Pondurance Launches Kanati™ Agentic AI SOC Pondurance March 20, 2026 Facebook X (Twitter) LinkedIn Copy link Pondurance is proud to announce the launch of the industry’s first Agentic SOC designed for autonomous operations within a managed detection and response (MDR) service. Kanati replaces alert-driven, error-prone workflows with a coordinated system of AI agents that operate continuously throughout the full threat lifecycle. Doug Howard, Pondurance CEO notes that “cyber adversaries operate at machine speed, using AI with no rules of use. Security operations must match that pace or fall behind, while protecting and not negatively impacting each customer’s environment. Our new Kanati Agentic AI SOC reimagines from the ground up how the SOC operates in the next-generation MDR, fusing 25TB of daily event, alert, and threat intelligence data with contextual AI to achieve containment for high-confidence threats.” With Kanati, our customers will receive lightning fast threat analysis, a dramatic reduction in false positives, and sub-second containment for high-confidence threats. Initial performance measurements of Kanati demonstrate: 90% faster threat analysis with AI-powered confidence rating and containment < 2 minute average investigation time of all alerts, regardless of priority 80% reduction in false positive tickets 10x improvement in contextual enrichment and correlation of threats 100% coverage of alerts resulting in all alerts investigated with full analytical rigor Agentic AI is an absolutely ideal application for security operations where threats move at machine-speed, where fast, accurate detection, analysis and containment can make the difference between a minor inconvenience and a successful ransomware attack or data breach. Why the Name Kanati? Kanati was designed to ingest and analyze the over 60 terabytes of telemetry data at peak that Pondurance sees every day in real-time. This means that new threat activity can be identified quickly and correlated with thousands of other events - both real-time and historical. This allows the entire SOC (Agentic and human-driven) to see more enriched and detailed information on every alert that is created. False positives are quickly identified; true positives are either instantly acted on autonomously (in cases of high-confidence alerts) or brought to the attention of our SOC Analysts where human judgment can be applied. In the mythology of the Cherokee people, Kanati (kah-nah-TEE) is the Master of the Hunt. He is described as a careful and responsible hunter who controls game animals to avoid overhunting and works with humans to define and preserve the spirit of the hunt itself. Pondurance Kanati was named as an homage to him, as the name also describes the nature and ethos of Pondurance Kanati incredibly well. The Agentic AI is careful and responsible as it hunts for threats, ensuring that these alerts are properly handled either on its own or in collaboration with human SOC Analysts – or both. With this model our SOC can operate at optimal efficiency. With the Agentic AI doing what AI can do best -- evaluating and analyzing large amounts of information round-the-clock to draw rigorous, informed conclusions, then taking remediation actions that can be executed at machine-speed for high-confidence events. Working with human SOC Analysts who provide oversight, judgment, and intuition for situations with greater ambiguity. Is Kanati Safe to Use? Yes. As a cybersecurity company, trust is everything between Pondurance and our customers. We have gone to tremendous lengths to ensure that Kanati will deliver exceptional value to you, while providing the highest security standards designed for Agentic AI. To this end Kanati’s visibility is restricted to each customer’s data tenancy, and all data is maintained by Pondurance alone, in a US-based AWS platform. Amazon Bedrock was chosen as the AI infrastructure for Kanati, specifically so that we could be sure we had complete and total control over all data, models, and training for Kanati, and customer data is never permitted to be used for general or external model training. Who Can Take Advantage of Kanati Benefits? With Kanati, we have reimagined how the SOC can be made more effective while operating at machine speed. As a result, it is foundational to the SOC operations and services we provide to all of our customers. So all Pondurance MDR customers will see tangible benefits and value from our investment in creating, growing, and optimizing Kanati. Of course, if any customer is restricted from using AI due to regulatory compliance, they can opt-out at any time by reaching out to the Pondurance SOC via email, phone, or by opening a service ticket in Scope. We’re very excited to be taking this journey with you, we look forward to how it will improve your overall cyber posture and reduce your exposure to data breach risk. For more information on Agentic SOC AI and how it improves the SOC operational model, visit our blog frequently over the next several weeks for a series of articles on this topic. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

