Cyberattacks on French supermarket refrigeration systems reveal the risks of connected equipment and why operational technology security matters. Lessons Learned from the French Refrigeration Attacks Pondurance October 19, 2026 Facebook X (Twitter) LinkedIn Copy link Cybersecurity incidents can have consequences far beyond stolen data. For a supermarket, losing control of refrigeration can mean spoiled inventory, interrupted operations, and lost revenue. That connection became clear in October 2026, when cyberattacks disrupted refrigeration systems at hundreds of French supermarkets. Reports described abnormal temperature increases that forced stores to discard fresh and frozen products. For the employees and businesses affected, the recovery involved both restoring equipment and safely replenishing inventory . The incident raises a question relevant to organizations in every industry: Do you know which connected systems your business depends on—and how those systems are protected? What we know France’s national cybersecurity agency, ANSSI, through its CERT-FR alert, confirmed compromises involving refrigeration controllers in the Danfoss AK-SM and AK-SC series, as well as Copeland and Dixell XWEB equipment. The alert identifies exposed management interfaces as a security concern and recommends removing direct internet exposure. According to reporting by the Associated Press, Danfoss said most affected systems were older products that no longer received software or security updates. That is an important distinction: it does not establish that every affected system was unsupported or that one particular failure explains every compromise. As of October 16, the precise entry points and full sequence of events across affected locations should not be treated as settled. Publicly documented vulnerabilities can help explain potential risks, but they do not, by themselves, prove which techniques attackers used in a particular incident. Additionally, a similar attack succeeded against United States Department of Defense commissaries throughout the continental US. Due to the nature of this incident being classified and investigated as a national security issue, it is unknown if the same Danfoss equipment was in-use at these sites, but the attack played out the same and had the same impact as the French attacks. Why connected equipment deserves attention Refrigeration controllers are part of operational technology, or OT: systems that monitor or control physical equipment and processes. Unlike a compromised email account, a compromised controller can directly affect the operation of machinery or the conditions needed to preserve inventory. These systems can also have different replacement cycles and maintenance requirements from everyday office technology. Equipment may remain useful long after its connected controller stops receiving security updates. Replacement can require coordination among operations teams, technology staff, equipment vendors, and service providers. Those constraints deserve recognition. They also make it important to identify unsupported systems early and plan how to protect or replace them. Practical lessons for business leaders 1. Know what your operations depend on Maintain an inventory of connected systems that support critical operations. Identify who owns each system, who maintains it, who can access it remotely, and whether its software and hardware remain supported. Include equipment managed by outside service providers. Responsibility for maintaining equipment and responsibility for securing its remote access should be explicit. 2. Review remote access with your service providers Remote management can be valuable, but the access path needs appropriate protection. CERT-FR recommends restoring access to affected refrigeration controllers only through a secure VPN or protected network. Its guidance also calls for configuration reviews, manufacturer-recommended updates, and changes to default passwords. This would require that all existing control interfaces which are visible on the public Internet be configured so that they are restricted to VPN and on-network accessibility only. Coordinate changes with the people responsible for the equipment. Disconnecting remote access without understanding its purpose could interrupt monitoring or maintenance services. 3. Plan for the end of support A functioning device is not necessarily a supported device. Track support deadlines and include replacement costs, testing, and downtime in operational budgets. When immediate replacement is impractical, work with qualified equipment and security specialists on interim protections and a defined replacement timeline. Those protections should address the system’s exposure and business importance; they should not become an indefinite substitute for lifecycle planning. 4. Prepare for disruption Ask what happens if a critical system becomes unavailable or its settings cannot be trusted. How will the organization be alerted? Who receives the alert? Who can safely intervene? How will the organization maintain operations, protect inventory, and verify that service can resume? For refrigeration, that planning should involve the people responsible for equipment operation and food safety. Cybersecurity response and operational recovery need to work together. The broader business lesson The French refrigeration attacks illustrate how closely digital access and physical operations can be connected. They also show why security conversations need to include operations leaders and equipment providers alongside IT. For business leaders, a useful starting point is straightforward: Which connected systems could stop us from serving our customers, and who is accountable for managing that risk? Answering that question helps turn a distant news story into practical preparation for your own organization. Featured Posts READ MORE Lessons Learned from the French Refrigeration Attacks October 19, 2026 Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026

MDR Security Services aren’t a one-size-fits-all solution. Learn the advantages of MDR and how to choose the best solution for you. MDR Deep Dive: What It Offers and What To Look For Pondurance March 8, 2022 Facebook X (Twitter) LinkedIn Copy link The Russia-Ukraine conflict has put global and U.S. businesses on notice that the risk of cyberattack is a serious threat. If your company doesn’t have the cyber protection it needs, you’re most likely searching for a security solution, like managed detection and response (MDR) security services. You probably have questions about how to choose a provider, such as: How will the provider integrate with your company’s existing technology and team? Do the provider’s security professionals have the experience to detect and respond to an attack? Are there red flags to be wary of when choosing a provider? In Chapter 5 of our new eBook Managed Detection and Response (MDR) for Dummies , we discuss what you should consider when choosing an MDR security service. We explain the primary advantages of adopting MDR over other security solutions and offer specifics on what to look for in an MDR provider. MDR advantages MDR isn’t a one-size-fits-all solution. Companies have different compliance requirements, staffing issues, policy requirements, and other considerations. MDR offers a flexible solution that costs less than building an in-house team. We discuss flexibility, cost, and why security expertise is critical to making it all work. Flexibility. When we say flexibility, we mean customizability and open integration. MDR can customize its services to your company’s specific needs and integrate any security tools that your company already has in place. Cost. The total cost of ownership of MDR is much lower than having to hire a staff and provide it with tools. Tools are expensive to purchase and maintain, and with the global shortage of security staff, qualified professionals come with high salaries — that is, if you can find available talent to hire. Security expertise. MDR providers are staffed with knowledgeable, experienced professionals. We discuss the advantages of having these talented humans to keep your company safe from cyberattacks . What to look for in an MDR security service When choosing an MDR provider, there can be major differences in the offerings, and that can mean the difference between an attack penetrating your network and one being stopped. We discuss the most important capabilities to seek out when choosing a provider: Comprehensive logging and reporting. Make sure your provider can handle the volume of incident logs and alerts and has the knowledge to address your compliance issues. Detection and response. Confirm that your MDR provider has broad and deep visibility into your internal systems and resources and has the tools to remediate an attack. Also, find out why we believe “focus” can be a red flag. Full integration. Be certain the provider integrates with the tools, people, and policies at your company. Incident analysis and forensics. Learn why an MDR provider must evolve its own internal procedures and tool sets to meet modern cyber threats. Human expertise . People make MDR stand out from other security solutions. Find out how to assess the quality and availability of a provider’s expertise. Cybersecurity is a global concern, and your company — no matter where it’s located — needs to put in place the right security solution provider to protect against a cyberattack. We can give you the details to understand the advantages of MDR and know what to look for in an MDR provider. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

To kick off Cybersecurity Awareness Month with Pondurance, take a look at the four basic practices identified by CISA as this year's themes. 4 Basic Practices To Reduce Your Cyber Risk Pondurance October 1, 2024 Facebook X (Twitter) LinkedIn Copy link The frequency of cyberattacks continues to rise for organizations across industries. Specifically, organizations experienced a substantial increase in attacks involving the exploitation of vulnerabilities, according to the Verizon 2024 Data Breach Investigations Report . Vulnerabilities can include blind spots, gaps, and weaknesses in a network that put an organization at risk of a cyberattack. The report found that the number of vulnerability attacks increased 180% in the last year. Cybersecurity Awareness Month in October provides an ideal opportunity to remind organizations to practice cybersecurity awareness to safeguard against vulnerability attacks and all other breaches. Though there’s no surefire way to keep bad actors at bay, four basic practices — using strong passwords or a password manager, turning on multifactor authentication (MFA), recognizing and reporting phishing, and updating software — can substantially reduce your cyber risk. Use strong passwords or a password manager Using strong passwords is a simple way to protect your online accounts and apps. Pondurance recommends clients use passwords that are a minimum of 16 characters including uppercase, lowercase, numbers, and symbols. Also, clients should use a different password for every account. Of course, remembering all those passwords is practically impossible, and that’s where the use of a password manager is a smart idea. A password manager is a program that generates strong random passwords, stores them, and can even autofill your passwords, so you don’t have to remember your passwords or write them down. Just be sure to use a strong master password that you can easily memorize to secure the password manager account. Turn on MFA The implementation of MFA can make it more difficult for a bad actor to access an account, as MFA requires two or more authentication factors, such as a password, PIN, verification code, fingerprint, or voice recognition, to verify a user’s identity at login. That extra layer of protection can mean the difference between a bad actor exploiting a network and the continuation of business as usual. Organizations should have MFA properly implemented on each and every device; otherwise, they can be vulnerable to exploitation. As an example, the Pondurance digital forensics and incident response team has cited that a whopping 82% of virtual private network (VPN) for ransomware attacks occur when an organization has not implemented MFA on the VPN. In addition, cyber insurance providers are increasingly requiring organizations to have MFA to qualify for cyber insurance and, more importantly, requiring that it is implemented on all devices. Answering questions on MFA implementation is now part of the application process. “Early on, insurance providers would ask, ‘Do you have multifactor authentication?’” said Doug Howard, CEO at Pondurance. “Companies would answer ‘yes,’ but come to find out, the companies had it but never implemented it or implemented it only on VPN and no other system. Now, the questions on the insurance applications are getting deeper. Providers want to know that you’re using MFA in a way that will actually protect your company against bad actors.” Recognize and report phishing In a phishing attack, a user receives an email or text from someone claiming to be a trusted source and is deceived into providing credentials or sensitive personal information, such as passwords or credit card numbers. The FBI receives more complaints about phishing/spoofing than any other type of attack. In fact, the total number of phishing complaints (298,878) is more than five times greater than any other reported attack, according to the FBI Internet Crime Report 2023 . The Pondurance security operations center (SOC) team agrees that phishing ranks as the top method of credential compromise. The team reports that phishing emails with a financial lure, particularly for tax rebates and refunds, are common schemes during tax season. Also, malware delivery via phishing emails is an increasing threat, occurring through links in the body of emails and attachments that lead to malicious websites. The use of artificial intelligence services, such as ChatGPT, is making phishing emails harder to detect due to more convincing language and correct grammar. To reduce the risk of an attack, the SOC team suggests setting inbox rules to detect any unauthorized activity and offering user awareness training to employees. User awareness training helps employees recognize phishing emails and learn how to report any suspected activity. Update software Updates, or patches, plug the holes in software and operating systems that make them vulnerable to bad actors. Updating can fix bugs, improve performance, protect against malware, add features, and more — and it’s of utmost importance to patch promptly. To help clients stay current on updates, Pondurance conducts a monthly SOC webinar to discuss notable vulnerabilities and the threat landscape. Each month, the Pondurance team reviews high-risk vulnerabilities, recent cybersecurity trends, and upticks in activity over the past month. The team explains how disclosed vulnerabilities occurred, recommends various updates and patches, and suggests ways clients can protect themselves against these new threats and possible future threats. Conclusion Every organization should practice cybersecurity awareness to safeguard against cyberattacks and breaches. Using strong passwords or a password manager, turning on MFA, recognizing and reporting phishing, and updating software are great first steps to substantially reduce your cyber risk during Cybersecurity Awareness Month and throughout the year. Find out how your organization can practice cybersecurity awareness, day in and day out, using Pondurance’s risk-based approach. Learn more . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Navigating the Cybersecurity Landscape Pondurance July 29, 2025 Facebook X (Twitter) LinkedIn Copy link At the recent FutureCon in Orange County, Ron delivered an enlightening presentation that shed light on the pressing cybersecurity challenges faced by modern organizations, particularly mid-market businesses. With extensive experience in the cybersecurity field, Ron's insights are particularly valuable for those grappling with oversized data breach risks while operating with limited budgets and expertise. His session illuminated the ever-evolving landscape of cyber threats and provided strategic approaches necessary to effectively combat them. Understanding Current Cyber Threats The presentation began by analyzing the current cybersecurity landscape, emphasizing the escalating sophistication of threats. Alarmingly, ransomware attacks are proliferating and are increasingly targeting critical infrastructure. Attackers are employing advanced tactics, such as double extortion, where not only is data encrypted but also exfiltrated for potential public release. This troubling trend underscores the heightened stakes for mid-market organizations, which often lack the resources to manage the fallout from such breaches effectively. Furthermore, a growing number of software vulnerabilities highlight the urgent need for comprehensive security measures. The data from the Common Vulnerabilities and Exposures (CVE) database reveals a continuous rise in reported vulnerabilities, necessitating that mid-market organizations prioritize patch management and vulnerability assessments. Investing in proactive cybersecurity measures is no longer a choice; it is a crucial necessity for firms that may struggle to recover from significant breaches due to resource constraints. The Significance of a Comprehensive Cybersecurity Strategy Developing a comprehensive cybersecurity strategy is essential for mid-market organizations navigating a complex threat landscape while managing limited resources. This strategy should include a multi-layered defense-in-depth approach that integrates technology, effective policies, employee training, and a focus on attack surface exposure—an increasingly key priority for CISOs. A critical element of this approach is implementing a Zero Trust architecture, which operates on the principle of "never trust, always verify." This model enforces strict identity and access controls, ensuring that users and devices are continuously authenticated, regardless of their location within or outside the network perimeter. Such proactive measures are especially vital for mid-market organizations that may lack the resources to recover effectively from significant breaches. Best Practices and Essential Tools To enhance their cybersecurity posture, organizations should consider the following best practices: Incident Response Planning : Establish a well-defined incident response plan (IRP) that includes phases such as preparation, detection, analysis, containment, eradication, recovery, and post-incident review. Regular tabletop exercises can help evaluate the IRP's effectiveness in a controlled setting. Continuous Monitoring: Implement 24/7 security monitoring through a combination of Endpoint Detection and Response (EDR) systems, next-generation Security Information and Event Management (SIEM) solutions, and a dedicated Security Operations Center (SOC). Solutions like Pondurance's managed detection and response (MDR) empower organizations to monitor, detect, and respond to security incidents in real-time, significantly reducing response times and minimizing risks. Threat Intelligence Integration: Incorporate threat intelligence feeds into security operations. Leveraging real-time threat data enables organizations to proactively identify indicators of compromise (IOCs) and adapt their security posture accordingly, thereby staying ahead of adversaries. Regular Security Assessments: Conduct comprehensive security assessments, including penetration testing and vulnerability scanning. Applying methodologies like the MITRE ATT&CK framework can help identify potential attack vectors and improve defenses. Addressing Attack Surface Risk: Regularly inventory your IT assets to get a comprehensive view of your attack surface, identify remediate vulnerabilities, and assign asset risk ratings in order to reduce potential exposure to threats. This proactive assessment is critical in achieving effective cyber resilience. Empowering Employees through Training Recognizing the human element of cybersecurity is essential. Ongoing training and security awareness programs are vital for educating staff on recognizing phishing attacks, social engineering tactics, and other common threats. Conducting simulated phishing exercises and social engineering tests can gauge employee awareness, ultimately strengthening your organization’s resilience against potential attacks. Preparing for the Future of Cybersecurity Looking ahead, mid-market organizations must cultivate a culture of continuous improvement. As cyber threats evolve, businesses should emphasize proactive security measures, including threat hunting, to tackle emerging challenges, particularly those posed by AI-driven attacks and the increasing complexity of interconnected environments. Conclusion The insights shared during Ron’s presentation at FutureCon Orange County provided valuable guidance on the complexities of modern cybersecurity. With actionable strategies and best practices in hand, mid-market organizations can enhance their cybersecurity posture in an increasingly hostile digital landscape. By adopting a comprehensive, multi-layered cybersecurity strategy, investing in continuous training, and embracing innovative technologies, businesses can defend against existing threats and confidently navigate the dynamic future of cybersecurity. Implementing these recommendations will not only fortify defenses but also foster a resilient cybersecurity culture that adapts to new challenges ahead. Check out the video here . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

The need for virtual cybersecurity for healthcare and behavioral health providers is rising. Learn how to stop healthcare cybercrime here.|The need for virtual cybersecurity for healthcare and behavioral health providers is rising. Learn how to stop healthcare cybercrime here. Behavioral Health Providers Face Cybercrime Attacks as Demand Rises Pondurance June 7, 2021 Facebook X (Twitter) LinkedIn Copy link The COVID-19 pandemic, lasting over a year in duration, provoked an increase in behavioral health issues. Extended periods of isolation, loss of loved ones to the virus, and continual fears of infection adversely affected the mental health of populations worldwide. The economic downturn caused by the pandemic further added stress and anxiety, with many facing job loss, difficulty paying for expenses, and an uncertain future. Before the pandemic began, only about 1 in 10 U.S. adults reported symptoms of anxiety or depression (Figure 1). However, by January 2021, that figure increased to about 4 in 10 adults. Source: KFF Health Tracking Poll - July 2020, KFF, July 27, 2020. Behavioral health issues can manifest in a variety of ways. A July 2020 poll conducted by Kaiser Family Foundation , a nonprofit organization focusing on national health issues, showed adults reporting specific negative impacts on their mental health and well-being due to worry and stress over the pandemic, such as difficulty sleeping (36%) or eating (32%), increase in alcohol consumption or substance use (12%), and worsening chronic conditions (12%), such as diabetes or hypertension. Historically, the behavioral healthcare industry operated in a fairly low-tech manner. Patients met providers in their offices face to face, notes and medical records were predominantly paper-based, and billing and payment were primarily manual processes. When the COVID-19 pandemic hit, the widespread shutdown of medical facilities and the mandates for social distancing brought the traditional method of mental health treatment to a near standstill, at a time when more people than ever needed services. It was in this dire circumstance that technology and dedicated behavioral health professionals rose to the occasion. The ongoing transition to digital health records, coupled with the rapid, widespread rollout and adoption of telemedicine programs using platforms like Zoom and online correspondence, placed technology front and center in treating mental health issues. BHCOE shares that “choosing the right technology to support your telehealth needs is important and the number of cameras, video conferencing platforms, and other tools can be overwhelming.” Clinicians who were initially reluctant to adopt these technologies found that there were several benefits, including: Clients were more comfortable when in their own homes during sessions. Poor weather and travel problems were no longer issues. Many people who mental health programs had historically underserved were now reachable and able to receive treatment. Many patients embraced remote telemedicine for behavioral health, claiming it felt more confidential and eliminated their potential embarrassment of bumping into someone they know in the waiting room at the provider’s office. Unfortunately, as the pandemic drove a significant