Discover why Pondurance has been recognized as a "Best Place to Work" for 2025! Learn about our commitment to a supportive workplace culture and our dedication to providing exceptional cybersecurity solutions for midmarket organizations. Pondurance Receives Recognition as a Best Place to Work for 2025 Pondurance January 7, 2025 Facebook X (Twitter) LinkedIn Copy link We are pleased to announce that Pondurance has been honored as a "Best Place to Work" for the second consecutive year by Built In. This esteemed recognition underscores our commitment to cultivating a positive workplace culture and providing our team with competitive rewards. Pondurance delivers world-class MDR services to industries facing today's pressing cybersecurity challenges, including ransomware and complex compliance requirements. As the first and only MDR specifically engineered to eliminate breach risks, we leverage our advanced platform and experienced team of analysts to continuously hunt, investigate, validate, and contain threats. This approach allows your team to focus on what matters most: securing regulated data and mitigating vulnerabilities effectively. We are proud to be included on the following lists for 2025: 100 Best Places to Work in Washington DC 100 Best Midsize Places to Work in Washington DC These accolades are a testament to the hard work and dedication of every member of the Pondurance team. Their contributions are what make our company an exceptional place to work. We extend our sincere gratitude to our team for their efforts in shaping an engaging and supportive workplace environment. As we move forward, we remain dedicated to enhancing our culture and supporting our employees in their professional growth. We invite you to celebrate this achievement with us! Please visit our LinkedIn post to show your support and join the conversation. Thank you for being an essential part of our journey, and we look forward to achieving new milestones together! Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Many midsized organizations underuse their security tools. Learn how MDR from Pondurance keeps them tuned, monitored, and ready against evolving threats. How MDR Makes Your Security Tools Work Better Pondurance October 21, 2025 Facebook X (Twitter) LinkedIn Copy link Many midsized organizations have invested in solid security tools—endpoint protection, email filtering, firewalls, identity controls. Yet many remain exposed to cyber risk because those tools aren’t configured or maintained to their full potential. Out-of-the-box settings are designed for broad usability, not for your organization’s specific environment. Without tuning and continuous oversight, they provide only partial protection and leave your organization vulnerable to cyber-attacks. In this second article in our new series, we’ll share how managed detection and response (MDR ) provides the people and expertise to manage, monitor, and adjust your tools so they perform as intended and keep pace with evolving threats. Three Signs You Need an MDR Service 1. Default configurations remain unchanged. Many organizations deploy security tools with default settings. These configurations often leave unnecessary functions active—such as PowerShell v2 or Windows MSHTML —that attackers can exploit. Because tuning requires time and specialized knowledge, these features may remain enabled, exposing systems to unnecessary risk. MDR brings the expertise to safely disable or restrict unused functionality without interrupting business operations. 2. Security configurations lag behind evolving threats. Integrations that were safe a year ago may now pose risks. For instance, integrations with third-party applications or old operating systems can become weak points if not reviewed and updated. Most midsized teams don’t have the bandwidth to continually test and adjust every control. MDR provides continuous monitoring and tuning to ensure defenses remain current. 3. Limited confidence in overall security posture. Even well-run IT teams can struggle to know whether controls are appropriately configured or whether legacy systems are adequately protected. MDR offers visibility into where protections are working and where compensating controls are needed, building practical assurance that defenses align with real-world risks. What MDR Does An MDR service such as Pondurance provides continuous visibility and expert oversight, helping ensure your security tools work as intended. Core functions include detection, validation, and response: Detection: Using telemetry and threat intelligence, security operations center (SOC) analysts identify suspicious activity across endpoints, networks, and cloud systems. Pondurance MDR works with your existing systems—including identity, cloud, and IoT—to strengthen protection without requiring expensive replacements. Validation: Pondurance MDR detects, confirms, and disrupts threats in one process. SOC analysts review each alert to understand its context and reduce false positives that cause alert fatigue. Response: When a verified threat appears, the MDR team isolates, contains, or disrupts it to stop a potential breach before it happens. For Pondurance, the typical time to remediation is under 15 minutes. How vCISO and Incident Response Complement MDR MDR is one component of a broader cybersecurity framework. Pondurance offers complementary virtual chief information security officer (vCISO) and incident response (IR) services that address strategy and recovery needs. vCISO: Defining priorities and execution A vCISO evaluates business processes, compliance requirements, and risk tolerance to build an appropriate security strategy. This includes advising on policies such as SSL decryption or which legacy services can safely be disabled. For example, some systems—such as specialized medical equipment or manufacturing tools—must run on outdated software for business or regulatory reasons. The vCISO role provides the “why” behind security decisions, aligning technical measures with business priorities. MDR: Operationalizing detection and response MDR translates that strategy into daily operations. It configures tools, monitors for anomalies, and adjusts controls in real time. When the vCISO identifies risks that can’t be fully eliminated—such as outdated systems—MDR applies technical safeguards to minimize exposure. Incident response: Managing containment and recovery If a breach occurs, the Pondurance incident response team investigates, identifies root causes, and restores operations. Our full-service team integrates with your internal response plans, insurance policies, and legal team to fit your specific requirements. And because SOC analysts already monitor your environment, the incident response team can act quickly and effectively. Collaboration among these three services ensures strategy, execution, and recovery remain connected rather than isolated efforts. From Tools to True Security Security tools are only as effective as the people managing them; however, many midsized organizations and smaller enterprises lack the expertise and time to do so. MDR closes that gap by ensuring your existing controls are properly configured, continuously updated, and actively monitored. When paired with advisory and incident response services, MDR forms part of an ongoing cycle of detection, prevention, and improvement. The result isn’t a static defense but a resilient system that adapts to real-world conditions and evolving threats. Organizations that invest in this integrated approach gain clarity on where they stand, confidence in how they respond, and assurance that their security tools are doing what they’re meant to do—protect the business. See how Pondurance MDR can protect your organization against breach risks: From Detection to Defense: Eliminating Breach Risk Through Active Response. Read the first article in this series: From Data Breach to Cyber Resilience with Managed Detection and Response (MDR) Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Explore how AI, IoT, and human elements escalate breach risks for midsize firms and learn strategies to mitigate them. How New Cyber Threats and the Human Factor Escalate Breach Risks for Midsize Companies Pondurance January 29, 2025 Facebook X (Twitter) LinkedIn Copy link Data breach risks are soaring. The amount and types of sensitive personal information collected multiply every day: personally identifiable information (PII), protected health information (PHI), biometrics, and information from smart devices and social media, to name a few. Two categories of risk make it easier for malicious actors to launch cyber-attacks on this data, increasing the likelihood of unauthorized exposure—a data breach. Technological vulnerabilities from sources like artificial intelligence (AI) and the Internet of Things (IoT) generate a never-ending flow of threats. Human and organizational factors must also be considered. When it comes to data breaches, mid-market organizations have the same cybersecurity and human risk factors and regulatory requirements as larger enterprises. However, they often lack the funding and in-house expertise to address these risks and compliance obligations as effectively. Without the proper resources at hand, midsized companies in fact face greater breach risks than larger businesses. To minimize breach risks , midsized companies must understand how both cyber threats and the human factor impact the security of their data and systems: Cybersecurity Risk Factors The rapid rise of artificial intelligence (AI) AI is everywhere. One survey reports that 77% of companies are using or exploring the use of AI, and 83% say it’s a top priority in their business plans. Indeed, AI has the power to help businesses transform how they work and spur innovation. But it also creates immense privacy and security risks that evolve as AI itself evolves. Some threats include: Increase in social engineering and phishing attacks, due to enhanced cybercriminal capabilities from generative AI. Malware that can elude traditional security measures. There’s even malware that uses machine learning to change behavior based on its target environment. Deepfakes, which are videos, photos, or audio recordings that appear to be real but have been manipulated with AI . Even non-technical bad actors can quickly and cheaply generate convincing deepfake content , which can be used to threaten an organization’s brand, impersonate executives, and launch effective phishing attacks. Behavioral tracking and surveillance, which can be used for purposes like marketing and employee monitoring . These uses could have serious privacy and legal implications. The plague of ransomware Cybercriminals are targeting smaller companies—not just enterprises—for ransomware attacks. And they’re paying the highest price for it. A Sophos study found that even the smallest organizations are regular targets, with 47% hit by ransomware in the last