February Cyber Threat Download™ Pondurance February 12, 2026 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. Escalated Microsoft 365 configuration review An escalated Microsoft 365 configuration review is a relatively new offering from the digital forensics and incident response team. During such a review, the team analyzes the technical settings of a client's environment, outside of any potential event, to reduce the risk of a compromise. The review allows the team to provide insights about technical hardening to strengthen the security posture of the environment. As a case study, the team shared information about a recent configuration review performed for a national insurance company. For the review, team members conducted an analysis based on the Cybersecurity and Infrastructure Security Agency's secure configuration baseline policy and conducted a high-level review of recent login data for all users, looking for suspicious activity involving IP addresses, internet service providers, user agent strings, and other known indicators of compromise. They observed user agent Axios being used as a phish kit, which is a tool that can allow threat actors to automate account takeovers and help them to evade detection, exfiltrate data, and even bypass multifactor authentication. The team reviewed the user session IDs to gauge the legitimacy of the activity. All of the session IDs were new, indicating malicious activity, and the client verified this conclusion. The team worked with the client to escalate a full business email compromise investigation where team members conducted password resets and session revocations. In addition, the team provided deeper insights than a typical Microsoft 365 configuration review provides to keep the client safe from similar threats moving forward. Notable vulnerabilities As many as 5,485 newly disclosed vulnerabilities were reported in December 2025, a steep increase from November. Twenty-two of the vulnerabilities were actively exploited on a wide range of products, including Meta, Array Networks, Fortinet, Microsoft, Google, Gladinet, and ASUS, to name a few. Proof-of-concept codes were released for 11 of the vulnerabilities, making the information available for threat actors to use for exploitation. The team discussed in detail the React2Shell remote code execution vulnerability . The React2Shell vulnerability targets React Server Components versions 19, 19.1, 19.1.1, and 19.2, which also affect specific server-side packages and indirectly affect frameworks that use React Server Components. The vulnerability is a deserialization flaw that improperly validates the structure of incoming flight payloads. To execute an attack, the threat actor sends a specially crafted HTTP request with the malformed flight stream data. The server deserializes and processes the request, leading to attacker-controlled data influencing the server-side execution logic. Remote code execution occurs within the privileges of the Node.js process. Honeypot activity was reported through malicious activity, including brute-force attacks, from 40 unique IP addresses. Two China-based threat actors, Earth Lamia and Jackpot Panda, and a few North Korea-linked threat actors are responsible for the 1,124 exploitation attempts. During Microsoft Patch Tuesday in December, 57 reported vulnerabilities were addressed. Two of those were critical vulnerabilities, both involving remote code execution and the compatibility field. Three were zero-day exploits, including a Windows Cloud Files Mini Filter Driver vulnerability, which was an elevation of privilege flaw that was successfully exploited in the wild, a GitHub CoPilot for JetBrains vulnerability, and a PowerShell exploit. In January, 114 reported vulnerabilities were addressed during Microsoft Patch Tuesday, exactly double the number from December. Of those 114, eight were critical vulnerabilities, and three were zero-day exploits. Most of the eight critical vulnerabilities included Microsoft Office Suite, Windows LSASS, and the virtualization-based security products. The zero days included a Desktop Window Manager vulnerability, which was exploited in the wild, an Agere soft-modem driver vulnerability, and a Secure Boot certificate vulnerability. SOC use of AI The security operations center (SOC) team receives frequent questions from clients about artificial intelligence (AI). Clients want to know how Pondurance is implementing AI technology, so the team provided answered. The team does not see AI as a replacement for human analysts. Rather, the team views AI as another tool to assist with investigations and responses to cybersecurity alerts. The SOC team explained a few specific ways it uses AI: Streamline the workflow. The SOC team is always looking for ways to improve its workflow to increase accuracy and efficiency — and AI can help. AI technology can assist with deduplication of events across different alerting source types to reduce the alert volume in the queue. Also, AI can correlate related events across multiple sources into one alert that includes all the available context. This correlation allows for speedier investigations, provides more valuable context about what is happening, and allows the SOC analyst to investigate and come to a better disposition. Understand normal behavior. The SOC team currently uses client feedback and alert history to understand what "normal" looks like for a client's environment, but it can sometimes be a challenge. AI's learnings from past activity can expedite the process of determining if an alert is a false positive or requires escalation, allowing the team to quickly take appropriate action. Use cross-customer threat intelligence. The SOC team applies what it has learned about one client to other clients to help keep them safe. Now, AI can help by constantly searching for indicators of compromise