Maintaining Regulatory Compliance in the Gen AI World Pondurance September 11, 2025 Facebook X (Twitter) LinkedIn Copy link Generative artificial intelligence (gen AI) uses deep learning models and large datasets to recognize patterns within the data and learn from them. Once a gen AI tool is trained, it can create new data, similar to the data it was trained on, to generate content such as text, images, designs, music, and computer codes. As much as 91% of midmarket organizations use AI in their business practices, according to RSM Middle Market AI Survey 2025. That’s a marked increase from 78% reported in 2024. With such rapid adoption of gen AI, midmarket organizations are legitimately concerned about balancing the innovation benefits of gen AI and the potential risks that come with its use. Data privacy, security, and integrity top the list of concerns and are a primary focus for regulatory compliance. Keeping data safe can help organizations build trust with customers, sustain a good company reputation, and avoid costly penalties from compliance violations. Organizations can take a few substantial steps toward achieving gen AI compliance by knowing the applicable laws, making a written plan, monitoring and conducting risk assessments, and providing training to all employees. Know the law Organizations have had to follow cybersecurity rules to stay in compliance, and adding gen AI rules heightens the risk of possible compliance violations. Staying in compliance means following all state, federal, and even international laws that may apply. Currently, there’s no overarching federal law that regulates gen AI for U.S. companies. In a January 2025 executive order , President Donald Trump revoked “existing AI policies and directives that act as barriers to American AI innovation.” Then, in the One Big Beautiful Bill, the Trump administration attempted to place a 10-year moratorium on state governments’ abilities to enforce and enact legislation on AI; however, the moratorium provision was removed by the Senate prior to passage. Proponents of the moratorium argued that the restriction would keep states from passing a mishmash of rules that would discourage AI innovation, while those in opposition to the moratorium argued that AI technology needs rules in place to ensure fairness and protect citizens from possible misuse. All 50 states introduced legislation on AI in 2025, and as of July, 38 states have adopted or enacted laws covering a wide range of AI topics. A few examples of new and existing AI legislation for various states include: Arkansas . The statute sets out who owns AI-generated content and makes clear that the content cannot violate intellectual property rights or copyrights. California . The law requires a disclosure when election-related advertisements use AI-generated content, and a separate law requires AI services with over 1 million users to disclose AI-generated content. Colorado . The statute requires developers and deployers of high-risk AI systems to use reasonable care to protect against algorithmic bias and disclose the use of AI to customers. North Dakota . The legislation expands existing law, mandating that an individual must not use an AI robot to stalk or harass. Oregon . The law mandates that a nonhuman, including an AI robot, is prohibited from using the title “nurse.” Tennessee . The Ensuring Likeness, Voice, and Image Security Act, known as the ELVIS Act, prohibits the use of gen AI to mimic the voice of a songwriter, performer, or celebrity without the individual’s permission. Utah . The legislation mandates that a mental health chatbot must disclose to the user that it is not a human being but is gen AI technology. The diverse collection of state gen AI regulations poses a challenge for organizations doing business in all or multiple states across the country. Organizations should become familiar with the enacted and pending AI laws in the 50 states — or whatever states they do business in — to make sure they are in compliance. In addition, organizations that conduct business globally should comply with the European Union AI Act and other regulatory measures drafted or enacted in countries such as China, Japan, Singapore, India, and Brazil. Make a written plan For years, midmarket organizations have implemented incident response plans for cybersecurity — and written plans for gen AI are just as important, particularly for regulated industries like healthcare and financial services. Only 43% of organizations are currently developing ethical AI guidelines aligned with regulations, according to RSM Middle Market AI Survey 2025. The need for such plans may rise as future legal battles over gen AI increase in number and more companies adopt gen AI tools. The provisions needed in a written plan depend on the company size, which gen AI tools are implemented, how the gen AI tools are used, and other company-specific considerations. In general, a few crucial topics to consider in a written plan are: Proper uses for gen AI. Organizations need to define when employees should use gen AI and when it should be prohibited. The plan’s rules should define who can use gen AI, under what conditions, and for what purposes. Data privacy. Gen AI tools collect and analyze large amounts of data, including sensitive and confidential information, to train algorithms, make predictions, and improve performance. Organizations need to protect the data from possible employee misuse, threat actor exploits, intellectual property infringement, and data leaks that can lead to consumer privacy violations and cause ethical or reputational damage to the company. Verification of data. AI tools require human oversight, and employees should regularly verify all information generated by AI tools to confirm accuracy, remove bias, ensure privacy, and protect intellectual property rights. The plan should provide a clear understanding of when corrective action is needed. AI use disclosure. Some state laws now require that AI-generated output must be disclosed, and experts agree. In a 2024 MIT Sloan Management Review survey , 84% of participants either agreed or strongly agreed that organizations should make disclosures about AI use in their consumer products and offerings. The plan should spell out any mandatory AI use disclosure language and requirements. Monitor and conduct risk assessments Midmarket organizations must understand the possible compliance risks of using gen AI technology, including privacy and data security breaches, exposure of confidential information and trade secrets, and exploitation by bad actors. The organization’s cybersecurity team or provider should constantly monitor the environment to protect against threats and conduct a risk assessment on an annual basis and whenever the organization adds a new gen AI tool to the network. A risk assessment enables an organization to assess the cyber landscape, identify potential risks and vulnerabilities, and prioritize the actions needed to stay safe while using gen AI. A written plan should provide provisions for ongoing monitoring and scheduled risk assessments to evaluate and protect the network. Provide training A single employee using a gen AI tool can be the epicenter for a regulatory compliance violation. Employee misuse, such as sharing sensitive customer information using gen AI tools, can create data privacy breaches and confidentiality issues. Also, the use of gen AI tools, such as ChatGPT or Microsoft Copilot, is making phishing emails harder for employees to detect primarily due to more convincing language and correct grammar. To reduce the risk of a compliance violation, midmarket organizations should provide user awareness training to all employees. Currently, 45% of organizations are training employees on compliance requirements to reinforce the safe, ethical, and responsible use of gen AI, according to RSM Middle Market AI Survey 2025. Ongoing training can reduce risk as employees learn how to properly use gen AI tools and stay up to date on the evolving risks of their use. Organizations should designate a specific contact person who employees can report to and should outline the reporting process for any possible gen AI-related compliance issues. Conclusion The fast adoption of gen AI has left midmarket organizations concerned about balancing innovation and the potential risks of gen AI. But knowing the laws, making a written plan, monitoring and conducting risk assessments, and providing training to employees can be the basic steps an organization needs to stay compliant. Check out Doug Howard's latest analysis of the NetDiligence Cyber Claims Study for future predictions. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Choosing a managed service provider can be confusing. Read this blog to understand your options in the managed security services market.|Choosing a managed service provider can be confusing. Read this blog to understand your options in the managed security services market. Understand Your Options When Selecting a Cybersecurity Provider Pondurance December 1, 2021 Facebook X (Twitter) LinkedIn Copy link Cyberattacks are on the rise, and bad actors seem able to stay one step ahead. Work from home arrangements, Internet of Things devices, IT/operational technology security challenges, and the expanded attack surface are all contributing factors. Organizations are working to protect their IT environments from bad actors, but with limited success. The situation leaves organizations asking what they should do to protect their businesses from cyberattacks. Are managed security services providers (MSSPs) the answer? Would an in-house security team or a managed security operations center (SOC) be the correct fix? What are the options available in the managed security services market? Is managed detection and response (MDR) the way to go? The managed security services marketplace can be confusing, but the answers to these questions become clearer in the IDC Technology Spotlight whitepaper Clearing Up the Managed Security Services Confusion . Among other things, the whitepaper compares the three most common managed security services market options and discusses what organizations should consider when selecting a provider. Compare Your Options It’s important to distinguish between the services offered by MSS, MSSPs, and MDRs. The whitepaper offers a brief history of the evolution of the three services and explains the differences between managed security services market offerings. MSS 1.0 (MSS). This first generation