year. The lower and mid-market organization also had the greatest uptick in overall recovery costs, from $885,018 to $2.885 million—a $2 million increase. Ransomware, a malicious type of software that blocks access to systems and data until the target company pays up, has advanced, creating even greater threats to organizations unprepared for such an attack. Double-extortion ransomware uplevels the typical ransomware attack. Malicious actors encrypt sensitive customer or patient data and threaten to publish it on the dark web, sell it, or permanently block access if the ransom payment is not made. Another trend, ransomware-as-a-Service (RaaS), makes it easier for less tech-savvy bad actors to launch a ransomware attack, which increases the likelihood of such an attack. The Harvard Business Review notes the many ways developers can franchise their malware, from a simple purchase, as a monthly rental, or splitting the ransom money. Threats in the cloud Using cloud storage makes good business sense for midsize organizations; it’s accessible, cost-efficient, convenient, and scalable. It’s no surprise that more than 60% of the world’s corporate data is stored in the cloud —and that cyber attackers are after that data. In fact, more than 80% of data breaches involved data stored in the cloud, according to a 2023 IBM report . The cloud is noted for security, but misconfiguration can make it an easy target, according to MIT professor Stuart Madnick . Cloud technology is evolving, and IT teams lack the experience to properly secure data in the cloud. Madnick said hackers are able to access cloud data and services in part because of misconfigurations such as not changing default settings, unrestricted ports, and unsecured backups. Danger on the edge: the Internet of Things (IoT) Smart devices, from watches to industrial control systems, are a part of everyday life at home and work. Today, there are more than 24 billion active internet of things (IoT) and operational technology (OT) devices. IoT devices can add business value and reduce complexity and cost for many industries, from manufacturing to healthcare. However, they also create significant cyber risks that can lead to a data breach. For example, doctors often remotely monitor patient health with wearable devices, generating massive amounts of data that’s stored, managed, and analyzed in the cloud . As we’ve seen, misconfiguration can make the cloud an easy target for cybercriminals. Similarly, IoT devices not properly developed or secured create vulnerabilities that can lead to service disruption, data theft, or data or service manipulation. In the above healthcare example, the cloud and IoT device create double vulnerabilities for hackers to exploit. Often, smart devices have weak default passwords and login information, leaving them open to password hacking and brute-forcing —the use of trial-and-error to guess login information or encryption keys, or to find a hidden web page. The increased number in IoT devices has also increased the risk of malware and ransomware to exploit these devices. Another risk is a distributed denial of service ( DDoS ) attack. This occurs when cybercriminals use hijacked devices as an attack base to infect more machines or hide malicious activity. IoT devices also increase data privacy risks . They collect, send, store, and process an enormous amount of personal data, which can be shared with or sold to third parties. Human and Organizational Risk Factors A deficit of cybersecurity talent While cyber threats continue to escalate, the pool of cybersecurity talent is shrinking. Globally, there is a shortage of nearly 4 million cybersecurity professionals , with more than 500,000 in the United States alone. Factors such as unclear career paths, outdated training, high-cost certifications, and job stress deter people from choosing a cybersecurity career, the World Economic Forum reports. Those who do choose to work in cybersecurity can earn an average starting salary of over $130,000 yearly —potentially too costly for midsized organizations to pay. Distributed teams In 2020, the world went remote almost overnight, and working from home became the norm. Even though the pandemic has ended, remote and hybrid work are commonplace. A distributed workforce, while more convenient and flexible, increases an organization’s cyber risks . Employees can remotely access company systems and data through the cloud using multiple devices—even personal ones—and via home networks that may be less than secure. All this creates more access points, which expands the attack surface for cybercriminals and makes network monitoring much more complex. In addition, remote work expands physical security risks, such as leaving a work screen open in a public place. Distributed data It’s a business necessity for an organization to share data with third parties, such as suppliers, partners, vendors, and business associates. This can include sensitive personal information like customer payment data and electronic protected health information (ePHI). While data sharing is an accepted and necessary practice, companies don’t have control over a third party’s cybersecurity programs—which may not be as robust. In fact, a security vulnerability at a single vendor creates vulnerabilities for all their customers. In Q3 2024, supply-chain attacks increased 203% over the previous quarter. 2023’s MOVEit hack exemplifies the devastating and ongoing risks from a third-party breach. A zero-day vulnerability in Progress Software’s MOVEit managed file transfer app created a breach affecting the sensitive data of millions of people, including the possible theft of insurance and financial information. More than 2,500 organizations were affected, including well-known brands like the BBC, British Airways, Ernst & Young, and Amazon. Open data across the organization Employees throughout an organization must have access to sensitive data, such as electronic health records, to do their job. Employees are often a significant source of breach risk. Verizon’s 2024 Data Breach Investigations Report found that 68% of breaches involved “a non-malicious human element,” like becoming a victim of a social engineering attack or making a mistake. Social engineering attacks such as phishing emails can lead to business email compromise (BEC) , which can lead to financial loss or the unauthorized sharing of sensitive data. Minimizing Breach Risk amid Cyber Threats and Organizational Realities The fast-changing nature of cyber threats combined with the human element can be overwhelming when considering how to minimize breach risks. It requires addressing both sets of risk factors and how they relate. Pondurance can help. We are the only managed detection response (MDR) cybersecurity service designed from the ground up to minimize data breach risk for mid-market organizations. Our platform provides a complete set of technologies and tools, backed by an always-on concierge security operations center (SOC), for protection before, during and after incidents. Have a third party, vendor, or business associate adopting AI? Request an MDR demo . Have a vendor using AI? Get a third-party risk assessment today. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

This blog discusses what prevention measures are required for your company to get accepted for cyber insurance. Read now! Applying for Cyber Insurance: Prevention Measures Required To Get Accepted Pondurance October 31, 2023 Facebook X (Twitter) LinkedIn Copy link Companies of all sizes know that cyber insurance premiums come with a high price tag. Premiums have increased every quarter over the last several years, according to the Global Insurance Market Index, and ransomware is the primary reason for the increased prices. Two-thirds of all companies suffered a ransomware attack within the past year, according to Sophos’ The State of Ransomware report. The report also found that the average ransom payment was more than $1.54 million in 2023, and the average cost to recover from an attack — not including the ransom payment — was $1.82 million. As a result, cyber insurance providers feel the rise in premiums is justified. With the large number of ransomware attacks, companies consider the protection of a cyber insurance policy to be a necessity. Yet, cyber insurance providers want to minimize their losses. As a result, the application process for insurance is lengthy and comprehensive. Providers are only offering cyber insurance to companies that have prevention measures in place to reduce the risk of a cyberattack. To get accepted for cyber insurance, companies need to be prepared for the application process — and that can mean proactively implementing proper cyber measures prior to application. A few of the core qualifications for cyber insurance that every cyber insurance provider will ask about include the use of multifactor authentication (MFA), managed detection and response (MDR), digital forensics and incident response (DFIR), and employee training. MFA Across the board, cyber insurance providers want to know that your company has MFA in place. MFA requires multiple methods of authentication to verify an account user’s identity during login. MFA’s layers of security make it harder for a bad actor to access a targeted account. Types of MFA include knowledge factors such as passwords, personal identification numbers, and security questions; possession factors such as tokens, key fobs, and badges; and inherence factors or biological traits such as retina scans, fingerprint scans, and voice authentication. Last year, cyber insurance providers required companies to have MFA to qualify for cyber insurance. This year, insurers are taking that requirement one step further. Now, providers need to know that companies have MFA and, more importantly, that it has been implemented. “Early on, insurance providers would ask, ‘Do you have multifactor authentication?’” said Doug Howard, CEO at Pondurance. “Companies would answer ‘yes,’ but come to find out, the companies had it but never implemented it or implemented it only on VPN (virtual private network) and no other system. Now, the questions on the insurance applications are getting deeper. Providers want to know that you’re using MFA in a way that will actually protect your company against bad actors.” MDR Insurance providers want to see companies partnering with MDR providers, and having MDR services is a minimum requirement for many insurance providers. Working with an MDR provider can reduce the likelihood that your company will experience a cyber incident and can demonstrate to cyber insurance providers that your company is taking responsible steps to pursue comprehensive defense strategies. Modern MDR providers monitor networks 24/7, discover suspicious activity, and launch mitigation measures if an incident occurs. MDR services combine technology and humans to monitor, alert, investigate, and proactively