across all Pondurance clients. That way, the SOC team can more quickly identify phishing campaigns and other activities that are being exploited in the wild across the entire client base to allow for faster remediation. The team also discussed how its analyst-in-the-loop model for using AI protects the human experience. AI works as a powerful tool to aid analysts during day-to-day operations, not replace analysts. Team members always use a trust but verify approach, meaning that they trust the technology but don't use AI as a decision-maker and do confirm the accuracy and completeness of the AI information before moving it forward. The team believes in protecting human interaction, human response, and human experience throughout the process. In addition, the SOC team uses AI as a means of improvement and development. Team members work in parity with AI and large language models to review suspect commands and scripts, pair AI with their existing threat intelligence feeds to provide additional avenues for event investigation and threat hunting, reference existing LogScale queries to assist with searches and dashboard logic improvement, and use the technology for technical report writing assistance. Password blocklist Implementing a password blocklist is a simple way for clients to make sure that employees are using strong passwords for logins. A blocklist is a tool that checks an employee's proposed password against a list of weak or common passwords, usually based on the data compiled for haveibeenpwned.com . If the employee's proposed password is on the list, the employee will receive an error message and must try a different password. The team recommends that all clients enable a blocklist and used Microsoft Entra to demonstrate how a blocklist works. Microsoft Entra provides a list of 1,000 banned passwords, but the team suggests that clients replace at least 10 to 20 of those passwords with their own renditions of passwords. Often, employees use the names of sports teams, localities, company products, or industry names as passwords, and these words should be banned as passwords since they are too easy for threat actors to guess. As an example, the team discussed how it added the words Pondurance, cybersecurity, scorecard, and Indianapolis to its own blocklist. From there, the tool will apply an algorithm to figure out the many different permutations of those words, such as adding 1234 or ABC to the end of the password. However, the team noted that it has seen a few weaknesses in the permutations including: Double substitution. Two characters used to substitute for one character, such as using a pipe character and a right parenthesis to create the letter D. Keyboard walking. Passwords made up of keys located next to each other on the keyboard, such as qwerty or xcvbnm. Foreign characters. Only English words or characters are considered. As best practices, the team recommends creating passwords that are all lowercase and using an eight-character minimum (but using a six-character minimum for the passwords entered into the blocklist to allow for permutations). In addition, the team suggests doing password checkups where clients check with employees about whether they are using the password managers within their browsers. It's important to control the use of password managers in the browsers because a password can remain in an employee's personal password manager even after the employee has left the company, leading to potential exposure for the company. Clients can enter a Scope service ticket for more information on how to perform a password checkup. About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our SOC, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Incident Response Leaders from Pondurance Take Top Prize in SentinelOne Capture-the-Flag Event for the Second Year in a Row Pondurance September 25, 2025 Facebook X (Twitter) LinkedIn Copy link In a repeat performance, professional threat hunters and incident responders from the Pondurance team have taken top honors in the SentinelOne Incident Responder Partner ThreatOps Challenge, a Capture-the-Flag (CTF) competition. Part of the CFO Forum , this event brings together professionals from the entire SentinelOne Partner ecosystem to engage in friendly competition. While all the competitors in this year’s event were exceptional, we’re proud to announce that William Gadzinski and Jeremiah Dennen brought the trophy back to Pondurance once again. CTF competitions and exercises allow teams of cybersecurity experts, newcomers, and hobbyists to attempt to reach a pre-defined goal in the shortest amount of time - using any techniques they choose within the limitations of clearly stated rules. In this event, participants were challenged to quickly and accurately perform rapid incident analysis of a scenario created by SentinelOne. Without prior knowledge of the parameters of the event; each team was required to identify the situation, undertake a forensic investigation, and provide a complete analysis of the threat activity using SentinelOne’s suite of tools. While we’re really proud of William and Jeremiah, everyone here at Pondurance would like to applaud all the contestants. Each of these events is a chance to learn new techniques, discover new ways to identify and block threat activity, and further knit together the community of cybersecurity professionals and practitioners. Even those who didn’t take home a trophy have advanced their careers, company reputations, and the overall ability of our industry to keep people safer in an ever-evolving threat landscape. As for our team, no matter if it is on the stage of a CTF event or hunting down a threat actor in one of our customers’ environments, we look forward to the next challenge that comes our way. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Navigate federal cybersecurity compliance with confidence. Learn how to build a security program that meets NIST, CMMC, HIPAA, and FedRAMP requirements. Enterprise Cybersecurity Compliance Tools for US Federal Regulations Pondurance February 5, 2026 Facebook X (Twitter) LinkedIn Copy link Federal cybersecurity compliance is one of the most consequential and most misunderstood obligations enterprises face. The frameworks are complex, the requirements evolve, the overlap between different regulatory regimes creates genuine ambiguity, and the consequences of getting it wrong, failed audits, lost contracts, regulatory action, breach liability, are severe enough that the pressure to find the right tools and get it right is intense. Here's the problem with framing this as a tools question: compliance tools don't make you compliant. They help you demonstrate and maintain compliance. The distinction matters because organizations that invest heavily in compliance tooling without the underlying program to back it up end up with expensive software and a false sense of readiness that falls apart the moment an auditor or an adversary tests it seriously. This guide covers the major US federal cybersecurity compliance frameworks enterprises need to understand, what tooling and capabilities actually support compliance at scale, and how to think about building a program that satisfies regulators and actually reduces risk at the same time. Compliance is a floor, not a ceiling. The organizations that treat it as a destination stop improving when they hit it. The ones that treat it as a baseline keep building. The Federal Compliance Landscape: Frameworks Every Enterprise Needs to Understand The US federal cybersecurity regulatory environment is not a single framework. It's a collection of overlapping requirements that apply differently depending on your industry, the nature of your data, whether you do business with the federal government, and which agencies you interact with. Understanding which frameworks apply to your organization is the first step before any tool evaluation. NIST Cybersecurity Framework (CSF): The NIST CSF is not a regulation — it's a voluntary framework published by the National Institute of Standards and Technology that organizes cybersecurity activities into five functions: Identify, Protect, Detect, Respond, and Recover. Despite being voluntary, it has become the de facto standard that regulators, cyber insurers, and board-level stakeholders use to assess security program maturity. Version 2.0, released in 2024, added Govern as a sixth function and broadened its intended audience beyond critical infrastructure to all organizations. If you're not using NIST CSF as a reference framework for your program, you're operating without a common language that everyone else in your ecosystem is using. NIST SP 800-53: The more detailed companion to the CSF, SP 800-53 provides a comprehensive catalog of security and privacy controls for federal information systems. If you work with federal agencies or operate federal systems, these controls are the specific requirements you're measured against. The catalog is extensive, hundreds of controls across 20 control families, and mapping your environment to it is a significant undertaking without the right tooling and expertise. FedRAMP: The Federal Risk and Authorization Management Program governs cloud service providers who want to sell to federal agencies. If your organization offers cloud services to the government, FedRAMP authorization is a requirement, not an option. The process involves a significant documentation burden, a third-party assessment organization (3PAO) evaluation, and ongoing continuous monitoring requirements that don't end at authorization. CMMC (Cybersecurity Maturity Model Certification): CMMC is the Department of Defense's framework for ensuring that companies in the defense industrial base protect Controlled Unclassified Information (CUI). The model has gone through several iterations and as of the current version requires third-party certification at higher maturity levels, self-attestation is no longer sufficient for most defense contractors handling sensitive data. CMMC compliance is a contract requirement, not a regulatory suggestion: organizations that can't demonstrate compliance lose access to DoD contracts. FISMA (Federal Information Security Modernization Act): FISMA applies to federal agencies and organizations that operate federal information systems on their behalf. It requires agencies to implement security programs based on NIST standards, conduct annual assessments, and report to oversight bodies. If your organization operates under a federal contract that involves federal information systems, FISMA requirements flow down to you. HIPAA Security Rule: For enterprises in healthcare or handling protected health information on behalf of healthcare entities, the HIPAA Security Rule establishes required and addressable safeguards for electronic PHI. The Security Rule is technology-neutral by design, which means it doesn't specify particular tools, it specifies outcomes, and organizations have flexibility in