adoption of digital technology by the behavioral health industry, cybercriminals were presented with more opportunities to attack healthcare organizations. In 2020, the number of cyberattacks on healthcare more than doubled from the previous year, with ransomware accounting for 28% of all attacks. Attackers, driven by profit, see patient data as a prime target. They can monetize healthcare cybercrime data in multiple ways: First, they can request ransom payments to restore access to patient data or other systems. If the ransom is not paid, they can hold patient data hostage, encrypting systems and stopping service from being delivered entirely. Second, since behavioral healthcare records contain a large amount of personal identifiable information, the records are valuable on the black market and may be priced at up to $250 per record (compared to $5.40 for the next highest value record: a payment card). How can mental health providers ensure that their clients’ personal health information is protected? Providers must acknowledge that patient data is incredibly valuable to cybercriminals. Ransomware attacks are the most obvious threat, but they can be a major decoy in a much larger scheme, such as establishing remote access to sensitive patient data to sell on the dark web for a much larger payoff. While the primary focus of behavioral healthcare organizations should be on 24/7 care for the growing population of those suffering from mental health issues, the increase in healthcare cybercrime and new digital vulnerabilities must also be addressed. Knowing the risks, it is crucial that mental health providers continuously protect patient information and quickly detect and identify breaches in their networks before an attack is successful. With significant experience supporting national and regional healthcare providers, Pondurance Managed Detection and Response (MDR) provides the protection needed to combat cybercriminals cost-effectively, enabling behavioral healthcare providers to focus on their patients while remaining confident that patient data is secure and patient care is unaffected. Learn more about MDR services in our eBook 5 Things to Consider When Choosing an MDR Vendor . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn about Niloofar Razi Howe, Executive Chair of the Board, whose unique experience gives her an interesting perspective on cybersecurity.|Learn about Niloofar Razi Howe, Executive Chair of the Board, whose unique experience gives her an interesting perspective on cybersecurity.|Learn about Niloofar Razi Howe, Executive Chair of the Board, whose unique experience gives her an interesting perspective on cybersecurity. Get to Know Niloofar Razi Howe, Executive Chair of the Board Pondurance December 2, 2021 Facebook X (Twitter) LinkedIn Copy link For this month’s leadership spotlight, we spoke with Niloofar Razi Howe, Executive Chair of the Board at Pondurance. Niloo’s experience as an investor, entrepreneur, executive and advisor gives her an extraordinary perspective into the world of cybersecurity. She offers helpful advice to individuals starting their cyber careers. How did you get into cybersecurity? The way I got into cyber may be different than other folks. I’m an immigrant, and my country, Iran, went through a revolution. When 9/11 happened, like a lot of folks on the West Coast, I was woken up by phone calls from friends who wanted to make sure I wasn’t on a plane traveling somewhere. What hit me that day was, wow, I don’t want to go through this again. Is there anything I can do to help keep the country and the world be safe from bad actors? At the time, I was a venture capitalist in Los Angeles, investing in technology, and I wanted to figure out how to take that knowledge and experience base and apply it to security, to national security, to global security. Cyber wasn’t, back then, as big an issue, so I joined with the former director of the CIA, former director of the National Security Agency and former head of the Defense Advanced Research Projects Agency to build a venture capital fund dedicated to investing in national security technologies. Over time, we started to focus on cyber and, as we did, it was something I really wanted to dive deep into. It felt to me, even in the early days when cyberattacks were starting to become real and not just for the government but for enterprises, that this was a threat factor that we should all be paying attention to. So, I started focusing almost exclusively all my time and energy on cyber. How did you grow into the leadership role you’re in today? My career hasn’t followed a straight line. I’ve sat on almost every side of the table. I’ve been an investor in technology and cybersecurity, I’ve been an entrepreneur in technology and cybersecurity, I’ve done policy work in national security and technology, and I’ve advised the U.S. government. So, I come at this from a number of different perspectives. A few years ago, I was connected with Newlight Partners, the investors in Pondurance, and they were very interested in finding a platform that they could use as a way to invest in the cybersecurity market. I worked with the team to develop the thesis, to identify the markets that we wanted to be in and to identify the best company that we could invest in and grow, and that was Pondurance. So, that’s how I got involved with Pondurance and was lucky enough to recruit Doug Howard, who I worked with at RSA, to be the CEO of the company. We are on this great journey with a really great leadership team and a great investor base. What has been the biggest lesson you learned as you moved up in your career? The best and worst decisions you make are based on people, so make your decisions based on the people you work with. Treat them with care, be a great advocate when you can and pay it forward when you can, but it starts and ends with people. Why would somebody be excited about joining Pondurance? Pondurance is a phenomenal company. It has an amazing leadership team that is not just focused on going after a great market opportunity and building a durable company but doing it the right way, with the right culture, with the right values, and really living and breathing those values every day. There are a lot of companies out there, but this is one that’s going to not only do great but be focused on the people and how we do it. Any advice for an individual starting a career? The advice I would give for anyone starting out in a career is don’t worry too much about five, six, seven years out. And don’t worry about the obstacles that are going to keep emerging in your way. Just focus on the job that you’re doing and the people you’re doing it with, learn as much as you can and develop a network. Everyone’s looking for mentors, but I found over time that peer networks can be just as valuable. In fact, many times, they’re much more valuable. So really develop those peer networks and find ways to have fun. I mean, this stuff is hard. We’re still living through a global pandemic, so it’s even harder. You have to take care of yourself as you do that. But stay focused on the path, ignore the obstacles, develop great peer networks and find ways to have fun. Interested in joining the Pondurance team? View our current openings! Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Cyber Trends, Nation-State Collaboration, and Technology as a Target Discussed at Cyber Risk Summit in Miami Beach Pondurance February 25, 2026 Facebook X (Twitter) LinkedIn Copy link The cybersecurity community gathered Feb. 9-11 at the NetDiligence Cyber Risk Summit in Miami Beach to exchange insights and learn about cybersecurity liability and risk management. Pondurance's Chair Niloofar Razi Howe and Assistant Vice President Will Gadzinski talked with James Thaler of The Insurer TV about the new, creative ways threat actors are targeting victims. They discussed trends in artificial intelligence (AI) and ransomware, threat actor collaboration with nation-states, technology as a target, and what's new at Pondurance. AI and ransomware The cybersecurity landscape is in constant flux, and AI and ransomware are at the forefront of the change. AI. "With respect to artificial intelligence, attackers are using it much more proactively than the defenders are, and there's a reason for that," Niloo said. She explained that threat actors are not concerned with the problems that can arise with AI, but the defenders are. Defenders know it's important to keep humans in the cybersecurity loop. Humans must observe, make decisions, and know when to escalate an alert. Niloo also noted the increase in AI usage for social engineering exploits. As an example, she discussed the $26 million deepfake heist in 2025 against Arup. The exploit involved a video conference where every attendee except the victim — including the CEO and members of the financial department — were generated by AI. Ransomware. The volume and sophistication of ransomware attacks are on the rise, according to Will. He explained that threat actors are using AI in their overall attack life cycle, which speeds up the process and allows a lower barrier to entry so that a larger number of threat actors can use ransomware against victims. Many of these new threat actors are even less scrupulous than traditional cybercriminals. Nation-state collaboration Typically, there have been two separate sets of cybercriminals: ransomware gangs and nation-state actors. But today, 75% of ransomware from Russian-language gangs is coordinating directly with Russian intelligence agencies, according to Niloo. The largest rise in activity is coming from Iran, Russia, and North Korea, and Niloo made the connection that these countries are currently under Western sanctions that are causing substantial economic stress. She discussed how Iran coordinates with Russian ransomware gangs through hubs such as Black Hat and launders money for Russia, Russia has released its own form of cryptocurrency, and North Korea funds its state missile programs through cybercrime such as crypto theft and IT worker fraud. Technology as a target Threat actors typically target specific industries, such as healthcare or manufacturing, but that pattern is changing. "What we find is that the ransomware gangs and the overall campaigns that are being carried out are more opportunistic and based around the technology that's in place," said Will. He discussed how, in earlier years, when a vulnerability in a network was exploited, the process of gaining a foothold in the network would take days or weeks, but today, that timeline has accelerated. "Exfiltration can happen within the first hour," Niloo said. She explained how this acceleration shifts the key metric from mean time to detection to mean time to containment, meaning that defenders no longer have time to figure out that a threat actor is in the network and how to contain the threat. "We can't stop this from happening," she continued. "But what we can make sure is that every organization can survive it, that it's OK, and they can make it through the attack." "It's almost inevitable these days that you will be attacked," Will said. Prevention alone is not an effective total control. He suggested that organizations need a strategy for readiness with multiple layers of security including humans in the loop for quick detection and response to mitigate the impact of an attack. Will also emphasized that organizations often have the right technology for their environments, but they haven't fully adopted or correctly configured the technology, which is an area where organizations can improve. What's new at Pondurance Cybersecurity is evolving, and Niloo and Will discussed how Pondurance is implementing changes to continually improve its capabilities and offerings. In the first quarter of 2026, Pondurance will roll out three new solutions: AI-assisted security operations center - to improve automation for quick detection while keeping humans in the loop for smart decision-making Overall software and system inventory - to help clients keep track of technology within their environments Microsoft 365 configuration review - to provide insights to help clients properly configure and secure their environments Conclusion Threat actors are indeed finding creative ways to target victims, and organizations need to keep up with the latest developments in cybersecurity to properly respond to new threats. Watch the video to learn more. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn how to improve your healthcare IT security by your protecting your domain controller, the heart of any healthcare network. Read more.|Learn how to improve your healthcare IT security by your protecting your domain controller, the heart of any healthcare network. Read more. Protecting the Domain Controller: The Heart of Your Healthcare Network Pondurance September 2, 2021 Facebook X (Twitter) LinkedIn Copy link In today’s threat landscape, the healthcare industry continues to be a prime target for financially motivated attacks with more than half of all healthcare organizations experiencing a data breach or cyberattack that exposed protected health information.* Pondurance analysts found the domain controller to be one common factor associated with large-scale attacks. Cyberattacks against healthcare organizations involving access to the domain controller pose a lot of potential risks including: Risk to revenue. Risk to medical research and other intellectual property. Risk to medical devices. Risk to HIPAA compliance and regulatory fines. Risk to reputation. Risk to legal exposure and remediation costs. Compromises to the Domain Controller The domain controller is the heart of any distributed network, making it a valuable asset within any healthcare IT infrastructure. As healthcare organizations continue on their path of digital transformation, they significantly broaden their attack surface. Some common ways attackers gain access to an organization’s network include: Third parties and vendors. Impersonation (phishing, social engineering, stolen credentials). Medical devices and applications. Protecting the Domain Controller The healthcare industry is faced with a unique wave of challenges in defending itself from the rise in cyberattacks. The sophistication of attacks alone makes it extremely difficult to continuously protect a domain controller from compromise. While there is no silver bullet to stop bad actors from gaining access to the domain administrator or enterprise administrator privileges, healthcare organizations can follow the recommendations below to help prevent access to the domain controller: Ensure that multifactor authentication is enabled on compatible protocols. Maintain domain controllers and any applications running with supported release versions and ensure they are patched. If remote desktop protocol is enabled, ensure there are compensating controls associated with it. Implement an email defense filtering system, combined with URL/IP blocking outbound capabilities. Ensure adequate protections are enabled for a server message block. Monitor and analyze logs to ensure in-depth 360-degree visibility is properly implemented. Separate the use of local system administration from domain administration. Monitor your healthcare IT security and infrastructure, medical devices and domain controller at system and application log levels. Encrypt endpoints. Healthcare organizations are faced with unique challenges that affect critical departments within their ecosystem. While completely eliminating cyberattacks may not be realistic, healthcare organizations should focus on maturing their cybersecurity and healthcare IT security programs. Constant monitoring of the domain controller at system and application log levels is critical in responding to malicious activity. Learn more about protecting your healthcare organization in our whitepaper, Protecting the Heart of Your Healthcare Network: The Domain Controller. Sources: 53% of Healthcare Organizations Have Experienced a PHI Breach in the Past 12 Months , HIPAA Journal, March 9, 2020. COVID cybercrime: 10 disturbing statistics to keep you awake tonight , ZDNet, September 14, 2020. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Explore insights from our recent monthly webinar, covering threat tactics, significant vulnerabilities, emerging trends, and data breaches. Threat Intelligence, Notable Vulnerabilities, and Current Trends for January 2024 Pondurance March 3, 2024 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In January, the team discussed threat intelligence, notable vulnerabilities and trends, threat hunting trends, and the cyber threat landscape. Threat intelligence review To begin the webinar, the Senior Manager of Incident Response discussed the most prevalent threats for the month, including ransomware, business email compromise (BEC), and phishing. Ransomware . Following a brief slowdown in December, the team saw an increase in the rate of ransomware cases. Threat actors achieved initial access through improperly protected access channels, such as virtual private networks (VPN), terminal servers, and virtual desktop infrastructures, that are not using multifactor authentication or patching regularly. In most cases, they achieved persistent access via remote monitoring and management tools. The team also saw an uptick in the exfiltration of targeted data. Since threat actors know what data is valuable to steal, they’re spending more time conducting reconnaissance and less time exfiltrating data. BEC . Threat actors consistently exploit BECs, and financial gain is the most common motivation for their use. For example, threat actors use compromised email accounts to gain access to automated clearing house (ACH) codes or wire transfers or use a mail platform to change direct deposit information for payroll and human resources functions. Threat actors also use transport rules to converse and hide responses while maintaining an ongoing presence within an environment. Phishing . As usual, phishing ranks as the top method of credential compromise. Threat actors now use malicious QR codes in their phishing activity for two reasons: 1) many security solutions don’t have a reliable way to review or scan QR codes for a malicious redirect and 2) most people use their phones to scan a QR code, which is typically outside the protected network. Also, the team suggests that tax returns are a prime target for threat actors, so companies should look out for activity regarding W-2s, direct deposits, and ACH payments for tax returns. Vulnerabilities and Trends The Vulnerability Management Team Lead reviewed vulnerabilities from December. As many as 2,500 vulnerabilities were disclosed, and 12 of those vulnerabilities were high risk. Of those 12, six were zero-day vulnerabilities. The zero days included products from Google Chrome, Future X Communication, QNAP, Unitronics, Apache Struts 2, and Android. The most impactful was the Google Chrome vulnerability CVE-2024-0519. This out-of-bounds memory access in Google Chrome allows a threat actor to exploit a heap corruption vulnerability using a crafted HTML page. The exploitation occurs when a user visits the malicious page and interacts with it by clicking on a link or pop-up box. The most critical new vulnerability that the team saw on internal vulnerability scans on client networks was the SSH Terrapin attack CVE-2023-48795. This man-in-the-middle type of exploit occurs when the threat actor already has a network presence, either through phishing or some other initial access. The attack requires a connection secured by either ChaCha20-Poly1305 or cyber block chaining with encrypt-then-MAC and a network running a vulnerable version or implementation of OpenSSH 9.5 or earlier. The vulnerability is not highly critical, but the team does recommend an upgrade to a newer version. Also, in early January, the Ivanti VPN vulnerability impacted Ivanti Connect Secure and Ivanti Policy Secure gateways. Nation-state actors chained together the authentication bypass vulnerability (CVE-2023-46805) and the command injection vulnerability (CVE-2024-21887) to gain a foothold and deploy a web shell on devices across the network to implement ransomware, steal credentials, or conduct other exploits. Since this vulnerability is critical, the team recommends using a workaround that involves downloading an XML file from the Ivanti website and importing it. The patch will be released in late January. Threat Hunting Trends The Director of SOC Operations talked about various trends that the security operations center (SOC) team is monitoring on client networks. Ransomware is the most prevalent type of malware attack, and the team expects to continue to see these attacks. Fortunately, the older types of ransomware attacks, such as cryptomining , have died off. Credential harvesting via phishing emails is on the rise. The use of artificial intelligence (AI) services, such as ChatGPT, is making phishing emails harder to identify. Successful credential harvesting attacks typically involve the creation of auto-forward rules, which the team alerts on for every client. To reduce the risk of credential harvesting attacks, the team suggests using multifactor authentication (MFA) for all user accounts and implementing awareness training. Malware delivery via phishing emails is increasing. These attacks usually occur through link attachments in the body of emails or PDF attachments that contain JavaScript or links to malicious websites. Also, password-protected documents and zip files are often associated with these attacks. The team recommends blocking password-protected files at the gateway, but it’s important for companies to fine-tune the blocking to assure that valid business documents are not also blocked. In addition, the team is seeing screensaver files that drop malware in a user’s home directory and the use of commonly allowed domains, like Blogspot, for hosting malicious components. Fortunately, malware delivery via drive-by websites is decreasing, though the attacks still occur. The team encourages companies to update all browsers and network devices to reduce attack surface vulnerabilities. Cyber Threat Landscape The SOC Engineering Lead discussed the cyber threat landscape, focusing on the solutions for a broad number of security topics. Ransomware. Threats actors use ransomware as a service to enter an environment and sell access to the highest bidder. Also, they use SIM swapping attacks, so if a user is texting a one-time code to another user, a threat actor who has cloned the cell phone can intercept the code. The team suggests that MFA bypasses are the best way to remedy such an intercept. Solutions to protect against ransomware include timely patching, using the principle of least privilege for all facets of a network, and encouraging users to “trust but verify” before taking an action. Credential theft. The team suggests that using password managers is one of the most important tools a company can employ to keep users safe. Also, the team recommends that clients sign up for the free service HaveIBeenPwned to receive email breach notifications. Malware. The ease of using remote administration is surging, and password reuse is a big reason why. Threat actors install approved tools such as AnyDesk and LogMeIn to take over the networks. As a solution, the team suggests using application inventory, application approval process, and the principle of least privilege and implementing MFA controls on remote management and monitoring tools. Social engineering. With AI, social engineering scams are tougher to identify. Instead, it’s best to use secondary contacts for verification, establish reporting and escalation processes, and reward users who report phishing emails. Also, human resources and accounting employees may need additional training, more security controls, and a chain of command for reporting suspicious activity. Data threats. Data destruction is a common threat from bad actors. To stay safe, companies and their cloud providers need to back up and encrypt the data and then test the backups. If an attack happens, a company must know the timeline for restoring the data to accurately weigh the benefits of paying a ransom. Distributed denial-of-service attacks (DDoS). Threat actors use DDoS attacks to disrupt the availability of data. Every company must know how to contact its internet service providers, cloud providers, and data providers in the event of an attack and confirm that these providers are performing tested backups. Disinformation and misinformation. False information is common in political arenas and on social media. Companies need a protocol for how to submit questions, escalate issues, or report on false information. Also, training for media and public relations staff can help. Supply chain attack. A trusted third party can be compromised without its knowledge, so it’s best to always assume the worst has happened. The team recommends using a trust but verify philosophy, implementing the principle of least privilege for third parties, using trusted install sources, and staying diversified with backup suppliers. Hacktivism . Government entities are common targets for hacktivists, but sometimes reporters are swatted or public figures are doxxed. Whenever hacktivism occurs, the incident should be reported to the FBI and local law enforcement, and your company’s crisis communication plan should kick in. Go silent, call only on private cell phones, or use other means to avoid communications that the threat actor can readily track. Next Month The Pondurance team will host another webinar in February to discuss new cybersecurity activity. Check back next month to read the summary. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