respond to cyber threats for clients. These services also decrease dwell time — the time from when a bad actor enters an environment until the bad actor is removed — and, ultimately, reduce the cost of a breach. “Cyber insurance providers want to know that companies have the technology, processes, and people already in place to protect against an attack,” said Doug. “MDR services can provide the full visibility, testing and analysis, and talented humans needed to reduce your cyber risk. As a result, MDR has become a standard requirement for cyber insurance.” DFIR DFIR involves digital forensics, which is data collection to determine what happened during an attack, and incident response , which is action taken following an attack. DFIR teams deploy at a moment’s notice to intercept attacks, save electronic evidence, perform damage control, and determine what is needed for secure restoration. When you work with a DFIR firm, your company can lower its risk profile and improve its ability to secure cyber insurance. Every minute counts after an attack, and companies that have a DFIR team already in place are ready to immediately respond to a compromise, minimize losses, and prevent future incidents. “If your company has an incident and you’re proactively partnering with a DFIR team, you’re way ahead in terms of response and recovery,” said Doug. “A DFIR partner will already be familiar with your company and understand what’s important to you. The team can contain the incident, determine exposure through forensic analysis, and quickly restore your normal operations.” Employee Training Every company should educate employees — both staff and managers — about the importance of data privacy and the potential cyber threats that they may encounter. When employees are well educated on cybersecurity practices, a company faces less likelihood of a data breach. And that’s what cyber insurance providers want to see. During the application process, all providers will ask if your company performs cybersecurity awareness training at least once every year. They also want to know how often your company conducts phishing training since phishing is such a common way for bad actors to infiltrate a company’s system. “Many bad actors target employees through phishing attempts,” said Doug. “So it’s critical to educate employees year-round about how to detect malicious email links and keep your company’s systems safe from attack.” Conclusion Cyber insurance providers only offer insurance to companies that have prevention measures in place to reduce the risk of a cyberattack. Your company needs to be prepared for the application process by proactively implementing such measures prior to application. To learn more about how to get approved for cyber insurance, check out our blog Improve Your Qualifications for Cyber Insurance: 4 Things To Know . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Follina, a/k/a CVE-2022-30190, is nothing to take lightly. What it is, what to watch for and mitigations to help keep this zero-day at bay. Critical Diagnosis: What You Can Do To Mitigate the Scourge of Microsoft CVE-2022-30190 Pondurance June 1, 2022 Facebook X (Twitter) LinkedIn Copy link Well, like clockwork, another critical vulnerability has been found in a widely used product. This time it comes in the form of a zero-day code execution exploit involving the Microsoft Support Diagnostic Tool (ms-msdt) protocol within Microsoft Office. This zero-day exploit was discovered and reported on May 27 by security researcher “nao_sec”, but was discovered to have been exploited by attackers as early as April of this year. This vulnerability, tracked as CVE-2022-30190, can be exploited to achieve code execution when opening or previewing Word documents and \rich text format (.rtf) files within Microsoft Word. This is different from the traditional code execution security analysts are used to seeing that requires a click to enable macros to run. This exploit, instead, runs whether macros are enabled or not. Furthermore, researchers have identified zero-click exploits on all versions of Microsoft Office products, including the most up-to-date channel of Office365 products . Several researchers report that an embedded payload can be executed when a weaponized .rtf file is previewed in Windows Explorer , and an .rtf exploit can also bypass Word’s protected mode protections. Technical Details Colloquially dubbed Follina, the exploit itself uses the ms-msdt diagnostic tool protocol to query a malicious URL, which is loaded and interpreted to achieve code execution with equivalent privileges of the parent Office process. This is achieved by leveraging the Word remote template feature to reach out for a malicious HTML file, which is loaded using the ms-msdt URL scheme. Once loaded, this HTML file is then interpreted and calls the Native PCWDiagnostic pack using the IT_BrowseForFile parameter, ultimately resulting in code execution via PowerShell. Malicious use of msdt.exe has been previously documented . So what does this mean? This is an evolution of Maldoc threats that already exploit Microsoft tools like Word and Excel to infect systems. This new method requires no additional authorization from the user other than opening (and in some cases, simply previewing) the file. Additionally, vendor detection on exploit files found in the wild (and Proof of Concepts – POCs – developed by researchers) is poor. One can expect this to become part of most attackers’ arsenal moving forward and should take measures against it. This is being actively weaponized and exploited, and therefore, poses a significant risk to an organization, even one with up-to-date detection and mitigation strategies. Mitigations Unfortunately, at the time of this blog post, Microsoft has not published an official patch yet; however, they have published a Microsoft Security Response Center (MSRC) blog suggesting workarounds . In short, Microsoft suggests disabling the ms msdt URL protocol (used to interpret the malicious external HTML) via a registry key modification. Other researchers have gone further, suggesting: Disabling “ Troubleshooting Wizards ” VIA Group Policy Object (GPO) . Using Defender’s attack surface reduction capabilities, one can activate a rule to block all office applications from creating child processes . Removing the ms msdt handler entirely via registry key modification. With these mitigations, your mileage may vary based on your organization’s needs. Expect things to change rather rapidly over the next few days, so keep an eye out for any talk of improved mitigations (or ways your mitigation can be bypassed). What about detections? Unfortunately, many researchers have found current endpoint detection and response (EDR) and antivirus (AV) technologies are somewhat limited in their ability to detect Follina exploits. However, they do follow a pattern that can be identified by threat hunters. Expect detection capabilities to improve moving forward, but obfuscation and encoding within commands can be expected to change and improve from the attacker’s perspective as well. Active threat hunting can help mitigate that. Do you have an EDR with process auditing? Look for systems in your environment spawning msdt.exe as a child process of winword.exe, excel.exe, outlook.exe, or powerpnt.exe. A similar parent-child process hunt can be performed looking for conhost.exe sessions or other processes with the parent process sdiagnhost.exe. Similarly, keep an eye out for any network connection events spawned by the sdiagnhost.exe process not reaching out to an official Microsoft resource. Also, if you have command line auditing enabled (either in EDR or in event logs), look for IT_BrowseForFile, as it is not a common parameter. SentinelOne Kibana Query Language (KQL) queries can be found here . Signatures EmergingThreats has published a signature to detect potential exploitation attempts in their open rule set with the message “ET EXPLOIT Possible Microsoft Support Diagnostic Tool Exploitation Inbound (CVE-2022-30190.)” Other reports seem to be regarding targeted attacks, leveraging the following domains: Tibet-gov.web[.]app Xmlformats[.]com Sputnikradio[.]net Joe Security has a YARA rule for command line auditing. SecurePeacock wrote this Sigma rule . @kostastsale wrote a Sigma rule for detection as well. Looking for evidence of previous execution? The PCW.debugreport.xml file within %localappdata%\Diagnostics and %localappdata%\ElevatedDiagnostics (depending on the level of privileges the exploit achieved) has been reported to contain the payload in some instances, which can be useful for historical threat hunts. The hkcu\software\microsoft\office\16.0\common\internet\server cache registry key can also be queried for all URLs contacted via Office. Note that this is an HKCU (current user) key and, therefore, is user-specific. Also note this contains legitimate URLs as well. Final notes This exploit is reminiscent of the Log4j exploit identified in late 2021, wherein an underlying subsystem with an external connection functionality was similarly exploited to achieve code execution. In that case, the quick-and-dirty solution seemed to be to disable the functionality entirely as a long-term solution was developed. In the case of the Log4j exploit, the first round of patches didn’t fully mitigate the threat, and we should account for that possibility in this case as well. P.S.: Security researchers should be cautioned against blindly running reportedly benign POC exploits during their exploration of this particular vulnerability, as several have been reported to drop Cobalt Strike beacons . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

