools such as Advanced IP Scanner to look for internal RDP servers to access. Set up an internal file share Having an internal SMB share or an FTP server for someone to discover could be a good way to catch people that are doing internal scanning and then attempting to access files. Both SMB servers and FTP servers can have their logs sent to a SIEM for alerting. Place honey files or canary files Putting various types of canary files in various locations could be useful if you’re trying to detect someone accessing and opening them. Canarytokens.org (by Thinkst) generates files and tokens that can be used as honey files. Watch out for vulnerabilities One of the biggest things to watch out for when using a honeypot is to make sure that you do not accidentally allow attackers more access to a system than they should. You ensure that the attacker can’t use the honeypot system to attack other things (unless that’s what you want) or gain additional information such as valid credentials to different systems and services. You should understand the risks that come with creating and managing your own honeypot systems if you plan to do that. Interested in learning more about threat hunting? Through our Managed Detection and Response (MDR) engagements, our clients have 24/7 access to our Security Operations Center and can communicate with the team through the SCOPE portal. Learn more about our MDR services. Resources/Useful links: https://github.com/thinkst/opencanary https://github.com/pwnlandia/mhn https://github.com/CommunityHoneyNetwork/rdphoney http://canarytokens.org/generate https://blog.thinkst.com/2021/09/a-mysql-canarytoken.html – Thinkst does some great research related to honeypots. https://chrissanders.org/2020/09/idh-release/ – This book is great if you want to understand, deploy, and maintain honeypots Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

As the cyber threat landscape evolves, modern MDR services must adapt to defend against threats. Learn the critical pivots in this blog. As the Threat Landscape Shifts, Modern MDR Must Go Beyond Legacy Solutions Pondurance June 21, 2022 Facebook X (Twitter) LinkedIn Copy link Cyber threats have changed substantially over the years. The types of threats are different, with ransomware and supply chain attacks becoming increasingly prevalent compared to years ago. Cybercriminals and nation-state actors are more sophisticated and motivated than ever. Every company, large or small, across all industries, finds itself with a target on its back. Sometimes the company is a target by design – other times, a target of opportunity. In fact, more than 60% of companies worldwide experienced at least one cybersecurity incident in the last year, according to TechJury. Lyndon Brown, Chief Strategy Officer at Pondurance, talks about the shifting cyber landscape in an interview with Mathew Schwartz of Information Security Media Group at the RSA Conference in San Francisco. Lyndon discusses how cybercriminals are monetizing data and how modern managed detection and response (MDR) services have adapted to defend against today’s threats. Cybercriminals monetize data “Cybercrime is big business,” said Lyndon. “Cybercriminals all around the world have figured out ways to get very rich … and that’s been a big shift over the last decade or so.” In years past, only specific, monetizable data was considered valuable, such as medical records and credit card information. But today, to maximize their business profits, cybercriminals have changed their perspective on what is monetizable data. Learn what Lyndon says about monetizing data and how it may increase your company’s risk of ransomware and supply chain attacks . Modern MDR responds As cybersecurity threats shift, MDR providers must pivot to stay one step ahead of the bad actors. A few of those important pivots involve integrated response, customization, and integration: Response. With traditional MDR, companies benefited from MDR services such as triage, detection, and limited response to threats. Modern MDR has advanced from there with threat blocking, 360-degree visibility, 24/7 threat hunting, and more. Also, discover why Lyndon believes early detection and response is key to minimizing attack damage. Customization. One size no longer fits all in cybersecurity. Companies have different technology infrastructures, levels of cloud adoption, business perspectives, and levels of risk tolerance. MDR providers need to understand the risks their clients are willing to take and know what data they most want to protect. Integration. Early on, companies either had to handle their cybersecurity in-house or give up control to a service provider. But you no longer have to forgo control to benefit from MDR services. Lyndon explains how modern MDR providers like Pondurance can integrate with your company’s existing team and technology and allow your team to maintain visibility and control over your own data. Learn more about modern MDR Over the years, the cyber landscape has changed with new types of attacks, more sophisticated cybercriminals, and a broadened definition of who is a target. But MDR providers are adapting to defend against cybercriminals. Learn how cybercriminals are monetizing data and how MDR providers must implement critical changes to keep up with modern threats. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Read this blog to learn more about the challenges of ransomware, why organizations are adopting MDR, and the need for talented cyber experts.|Read this blog to learn more about the challenges of ransomware, why organizations are adopting MDR, and the need for talented cyber experts. Combating Ransomware with MDR Services Pondurance November 1, 2021 Facebook X (Twitter) LinkedIn Copy link Cybersecurity breaches have been headline news throughout the COVID-19 pandemic. Organizations experience increasing threats from cybercriminals across industries, including healthcare, banking and financial services, with ransomware at the forefront of these attacks. Executives are challenged with how to protect the data of customers and patients against such threats. More and more, using managed detection and response (MDR) services is the answer. But what is MDR and how can it help? Lyndon Brown, Chief Strategy Officer, talks about ransomware and explains how MDR services can combat threats in The Security Ledger Spotlight podcast with host Paul Roberts. Lyndon discusses the challenges of ransomware, why organizations are adopting MDR and the need for talented cyber experts. The challenges of ransomware Ransomware is malware that allows cybercriminals to gain access to an organization’s data and block access to the data unless a ransom is paid, usually in the form of cryptocurrency. “Cybercriminals use ransomware because that’s where the money is”, says Lyndon. Using ransomware is a monetary strategy for them to get rich quick, and cryptocurrency as a payment is difficult to trace. “It really only takes a few mistakes by an organization to be susceptible and vulnerable to an attack,” says Lyndon. “In fact, the large Colonial Pipeline attack was caused by a single compromised password.” Enter the adoption of MDR Early on, managed security service providers focused on device management kept behind a physical perimeter, such as a firewall or antivirus product, to stop a cyber threat. But today, with the cloud and widespread information sharing, MDR providers focus on the cybercriminal before they get to the door. MDR proactively performs detection and response capabilities by leveraging advanced techniques, such as artificial intelligence and machine learning, and performing threat hunting. Lyndon discusses how a quality MDR provider should offer 360-degree visibility across an organization’s infrastructure to close gaps across endpoints, logs, networks and the cloud and should be able to manage response from end to end. Humans are needed Technology alone is not enough to solve cybersecurity issues. Organizations also need humans to detect and respond to complex security threats. “There’s somebody at a keyboard somewhere in the world trying to figure out…how to gain access to an organization’s assets to either monetize them or further their nation-state goals,” says Lyndon. “As long as you have that, someone on the other [side], you need humans on this side.” Many organizations are struggling to find cybersecurity talent, and when they do, the candidates demand competitive salaries. Lyndon discusses the importance of attracting, developing, retaining and advancing talented cybersecurity experts who have a depth and breadth of experience in industry verticals. Cybercriminals have increased the number of threats to organizations across all industries, and ransomware is a favorite among bad actors. Learn more about how MDR services can provide a comprehensive solution for companies to combat these threats. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn about obligations for HIPAA compliance when How HIPAA Regulations Affect Online Tracking Pondurance January 27, 2023 Facebook X (Twitter) LinkedIn Copy link The Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services (HHS) has issued clarification on obligations for HIPAA-covered entities and business associates (regulated entities) under the HIPAA Privacy, Security, and Breach Notification Rules (HIPAA Rules) when using online tracking technologies. By definition, tracking technologies are apps used to collect and analyze information about how users interact with regulated entities’ websites or mobile apps when the information collected through tracking technologies or disclosed to tracking technology vendors includes protected health information (PHI). “Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosure of PHI to tracking technology vendors or any other violations of the HIPAA Rules.” Regulated entities are not permitted to use tracking technologies where impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules would occur. “Regulated entities cannot use or disclose PHI, without an individual’s written authorization, only as expressly permitted or required by the HIPAA Privacy Rule. See 45 CFR 164.502(a).” There are several challenges, starting with the fact that many regulated entities did not contemplate how services and tools, including tracking technologies, they use for measuring web statistics, web and app usage, and