how they achieve them. That flexibility is frequently mistaken for looseness. Enforcement actions have been significant, and the bar for what constitutes a reasonable security program has risen substantially over the past decade. CISA Directives: The Cybersecurity and Infrastructure Security Agency issues Binding Operational Directives (BODs) and Emergency Directives that apply to federal civilian executive branch agencies. For private sector organizations in critical infrastructure sectors, CISA's guidance and cross-sector cybersecurity performance goals provide a reference point that is increasingly cited in regulatory contexts even when not formally binding. What Compliance Tools Actually Do, and What They Don't The category of "compliance tools" encompasses a wide range of capabilities, and it's worth being precise about what each one contributes before evaluating specific solutions. Governance, Risk, and Compliance (GRC) Platforms: GRC platforms are the administrative backbone of a compliance program. They help organizations document controls, map those controls to regulatory frameworks, track evidence of compliance, manage risk registers, and produce the audit-ready documentation that assessors and regulators require. What they don't do is implement the controls themselves or monitor whether those controls are actually working. A GRC platform that shows all controls as green is only as accurate as the evidence submitted to it. Continuous Monitoring Platforms: Federal compliance, particularly under FISMA and FedRAMP, requires continuous monitoring of security controls, not just point in time assessments. Continuous monitoring tools collect telemetry from across the environment, track control effectiveness over time, and produce the automated reporting that federal programs require. This is where compliance tooling intersects directly with operational security tooling, and where the distinction between the two starts to break down. Vulnerability Management Platforms: Identifying and remediating vulnerabilities is a control requirement under virtually every federal framework. Vulnerability management tools scan the environment, prioritize findings, and track remediation. What elevates a compliance-grade vulnerability management program above a basic scanning tool is the ability to prioritize based on actual exploitability and business context, track remediation against defined SLAs, and produce evidence of that process for auditors. Configuration Management and Hardening Tools: Many federal frameworks, particularly those based on NIST SP 800-53, include specific configuration requirements. Tools that enforce and monitor system configurations against defined baselines, flag deviations, and track remediation are a compliance requirement for organizations subject to these frameworks, not an optional enhancement. Security Information and Event Management (SIEM): A SIEM that aggregates logs, correlates events, and produces the audit trail required by federal frameworks is a compliance tool as much as a security tool. Federal requirements around logging, what must be logged, how long logs must be retained, and what events must trigger alerts, are specific enough that SIEM configuration for compliance is a discipline in itself. Identity and Access Management (IAM) Tools: Access control requirements are central to virtually every federal cybersecurity framework. Tools that enforce least-privilege access, manage privileged accounts, monitor for anomalous access behavior, and maintain audit trails of who accessed what and when are compliance requirements under NIST SP 800-53, CMMC, and HIPAA alike. Incident Response and Case Management Tools: Federal frameworks require documented incident response capabilities, not just a plan, but evidence that incidents are detected, analyzed, contained, and reported within defined timeframes. Tools that support the IR workflow and maintain the documentation trail that compliance requires are part of the compliance stack, not separate from it. Questions Enterprises Must Ask When Evaluating Federal Compliance Tools Q: Which specific frameworks does this tool support, and how current is that mapping? Federal frameworks evolve, NIST CSF 2.0, CMMC revisions, and HIPAA enforcement guidance all represent changes that compliance tools need to reflect. Ask for a specific list of supported frameworks, how frequently control mappings are updated, and what the process is when a framework changes after you've deployed the tool. Q: How does this tool handle the overlap between multiple frameworks? Most enterprises subject to federal compliance requirements aren't dealing with one framework, they're dealing with several simultaneously. A healthcare company with federal contracts may need to satisfy HIPAA, NIST SP 800-53, and CMMC. Ask how the tool handles cross-framework mapping so that a single control implementation can satisfy requirements across multiple frameworks without redundant documentation work. Q: What does the evidence collection process look like, and how much of it is automated? The operational burden of compliance is largely in evidence collection, gathering documentation that controls are implemented and working. Tools that automate evidence collection from integrated systems dramatically reduce that burden. Ask specifically what integrations the tool supports for automated evidence collection and what still requires manual effort. Q: How does this tool support continuous monitoring rather