March's monthly threat intelligence newsletter from Pondurance March Cyber Threat Download™ Pondurance March 11, 2025 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. Threat trends Our team has noted certain trends in recent attack methods focused on intrusion, operational disruption, or financial harms to organizations. The following trends are increasing or steady in frequency, as these types of attack continue to prove successful for malicious threat actors. Ransomware . As usual, these attacks are still the most prevalent threat on the internet. The team is seeing manual deployment of ransomware — versus automated deployment — where the threat actor has to break into the network and stage, deploy, and execute the ransomware. Manual deployment allows minutes to tens of minutes for the team to get out in front of an attack. Recently, a new ghost ransomware has been seen in the wild. Phishing emails . These attacks are trending up, particularly with tax season in full swing and government actions making headlines. Most phishing emails link to credential harvesting webpages, with successful attacks resulting in Office 365 mailbox access where the threat actors create mailbox rules to cover their tracks. To reduce the risk of phishing threats, the team recommends enabling multifactor authentication (MFA) and offering user awareness training to all employees. Credential stuffing attacks . These attacks, also known as brute force attacks, are trending steady. Okta and Microsoft 365 have immediate countermeasures to deploy against credential stuffing attacks. Okta uses adaptive MFA with behavioral detection and dynamic zones, and Microsoft 365 uses Azure Active Directory Identity Protection, which includes conditional access and smart lockout features. Also, Pondurance can take proactive action to restrict an account, for a quicker response time. Social engineering help desk calls are trending way down. In fact, the team hasn’t seen or heard of any help desk call compromise in recent months. The lack of attacks may be due to user awareness training and more robust help desk validation processes. Concerned about the rising threat of ransomware, phishing, or VPN exploits? Request a demo of Pondurance's proactive cybersecurity solutions today and stay ahead of the threat curve. Incident response learnings As a recent exploit, lone wolf actors have recently been using email bombing in their ransomware and data exfiltration efforts. In this social engineering attack, a threat actor sends hundreds to thousands of spam emails to a target user. Then, 15-20 minutes later, the threat actor, posing as an IT person, contacts the user using one of three methods: Microsoft Quick Assist. The user launches Quick Assist (Ctrl+Win+Q), a legitimate tool that can bypass endpoint detection and response, and provides a code to grant a remote session on the computer. Then, the threat actor loads a fake page for the unwitting user to click on. Once the user clicks on the page, the threat actor runs a tool such as FileZilla to remotely exfiltrate the closest file share — in 24 minutes or less! One month later, the user will receive an extortion email. Run command. The user enables Run command (Win+R), a legitimate tool that allows the user to quickly open a program, file, or folder by typing in a command (Ctrl+V). In an email bombing attack, the threat actor hijacks the user’s clipboard so that the typed command is automatically copied to the clipboard. From there, it installs a backdoor on the backend. Phone call. The user receives an email with a phone number to a fake call center. Once on the call, the user receives instructions to download a tool such as Zoho Assist or ScreenConnect to allow remote management. Exploitation of virtual private network (VPN) logins, particularly SonicWall and Fortinet, is a common theme right now. The team sees threat actors using valid username-password combinations to log in to VPNs. In most cases of exploitation, MFA or single sign-on that enforces MFA is available but not implemented. Once the threat actors directly log on to the VPN, they use attacks such as Kerberoasting to exploit service accounts and then log on via remote desk protocol to any servers they can access. With these VPN exploit cases, the team often finds that VPN logs are only retained for a span of 24 hours to seven days. Instead, the team recommends that clients preserve and centralize their logs. The use of the Godzilla web shell is currently a trending form of exploitation. Godzilla opens a shell code launcher with commands written to memory — rather than written to disks or logs as with JavaScript and PowerShell — and performs process injection to launch shell code within that process. The threat actors use Advanced Encryption Standard to create the web shell and can launch any sort of shell code to pull off the attack. Then, they install remote monitoring and management tools, bring in tools like Advanced IP Scanner, and steal the service accounts and exfiltrate data. Notable vulnerabilities Approximately 4,000 vulnerabilities were disclosed in January, and this number is expected to slowly increase over time. As many as 33 of the 4,000 disclosed vulnerabilities were high risk, and five were actively exploited. There was one proof-of-concept exploit impacting Windows lightweight directory access protocol discovered on the internet. As many as 159 reported vulnerabilities were addressed during Microsoft Patch Tuesday in January. Among those 159, 10 were critical, and eight were zero days. Three of the zero days are particularly notable: Fortinet authentication bypass vulnerability . Exploitation of this vulnerability initially occurs through the JavaScript console interface. From there, the threat actor creates a new administrator account with VPN access, modifies existing accounts, makes changes to the firewall settings, and adds a VPN tunnel into the internal network. The threat actor also may steal credentials through DCSync. Ivanti Connect Secure vulnerability . This buffer overflow vulnerability, exploited by China-based espionage groups, targets particular industries. The exploitation begins with automated scanning to find vulnerable devices that are accessible over the internet. Once a device is accessed, the threat actor disables the SELinux security module running in the Linux kernel. The threat actor remounts some file systems for write access, which allows downloading and installation of additional malware. The threat actor may also deploy web shells to gain control over the compromised systems. GFI KerioControl product vulnerability . This carriage return line feed vulnerability can occur when user input is not sanitized correctly, meaning the line feed characters are not removed. For the exploit, the threat actor crafts a malicious URL and sends a phishing email to the product administrator. Once the product administrator clicks on the link, a malicious disk image file uploads to the system and lands in the software updates folder of the carrier control product, ultimately granting root access to the firewall system. In February, 67 reported vulnerabilities were addressed during Microsoft Patch Tuesday. Of those 67, three were critical vulnerabilities, and four were known zero days, including two escalation of privileges vulnerabilities, a hash disclosure vulnerability, and a security feature bypass vulnerability. The team recommends maintaining an ongoing, robust patching program to address these issues. Focus on device code phishing attacks Device code phishing is a relatively new MFA bypass technique being used by Storm-2372, a Russia-backed group of threat actors. The group is targeting the IT, defense, higher education, telecommunications, and energy sectors, primarily in the United States and Europe. A device code phishing attack begins with a social engineering campaign using a third-party messaging app, such as Telegram, Signal, or Microsoft Teams, to build a rapport between the user and threat actor. The ultimate goal is to convince the user to accept an invitation to an online meeting. Once the user accepts the invitation, the threat actor requests a device code from the meeting service and sends the code to the user. Then, the user is taken to a legitimate device code authentication page to log in with credentials and enter the threat actor-generated code. The threat actor captures the authentication tokens and uses them to access the user’s account. Now, with full access to the compromised account, the threat actor can gather sensitive data for use in future attacks and extortions and send additional phishing emails from the account to lure potential new victims. To prevent device code phishing attacks, organizations should offer user awareness training to all employees, require MFA to disrupt the entering of a device code, and monitor login data for all user accounts. About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our security operations center, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Educational organizations are a particularly attractive target for cybercriminals. See how Pondurance and E&I's partnership can help. Pondurance Announces Partnership With E&I Cooperative Services Pondurance May 8, 2024 Facebook X (Twitter) LinkedIn Copy link The vast majority of cyberattacks are executed for financial gain, and that means that any organization, regardless of size, industry, or current in-house capabilities, can become a victim of cybercrime. Educational organizations are a particularly attractive target for cybercriminals, especially from phishing and ransomware attacks, due to their valuable personal data on students and lack of resources and cybersecurity staffing. Research and consulting firm Gartner reports that “(e)ducation typically employs the least number of security employees when compared to other industries.” But that’s where a new partnership between E&I and Pondurance can help. Pondurance, a national cybersecurity firm that provides an array of comprehensive services to clients, was recently selected to partner with E&I Cooperative Services , a procurement cooperative serving the education industry. Now, existing E&I members can receive cybersecurity services from Pondurance via the cooperative, and prospective clients of Pondurance can join E&I to take advantage of the special pricing, programs, and benefits that come with membership. Work with Pondurance Pondurance is the first and only managed detection and response (MDR) provider to be built on a risk-based approach to cybersecurity. The approach focuses on the specific cyber risks of an organization and considers what the organization wants to accomplish and what it needs to protect. Using this approach, the Pondurance team helps organizations identify their cyber risks, prioritize the risks, and find the most impactful ways to protect organizations against those risks. Once the team has that understanding, it can customize a bundle of services that allows a organization to achieve its cybersecurity and compliance goals. Services include virtual chief information security officer leadership, MDR services, incident response services, penetration testing, vulnerability management, tabletop exercises, risk assessments, awareness training, and more. Pondurance’s team of highly skilled professionals uses technology, automation, and advanced analytics to gather specific threat intelligence and provide relevant data. Team members gain insights on potential cyber threats and assess how to plan, recognize, respond to, and mitigate a threat. They limit an organization’s cyber risk exposure and ensure that the organization can confidently respond to a cyber crisis. In addition, the team integrates the organization’s tools and technology with the Pondurance platform to assure that there are no security gaps and no inefficiencies from overlapping capabilities. “Pondurance is proud to partner with E&I Cooperative Services,” says Ron Pelletier, Founder and Chief Client Officer at Pondurance. “We look forward to offering our risk-based approach and full suite of services to protect E&I members from cyber threats and reduce their exposure to attacks.” Become and E&I Member