of MSS provided the management of traditional security devices such as firewalls, intrusion detection and prevention systems, log collection, and alert management and guidance. But the service didn’t include in-depth capabilities. MSS 2.0 (MSSPs). MSSPs started out offering MSS 1.0 services. They soon offered advanced security capabilities and services and later included the adoption of new security technologies and the use of SIEMs. As the service has evolved, MSSPs have expanded their services to include protecting data and providing managed SOCs for 24/7 defense against cyber threats . MSS 3.0 (MDR). This service includes MSS and MSSP services and combines the tools, technologies, methods, and people to provide full cybersecurity capabilities. An MDR service provider can function as a third-party vendor or work with an organization’s in-house team to provide endpoint protection solutions, human-based expertise for threat intelligence and hunting, web-based consoles and dashboards for enhanced monitoring and reporting, and intellectual property. Also, for an even clearer understanding, you’ll want to check out the side-by-side comparison chart that shows the advantages and disadvantages of the three services. Select A Provider When choosing a service provider, organizations should concentrate on the type of security assistance they need. They should focus on the people, processes, and technologies that will help them reach their long-term cybersecurity goals. The whitepaper discusses the questions you should ask about various providers, the importance you should place on the different services and competencies they offer, and the benefits you can anticipate when you choose the right provider. Make The Right Choice The number of cyberattacks continues to increase, and bad actors are targeting organizations of every size and industry. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

If you are using IoT to improve logistics and supply chain management, you must be aware of IoT vulnerabilities and how to secure devices.|If you are using IoT to improve logistics and supply chain management, you must be aware of IoT vulnerabilities and how to secure devices. Don’t Let IoT Vulnerabilities Disrupt Your Supply Chain Pondurance June 29, 2021 Facebook X (Twitter) LinkedIn Copy link Organizations are adopting new technology, such as the Internet of Things (IoT), at a rapid pace to improve supply chain management and logistics. In fact, the aggregate number of IoT devices deployed globally was 7.7 billion in 2019 and is expected to reach 25.4 billion by 2030. As a result, improvements in real-time tracking, automation, forecasting, and inventory controls are some of the benefits that IoT brings to supply chain management. While IoT sensors can automatically track and analyze inventory and stock levels, organizations rely on the data being collected in these devices to make quantitative operational decisions. Threat actors, on the other hand, see these devices as a soft entryway into larger organizations, and they can use their skills to manipulate the data that organizations are tracking as a diversion tactic to a much larger attack on the horizon. Read about IoT vulnerabilities attackers are leveraging below. IoT Vulnerabilities Are Attractive Targets Threat actors are constantly improving their attack methods by exploiting new vulnerabilities found within these devices. According to a study, more than half of all IoT devices are vulnerable to high-severity attacks. Often organizations do not have sufficient insight into the cybersecurity posture of these devices or their manufacturers, meaning usage can inadvertently broaden the attack surface for their clients. IoT devices remain an unregulated technology with minimal security standards among device manufacturers. In a study, over 60% of cybersecurity professionals have experienced difficulty identifying and remediating vulnerabilities found in IoT devices, while another 61% of cybersecurity professionals within the industrial sector claimed they did not have visibility into the type of updates those within the supply chain may have been experiencing, rendering the use of IoT a risk to their cybersecurity posture. These vulnerable gaps make it easier for attackers to disrupt business functions within an organization. 360-Degree Visibility Is Critical To Defend Against IoT Attacks Businesses that utilize third parties to improve logistics, and other use cases, need to understand the risks associated with IoT devices. This will enable them to implement a cybersecurity strategy that provides them with 360-degree visibility into network, endpoint, logs, and cloud infrastructure to detect threats effectively. Ransomware attacks can provide adversaries with a large payout, but it is not the only prime objective threat actors are after. Attackers can use IoT botnets to launch a distributed denial-of-service attack to cripple the network or steal critical intellectual property. Proactive vulnerability managemen t, third-party risk assessments, and 24/7 monitoring are essential to prevent, detect, and mitigate related attacks. Even though securing IoT devices may be a challenging task, having 360-degree visibility into the inventory of your IoT devices is an essential starting point. Once you have a comprehensive overview of your devices, discuss segmenting the devices from the rest of your network with the IT manager to reduce the risk of accessing sensitive business information. IoT devices are considered an endpoint asset that lives on the edge of your network, and it is critical to deploy 24/7 monitoring to detect and remediate threats in real-time. The risk of unsecured devices and IoT vulnerabilities in the wild is greater than the cost of implementing security. An essential and cost-effective approach to ensuring your infrastructure is constantly monitored is integrating a Managed Detection and Response ( MDR ) service. To learn more about IoT, check out our latest webinar, Foundational Security for the Internet of Things (IoT). Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Explore the 2025 NetDiligence Cyber Claims Study to see evolving cyber risks and how Pondurance can help organizations prepare. Cyber Claims 2025: What It Means for the Future of Breach Defense Doug Howard September 19, 2025 Facebook X (Twitter) LinkedIn Copy link Cyber risk continues to evolve, and the 2025 NetDiligence Cyber Claims Study shows what organizations are really facing. From ransomware’s ongoing grip to the rising impact of third-party breaches, the findings provide a roadmap for how businesses should prepare — and where partners like Pondurance can make a difference. Note all data and analysis is based on prior year claims for cyber insurance carriers and opinion and analysis of the data from Pondurance. What the Data Shows Ransomware Still Rules: While ransom demands aren’t skyrocketing, downtime and recovery costs remain a heavy burden. Business Email Compromise on the Rise: Fraudulent transfers and impersonated vendors are costing businesses millions. Vendors as Weak Links: Third-party providers and SaaS platforms continue to trigger cascading breaches. The Regulatory Price Tag: Legal fees, fines, and compliance obligations are now a bigger share of the fallout. Target-Rich Industries: Healthcare, education, and finance remain at the top of attackers’ lists. The key message: cybercriminals are pragmatic. They follow the money, exploit the weakest link, and focus on where disruption creates leverage. What This Means for Security Monitoring For organizations and their security partners, these findings point to a few clear priorities: Look Beyond Encryption: Ransomware defense isn’t just about backups — it’s about spotting suspicious activity before lockout occurs. Watch the Inbox Closely: Human error fuels BEC. Strong monitoring around financial processes and user activity is essential. Don’t Forget Your Vendors: Security must extend to cloud services and supply chains, not just internal systems. Think Compliance from the Start: Fast, accurate reporting and evidence handling can mitigate regulatory costs. Tailor to Your Sector: Every industry has different vulnerabilities, and monitoring needs to reflect that. How Pondurance Can Help While the data shows where risks are growing, organizations don’t have to navigate this landscape alone. Pondurance partners with businesses to strengthen resilience across three critical fronts: Cyber Advisory: Helping organizations build stronger strategies around compliance, vendor risk, and industry-specific defenses. This ensures security investments align with both business goals and regulatory requirements. Managed Detection & Response (MDR): Delivering 24/7 monitoring to spot ransomware behaviors, flag suspicious emails, and extend visibility into cloud and vendor ecosystems. Our MDR analysts act as an extension of your team, providing human-driven context when it matters most. Digital Forensics & Incident Response (DFIR): When incidents occur, speed and clarity are critical. Pondurance provides immediate response, forensic investigation, and guidance to ensure both recovery and regulatory obligations are handled effectively. Together, these services help organizations not just react to today’s threats, but proactively prepare for what’s next. What’s Ahead in 2026 Looking forward, we can expect: More Small-Scale Ransomware Hits: Mid-tier operators will increasingly target smaller, less-defended organizations. AI-Fueled Scams: Deepfake calls, realistic phishing, and voice fraud will amplify business email compromise. Supply Chain Breaches as the Norm: Vendor incidents may become the single largest source of compromise. Blended Extortion: Attackers will combine ransomware, DDoS, and data theft into multi-pronged campaigns. Tighter Regulatory Deadlines: Faster reporting rules will demand incident response processes that are “compliance ready.” New Industry Targets: Manufacturing and industrial IoT may join healthcare and finance as top attacker priorities. The Bottom Line Cyber threats aren’t slowing down — they’re diversifying. The winners in 2026 will be those who: Strengthen supply chain visibility. Defend against people-focused scams as much as technical exploits. Bake compliance readiness into their response plans. Adapt playbooks to match sector-specific risks. At Pondurance, our mission is to help organizations stay ahead of this shifting threat landscape — with the right strategy, the right monitoring, and the right response when it matters most. From integrated IT Assets, continuous Rapid Risk Assessments, end pre-encryption protection, to end user testing (multi-channel) and user risk scoring, Pondurance has established a end to end solution that leads the industry in cyber risk reduction. See how Pondurance can transform your cybersecurity strategy . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