This blog discusses the actions your organization can take to improve its qualifications for cyber insurance. Read now! Improve Your Qualifications for Cyber Insurance: 4 Things To Know Pondurance October 11, 2023 Facebook X (Twitter) LinkedIn Copy link Cyberattacks continue to threaten organizations in frequency, severity, and cost. In the past year, as much as 66% of all organizations were hit by ransomware , compared with 37% in the preceding year, according to Sophos’ report The State of Ransomware 2023 . The rise in threats has spiked the demand for cyber insurance and raised the amount of monthly premiums. Cyber insurance premiums have increased every quarter over the last several years, according to the Global Insurance Market Index, though this year’s second-quarter increase was only a moderate rise. Unfortunately, the rise in threats also has decreased the number of companies that will qualify for a cyber insurance policy. But there are actions your organization can take to improve its qualifications for cyber insurance. First and foremost, your organization can plan ahead and recognize what cyber insurance providers are looking for. Your organization needs to know the threats to your business, prepare ahead of time for the application process, understand what is covered in a cyber insurance policy, and partner with cybersecurity experts to proactively protect your organization from threats. Know the Threats Every day, bad actors plot new ways to exploit the networks of U.S. and global organizations. Ransomware is the primary threat concern from bad actors, particularly in the healthcare, government facilities, and critical manufacturing industries. The average ransom payment nearly doubled from $812,380 in 2022 to over $1.54 million in 2023, according to the Sophos report. The report also found that it cost an average of $1.82 million to recover from a ransomware attack, and that’s excluding the hefty ransom payments. The high price tags for a ransomware attack have impacted the premiums for cyber insurance. “Three years ago, if you applied for cyber insurance, you could get a policy and who knows what you’d pay for it, anywhere from cheap to not that expensive,” said Doug Howard, CEO at Pondurance. “Then, ransomware hit, which changed the payouts. As a result, insurance providers adjusted their premiums, and now, in the last few years, premiums have gone up anywhere from 50% to 100%.” Business email compromise (BEC) ranks second as a threat concern, close behind ransomware. In BEC attacks, bad actors use social engineering scams and phishing emails to gain access to the email accounts of unsuspecting employees. In 2022, the FBI’s Internet Crime Complaint Center received a total of 21,832 BEC complaints, amounting to adjusted losses of over $2.7 million. Prepare for the application process Organizations want cyber insurance to protect their businesses against financial, regulatory, reputational, and other harms. Because the harms of a cyberattack have increased, the requirements for getting cyber insurance have become more strict. For instance, last year, insurers required organizations to have multifactor authentication (MFA) to qualify for cyber insurance. Today, insurers need to know not only that an organization has MFA but, more importantly, that MFA has been implemented. Cyber insurance providers ask many crucial questions during the application process. All of them ask many of the same questions such as: Do you use an endpoint protection product across your entire system? What is your timeline for making patches? Do you have an in-house or outsourced security operations center ? How often do you conduct phishing training for your staff? Your answers will determine whether your organization receives cyber insurance, so it’s important to have implemented proper cyber measures prior to application. “People looking for cyber insurance want to know what impacts their ability to qualify,” said Doug. “Whether they’re applying for cyber insurance for the first time or trying to renew an existing policy, they want to know what to do to get it right. I tell them to be proactive. Cyber insurance providers want to know that you have the technology, processes, and people already in place to protect against an attack.” Understand What's Covered Cyber insurance policies cover a broad array of attack scenarios, but if your organization experiences an attack that is not covered, the lack of coverage can be costly. That’s why it’s so important to thoroughly understand what is actually covered — and what is not covered — in your cyber insurance policy. Most cyber insurance policies contain exclusions , which are cyber events and scenarios that the insurance provider will not cover. These exclusions may include acts of war, failure to maintain standards, payment card industry fines and assessments, and prior acts, to name a few. “The courts have weighed in on exclusion clauses in cyber policies, particularly the acts of war clause, and they don’t always rule on the side of the policyholder,” said Doug. “That’s why you need to comb through each line of the exclusion language to know exactly what your policy covers and do not assume that the exclusion will never apply to your organization.” Partner with Cybersecurity Experts Working in partnership with cybersecurity experts can reduce incidents and demonstrate to cyber insurance providers that your organization is taking responsible steps to pursue comprehensive defense strategies. Cyber insurance providers encourage organizations to partner with digital forensics and incident response (DFIR) providers and managed detection and response (MDR) providers. DFIR providers can help your organization swiftly contain incidents and conclusively restore systems after an attack. Proactively partnering with a DFIR team allows the team to become familiar with your organization and understand your network in advance of a breach. That way, if a breach does occur, your organization is already steps ahead in the process. Enlisting an MDR provider can help your organization reduce the likelihood of a breach. Modern MDR providers monitor networks 24/7, find suspicious activity, and launch effective mitigation measures if an incident occurs. These services decrease dwell time — the number of days, weeks, or even months that a threat can hide within a network and compromise data — and, ultimately, reduce the cost of a breach. “More and more, we are seeing cyber insurance providers require Managed EDR and Managed Detection and Response (MDR) across logs, network and cloud,” said Doug. “The providers used to ask, do you have technology? And then, do you use it, and is it being implemented? But later, they just skipped EDR and went directly to MDR. Now, MDR is a standard requirement for cyber insurance.” With DFIR and MDR partnerships in place, your organization greatly lowers its risk profile, which can help in reducing cyber insurance premiums. If a compromise occurs, the cyber insurance provider will be more likely to cover the incident based on the necessary precautions that your organization has taken. Additionally, a cybersecurity partner can serve as a trusted representative that can work with the cyber insurance provider to accelerate the recovery process. Conclusion The rise in threats has spiked the demand for cyber insurance and decreased the number of organizations that will qualify for a new policy or a renewal. But there are actions your organization can take to improve your qualifications for cyber insurance and help you achieve cyber insurance success. To keep up on the latest cyber insurance discussions, check out our blog Hot Topics in Cyber Insurance . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Fraudulent wire transfer accounted for $2.4B in losses in 2021. We provide guidance on how to prevent it and the actions to take if it happens to you. The Preventable Scam: Fraudulent Wire Transfer Pondurance September 13, 2022 Facebook X (Twitter) LinkedIn Copy link Pondurance CEO Doug Howard recently had the opportunity to talk with friend and Pondurance business partner, Rick Borden, on the topic of fraudulent wire transfers. Rick is a Partner at the law firm Frankfurt Kurnit Klein + Selz , specializing in cybersecurity and privacy and the Pondurance and Frankfurt Kurnit teams collaborate when one of Frankfurt’s clients suffers a cybersecurity breach and requires the help of a seasoned incident response (IR) team to help them navigate their way through the breach with minimal damage. Frankfurt Kurnit provides legal counsel and guidance throughout the process; Pondurance IR experts provide response expertise and work to get the affected organization back to normal operations. Doug and Rick got together to talk about fraudulent wire transfer—what it is, how it can happen and what organizations can do about it—because it’s a topic that often flies under the radar but is imminently preventable. Fraudulent wire transfers accounted for losses of almost $2.4 billion in 2021 and both businesses and individuals are targets, so this is not a trivial scam. Doug and Rick focused their discussion on businesses, but the recommendations for actions that can be taken to try to stop or minimize the damage from such an attack can be applied to anyone or any organization that falls victim. What is wire transfer fraud? Wire transfer fraud is especially frustrating when it happens because it means that someone in an organization has been manipulated into triggering a false wire transfer, thinking it’s a legitimate request. It’s usually the result of a social engineering hack that has involved the use of business email compromise , phishing or some other cyberattack tactic. Lurking in an organization’s IT environment and monitoring email communications, for instance, a bad actor can learn about the person or people they want to compromise and the business they want to steal from and then opportunistically trick their victim into initiating a wire transfer. Appropriate financial controls + a strong cybersecurity infrastructure are critical This particular type of scam is really a financial control issue because it’s the finance team that’s targeted in such an attack—they’re typically the only department with individuals who can initiate funds transfers. But bad actors are only able to orchestrate a fraudulent wire transfer because they’ve gotten into the organization’s IT systems and have been able to watch, study and learn what they needed to learn to trigger the desired actions. Like having an incident response plan to address cyberthreats, finance teams within organizations must have well documented plans in place for what to do if they fall victim of wire transfer fraud. Understanding the steps to take and who to call if a fraudulent wire transfer has been initiated can literally be the difference between keeping or losing all of the funds in question and suffering the ripple effects of such a loss. The most important phone calls you can make The most important tool if you think your organization has been tricked into initiating a fraudulent wire transfer? The telephone. Picking up the phone and calling the bank processing the wire transfer should be call number one; if you’re lucky and your timing is good, the bank may be able to put a hold on the transfer until you validate whether it’s legit or not. Call number two? Law enforcement. The FBI can be tremendously helpful if you’ve fallen victim to this scam. Besides getting their help potentially stopping the fraud in its tracks, the fact that you’ve engaged with law enforcement immediately demonstrates that you’ve been proactive in dealing with the situation, and this can only provide assurances to your executive team and board that you’ve done everything possible to mitigate impacts. Additional information Read Doug’s article in Forbes on this topic, titled Wire Fraud Is An Epidemic: Take These Three Steps To Protect Your Company From Cybercriminals . It also provides a good overview of fraudulent wire transfers and actions organizations can take if they’ve been scammed. The resources Doug and Rick discuss in the video include: The 2021 FBI Internet Crime Report The FBI Internet Crime Complaint Center IC3 for filing a complaint The Directory of FBI field offices nationwide If you ever do fall prey to wire transfer fraud, and after you’ve called the bank and law enforcement agencies, call in the experts at Pondurance and Frankfurt Kurnit Klein + Selz for the incident response and legal guidance that you’ll need to get through the situation. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

The cybersecurity landscape is constantly evolving. Learn more about current threats and how to protect your organization. Cybersecurity is Evolving Pondurance February 10, 2022 Facebook X (Twitter) LinkedIn Copy link Reports of ransomware attacks, business email compromise, and phishing scams are front page news, as the number of cyberattacks rises and ransom amounts skyrocket. Statistics show the average ransomware demand increased by 518% in the first half of 2021 compared to 2020, and the average ransomware payment was $570,000, according to Infosecurity Magazine. The media warns that every organization in every industry needs to have a plan to protect itself from a cyberattack. Often, what it doesn’t adequately tell you is how to protect your organization against cybercriminals. But you can find the simple answers in the new eBook Managed Detection and Response (MDR) for Dummies . The eBook contains the valuable information and tips you need to understand the current cybersecurity landscape, find the service that’s right for your organization, and discover what sets MDR apart from other security options. Each week, we’ll highlight a new chapter of the eBook, so you can learn all you need to know to protect your organization against cyber threats. Chapter 1 explores the current cybersecurity landscape and how it’s evolving. In this chapter, you’ll learn: How cyber threats are changing. Threats have changed significantly over the past five years. The types of attacks, the targets, and the cybercriminals themselves are different. Find out how nation-state actors have altered the dynamic of cybersecurity and how the introduction of cryptocurrency, such as Bitcoin, has made it harder to trace cybercriminal activity. Current threats facing organizations are increasing. The number of potential cyber threats is escalating, and the attacks are getting more sophisticated. Organizations face attacks from malware, ransomware, business email compromise, phishing schemes, distributed denial-of-service attacks, and more. Take a closer look at the most popular attacks on organizations and the common tactics cybercriminals use to penetrate internal systems. What a comprehensive security program looks like. Once you recognize the cyber threats to an organization, you’ll want to know what you can do about them. Three main considerations will influence your success in defending against a cyber threat. Find out what these considerations are and how they work together. Also, learn details about recent cyber incidents that have threatened U.S. industries. In particular, healthcare and manufacturing have seen a jump in cyberattack activity. Discover what security tools and procedures the organizations could have used to prevent the attacks from happening or at least lessen the damages from the attacks. The security solutions landscape is expanding. We’re seeing more acronyms like SIEM, SOAR, NDR, EDR, MSSP, MDR, and XDR. One or more of these could be the right security solution for your organization. Get a brief understanding of these tools and services and an introduction to what differentiates MDR from the other security solutions on the market today. As the cybersecurity landscape evolves, cyberattacks are becoming more frequent and damaging. Learn how you can protect your organization from cybercriminals. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026