E&I is a member-owned, nonprofit cooperative exclusively focused on serving the education industry. The organization is equipped with the knowledge, experience, and passion to meet the specialized needs of education procurement. E&I helps nearly 6,000 member institutions make informed, analytics-driven decisions. The benefits of membership include: Skipping the request-for-proposal process. E&I vets its partners so members can focus on more strategic initiatives. Tapping into aggregated spend. E&I negotiates better terms and pricing on contracts for better purchasing power for members. Accessing competitively solicited contracts. E&I’s portfolio of contracts spans most categories including technology, residence life, research, and healthcare. Meeting compliance needs. The member-driven, competitive solicitation process complies with generally accepted procurement standards. Optimizing the spend. E&I uses a member’s purchasing data to reduce costs, bring more spend under contract, and maximize control and efficiencies. Taking advantage of e-procurement. Members reap the benefits of e-procurement through the no-cost online platform and other platforms. Containing costs and driving revenue. Members benefit from supplier-driven rebates, financial incentives, and the patronage program, which distributes funds at year-end. Handling supplier management. E&I handles regular supplier and contract performance reviews to save members time and money. Receiving local support from industry experts. A nationwide team of member representatives understands member needs to ensure member satisfaction and success. Educational organizations can join the E&I cooperative at no cost and with no minimum purchasing requirements. Once becoming a member, an organization can receive the added benefits of membership — including special pricing, programs, and benefits for using Pondurance as a cybersecurity provider. Learn More The education industry is an attractive target for cybercriminals, but the new partnership between E&I and Pondurance offers members the opportunity to work hand in hand with a trusted partner to stay protected against cyber threats. Learn more about the benefits of membership and how to join E&I today. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Are you looking to achieve CMMC compliance? See how working with Pondurance as a CMMC C3PAO can help you save money and achieve compliance.|Are you looking to achieve CMMC compliance? See how working with Pondurance as a CMMC C3PAO can help you save money and achieve compliance. CMMC Readiness Assessment: How Can a Registered Provider Organization (RPO) Help? Pondurance July 13, 2021 Facebook X (Twitter) LinkedIn Copy link Supply chain attacks continue to affect government and private sectors worldwide. These attacks are soft entries affecting more than just the supplier. The attack trickles down to the supplier’s customers, leading to broader incidents and severe ransomware demands from attackers. To further mitigate the rise in malicious attacks and unauthorized access to sensitive information, the Department of Defense (DoD) developed a framework to ensure contractors and subcontractors that handle controlled unclassified information (CUI) and do business with the DoD follow stringent cybersecurity guidelines. As a result, the DoD released details surrounding these guidelines, the Cybersecurity Maturity Model Certification (CMMC). The five-level CMMC framework drives suppliers and contractors of all sizes to contribute time, funds, and other resources to strengthen their cybersecurity strategies to meet compliance. Before submitting bids, an organization seeking certification (OSC) must identify the desired maturity level and then schedule a CMMC assessment with a certified CMMC third-party assessor organization (C3PAO). The CMMC C3PAOs are the only entities authorized to enter into contracts with the DoD to perform assessments. Upon completing an assessment, the auditors review the assessment and certify the organization for three years if the proper cybersecurity requirements are in place. Sounds easy, right! Organizations must understand there are limited CMMC C3PAOs available, which could lead to further delays if an OSC fails the audit the first time. Small and midsize businesses often find it more difficult than a larger enterprise to strengthen their cybersecurity defenses in-house due to budgetary constraints. To ensure the time, funds, and resources invested in obtaining a certification lead to success, OSCs can seek a Registered Provider Organization (RPO) with registered practitioners on the team to perform a readiness assessment and gap analysis. RPOs are authorized by the CMMC Accreditation Body (CMMC-AB) to provide consulting services to government contractors, subcontractors, and businesses to prepare for the CMMC assessment. Not all RPOs are created equal. It is critical for OSCs to properly vet vendors and make sure they are getting the most out of their investments and are asking the right questions: Is the RPO authorized by the CMMC-AB? Does the RPO have previous experience performing cybersecurity assessments and identifying critical security gaps? Does the RPO have deep knowledge of NIST 800-171 and other frameworks? Will the RPO provide you guided recommendations based on your desired CMMC maturity level? Does the RPO offer other services that satisfy many of the CMMC controls to help you maintain your certification while protecting your organization from today and tomorrow’s sophisticated cyber threats? Pondurance is an RPO authorized by the CMMC-AB to provide consulting services to help OSCs prepare for their CMMC assessments and provide guided recommendations on how to remediate vulnerabilities. Pondurance has decades of experience in compliance along with a range of regulatory frameworks such as HIPAA , CMMC, PCI DSS, FERPA, NERC CIP, NIST 800-53, ISO 27001/2, CMMC, and NIST 800-71. We believe the key to any good program is having a deep understanding of internal risk and third-party risk through assessments and monitoring. Learn more about our CMMC Services . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

When Cyber Threats Don’t Sleep: The Case for a 24/7 Security Operations (SOC) Pondurance November 17, 2025 Facebook X (Twitter) LinkedIn Copy link Threats to your business never stop. Malicious actors are always on the hunt for a vulnerability to exploit—whether that’s an unpatched system, human error, or other security lapse. These vulnerabilities escalate your breach risks by making it easier for adversaries to access your systems and data. Constant vigilance is essential to detecting and neutralizing threats before they can do harm. However, midsized organizations and smaller enterprises often lack the resources for always-on cybersecurity capabilities, leaving them exposed to increasingly sophisticated cyber-attacks. In this third article in our series, we’ll share how an outsourced 24/7 security operations center (SOC) works with your organization’s security team to proactively hunt for, triage, and disrupt threats before they can do harm. Read previous articles in this series: From Data Breach to Cyber Resilience with Managed Detection and Response (MDR) How MDR Makes Your Security Tools Work Better How SOC Analysts Turn Alerts to Action The first lines of defense against data breaches should be basic security policies and cyber-aware employees. Least privilege, system hygiene, role-aware training—all these are cybersecurity essentials, especially in environments where exposure is a common risk. Even so, it’s impossible to protect against every threat. If a control is bypassed—through an endpoint, cloud workload, or user action—the challenge is not receiving an alert but in determining its significance and response. For example, your SIEM or EDR may flag a suspicious executable or document, yet the alert alone rarely explains intent or scope. SOC analysts—who are often certified cybersecurity professionals — review these alerts to determine their potential for harm. They observe suspicious files in a secure sandbox, identifying key indicators that reveal the attacker’s goals, how the threat spreads, and what evidence it leaves behind. Analysts use these indicators to search for related activity across the environment and confirm whether the threat executed elsewhere. This human review uncovers patterns that automated tools may miss, and insights from multiple cases are added to a shared knowledge base to strengthen future detection and threat hunting. When Threats Masquerade as Legitimate Tools Many threats don’t look like malware. Attackers often use legitimate admin tools—such as remote access or management utilities—to blend in and avoid triggering antivirus alerts. Analysts look for unusual activity, like a first-time remote connection or an account acting outside its normal pattern, then use those clues to determine whether the activity is malicious. By continuously hunting across environments, they recognize these behaviors faster when they happen again. Attackers also disguise harmful code inside software that appears legitimate, including popular AI tools. This tactic targets developers and power users, making it important to collect telemetry from endpoints, identity systems and networks, and to have teams who track evolving attack techniques. Even with strong EDR coverage, an initial breach may not be immediately visible—especially when attackers exploit vulnerabilities without dropping malware. In those cases, analysts work backward from what they can see: unusual processes, network ports, or log entries. They use forensic methods to find the source of the breach and stop the attacker from moving deeper. EDR is still essential for host-level visibility and actions like isolating a device, but human investigation connects the dots and closes gaps that tools alone can’t catch. 4 Ways Pondurance SOC Improves Cyber Resilience Effective cybersecurity requires human expertise to interpret alerts, adjust detection logic, and act when something is wrong. Pondurance’s 24/7 SOC provides that operational maturity. 1. Continuous Monitoring by a U.S.-Based SOC Pondurance provides continuous monitoring from a U.S.-based SOC, ensuring that qualified analysts are available at all times to investigate alerts and take action. Local coverage minimizes communication delays and reduces handoff complexity during response. Analysts can isolate compromised endpoints, stop malicious activity, and guide containment as events unfold. 2. Real-Time Threat Intelligence and Adaptive Detection Threat activity changes quickly, and detection logic must evolve with it. SOC analysts continuously update detections using peer intelligence, public reporting, and threat research—even when campaigns are targeting other industries. New rules are applied proactively to account for shifts in attack patterns. Prioritization remains focused on active and emerging threats rather than legacy malware. 