The Ultimate Guide to Endpoint Security for the Midmarket Pondurance, Michael DeNapoli February 23, 2026 Facebook X (Twitter) LinkedIn Copy link An organization’s endpoints—devices such as laptops, smartphones, tablets, and IoT devices used in daily work—are easy entry points for attackers. According to Unit 42 data, endpoints are a primary attack surface in 61% of cyberattacks . Thus, endpoint security is a crucial component in any organization’s defense against cyberattacks and breach risks. Many midsized organizations, however, may be challenged when evaluating the managed endpoint detection and response (EDR) solutions available as well as properly implementing these tools. This article is the second in our series on how midmarket organizations can get the best benefit from their security investments—including the tools they already have. As with our first article on Microsoft security , we sat down with Michael DeNapoli, a senior solutions architect at Pondurance. His insights include how to: Improve endpoint security across your organization Implement managed EDR for maximum effectiveness Determine the best managed EDR solution to meet your security needs Q: What are the risks and consequences of not fully implementing managed EDR? Michael: EDR platforms are not “set and forget.” They require continuous updates from the vendor and ongoing maintenance from the organization. If updates aren’t deployed, the tool can’t adapt to new threat intelligence or detection techniques. But technology drift is only part of the problem. Organizations themselves are constantly changing. They add applications, modify business processes, hire and terminate employees, and—without strong device management—users install their own software. All of these changes affect what a managed EDR tool sees and how it responds. Without regular maintenance and tuning, organizations face two types of risk: 1. Good-to-bad: An application that was previously benign becomes risky or malicious. If the organization created an exclusion years earlier to allow that application, the exception must be reviewed and removed quickly. Stale exclusions are dangerous because teams often forget they exist. When a new advisory is released—for example from CISA or another intelligence source—teams may struggle to identify and remediate outdated exceptions. 2. Bad-to-good: The managed EDR tool blocks something that is actually legitimate—sometimes even business-critical—because it appears suspicious. This often happens after an application update or new software rollout. IT or security teams must tune the platform, create an appropriate exclusion, and deploy it across endpoints. Without tuning, organizations risk business disruption when critical tools are suddenly unavailable. To mitigate these two types of risk, every device owned by the organization—or accessing organizational data—should have managed EDR software installed unless there is a clearly documented, defensible reason it cannot. Excluding even a small group creates an easy attack path. From an attacker’s perspective, one unprotected endpoint is enough. If managed EDR software truly cannot be installed due to compatibility issues with a critical system, the organization must implement compensating controls. Q: There are numerous managed EDR solutions available. How can an organization determine which one will best mitigate these types of risks? The simplest way to cut through the noise is to ignore the labels and focus on how the technology works. At its core, endpoint security relies on two types of detection: static analysis and behavioral (dynamic) analysis . When a file is written to disk, the EDR tool compares it to known malware signatures. If it matches, the EDR tool blocks it. Static detection quickly stops known threats before they execute.' However, attackers routinely modify, encrypt, or obfuscate malware so it won’t match known signatures. That’s where behavioral detection comes in. Behavioral—or dynamic—analysis focuses on what a file or process does , not just what it looks like. If a process begins encrypting large numbers of files, escalating privileges, or injecting code into another process, managed EDR can detect that suspicious behavior, stop execution, quarantine artifacts, and initiate remediation. Most modern endpoint platforms combine both approaches: Static detection to block known threats immediately Behavioral detection to catch novel or modified attacks during execution Managed extended detection and response (XDR) builds on this capability by correlating activity across endpoints—and often across identity systems, cloud environments, and networks—to identify coordinated attacks rather than isolated events. In practice, many leading platforms provide managed XDR capabilities regardless of branding. Because vendors market their EDR solutions differently, organizations should evaluate capabilities, not terminology. Look for: Strong static and behavioral detection Cross-endpoint visibility and event correlation Clear response and remediation capabilities Integration with identity and cloud systems Finally, remember that technology alone isn’t enough. Whether managed internally or through a managed detection and response (MDR) provider such as Pondurance , someone must continuously monitor alerts, investigate suspicious activity, and take action beyond the endpoint. Q: How should an organization implement managed EDR to ensure the most effective endpoint security? Michael: If possible, partner with an MDR provider which provides managed EDR. Alert volume can be overwhelming, especially during initial rollout. An MDR team helps interpret alerts, reduce noise, and ensure threats are handled properly. If MDR isn’t an option, plan carefully and roll out in stages to avoid disruption. A practical implementation typically includes three phases: Phase 0: Pilot. Deploy the managed EDR agent to a small group of IT users in a non-enforcement state. The software runs but does not block activity. This confirms compatibility with operating systems and business applications before wider deployment. Phase 1: Visibility mode. Roll out broadly in “alert-only” mode for about two weeks. The managed EDR reports what it would have blocked or terminated but does not take action. This phase identifies false positives, highlights business-critical applications that require exclusions, and gives the security team visibility into normal behavior patterns. Skipping this step is risky. Without alert-only mode, managed EDR could terminate or delete files tied to critical applications across the organization. Recovery can be painful—especially if files are destroyed rather than quarantined. Phase 2: Enforcement mode. Once tuning and exclusions are in place, move users into active protection profiles. Malicious activity is now automatically blocked or terminated. From here, regular monitoring and policy refinement continue indefinitely. When configuring policies, start with vendor-recommended default profiles—typically low, medium, or high protection levels—rather than locking everything down immediately. Over time, tune policies to align with business needs and accommodate legitimate one-off software or legacy tools. Bottom line: Effective endpoint security comes from phased deployment, careful tuning, and sustained operational oversight. Q: What role does Pondurance play in ensuring managed EDR security is effective? Michael: Pondurance strengthens managed EDR security in three ways: Providing managed detection and response: Pondurance MDR monitors EDR/XDR activity, investigates suspicious patterns, and takes action (for example, locking accounts or isolating machines). Identifying gaps in coverage using services like the Pondurance Exposure & Vulnerability Service to identify devices on the network that are missing the EDR agent. Advising and helping with tuning: This includes recommending settings, helping create exclusions for critical applications, and notifying customers of “good-to-bad” situations via advisories and outreach when there’s a known threat. Pondurance integrates with top-tier managed EDR providers, including CrowdStrike, SentinelOne, and Microsoft Defender XDR. Learn more . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

In this blog you will learn how attackers orchestrate a breach and the impact these attack methods can have on an organization. Read now! Prepare for a Challenging Year in the Threat Landscape Pondurance December 21, 2023 Facebook X (Twitter) LinkedIn Copy link A data breach is a cyber incident that violates the sensitive, protected, or confidential data of an organization. The breach can be overt, such as a ransomware attack where a threat actor holds an organization’s data hostage until the organization pays the ransom demand, or covert, such as a malware attack where a threat actor may wreak havoc in a network for weeks or months before detection. Either way, a breach can trigger business, regulatory, and legal issues that disrupt an organization with lingering effects. Doug Howard, CEO at Pondurance, explains how attackers orchestrate a breach and the impact these attack methods can have on an organization in the Threat Landscape Update: A Challenging Year Ahead webinar. Doug discusses topics of concern including current attack techniques, breach investigations and validations, and recommendations for how to improve your cybersecurity. Attack Techniques Sophisticated threat actors are using proven attack techniques and new, creative ones to infiltrate networks. The use of business email compromise is on the rise, especially for organizations that have multifactor authentication (MFA) but haven’t yet turned on enforcement. “It’s great to have MFA,” Doug says. “But if you don’t have enforcement on, it’s not much better than using username and password.” He strongly recommends using MFA rather than single-factor authentication for virtual private networks and any type of remote access, including the cloud. Ransomware attacks have increased this year, too, but not at a significant rate; however, Doug expects the ransomware trend will accelerate in 2024. Threat