than point-in-time assessment? Federal frameworks, particularly FedRAMP and FISMA, are explicit that compliance is a continuous state, not an annual certification. Ask how the tool supports ongoing monitoring of control effectiveness, how frequently it collects and reports on control status, and what the workflow looks like when a control falls out of compliance between formal assessment cycles. Q: What does audit support look like, can auditors and assessors access the platform directly? Third party assessments are a requirement under several federal frameworks, including CMMC and FedRAMP. Ask whether the tool provides a dedicated audit view or assessor portal, what documentation it can produce directly for assessors, and how previous audits have been conducted using the platform. Q: How does this tool integrate with our existing security stack? Compliance tools are most effective when they receive data from the security tools already operating in your environment, your SIEM, your vulnerability scanner, your EDR, your IAM platform. Ask specifically which integrations are available, which require custom work, and what happens when integrations break or produce incomplete data. Q: What reporting does this tool produce for executive and board level audiences? Federal compliance programs require communication to leadership, boards and executives need to understand compliance posture, open risk items, and remediation progress in terms they can engage with. Ask what executive reporting the tool produces, how customizable it is, and whether it can map compliance status to business risk in a way that non-technical stakeholders can use. The Program Behind the Tools: Why Tooling Alone Doesn't Create Compliance Federal compliance assessors, whether they're CMMC third-party assessment organizations, FedRAMP assessors, or HIPAA auditors, are not evaluating your tools. They're evaluating your program: the policies, procedures, evidence, and demonstrated practices that show your controls are implemented, operating, and effective. A GRC platform with every control marked green means nothing if the underlying controls aren't actually implemented. A vulnerability management tool that runs scans but whose findings sit unremediated for months demonstrates the opposite of a compliant program. Compliance tooling is how you manage, document, and demonstrate your program, it is not a substitute for having one. This distinction becomes most visible in incidents. A breach at an organization with a robust compliance tool deployment but a weak underlying security program reveals the gap immediately. Regulators and plaintiffs' counsel both understand the difference between a documented program and an operational one, and the consequences of the gap are significant. The organizations that handle federal compliance well treat it as an integration of their compliance program and their security program, using the same controls to satisfy regulatory requirements and to actually reduce risk. That integration requires experienced people, not just better software. The Role of Advisory Services and vCISO Support in Federal Compliance For many enterprises, particularly those entering a new federal compliance requirement for the first time, or those dealing with CMMC certification for the first time, the most significant capability gap isn't tooling. It's expertise. Federal compliance frameworks are complex. The interpretation of specific controls, the documentation required to demonstrate compliance, the preparation required for a third-party assessment, and the ongoing program management required to maintain compliance are all areas where organizations consistently underestimate the expertise required. Advisory services and virtual CISO (vCISO) support fill this gap. An experienced advisor who has guided organizations through CMMC certification, FedRAMP authorization, or FISMA assessment brings institutional knowledge that is genuinely difficult to develop internally. They know which documentation gaps get flagged most frequently, how assessors interpret ambiguous control language, and what remediation timelines are realistic for organizations at different maturity levels. For compliance-driven security decisions in particular, the combination of the right tools and the right advisory expertise produces significantly better outcomes than either alone. Common Mistakes Enterprises Make in Federal Compliance Programs Treating compliance as a project rather than a program. Federal compliance requirements don't end at certification. CMMC requires ongoing maintenance of certified controls. FedRAMP requires continuous monitoring. HIPAA enforcement is perpetual. Organizations that staff up for a certification effort and then reduce resources afterward find themselves out of compliance within months. Scoping too narrowly. Federal compliance frameworks apply to defined scopes, the systems, data, and people that touch controlled information. Organizations that define their compliance scope too narrowly to reduce the burden of compliance create boundary problems: controls that apply in scope don't get applied to adjacent systems, creating pathways that auditors and adversaries both find. Letting policy documentation outpace operational reality. It's relatively easy to write policies that describe a compliant program. It's significantly harder to ensure that the operational reality of the environment matches those policies. Assessors compare policy documentation against