3. Focused Detection That Reduces Alert Noise Not every possible alert adds value. Pondurance applies a selective approach, enabling rules that are relevant to actual threats and client environments. Analysts validate context, adjust thresholds, and tune detections to reduce unnecessary noise—helping ensure that escalated alerts represent meaningful risk and support faster decision-making. 4. Visibility and Expertise Close Coverage Gaps Endpoint tools can miss activity that appears at the network or identity level, and some EDR tiers don’t log enough telemetry for full investigation. The SOC reviews existing coverage and recommends improvements such as deploying additional agents, adding network sensors, or enabling higher-tier logging. Clients also benefit from collective insights across environments and access to digital forensics and incident response support if a breach occurs. “We truly have middle-of-the-night visibility and the peace of mind that comes from knowing that someone is still looking at our data even after our analysts have gone home at the end of the day,” says Pondurance user Tobey Coffman, who is director of information security services at Ball State University in Ohio. “Let’s face it: Bad guys don’t care about business hours. If something happens at 2:00 am, it’s important to have the confidence that our vendor enables us to get on it right away.” Learn how Ball State grew its partnership with Pondurance from a single penetration test into a fully managed, 24/7 detection and response program. Check out the podcast . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

The first autonomous AI ransomware attack marks a turning point. Learn why 31-second attacks demand machine-speed cyber defense and reshape enterprise risk. The 31-Second Adversary: The First Autonomous Ransomware Attack Just Reset the Clock on Cyber Risk Doug Howard August 5, 2026 Facebook X (Twitter) LinkedIn Copy link I've spent my career on threat timelines. In the Air Force and at the Pentagon, the question was never whether an adversary would act, it was how fast; at what scale, and whether our decision cycle could outpace theirs. Across 14 M&A transactions in M&A personally as a leader and 50+ with customers, I and teammates have evaluated hundreds of security programs against one standard: can this organization detect and contain faster than the adversary can act? Last week, the answer to that question changed for everyone. Specifically, as I’ll discuss, it is no longer possible for a human-driven cybersecurity response to successfully meet the challenge. On July 6, researchers at Sysdig published their analysis of what they assess to be the first fully autonomous ransomware attack. An AI agent, attributed to the JadePuffer operation, conducted an entire intrusion, most likely without a human at the keyboard. Reconnaissance. Exploitation. Credential theft. Lateral movement. Persistence. Privilege escalation. Encryption. Ransom note. All of it executed by an agent that adapted to failures on its own. Most importantly; the agent was able to see that the initial payload failed, diagnose what went wrong, correct for the mistake, and continue on to success. What must be on the agenda of every board meeting this quarter is not only that the agent did this, but that it did this in just 31 seconds. Thirty-one seconds. That is the new unit of measure for cyber risk. As a reference, for most vendors, event data is often delayed and measured in minutes and IOC updates and other actions measured in hours. The Facts JadePuffer is not a data point. This is the latest marker on a trend line theorized (and now proven) by credible sources over the last year and a half. The precedent was set in September 2025. Anthropic detected and disrupted what it assessed as a Chinese state-sponsored espionage campaign - designated GTG-1002 - in which threat actors manipulated an AI coding agent into executing roughly 80 to 90 percent of a malicious campaign autonomously. Approximately thirty global targets across technology, financial services, chemical manufacturing, and government were attacked. Humans set strategy and approved key escalations, the AI did the work. Anthropic's own framing was blunt: threat actors can now use agentic systems to do the work of entire teams of experienced threat operators. The speed data confirms the compression. CrowdStrike's 2026 Global Threat Report , which dubbed 2025 "the year of the evasive adversary", measured average eCrime breakout time (the period of time before lateral movement begins) at 29 minutes, a 65 percent acceleration in a single year. The fastest observed breakout: 27 seconds. In one documented intrusion, data exfiltration began within four minutes of initial access. AI-enabled adversary activity rose 89 percent year-over-year. And 82 percent of detections were malware-free: adversaries moving on valid credentials, trusted identity flows, and approved integrations rather than anything a signature will ever catch. The result is clear: adversaries are leveraging new technologies to adapt, attack, and succeed faster and faster every month. The patch window has not just shrunk. It has inverted. Mandiant's M-Trends 2026 report found that mean time-to-exploit ( the gap between vulnerability disclosure and first observed exploitation ) has gone negative. In 2018, defenders had roughly 63 days. Today, on average, exploitation precedes the patch.CrowdStrike corroborates: 42 percent of exploited vulnerabilities were attacked before public disclosure. Mandiant also documented the time between theft by initial access brokers and delivery to ransomware affiliates collapsing to 22 seconds. And the warning came from the top. On June 22, the leaders of all five Five Eyes cyber agencies: NSA, CISA, and their counterparts in the UK, Canada, Australia, and New Zealand, issued a joint statement that reads less like guidance and more like a warning flare: "Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months." Two weeks later, JadePuffer proved them right. The Analysis Here is what most of the coverage will get wrong, and what leaders need to get right. The attack was not technically novel. That's what makes it dangerous. JadePuffer exploited CVE-2025-3248, a known, patched Langflow vulnerability with a fix available since April 2025, and pivoted through a 2021 authentication bypass to reach a production database. No zero-days. No exotic tradecraft. Every technique in the chain was defensible with the fundamentals we've preached about for two decades. The change is not the what. It's the when. The same attack that once took a human crew days of hands-on-keyboard effort now completes at machine speed, at machine scale, at machine cost. The playbook didn't change. The clock did. The entry point tells you where the next front is. The initial foothold wasn't the AI system itself, it was AI-adjacent infrastructure: a Langflow server quietly accumulating provider API keys and cloud credentials that nobody monitored or rotated. As organizations race to deploy AI, they are standing up exactly this class of asset everywhere, fast, internet-exposed, credential-rich, and outside the governance perimeter. CrowdStrike responded to incidents at more than 90 organizations where adversaries injected malicious prompts into legitimate AI tools, and observed malicious clones of Model Context Protocol (MCP) servers intercepting data in AI workflows. Your AI stack is now simultaneously your productivity engine and your fastest-growing attack surface. Machine identity governance, who and what holds credentials, where they live, how often they rotate, just moved from hygiene item to board issue. The economics of ransomware just shifted in a direction nobody should be comfortable with. In the JadePuffer attack, the AES encryption key was never transmitted to the attacker's infrastructure. This means that even if the victim had paid, recovery was impossible. Read that again through a risk lens: an autonomous agent, optimizing for destruction rather than negotiation, breaks the already-fragile logic of ransom payment as a recovery strategy. Every incident response plan and every cyber insurance policy that implicitly assumes a rational, human counterparty on the other side of the ransom note now carries an assumption that may not hold. Dwell time math no longer works in the defender's favor. Mandiant puts global median dwell time at 14 days, and organizations self-detected intrusions only 52 percent of the time. When the adversary's full attack cycle is compressed to minutes and its self-correction cycle to seconds, a 14-day median dwell time isn't a metric-it's a eulogy. The window between first detection signal and material damage is now measured in seconds, which means detection and containment must be measured the same way. This is precisely why I have argued that the defining question for every security program in 2026 is not "What tools do you own?" but "What is your verified speed from signal to containment?" The Cyber Risk and Regulatory Reality For the boards, carriers, and breach counsel I work with every week, three implications deserve immediate attention. First, risk quantification must move from probability to velocity. Traditional cyber risk models estimate likelihood of breach. The more decision-useful question now: given inevitable initial access, how fast does your organization detect, decide, and contain, and can you prove it under pressure? The Five Eyes statement said it plainly: it is not enough to have controls; leaders must be confident those controls will perform at machine speed during a real incident. Tabletop exercises calibrated to human-speed adversaries are now rehearsing for a war that has already changed. Second, the insurance and legal ecosystem will reprice based on response speed most enterprises internalize. Carriers already underwrite requirements to have MFA, EDR, and backups. The next underwriting cycle will ask harder questions: patch velocity against known-exploited vulnerabilities, machine identity governance, credential rotation on AI infrastructure, and independently verifiable detection-and-response SLAs. Organizations that can demonstrate machine-speed containment will see it reflected in terms and pricing. Those that cannot will discover that "We had a policy," and "We had coverage that performed," are very different sentences, usually during the worst week of their corporate lives. Third, regulatory frameworks built for human-speed incidents are about to collide with machine-speed attacks. The SEC expects a materiality determination and 8-K disclosure within four business days of that determination. HIPAA's breach notification clock, state privacy statutes, NYDFS Part 500's 72-hour notice, the EU's NIS2 24-hour early warning; all of these assume an incident that unfolds over a timeline where facts can be gathered deliberately. When