actors also are using legitimate tools, such as payment platforms and desktop remote access tools, in illegitimate ways to gain unauthorized access into an organization’s network. In addition, Doug talks about “confirmation of the compromise,” where a threat actor claims to have compromised an organization’s data and provides some proof of a compromise. But is it an actual breach? Doug offers details about how your organization can determine if data was indeed exfiltrated by the threat actor. Investigations and Violations The anatomy of a breach includes eight distinct actions that a threat actor takes for a successful breach. These actions include reconnaissance and resource development; access; execution, persistence, privileged escalation, and credential access; defense evasion; discovery; lateral movement; collection; and command and control. Doug explains these actions taken by the threat actor during the breach and discusses the subsequent business, regulatory, and legal actions taken by the organization following the breach. When a breach is suspected, the cybersecurity team, executives, and board members can feel on edge. But it’s crucial to know precisely when to declare the suspicious incident to be a breach. “Always involve the lawyers quickly,” Doug suggests. By involving legal counsel at the onset of the incident, the attorneys can offer guidance on when to make the legal determination that a breach has occurred and provide notification of the breach. To limit the damage immediately after a breach, the attorneys must perform a legal analysis to get answers to questions such as: What information was accessed? What compliance areas or regulatory requirements were violated? Who do we have to notify? What is the time period for notification? Then, a risk analysis must be conducted to avoid a secondary attack in the near future. Doug advises that executives should talk with employees about the breach and stresses the importance of determining areas for improvement. “Make sure that you’re improving on all those areas that created friction,” Doug says. “Because unfortunately, threats continue to evolve, and ultimately, almost any company is going to have one or a few events in their next 10-year history.” Recommendations What can you do to protect against threat actors in today’s threat landscape? Doug gives several helpful suggestions on how organizations can improve their cyber environments. His recommendations include knowing where your personally identifiable information and regulatory data live within your system, communicating regularly with employees to reinforce user awareness training, and modernizing 24/7 detection capabilities, to name a few. Conclusion A breach can trigger business, regulatory, and legal issues that disrupt an organization with lingering effects, so be prepared. Know the attack techniques, understand the requirements of breach investigations and validations, and get recommendations on how to improve your cybersecurity in the current threat landscape. To learn more, watch the webinar. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Delve into Threat Tactics, Major Vulnerabilities, Emerging Trends, and Data Breaches Explored in Our Recent Monthly Webinar. Novel Threat Tactics, Notable Vulnerabilities, and Current Trends for February 2024 Pondurance April 2, 2024 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In February, the team discussed notable vulnerabilities and trends, took a deep dive into domain controller synchronization (DCSync) attacks, reviewed threat hunting trends, and offered security operations center (SOC) engineering insights. Notable Vulnerabilities and Trends The Vulnerability Management Program Team Lead reviewed vulnerabilities from January. As many as 2,500 new vulnerabilities were disclosed, and 27 of those vulnerabilities were high risk. Of those 27, eight were known to be exploited in the wild on products including Atlassian Confluence, Jenkins , Citrix NetScaler, Apple, and Ivanti Connect Secure VPN . There were no significant new vulnerabilities seen in vulnerability scans in January. Most new vulnerabilities were the result of version checks, such as PHP and Apache versions. The team also saw missing Microsoft security updates in authenticated internal scans and recommends running authenticated internal scans to gain visibility to the file systems, where it can view running applications and get access to the Windows registry. In addition, the team observed issues with network configurations where external scans were being blocked, but the exact reason for the issue is not clear. The team also detected internal scan activity where the networking equipment has security functions that are detecting scanning traffic and may shut down the route or impact the network in other ways. An organization that experiences missing assets or subnets or has any issue during scanning should inform the team members so they can troubleshoot the problem. In early February, the team sent a mass announcement to clients about the Fortinet FortiOS zero-day vulnerability that impacts an operating system running on Fortigate SSL VPNs. The vulnerability (CVE-2024-21762) is an out-of-bounds write issue that allows a threat actor to execute arbitrary code or commands. Virtual private network (VPN) devices are attractive targets for attackers, and three such attacks occurred in 2022 and 2023. Fortiguard updated its initial advisory about the incident to include a second product, FortiProxy, a security product intended to protect end users from internet-based threats. DSync Attacks The Senior Manager of Incident Response talked in detail about DCSync attacks, explaining what they are, how they are executed, and ways to detect them. A DCSync attack starts when a threat actor impersonates a Windows domain controller (DC) and tricks other DCs into providing a replica of sensitive information found in the active directory, including password hashes. The attack requires the threat actor to obtain elevated privileges. In the active directory, the threat actor also needs “replicating directory changes” and “replicating directory changes all” permissions to perform the attack. The attack allows a threat actor to obtain the password hashes for any account without having to log in to the DC and manually copy the entire active directory database. Then, the threat actor can authenticate and initiate the request. If the password hash was stored with reversible encryption, the threat actor can immediately view the text password of the account and use those new credentials to move around the environment. As another option, the threat actor can use “pass the hash,” a technique used to bypass the need for text credentials. From there, the threat actor can obtain a “golden ticket.” In a golden ticket attack, a threat actor can obtain the password hash of the KRBTGT account — the account responsible for handing out and authenticating users and accounts in an active directory — allowing the threat actor to forge Kerberos tickets to request access to any resource in the domain. To detect a DCSync attack, the team suggests an audit of Windows event ID 4662, an event generated when an operation is performed on an active directory object. The team warned that these events are verbose and can overwhelm a SIEM or SOC, so when looking in these logs, organizations should look for a request involving the globally unique identifiers for the “DS replication get changes” and “DS replication get changes all” functions. Also, look for any non-machine accounts — accounts that do not end with a dollar sign — in the subjectusername field of the event. In addition, the team recommends that organizations pay special attention to any application that interacts with the active directory in any way. And when determining a strategy to detect a DCSync attack, it’s important to understand the baseline because each organization has a unique implementation of its various applications that may generate false positives. Threat Hunting Review The Director of SOC Operations discussed upward and downward trends in cyberattacks observed by the SOC team. Ransomware . The most prevalent malware threat is ransomware. Credential harvesting via phishing emails . This type of attack is trending up with the use of artificial intelligence (AI) services like ChatGPT. Use of AI services is making it more difficult to identify phishing emails, as many of the easy catches such as poorly worded emails and bad grammar are being corrected. The team suggests using multifactor authentication for all user accounts and continuing with user awareness training. The team also sees a trend toward credential harvesting attacks that involve the creation of auto-forward rules. But, never fear, Pondurance can detect those rules. Malware delivery via phishing emails. This attack method is trending up as well. Most importantly, password-protected documents and zip files often associated with ransomware and Infostealers are increasing in frequency. The team recommends that organizations block password-protected documents and zip files on email gateways, if appropriate. Also, the team sees an increase in the use of screensaver files to drop malware in the user’s home directory, which is not uncommon, but threat actors are using files that would not be out of place in a user’s home directory in the hope of bypassing or avoiding detection. In addition, threat actors are using commonly allowed, legitimate domains, such as blogspot.com , for hosting malicious components. To stay safe, the team recommends that organizations know their environments, know their users, and keep an eye on trends. Malware delivery via drive-by websites. This attack method is trending way down, though threat actors are still using exploit kits. SOC Engineering Insights The Senior Manager, SOC Engineer, discussed Adload , a malicious malware stream that targets macOS. With roughly 1,500 hits per day at peak times, Adload is one of the more prevalent adware softwares that the team sees in its beacon streams and across the intel stream. The malware impersonates popular video players and widely used applications, forcing victims to visit malicious websites. Adload has evolved its tactics, techniques, and procedures (TTPs) over time, using platform languages such as Go, employing living-off-the-land binaries common to macOS, and calling out to legitimate projects on GitHub, where users mistake it for a benign software. In addition, Adload uses a number of other TTPs common to malware, including: Using code signing certificated to look legitimate Hijacking browser sessions Using two exploits to bypass security features inside macOS, allowing it to persist and be installe Delivering malvertising ads through malware droppers such as UpdateAgent The team encourages organizations to provide information distinct to their specific networks, such as hosts, VIP lists, honeytokens, and noisy guest networks, so the team can properly tune their event stacks. Next Month The Pondurance team will host another webinar in March to discuss new cybersecurity activity. Check back next month to read the summary. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Discover how SIEM enhances cybersecurity resilience by analyzing data, detecting threats, and protecting your organization from evolving digital risks. Read more now! Cyber101: What is a SIEM? Michael DeNapoli December 18, 2025 Facebook X (Twitter) LinkedIn Copy link Quite a few folks have asked the question "So, what is a SIEM, and what does it do?" That's a question that deserves an answer for certain, as a SIEM is an important and critical component of well-rounded cybersecurity resilience. Let's dive into the topic. What is a siem? A Security Information and Event Management (SIEM - pronounced either "seem" or "sim" as in simplify) platform is a set of technologies which take in data from many different sources, analyze that data to determine if what is being seen could indicate threat activity, and then alert when they finds something that does indicate threat activity. Of course, how a SIEM does all of this is a bit more complex - and can vary from vendor to vendor - but the overall activity of a SIEM can be mapped out. While the following is notably a bit of an over-simplification, SIEM solutions tend to follow similar methodologies to work: Key Components of a SIEM Solution First, a SIEM solution must ingest (receive copies of) information (telemetry) from security applications, operating systems, networking equipment, cloud systems, and other components of a security stack. There are some standard methods that are routinely used to make that happen, but it does vary from tool to tool in the security world; so a SIEM must have the ability to ingest multiple forms of telemetry in order to do anything with it. For example, Microsoft Windows uses a telemetry format - Windows Event Logs - that the SIEM will need to be able to take in and recognize to know what's going on in Windows systems (desktops, laptops, servers, etc.). Cloud platforms like AWS and Azure also have their own logging and telemetry formats. Linux - and a huge number of other things - use the very popular syslog format. Because of the very large number of log formats (and methods of getting those logs to the actual SIEM), modern SIEM solutions have integrations for the most popular security controls like endpoint defenses, networking equipment, operating systems, etc. They also build tools to allow them to ingest common logging formats like syslog data and common networking information formats. Finally, SIEM vendors and partners often will build custom ingestion tools for their customers when necessary. The combination of these methods allows a SIEM to be able to take in data from a huge variety of software, platforms, networks, and other components of an organization's technology and infrastructure. Next, all that data has to go somewhere. SIEM solutions also contain a database designed to file away every bit of that telemetry as it comes in. You might think this would require a huge amount of storage space somewhere, and you wouldn't be wrong, but most modern SIEM solutions have ways to keep that to a manageable amount of disk space. First, most log data is just small text files. These don't take up much room and are highly compressible, so the actual amount of space they take up is a lot smaller overall than many other forms of data you'd find in a database. On top of log files being small, a lot of the data ends up being duplicate entries that the SIEM already got from another security control, OS, or application. If the data is indeed duplicated, the SIEM only needs to store one copy of that information in the database. This has to be done with caution, however, as accidentally removing something that looks like a duplicate but is actually not can have severe consequences. Most SIEM solutions have the ability to retain the metadata (data about the data, like what tool sent that log and what time it was created) while compressing down the duplicate information. Taken together, this means that the amount of storage space your SIEM would need to hold all the necessary data to identify threat activity is manageable. Add in that most log data only needs to be in the "live" database for a relatively short period of time (usually about 90 days), and the SIEM can move stale data to a much less expensive storage system before things grow out of control. That data is still there, and can be examined whenever necessary to do investigations, but it's not taking up expensive disk space unless it's needed for that purpose. How SIEM Transforms Threat Detection So now you have an ingestion methodology set to get log and other information into the SIEM - removing duplicates but keeping everything necessary. That's flowing into a database that's storing everything needed and recent. But, how does the SIEM use all of that information to quickly find potential and actual threat activity happening in an organization? That's where the analytics engine comes in, the heart of a SIEM. Each vendor manages analytics differently, so rather than speaking about any one product, we can talk to the general operation of analytics on security data: First, the data is normalized. This step converts all the various forms of data into a standardized format that can be used to quickly evaluate what the SIEM is seeing without having to try to sort out what one security tool calls something as opposed to what a different security tool calls it. Deduplication (mentioned above) can also be performed during normalization - especially since everything is now in the same format, which makes true duplicates easier to spot. Next, the data is fed through a series of correlation rules. This allows the SIEM to define patterns of activity, looking at groups of events that relate to each other instead of individual events alone. Think of it like a security guard at a bank: Each person who comes in could be a bank robber, but they probably aren't. Instead of examining each person who comes in individually, they look for patterns in behavior that are unexpected or unusual, then focus on that person. The person walks around the public areas of the bank several times, they look up the ceiling several times, they watch what the tellers are doing behind the counters, etc. Taken alone, the person could just be nervous or confused as to where they're supposed to go. Taken together, that person may be checking out the security of the bank and looking for a way to avoid it. Correlation rules allow the SIEM to see patterns in the incoming telemetry that align with known methods of cyber attack. In or example, the person might try to figure out a password, open a web page that isn't usual for a work computer, or try to access a file share that isn't usually accessed by that person. Individually, these could be simple user mistakes; but together they can indicate that a threat actor is probing for weaknesses in security controls. The Role of AI in SIEM Analytics Correlation rules are only as good as the stuff that they know about, so a truly novel attack may not be recognized. This is why the majority of SIEM solutions also utilize some form of artificial intelligence to see how seemingly unrelated patterns could indicate a new form of attack traffic. While this isn't the same as something like ChatGPT, this form of AI - Machine Learning - looks for data points that fall outside of expected values. If the SIEM knows what "normal" looks like (due to feedback from security professionals over time), then it can use that statistical clustering to know what "abnormal" looks like - and further investigate those abnormalities. An abnormality doesn't instantly mean a threat actor is trying to break in, but it does mean that a deeper look at the telemetry is required in order to figure out if that's what is happening - even if the first pass of that data didn't see anything overtly malicious. The combination of correlation rules and Machine Learning create the ability for the SIEM to identify known and unknown, but aberrant, threat activities. From that decision, the SIEM then creates alerts which let security teams know that something needs to be investigated. Alerts commonly fall into a few key categories: Informational: Perhaps someone attempted to log in, but failed. If it happens often, then it needs to be investigated, but for now it's just a statistical blip that most likely user error. Low priority: Several failed login attempts were followed by a successful login - but nothing else even remotely suspicious happened. This could be threat activity, but it's much more likely to be someone logging in via a mobile phone and having trouble typing in a password. The SIEM and the security team need to keep an eye on this, but not start shutting down systems. Moderate priority: Now our hypothetical user has started to do things like download executable files, or download large amounts of company data, or do other things that need to be investigated, but could still be legitimate activities. If it is indeed a false alarm, then the rules can be refined to avoid it in future - but it still definitely needs to be researched further to make sure it's not a threat action. Security team personnel need to evaluate what happened and make the call as to if this is legitimate activity or an attack - and the SIEM will provide as much data as possible to those teams so they can do exactly that. High priority: Our user has now tried to install software on other machines, or add accounts to Active Directory, or encrypt large numbers of files - all direct indicators of malicious intent. At this point, devices need to be isolated and an investigation must happen immediately to contain the threat. It's highly unlikely that this is a false alarm due to the actions that were taken; and now security personnel must react, contain, and clean up. Best Practices for Effective SIEM Implementation To sum up, a SIEM is a data-processing solution that has three major components: an ingestion engine that allows the SIEM to absorb all different kinds of log data, a database that can store all that data after it is deduplicated and normalized, and an analytics engine that finds patterns which may - or absolutely do - indicate threat activity going on. Put together, these components keep track of an ocean of data and turn it into information human security teams can directly act on. This makes a SIEM solution an extremely valuable tool for any organization hoping to increase cybersecurity resilience. About the Author: Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