observed evidence and interviewed personnel, gaps between the two are one of the most common findings in federal compliance assessments. Underinvesting in evidence management. The evidence burden of federal compliance is substantial. Organizations that don't have a systematic process for collecting, organizing, and maintaining compliance evidence spend enormous time preparing for assessments that could be dramatically reduced with the right tooling and discipline. Ignoring the supply chain. Federal frameworks, CMMC in particular, increasingly focus on supply chain risk. Organizations that achieve compliance in their own environment but have third-party vendors with access to controlled systems or data face compliance exposure that their own controls don't address. The Bottom Line for Enterprise Compliance Decision Makers Federal cybersecurity compliance is not a tooling problem. It's a program problem that tooling helps you manage. The organizations that navigate it most effectively start with a clear understanding of which frameworks apply to them and why, build the underlying security program that those frameworks require, use tooling to manage and demonstrate that program efficiently, and bring in experienced advisory support when the complexity of a specific framework exceeds their internal expertise. The right compliance tools matter. A well-implemented GRC platform, continuous monitoring capability, vulnerability management, and integrated SIEM dramatically reduce the operational burden of compliance and improve your ability to demonstrate a compliant posture to auditors and regulators. But they work in service of a program, they don't replace one. If your compliance tool evaluation starts with features and ends with a procurement decision, you've skipped the most important part of the process. Start with the frameworks you're subject to, the gaps between your current program and those requirements, and the expertise you need to close them. Then evaluate tools based on how well they support that specific program, not on how many frameworks they claim to cover in a sales deck. About the Author Pondurance Security Team Pondurance is a U.S.-based managed detection and response and advisory services provider with extensive experience helping enterprises navigate federal cybersecurity compliance requirements. Our advisory team supports organizations through CMMC certification preparation, NIST CSF assessments, HIPAA security program development, and ongoing compliance program management. Our managed security platform provides the continuous monitoring, vulnerability management, and SIEM capabilities that federal compliance programs require, integrated with the human expertise to make them operationally effective. Related Resources Advisory Services — pondurance.com/advisory-services CMMC Compliance — pondurance.com/cmmc Ensure Compliance — pondurance.com/ensure-compliance Managed SIEM — pondurance.com/managed-siem Exposure & Vulnerability Management — pondurance.com/vulnerability-management Next Gen MDR: A Buyer's Guide for the AI Age — pondurance.com/mdr-buyers-guide Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

A managed detection and response provider can help remediate threats. Learn if MDR is right for you and how to choose an MDR provider. MDR: How It Compares and How To Choose a Provider Pondurance May 26, 2022 Facebook X (Twitter) LinkedIn Copy link Protecting your organization from cyberattacks requires a comprehensive security solution. You need the right people, processes, and technology to prevent, detect, and respond to threats. Fortunately, you don’t have to do it alone. A managed detection and response (MDR) provider can work with your in-house cybersecurity team and existing technology or a stand-alone solution to defend against cyberattacks. But what is MDR , and how do you know if MDR is the right fit for your organization? Lyndon Brown, Chief Strategy Officer at Pondurance, reveals what organizations need to know about MDR in the webinar Demystifying Managed Detection and Response with moderator Sharon Smith. Lyndon discusses the evolving cyber landscape, compares MDR with other security solutions, and explains what you should consider when choosing an MDR provider. The evolving cyber landscape Cyberattacks are ever evolving. Today, threats range from malware to ransomware to phishing, and once in the network, bad actors are capable of remaining for months or years. Organizations are struggling to keep up with cybercriminals and need to make smart investments to defend against them. Lyndon highlights the top cybersecurity challenges midsize and enterprise organizations face, including discussions on the talent shortage, technology evolution, and constrained network visibility. “There’s no slowdown in the number of attacks that are occurring, the number of actors that are jumping in — whether it’s cybercriminals or nation-states — to have effects in the cyber domain,” says Lyndon. “And that’s something that we expect to continue to see, particularly given various geopolitical situations.” MDR vs. other security services When seeking cybersecurity help, many organizations turn to solutions such as SIEM, managed security services providers (MSSPs), extended detection and response (XDR), or MDR to protect against cyberattacks. In the webinar, Lyndon explains the benefits and downfalls of these services: SIEMs collect log data and forward the data to a centralized location for management and