compromise-to-encryption completes in minutes, the forensic record your counsel needs and the notification clock your regulator enforces both start almost simultaneously. Reporting by Reuters in May indicated U.S. officials are already weighing shortened federal patching deadlines specifically because of AI-powered exploitation. Regulators will not slow down to accommodate your architecture. Expect "reasonable security", the standard that underpins FTC enforcement, negligence claims, and shareholder litigation, to be reinterpreted in light of what the Five Eyes agencies just told every leader in writing: the threat is here, you were warned, and the basics were on the list you already have. The Projection In my quantum series, I committed to making dated, specific, accountable projections rather than hiding behind hedged language. Same standard here. Before mid-2027, though I will confidently predict this will happen before the end of the year (2026), we will see the first confirmed agentic attack chaining a genuine zero-day, not just automating known CVEs. Once that happens, the last comfortable assumption - "defending against automated attacks is the same as defending against humans" - expires. GTG-1002 to JadePuffer took roughly nine months; the capability curve underneath is compounding faster than that. By the end of 2027, cyber insurance applications for mid-market and enterprise risks will explicitly underwrite AI-infrastructure exposure: inventory of AI-adjacent systems, credential governance, and demonstrated containment speed, the way they underwrote MFA after the 2020–21 ransomware wave. Panel counsel and forensics firms will build agentic-attack-specific playbooks because the evidentiary artifacts (LLM orchestration traffic, prompt logs, API telemetry) differ materially from human intrusions. While AI is different, at the end of the day it's an evolved technology … at least until its actions are unbound and self guided. By 2028, at least one major regulator (my bet is the SEC or NYDFS), will issue guidance or enforcement that effectively defines machine-speed response expectations, and "We relied on quarterly patch cycles," will function in litigation the way "We didn't have MFA," functions today. And through this entire window, the defenders who win will be the ones who fight autonomy with autonomy; AI-driven detection, investigation, and containment operating inside the adversary's loop, with human judgment governing rather than executing. The Five Eyes agencies told us adversaries are already using AI to move faster; and defenders must do the same. I'll go further: within 24 months, a security operation without agentic defense will be structurally unable to meet the standard of care. What Leaders Should Do Now The uncomfortable good news buried in the JadePuffer analysis is that nothing about the defense is exotic. The agencies' guidance is the same information your CISO has been carrying for years: reduce attack surface, accelerate patching against known-exploited vulnerabilities, retire legacy systems, harden identity and access, and pressure-test incident response. What's changed is the cost of deferral. Every unpatched is no longer a risk waiting for an attacker to notice. It is a target an autonomous agent will find, exploit, and monetize faster than your team can convene a bridge call. Add two items which the current standard list doesn't yet include. Inventory your AI-adjacent infrastructure: every orchestration platform, agent framework, and integration server, and treat the credentials they hold as crown-jewel assets with monitoring and rotation to match. Measure the efficacy of your program in the adversary's units: minutes to detect, minutes to contain, verified under live conditions, not asserted in a slide. The agentic adversary is not a forecast anymore. It has a name, a CVE, and a 31-second self-correction time. The organizations that internalize that this week will spend the next two years building advantage. The ones that file it under "emerging threats" will spend those years explaining timelines: to their boards, their customers, their carriers, and their regulators. The clock isn't ticking anymore. It's running. About the Author: Doug Howard is CEO of Pondurance, an AI-native managed detection and response firm. He is a U.S. Air Force veteran with Pentagon service and has led 14 transactions totaling more than $2.7B across the cybersecurity sector. He writes on cyber risk, AI, and quantum threat timelines, including the series "The Quantum Clock Is Ticking." Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Over the past few years, cyberattacks have increased in number and complexity. Learn more about how to get qualified for cyber insurance in Doug Howard's Interview with Insure TV. MDR Can Make an Impact on Cyber Insurance Pondurance April 25, 2024 Facebook X (Twitter) LinkedIn Copy link Over the past few years, cyberattacks have increased in number and complexity, and the cost to recover from an incident has increased as well. The average cost for a company to recover from a ransomware attack is $1.82 million, according to Sophos Guide to Cyber Insurance , 2023. That’s a substantial hit for any size company. So it’s easy to understand why companies now view cyber insurance as a necessity — and why insurers are more selective about the companies they insure. Insurers need to know that their customers have a strong defense against cyber threats. As a result, most insurers have established strict standards that companies must meet to qualify for cyber insurance , such as using multifactor authentication, backing up data, and knowing where the endpoint vulnerabilities are. But maybe the most important thing a company can do to qualify for cyber insurance is to work with a trusted managed detection and response (MDR) provider. The Value of MDR MDR is a 24/7 solution provided by cybersecurity experts who monitor, detect, and respond to cyber threats in a way that technology alone can’t. An MDR provider can help your company reduce the risk of a cyberattack, shorten dwell time if there is an attack, and stay in regulatory compliance. Plus, your MDR provider can facilitate the cyber insurance process when applying for a new policy or renewing your existing one. Reduces the Risk of a Cyber Attack Companies of every size and industry are at risk of a cyberattack. In fact, in Sophos’ annual ransomware study in 2023, 66% of participants said they were hit by a ransomware attack the prior year. MDR reduces the risk of a cyberattack by responding to alerts and proactively monitoring networks, logs, endpoints, and clouds to hunt down would-be intruders before they can cause damage. Full visibility is key to a strong cybersecurity defense. True MDR providers have a holistic view of the threat landscape, with no gaps in visibility, to protect their clients from potential attacks 24/7. In a recent interview with The Insurer TV, Doug Howard, CEO at Pondurance, discussed why visibility is so important to cyber insurers. “We’re going to catch things right when we’re starting to see suspicious activity, before it actually has an impact,” said Doug. This ability to detect and shut down that activity in real time can mean the difference between having to file an insurance claim or not. “[MDR] provides the highest level of protection against cyberthreats, minimizing the risk and the likelihood of making a claim,” according to the Sophos guide. “While rarely a make-or-break requirement for coverage, organizations that use MDR services are often considered ‘Tier 1’ customers by insurers, as they represent the lowest level of risk.” Shortens Dwell Time if there is an Attack The average time it takes to identify and contain a data breach is 277 days , according to IBM Security’s Cost of a Data Breach 2023 . As your company may well know, substantial damage can occur during that time frame. The longer a bad actor has access to your network, the greater the potential harm — and insurers want to limit that harm as much as possible. Partnering with an MDR provider that detects threats in real time can significantly reduce dwell time , the time from when bad actors enter an environment until they are removed. Most MDR providers can tout that their clients don’t get breached. But when they do, within minutes, they can help their clients to stop the attack from spreading. Responding quickly to an attack can significantly reduce the impact of an attack and lower the cost of recovery. “[MDR] allows a customer to lower their dwell time, so if something gets in their environment, hopefully it is a very short time before it’s detected,” said Doug. He estimates that a company without humans monitoring the infrastructure 24/7 and without sophisticated tools in place may take six to 12 months to detect a threat. MDR can greatly minimize that time frame. Ensures Compliance A cyberattack can be costly, but it also compromises the identities and sensitive information of customers, in violation of privacy laws. According to the IBM Security report, personally identifiable information, such as Social Security numbers and birthdates, was included in 52% of all breaches in 2023, and companies paid an average of $183 per lost or stolen record. Due to the increase in cyberattacks, many state and federal regulations, such as HIPAA, the Cybersecurity Maturity Model Certification , and the New York Department of Financial Services regulation, now require companies to stay compliant with cybersecurity standards. Also, third-party vendors and suppliers often write cyber requirements into their contractual agreements. Keeping up with these compliance standards can be a daunting challenge, particularly for small and medium-size businesses. But an MDR provider can help your company meet its compliance requirements in multiple ways. A provider can keep your company current on any existing regulations and update on any new rules or amendments. The provider can conduct user awareness training to educate employees about how to stay safe from phishing, business email compromise, malicious downloads, and more. Plus, if a breach does occur, your company will have access to a digital forensics and incident response team to help you rapidly recover from the incident and reduce the cost of your loss — and your insurance claim. Facilitates the Cyber Insurance Process Cyber insurers are indeed being more selective about the companies they choose to cover. Sixty percent of companies with cyber insurance stated that the quality of their cyber defenses impacted their ability to get coverage, according to the Sophos guide. And the companies that do receive coverage are paying more. Having an MDR provider can lower your company’s cyber risk, putting you in a better position to receive coverage at a competitive price. In addition, when it’s time to get a new policy or renew your existing one, an MDR provider can help ensure that your company has comprehensive coverage, without unexpected exclusions, for your specific needs. Conclusion More and more, insurers are establishing strict standards for companies to qualify for cyber insurance, but having MDR can make an impact on your company’s ability to qualify. An MDR provider can reduce your risk of a cyberattack, shorten your dwell time if there is an attack, and help you stay in regulatory compliance. That way, your company has a better likelihood of securing cyber insurance — and your company stays better protected against cyber threats. Doug Howard discusses the impact MDR is making on insurance claims in his interview with The Insurer TV. Watch the video here . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Explore AI adoption strategies for midmarket companies. Learn to balance risks with opportunities while implementing AI tools in a phased approach for optimal success. Explore Your AI Options and Weigh Risk With a Phased Approach Pondurance July 10, 2025 Facebook X (Twitter) LinkedIn Copy link Artificial intelligence (AI) solutions are being rapidly adopted by U.S. businesses, including midmarket organizations, across a wide range of industries. As much as 78% of respondents in the March 2025 McKinsey survey reported that their organizations use AI in at least one business function, up from 55% in 2023. AI tools provide attractive business opportunities, such as productivity gains, improved content for marketing and sales, and faster customer service, and there are plenty of options for organizations to choose from. Employees are eager to test the performance of AI tools, often before organizations have had a chance to fully implement best practices, draft new policies, and address regulatory compliance issues. So how do organizations explore the many AI options available and still stay safe from risk? It’s a balancing act. Pondurance suggests that midmarket organizations explore the benefits of the AI tools on the market, weigh the risks of using them, and take a phased approach to AI adoption. Exploring AI solutions The AI revolution is here, and global spending on AI, including applications, infrastructure, and services, is expected to more than double over the next few years, reaching $632 billion by 2028. Organizations in every industry know they need to determine how AI can drive efficiencies for their businesses to avoid falling behind. However, there are abundant AI technologies on the market, and choosing the AI tools that work best for your midmarket organization can seem overwhelming. As a first step in considering how AI can help your organization, you can conduct an in-depth analysis of your workflow to identify the pain points for your business. Then contemplate how AI can possibly address those pain points to move you closer to your overall business goals. Also think about how the tools will work within your unique organization. Ask yourself: How do the tools integrate with my existing technology and workflows? Can the tools grow as the business grows? Can the technology handle and process my data? What are the costs to set up, use, and maintain the tools? You’ll want to consider every department in your analysis, not just IT. AI solutions can address pain points for teams across your organization, and it’s important that you explore your options. Marketing. Content generation tools, such as Microsoft Copilot and Jasper, use text prompts to generate drafts of written content for emails, blogs, and creative inspiration. AI solutions can also check grammar, edit videos, generate images, manage social media posts, and create presentations. Sales. AI tools can help your sales team identify customer trends, generate predictive analytics to anticipate customer needs, recognize upselling and cross-selling opportunities, write better emails, and generate leads. Customer service. Chatbots, such as ChatGPT and Claude, allow your business to communicate with customers in real time to improve their online experiences. Many AI solutions can also retrieve data analytics from emails, logs, social media posts, and product reviews. Human resources. AI tools can assist in recruiting candidates, onboarding, managing employee records and benefits, and upskilling workers to effectively use AI. Cybersecurity. AI can proactively help teams with enhanced security monitoring, authentication, threat detection, and incident response. However, AI also can pose security risks as it adds to the organization’s attack surface. Finance. Teams can use AI tools to detect fraud, automate compliance checks, assist with budgeting, analyze data, and more. Before letting employees experiment with these AI options, your organization should consider executing a pilot program where teams can safely use the AI tools in a controlled setting. Your organization can gather information from the pilot program teams and use their keen insights to narrow down the options that best address your pain points and further your business goals. Weighing the risks The right AI tools offer tremendous opportunities for midmarket organizations, making businesses faster and more efficient than ever before. But there are also significant risks, such as concerns about data privacy, accuracy, employee misuse, and cybersecurity. Your organization needs to carefully weigh the risks of AI, balancing them against the benefits of your AI options, to determine the best solutions. Data privacy. AI tools collect and analyze large amounts of data to train algorithms, make predictions, and improve performance. Businesses need to safeguard the data from threat actors (or even unwitting employees) to protect intellectual property and avoid data leaks that can cause ethical or reputational damage. In addition, organizations in regulated industries must protect their sensitive customer data to meet the compliance requirements of federal and state privacy laws. Accuracy. AI tools are designed to provide a correct answer to prompts. Unfortunately, when AI doesn’t know the answer, it may invent one, known as an AI hallucination. For example, Microsoft’s Bing AI Chat provided inaccurate figures about a Gap earnings report and Lululemon financial data. Also, ChatGPT fabricated six court cases for two attorneys to use as legal precedents in a brief submitted to a judge, and the judge subsequently fined the attorneys for using the fake citations. AI tools always require human oversight. Employees should verify all information generated by AI tools to confirm accuracy. Employee misuse. Sharing sensitive company or customer information on AI systems can create serious confidentiality issues, data privacy violations, and exposure of company trade secrets. The risk is real. In a recent survey, 47% of employees reported they have uploaded sensitive information into public AI tools, and 44% admits using AI at work in violation of company policies. Organizations need to set up safeguards, conduct ongoing training, and create safe workplace cultures to mitigate the risks. Cybersecurity. AI technology can detect patterns in your network traffic for a quicker response to cyber threats. But AI tools also expand the attack surface and provide new vulnerabilities for threat actors to exploit. In addition, threat actors are using their own AI tools to generate deepfakes , execute phishing scams, and create malware that is more convincing than victims have seen in prior attempts. Using a phased approach Once you’ve decided which AI solutions work best for your organization, you need to figure out how to implement them — and that implementation requires considerable preparation and planning. Your organization needs to determine the process or approach for the rollout, the usage policy, employee training, risk management, and many other important decisions. Phased approach. For most midmarket organizations, Pondurance recommends using a phased approach to AI adoption. In a phased approach, your organization takes small steps to implement AI, focusing on your pain points and business objectives in determining the phases. Your organization may want to start with the AI solutions that make the biggest impact for your employees but have a low level of risk, such as onboarding new talent, generating sales leads, or creating content for a new website. Or your team may have a high-risk priority that AI tools can address, and you want to tackle that first. No matter how you do it, the important thing is to concentrate only on specific areas or functions at a time —always with risk in mind — and set clear time frames to keep the process on schedule and on budget. Usage policy. For cybersecurity, your organization most likely compiled a comprehensive incident response plan. A similar plan is critical for AI, getting all employees and stakeholders on the same page. With the fast pace of AI adoption, your organization may not have the opportunity to draft a thorough usage policy before adopting AI. But at a minimum, your organization needs to specify the roles and tasks for using AI, the ongoing monitoring and auditing required, the training and awareness programs needed, and the controls and assessments required to protect sensitive customer data and company secrets. Employee training. AI tools are meant to help humans rather than replace them, so your organization should clearly communicate the positive benefits of AI to your employees. Your organization should offer ongoing training to every employee, teaching them how to responsibly use AI tools and stay current on the risks of AI. Your organization will also want to upskill employees , or prepare them for job changes as AI performs mundane tasks while employee work becomes more strategic. Risk management. The phased approach allows your midmarket organization to consider risk at every stage — and there are plenty of risks. Employees can misuse AI tools, resulting in the public release of confidential information or intellectual property, the use of false AI-generated information in content, or the exposure of sensitive customer data in violation of compliance laws. Threat actors pose a risk as AI expands the attack surface, leaving your network vulnerable to exploit, and they also use AI tools for deepfakes, phishing attacks, and social engineering scams. For all these reasons, it’s important to build in periodic risk monitoring and assessments during your AI launch period and after AI has become the norm to keep your organization safe and protected. Conclusion AI tools can provide productivity gains and efficiencies for your midmarket organization, but your teams must do the hard work of exploring the options, weighing the risks, and implementing AI with a phased approach. It takes preparation and planning. When you do it right, AI solutions can ease your pain points and align with your business goals to get your business running more productively and efficiently with reduced risk. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026