A summary of Pondurance's July SOC webinar including topics such as canary tokens, tar pits, honeypots, and the general threat landscape. Novel Threat Tactics, Notable Vulnerabilities, and Current Trends for June 2024 Pondurance August 6, 2024 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In June, the team discussed threat intelligence, notable vulnerabilities and trends, threat hunting, security operations center (SOC) engineering insights, and deception technologies. Threat Intelligence The Assistant Vice President of Digital Forensics and Incident Response discussed June’s heavy threat activity, particularly ransomware and business email compromise (BEC). Though the tactics and tools may change, the team expects these two types of attacks to continue to evolve. Ransomware. Most ransomware activity in June involved vulnerability exploits. However, the team saw virtual private network (VPN) compromise for ransomware as the second most common way threat actors gained access. The team estimates that threat actors execute kerberoast attacks in 9 out of 10 VPN for ransomware exploits. In a Kerberoast attack , the threat actor logs in, obtains a domain administrator account, intercepts a kerberos ticket, and then exploits service accounts with greater privileges to gain unauthorized access to the network. A whopping 82% of these VPN attacks occur when an organization does not use multifactor authentication (MFA) on the VPN. To avoid becoming a VPN attack statistic, the team recommends that organizations enable MFA on their VPNs and take steps to remove privileges from service accounts. In addition, the team stresses that organizations must confirm there is no web shell in place before applying an update on a VPN appliance. BEC attacks. The team saw very high numbers of BECs in June. In contrast to VPN attacks, 92% of BEC attacks occur with MFA in place. The team recommends that organizations implement a standard process where the accounting department must call a known phone number to verify a request to update financial information such as bank account numbers. The team also discussed that organizations may want to protect themselves with a paragraph in every legal contract that includes the phone number to call to request updated bank information. Vulnerabilities and Trends The Vulnerability Management Program Team Lead reviewed notable vulnerabilities from May and June. Based on 2024 numbers, he estimates that the new normal for disclosed vulnerabilities each month is 2,900, a bump up from 2023. As many as 258 of those vulnerabilities from May were high risk, and seven of those were known to be exploited in the wild on Justice AV Solutions, Google Chrome, and Microsoft products. The Justice AV Solutions vulnerability (CVE-2024-4978) is a supply chain attack in the legitimate version of the software. Justice AV Solutions offers digital audio-visual recording solutions for courtrooms and other legal settings. For the attack, the threat actor uploaded a malicious backdoor installer to the Justice AV Solutions website. Then, when unsuspecting users downloaded it, the vulnerability allowed the update to take place, which could ultimately lead to a complete compromise of the system where the update was installed. Four Google Chrome vulnerabilities were actively exploited, and a patch was released for each of them. CVE-2024-4671 is a use-after-free vulnerability that could result in data leakage, code execution on the impacted system, or a system crash. Both CVE-2024-4947 and CVE-2024-5247 are type confusion errors on a V8 JavaScript engine that could result in code execution, unauthorized memory access inside the system, or a browser crash. CVE-2024-4761 is an out-of-bounds memory write. All four of the vulnerabilities could be exploited by a user browsing to a specially crafted HTML page. Two Microsoft vulnerabilities were addressed with the Patch Tuesday release on May 14. CVE-2024-30040 is a security feature bypass vulnerability in the Windows MSHTML engine that a threat actor could exploit by convincing a user to open a specially crafted document and then executing code on the targeted system. CVE-2024-30051 is a privilege escalation vulnerability in the core library that is distributed via a phishing campaign with Qakbot malware and successfully exploited to gain system privileges. In June, CVE-2024-30078 impacted the Microsoft Windows Wi-Fi driver, found in every in-use version of Windows. This easy-to-exploit vulnerability is a zero-click attack that requires no authentication and no user interaction. The threat actor simply sends a specially crafted network packet to the device. Then, any user on the Wi-Fi network at the same time as the threat actor can be exploited. Users who work from public Wi-Fi networks are particularly at risk and can potentially compromise co-workers on the corporate network. This vulnerability can ultimately lead to the threat actor gaining complete control of the system, making it an important patch, though it’s unknown whether the vulnerability is currently being exploited in the wild. Threat Hunting The SOC Director talked about cyber activity that the team is currently monitoring on client networks. Social engineering tactics . The SOC is seeing an increase in compromises that originate from social engineering help desk calls. The team recommends that organizations use stricter verification procedures for the help desk and any employee who can reset MFA or passwords. Also, as always, user awareness training is essential. Ransomware is still the most prevalent malware attack, and the team expects this trend to continue for the foreseeable future. Phishing emails , particularly shipping notification emails with a financial lure, are prevalent but not as common now as during tax season. A majority of these emails link to credential harvesting web pages, and the use of artificial intelligence services, such as ChatGPT, is making phishing emails harder to detect due to more convincing language and correct grammar. To reduce the risk of an attack, the team suggests setting inbox rules to detect any unauthorized activity and hide attacker access and offering user awareness training to employees. Soc Engineering Insights The Senior Manager of SOC Engineering focused on a recent event in the news: a second ransomware demand on UnitedHealthcare. In February, the AlphV BlackCat ransomware group initially breached UnitedHealthcare, and UnitedHealthcare paid a $22 million ransom. The State Department offered a $10 million reward for individuals linked to the threat group, and shortly thereafter, the group went dark. Then, in June, RansomHub demanded a ransom from UnitedHealthcare for the same February breach. The Senior Manager of SOC Engineering discussed speculation that RansomHub is an affiliate of AlphV and that AlphV should have shared the large ransom payment with RansomHub but didn’t. There’s not much hard evidence that this scenario occurred, but there are reasons to believe it. Both groups use the same ransomware, which was developed by AlphV, and posts on the dark web stated that AlphV sold the ransomware. Also, there’s a theory that AlphV could have installed a backdoor to give RansomHub access to the data. Overall, the team suggests that it’s best to assume that RansomHub is an affiliate of AlphV until proven otherwise — and it’s an important consideration for an organization being threatened by a ransomware-as-a-service adversary. To minimize risk, the team recommends that organizations continue user awareness training, use MFA, and maintain visibility into all key aspects of their networks. In addition, the team asks clients to share their crown jewels, significant IP addresses, VIP lists, honeytokens, and anything distinct to the network that can give the team an edge against threat actors. Deception Technologies The Detection Engineer talked about basic deception technologies that clients can use as a covert measure to help protect their networks. Canary tokens are free tools that organizations can implant in files and folders to lure a threat actor, a pen tester, or even an unauthorized employee and expose his or her actions. Canary tokens function like a digital trip wire that will generate an alert once a file or folder has been accessed. There are several different forms of canary tokens including credit cards, where an organization can put a credit card in the database, and if the database is stolen and someone tries to sell the credit card or use it, the organization will receive an alert, and domain name systems, where a link within a document can resolve to a domain that no one should know about and trigger an alert if a visitor lands on the domain. Honeypots are quite similar to canary tokens and can be used interchangeably with them. They are tools used to lure threat actors into a safe environment where users can see what the threat actors are doing. In addition, honeypots can be used to detect a threat actor conducting a particular activity inside the network, such as scanning to look for remote desktop protocols and file shares. Tar pits act as decoys to lure potential threat actors and intentionally keep them “stuck in a network molasses” for an extended time. Tar pits spin up or reply as a host that doesn’t actually exist to slow down the threat actors or get them looking in a different direction. Breadcrumbs are a good way to catch improper activity in a network. Organizations can use breadcrumbs to detect activity in intranets, Teams messages, and password searches. The Detection Engineer explained that deception technology is already being used in system environments, as antivirus and endpoint detection and response (EDR) solutions use decoy files. All EDRs that Pondurance deploys have a decoy or deception technology built into them, with the exception of Microsoft Defender. He also discussed other deception technologies that can be created or purchased including QR codes, MySQL or SQL dumps, custom.exe, Raspberry Pi, and more. Next Month The Pondurance team will host another webinar in July to discuss new cybersecurity activity. Check back next month to read the summary. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn why companies are turning to managed detection and response (MDR) to protect against cyber threats and how to evaluate MDR providers. Making the Right Decision: How To Choose an MDR Provider Pondurance June 3, 2022 Facebook X (Twitter) LinkedIn Copy link Companies continue to face an increase in data breaches from cybercriminals. In the first quarter of 2022, publicly reported breaches were up 14% over 2021, according to the Identity Theft Resource Center . That’s impressive considering that the number of data breaches in 2021, up 68%, was the highest annual total ever reported. As the number of breaches increases, companies are turning to managed detection and response (MDR) services to keep them safe from threats. Technological research and consulting firm Gartner forecasts that 50% of all companies will use MDR services to monitor, detect, and respond to threats by 2025. But what does a company need to consider when choosing an MDR services provider? Lyndon Brown, Chief Strategy Officer at Pondurance, explains the ins and outs of MDR services in the webinar Demystifying Managed Detection and Response with moderator Sharon Smith. He covers what you should look for in an MDR and how to evaluate an MDR services provider. What to look for in an MDR People, processes, and technology are the three primary components of MDR services. A quality MDR services provider must offer all three to protect your company from cyber threats effectively. People . Cyber professionals are the most critical component of any comprehensive cybersecurity service. Technology alone will not deter a motivated attacker; human attackers must be confronted by human defenders , who are available 24/7 to help your company. But, as you may know, there’s a global cyber talent shortage, and companies are finding it challenging to hire and retain professionals for in-house security teams. “The MDR provider should be able to relieve the bulk of the burden associated with identifying and finding talent, training talent, retaining talent, and developing talent,” said Lyndon. “It really is the first pillar for the MDR provider.” Process . Modern MDR providers should be able to integrate with and support your existing policies and processes and add to your cybersecurity capabilities. MDR services should include technology management, detection and response, threat intelligence, and vulnerability management. Technology . Your company shouldn’t have to rip out existing tools to work with an MDR provider. Instead, the provider should build on the technology you have. Learn how MDR can provide a detection and response platform, log analysis, endpoint detection and response, forensics, and more to protect your company from a cyberattack. How to evaluate an MDR provider When choosing an MDR provider, major differences in the offerings can mean the difference between a cybercriminal penetrating your network and one being stopped. Choosing the right partner for your company and security protocols is important. In your search, you should challenge an MDR provider with some crucial questions to get the answers you need. For example: Can the provider enhance your security operations while leveraging your existing technology? Are alerts reviewed by expert analysts who will alert you only when action is needed? Can the provider detect and respond across your network, log, endpoint, and cloud infrastructure? Does the provider offer incident response capabilities? Find out what Lyndon suggests you learn about potential MDR providers to identify the right vendor for your company. Conclusion As data breaches increase, companies turn to MDR providers to prevent, detect, and respond to threats. Know what to look for and how to evaluate an MDR services provider for your company. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Is MDR right for you? Gain insights into the threat landscape and learn why security leaders are turning to managed detection and response.|Is MDR right for you? Gain insights into the threat landscape and learn why security leaders are turning to managed detection and response.|Is MDR right for you? Gain insights into the threat landscape and learn why security leaders are turning to managed detection and response. Is MDR the Answer? Or Just Another Technology Fad? Pondurance July 6, 2021 Facebook X (Twitter) LinkedIn Copy link I was recently invited to The Next Phase of Cybersecurity podcast to share insights on the current threat landscape and how managed detection and response ( MDR ) can help organizations adapt and defend in today’s world. With so many new products and acronyms in cybersecurity and technology, customers are right to have healthy skepticism. In the podcast, we discussed the history of MDR, the current threat landscape, common challenges for organizations, and how MDR can help businesses of all sizes. As a bonus, we chatted about extended detection and response (XDR) and how that fits in. Why are SIEMS and MSSPs not enough? For a bit of history, cybersecurity issues first arose when people started to meaningfully connect to the internet in the mid-to-late ‘90s. That’s when managed security service providers (MSSPs) started offering security prevention solutions. MSSPs were developed in a world where people believed you could build a wall big enough to keep attackers out with antivirus and firewalls. MSSP services focused on managing security technology to stop attackers at the front door, but that is no longer enough protection as attackers are now getting around the proverbial castle walls. Security information and event management (SIEM) services started to pop up shortly after MSSPs, as companies tried to meet compliance mandates to log everything and also fix their cybersecurity issues by improving monitoring. However, there simply weren’t enough experts to look at the data and maintain the complex tapestries of security rules. This approach led to an industry littered with half-implemented or shelved projects. MSSP raised its hands to help but ultimately didn’t have the visibility or expertise to do anything but produce more noise for the customer. Technologies like endpoint detection and response (EDR) popped up to help with visibility and detection, and that’s when MDR providers started offering end-to-end detection and response for companies. When done right, MDR providers partner with customer teams, bringing the expertise and technology that most organizations are not able to select, maintain, and improve on their own. What is MDR? MDR is a way for companies with limited budgets to finally achieve an effective 24/7 detection and response strategy. This includes monitoring their networks, endpoints, logs, and cloud infrastructure to detect cyber threats that are constantly evolving in sophistication. Unlike MSSPs, true MDR services deliver technology and human intervention to proactively search for threats, validate those threats, and respond in time to minimize damage or loss. They are designed to efficiently and consistently perform detection and response while managing the underlying technology. What’s happening in the current threat landscape and how is it leading to more adoption of MDR services? Attackers are constantly evolving their techniques and looking for new ways to get the biggest payoff with minimal effort. Ransomware attacks alone have increased 62% globally since 2019 and 158% in North America . Ransomware is a household name often in front-page news and highlighted on 60 Minutes. There are more attackers joining the business of cybercrime, resulting in more compromised companies. The economics favor the attackers. It only takes a few dollars of offense from attackers to defeat millions of dollars of defense from defenders. Gartner estimates that by 2025, 75% of organizations will face one or more cyberattacks. The number of attacks is increasing daily by a rate of 50% over the last year alone. Organizations want to do more. They want to keep up with the alert volume and be able to investigate alerts to find out what’s happening underneath the surface, but they don’t necessarily have the time or resources. Alert fatigue is a common contributor to false positives that can get overlooked, especially if an organization is understaffed. What is a common challenge organizations face today? Every sector has been touched by ransomware or other cyber threats. The prior belief was that only the top 1% was getting attacked — top banks, top defense contractors, large organizations, etc. However, that’s not the case. Everyone is a target, and not everyone is able to defend against cyberattacks. Cybersecurity talent shortages are widespread as there are simply not enough people with hands-on experience to support and keep up with the current threat landscape. Once organizations hire employees and train them, the employees can leave and often double their salaries somewhere else. It’s a tough environment to build and retain cybersecurity talent. How is MDR helping organizations tackle cyberattacks? MDR brings the people, processes, and technology together to solve the issue of visibility into an organization’s network. Organizations are either overwhelmed with alerts that they are not able to fully investigate or they don’t receive enough security alerts and are likely missing a possible attack or compromise. As long as there’s a human attacker, you’ll need human defenders. Human beings are too creative, motivated, and ingenious to be stopped with machines alone. MDR providers are able to attract and retain this human expertise and apply it across a customer base, where organizations have a hard time retaining this level of talent. There is also an intelligence aspect — understanding the threat landscape, what the latest attackers are doing, and keeping up with the best ways to prevent attacks. When you detect something, you need to take action to deal with it. This requires an understanding of the business and solid incident response expertise. Unfortunately, only a select set of MDR providers are really equipped with this combination of skills. Where do you see XDR heading and what potential does it have in contrast to EDR? Full visibility should be a tenet of any detection and response strategy. Our Scope platform has been performing extended detection and response (XDR) since before there was a term dedicated to this type of work. We started with network analysis in 2013, added endpoint, detection, and response (EDR) in 2014, and include cloud and log analytics as the core of our approach. We believe today, and have always believed, that XDR is a requirement to be an effective MDR provider. As a tool, I predict that XDRs will be similar to SIEMs. Many organizations will adopt them but realize limited success because of the people and process requirements to get the most out of the technology. The big banks will do it right. But, if you’re a midmarket organization, it will be hard to retain a full-time dedicated staff focused on getting the device up, running, and configured. At Pondurance, our managed XDR Platform, Scope, along with the smartest humans we can find, power our 24/7 MDR services. There is no one-size-fits-all approach to MDR. Every organization has different needs, and they are all at different stages in their journeys. It’s important to identify a partner that can be on that journey with you to navigate the various tech trends and threat evolution points that will continue to occur. Want more? Watch our webinar where I discuss MDR with our CEO Doug Howard and Jim Malone of CIO.com : Making the Case for Managed Detection and Response . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Take Steps To Protect Your Organization From Phishing Attacks Pondurance October 14, 2025 Facebook X (Twitter) LinkedIn Copy link Small and midsize organizations are targets for threat actors who use phishing schemes as a way to steal sensitive data, fraudulently take money, or cause disruption. Phishing has become so prevalent that it has now replaced stolen credentials as the No. 1 initial attack vector for threat actors, according to IBM Security’s Cost of a Data Breach Report 2025 . Today, phishing is responsible for 16% of all breaches, costing an average of $4.8 million per breach. Phishing attacks are different than many other types of cyberattacks because they use human error rather than a technology vulnerability as their entry point. An employee can click on one wrong link and unwittingly allow a threat actor to steal credentials, access business accounts, or install malware or ransomware. The Cybersecurity and Infrastructure Security Agency (CISA) recommends that all organizations take steps to protect against phishing, and there’s no better time to take those steps than during Cybersecurity Awareness Month 2025 in October. There are many things employees at your organization can do to combat phishing including understanding how phishing works, knowing the different types of phishing that threat actors use, recognizing the red flags associated with phishing, and participating in training to protect themselves and the organization from attacks. How phishing works A phishing attack is designed to manipulate an employee into providing information such as passwords, bank account numbers, PIN numbers, credit card numbers, and Social Security numbers, to name a few. In a phishing attack, a threat actor impersonates a co-worker, customer, or business associate and sends a message requesting that the employee take a particular action such as click on a link, open an attachment, or visit a website. Since the message looks legitimate, the employee may be convinced to take the requested action. Once the action is taken, the threat actor has what he needs to further the attack, going on to commit fraud, take over bank accounts, steal credit cards, collect Social Security numbers, install malware or ransomware, or complete whatever plan is in place to disrupt and harm the organization’s finances, business operation, or reputation. The employee may not even know the attack occurred until much later. Types of phishing Threat actors use numerous types of phishing scams to convince employees to hand over their sensitive information. Emails are the most common way that phishing occurs, but the attack can also happen on an employee’s phone, by text message, or via website. The APWG Phishing Activity Trends Report, which analyzes phishing attacks reported by its member companies, observed more than 2.1 million phishing attacks for the first six months of 2025, and the number of phishing attacks being reported is steadily rising. The increase in phishing is cause for concern, and every organization should be familiar with the types of phishing attacks that employees may encounter. Spear phishing. This email phishing attack targets a specific employee who has access to sensitive information or accounts. The threat actor may study the target before the attack to plan a convincing strategy using personal details to make the email seem more authentic — and more likely to succeed. Very similar to spear phishing, whale phishing is a targeted attack on a high-profile executive or high-net-worth individual. Business email compromise (BEC). In this phishing attack, the threat actor sends an email to an employee at an organization that appears to be from another employee, customer, or business associate. The email deceives the employee into sending files that contain sensitive data, wiring money to a fake bank account, paying a fraudulent invoice, or performing some other harmful act. BEC attacks accounted for more than $2.7 billion in losses in 2024 , making them one of the costliest types of cyberattacks, according to the FBI Internet Crime Report 2024. Vishing. This attack occurs by voicemail or phone using voice over internet protocol technology. The threat actor may impersonate a co-worker, customer, or business associate to convince the employee to provide sensitive information. As a different tact, the threat actor may try to frighten the employee with threats of legal trouble, past due invoices, credit card issues, or other critical situations that require immediate attention. Smishing. This phishing attack occurs through text messages. The fake texts often appear to come from a phone carrier, the post office, a credit card company, or even toll road operators, asking for updated account information or payments. Threat actors also use many other phishing schemes to trick employees into giving up their information including clone phishing, website spoofing, image phishing, domain spoofing, search engine phishing, and the list goes on. Cybercriminals constantly devise new malicious phishing attacks, so employees need to stay alert to potential threats. Red flags In past years, phishing messages were fairly easy to recognize with poor grammar, awkward language, or misspellings. Today, threat actors are able to use artificial intelligence (AI) tools to create messages that are much more sophisticated and effective. However, there are several red flags to alert employees that a message may be a phishing attack, and employees should watch out for these signs of phishing: Incorrect email address or website URL. Threat actors use subtle differences in spelling to deceive employees, so employees should closely examine the address or URL. Unknown email address from a known sender. If an email address is not one that the sender usually uses, it may be a sign of phishing. Urgent request. If an email sender requests a quick response or offers an emotional plea for action, the employee should think carefully before responding. Links within an email. Employees should always hover over a link to confirm that it is indeed a legitimate site. Also, they should never click on the “unsubscribe” link of a suspicious email. Unknown phone numbers. Employees should not use phone numbers from an unsolicited email. Instead, look up the phone number on the company’s website and call that number to verify that the message is real. Suspicious attachments. Employees should be cautious about any email attachment and should never open attachments from an unknown sender. Request for login credentials, money, or personal or financial information. Employees need to know that legitimate organizations will not ask for these items in an email. How to protect against phishing The threats from phishing can be relentless, but small and midsize organizations can protect against these attacks. Providing user awareness training, implementing technology, and establishing reporting protocols can help keep employees and sensitive data safe. Offering ongoing user awareness training is one of the most critical steps an organization can take to protect against phishing. After all, knowledgeable, observant employees are the best defense against a phishing attack. During training, employees can learn what a phishing attack is, how to recognize the signs of phishing, what they can do to prevent phishing attacks, and how to report phishing. Training improved phishing recognition for 52% of participants, according to a National Cybersecurity Alliance study. Organizations can use tools and technology to detect phishing messages and files, including email security software, spam filters, antivirus software, and anti-malware software. Also, endpoint detection and response solutions with AI and advanced analytics can intercept phishing attempts. In addition, CISA recommends that all organizations implement phishing-resistant multifactor authentication (MFA) to combat phishing. MFA is an authentication method that requires an employee to provide two or more factors, or forms of identification, during login for an extra layer of security. Phishing-resistant MFA is the only MFA that is resistant to phishing attacks. Unfortunately, even with training and technology, phishing attacks can still occur, so organizations should have procedures in place for reporting suspected cyber events. Employees need to know how to immediately report a suspicious email, phone call, or text message to a trusted person at the organization. Then, if warranted, the organization can contact CISA , the FBI’s Internet Crime Complaint Center , the Anti-Phishing Working Group , or the Federal Trade Commission to take further action with authorities. Conclusion Small and midsize organizations are targets for phishing attacks as threat actors tenaciously plot to steal sensitive data, access financial accounts, and cause disruption. But your organization can take steps to teach employees what they need to know about phishing attacks to protect your organization’s data and accounts and keep your business operating without disruption. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026