other well-intended purposes may improve the user experience. But first, let’s explore if the tracking technology creates a connection between users and their PHI. Like personally identifiable information (PII) regulations, it’s important to consider data classified as individually identifiable health information (IIHI) including an “individual’s medical record number, home or email address, or dates of appointments, as well as an individual’s IP address or geographic location, medical device IDs, or any unique identifying code. ” The brief clarifies this, in concept, as two general use cases that are authenticated users (including apps on PCs, mobile devices, and smartphones) and unauthenticated users. User-authenticated webpages, mobile apps that store and pass the user identification, or any scenario that requires users to log in or provide their identities before they are able to access the webpage or app, typically create a scenario where all data is associated with a user and is regulated by HIPAA. Unauthenticated access to data is typically “Webpage(s) that do not require users to log in before they are able to access the webpage, such as a webpage with general information about the regulated entity like their location, services they provide, or their policies and procedures. Tracking technologies on regulated entities’ unauthenticated webpages generally do not have access to individuals’ PHI; in this case, a regulated entity’s use of such tracking technologies is not regulated by the HIPAA Rules.” Two primary exceptions where tracking technologies are used on website or apps include: Registration or submittals, even without login, that may include PHI and create a connection to the user. Collection of an individual’s email address and/or IP address when the individual visits a regulated entity’s webpage to search for specific healthcare information (e.g., disease, health issue) or available appointments. Thus, the regulated entity is disclosing PHI to the tracking technology vendor. You can see in this example how, over time, HIPAA may be expanded to cover non regulated information providers using tracking technologies that may create a connection between a medical condition and user, although PII state laws may already cover this situation. Assuming the technology is embedded or necessary for business purposes, and authenticated or meets the unauthenticated exception definition, a critical step is to establish a business associate agreement (BAA) with any tracking technology vendors that meet the definition of a business associate. “The BAA must specify the vendor’s permitted and required uses and disclosures of PHI and provide that the vendor will safeguard the PHI and report any security incidents, including breaches of unsecured PHI, to the regulated entity, among other requirements.” Consistent with standing HIPAA BAA guidance, if a regulated entity does not want to create a business associate relationship with these vendors or the chosen tracking technology vendor will not provide written satisfactory assurances in the form of a BAA that it will appropriately safeguard PHI, then the regulated entity cannot disclose PHI to the vendors without the individuals’ authorizations. This article is for informational purposes only and is not a legal interpretation or guidance. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

AI in Healthcare: Reap the Rewards, Reduce the Risks Pondurance July 8, 2025 Facebook X (Twitter) LinkedIn Copy link In healthcare settings, AI can be both an ally and enemy . According to the World Economic Forum , AI has the potential to expand access to critical healthcare services, improve diagnostics, detect diseases sooner, and speed up administrative tasks. With AI’s limitless potential, it’s no surprise that the generative AI market in healthcare could reach nearly $17 billion by 2034 . Source: Market Research Future AI also has its downsides, from perpetuating biases of underrepresented groups to enabling sophisticated cyberattacks . In this fourth article on helping midsize healthcare organizations manage breach risks, Stacey Oneal, PhD , a senior security consultant at Pondurance, shares how providers can mitigate AI-powered threats—and benefit from AI’s limitless potential. Read the other articles in our healthcare series: ▸ Bridging the Compliance-Data Breach Gap in Healthcare ▸ Ensuring Patient Care in an Era of Ransomware ▸ Practical Strategies for Vendor Risk Management in Healthcare Q: What are the greatest security and privacy concerns for healthcare organizations using AI? Stacey: AI can enhance diagnostic capabilities by analyzing large amounts of patient data to detect patterns and improve treatment. However, there’s concern that this same data could be misused—such as by insurance companies to deny coverage based on predictive health analytics. On the privacy side, wearable devices—like smartwatches—collect sensitive health data that could be scrutinized or used unfairly. And advances in real-time patient monitoring raise additional questions about data integration and surveillance. Then, of course, AI enables cybercriminals to more easily deceive users and break through an organization’s security defenses. From social engineering and phishing to deepfakes and adversarial attacks , AI-powered threats are especially difficult to detect and remediate. Q: What can healthcare providers do to mitigate privacy, security, and breach risks around AI? Stacey: The strategies for protecting against AI risks are very similar to safeguarding against any other kind of cyber risk. If you’re already using some of the following best practices, then you’re on the right path to ensuring the safe and secure use of AI in your organization. Implement zero trust architecture. Unlike traditional models that assume anyone inside the network is trustworthy, zero trust architecture operates on the principle of “never trust, always verify.” It enforces least-privilege access and requires users and systems to continuously revalidate access, even within trusted environments. This approach limits exposure and potential damage in the event of unauthorized access. Zero trust architecture helps protect against AI threats in a complex healthcare ecosystem. Source: NIST Zero Trust Networks . Strengthen governance within your organization. You need strong policies around how AI is used, tested, and monitored. This includes integrating frameworks like the NIST AI Risk Management Framework into existing policies and procedures to ensure responsible and secure AI implementation. Encourage AI training and certifications for your security team. For example, ISACA has launched new AI-specific certifications, including one focused on auditing AI systems . These are designed for professionals with existing credentials like CISA and help build needed expertise in AI oversight. Building a workforce skilled in AI governance and auditing is essential as AI becomes more embedded in your healthcare operations. Provide continuous monitoring . Like any software or digital system, AI tools require ongoing monitoring for anomalies and other emerging risks. Keeping systems updated and identifying abnormal behavior helps reduce the impact of potential threats. Create a business case for your cybersecurity budget. Security teams are often seen as cost centers, which makes it necessary to frame cybersecurity and AI risk management as a form of insurance. Demonstrating how these measures prevent costly incidents can help justify investment and gain executive buy-in. Q: Given the complexity of healthcare operations, it’s impossible to monitor every system. How can providers best protect against AI security and privacy risks in these environments? Stacey: Network segmentation and data labeling help you identify what types of data live in which parts of your network, so you can focus your security resources where they’re most needed. Sensitive data—like anything covered by HIPAA—needs more protection than, say, billing information, which comes with a different set of concerns than patient privacy. Q: In a previous article , we discussed the gap between compliance and security. How do you see the relationship between these two objectives? Stacey: As I always say, compliance is not security; it’s just a baseline that creates a shared foundation and instills trust that organizations are implementing security controls. True security goes beyond compliance to identify and address real vulnerabilities and threats—including AI-based threats. Once you’ve achieved compliance, your next focus should be strengthening your cybersecurity program. Q: Midsized health care organizations have often limited cybersecurity budgets and resources. How can they best address new and emerging AI risks? Stacey: A trusted cybersecurity partner can supplement an internal team’s capabilities with tools and expertise they would not otherwise have access to. For example, Pondurance managed detection and response (MDR) solution helps healthcare organizations eliminate breach risks by stopping attacks—whether from AI or other sources—before they can do harm. Our team of experienced SOC analysts and cloud-native platform complements your existing security tools, technologies and resources. Together, we can rapidly detect, validate, and remediate threats to protect your organization from risks and harm. We also assist with AI governance and compliance, to help set up clear policies, procedures, and a secure architecture. Ongoing oversight is key—organizations need checks and balances, regular audits, and advisory support to ensure AI is integrated safely and in line with compliance standards, whether they’re adopting AI or protecting against its risks. We don’t replace an organization’s internal experts or policies and procedures. Rather, we work with what you have, offering recommendations to improve your organization’s overall cybersecurity program. Final Thoughts AI has endless potential to transform healthcare, from logistics and diagnostics to treatment and administrative tasks. The goal is to harness AI’s potential while mitigating its cyber threats and breach risks. Because, as a Dark Reading article said, “AI is…a tool that can be used for and against us.” Get your copy of “ A Midsize Organization's Guide to Reducing Breach Risks in 2025 ” playbook. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026