analysis. It stores the data for posterity, correlates data, and provides alerts. However, it actually expands the skills gap and is not designed to keep up with today’s scale and velocity challenges. MSSPs provide alerts and manage firewalls and devices designed to keep attackers out at the perimeter. They involve technology, people, and some minimal processes, but they do nothing to investigate and respond to in-progress attacks that find their way into the network. XDR solutions deliver detection and response by marrying network, log, and endpoint visibility. However, the platform can be complicated to deploy and requires much time and energy to configure and operate. The customer remains on the hook to find capable talent and build processes. MDR services combine technology and humans to monitor, alert, investigate, and proactively respond on behalf of clients. However, MDR has many flavors, providing different capabilities and value. Lyndon explains the distinctions between traditional MDR and modern MDR and describes how modern MDR performs for organizations facing cyber threats. What to consider when choosing an MDR provider With cyberattacks on the rise, organizations are looking for the best solution to protect their data and customers. Many are choosing MDR as the preferred security solution to stay safe from threats. Technological research and consulting firm Gartner predicts that one-half of all organizations will use MDR services to monitor, detect, and respond to threats by 2025. Lyndon discusses the people, process, and technology aspects of choosing an MDR provider. He also tells how threat intelligence, vulnerability management, forensics, incident response, and experience are all important considerations when choosing a provider. Find out which questions Lyndon suggests you ask any potential MDR provider and what you can expect when using MDR services. Conclusion You need a comprehensive security solution to protect your organization from evolving cyber threats. An MDR provider can work with your cybersecurity team and integrate relevant technology to keep your organization safe from a cyberattack. Learn how MDR compares with other security solutions and what to consider when choosing an MDR provider. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

DarkSide, a ransomware as a service organization, apologized for the Colonial Pipeline incident. Learn more about this attack in this blog.|DarkSide, a ransomware as a service organization, apologized for the Colonial Pipeline incident. Learn more about this attack in this blog. Ransomware-as-a-Service (RaaS), DarkSide, and the Colonial Pipeline Pondurance May 13, 2021 Facebook X (Twitter) LinkedIn Copy link The Cybersecurity & Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) confirmed this week that DarkSide , a ransomware as a service organization, is responsible for the Colonial Pipeline attack. As of May 12, the cyberattack caused the Colonial Pipeline to shut down, causing gas shortages affecting 45% of the fuel consumed on the East Coast. As of Tuesday, governors in North Carolina, Georgia, and Virginia declared states of emergency and took steps to relax fuel transport rules to ease the price increases at gas stations. The pipeline has resumed operations, but it will take several days for gas to reach its final destination to return to normal operations. DarkSide has apologized for this attack, stating on its website that it does not “participate in geopolitics” and should not be tied “with a defined government and [to] look for other motives.” However, the damage from the ransomware as a service (RaaS) organization is already done. DarkSide operates as a RaaS organization servicing multiple clusters of sub-operators that it calls affiliates. These affiliates benefit from ready-to-use ransomware tools that enable them to carry out more attacks and increase the number of successful ransomware payouts. The cyberattacks carried out by DarkSide all follow relatively the same playbook of tools and tactics as other ransomware groups. Through our hundreds of incident response engagements, we were able to view how the DarkSide works by exfiltrating data, moving laterally, and deploying ransomware. The attackers focus on encrypting ESXi servers, a type-1 hypervisor developed by VMware. A hypervisor is a software that runs and manages virtual machines (VMs). Other ransomware groups have encrypted VMs in the past but are encrypting them at the operating system level — the same way that a regular Windows laptop or server would be encrypted. The DarkSide cyberattacks take the encryption a step further to the ESXi servers, which render the VMs unusable or unbootable. In the recent Colonial Pipeline attack, cybercriminals used DarkSide to gain access to the victim’s network to encrypt and exfiltrate data, holding the data for ransom and threatening to expose it if the victim does not pay the ransom. Since its start in August 2020, DarkSide has targeted organizations in manufacturing, legal, insurance, healthcare, and energy, even though its dark web blog page says that it will not attack targets in medicine, funeral services, education, nonprofit organizations, or the government sector. If a victim is not able to pay, DarkSide will “publish all of your data and store it” on TOR CDNs for at least six months and promote it to partners for purchase. Unfortunately, the number of victims has increased since August 2020, with the overall growth showing that more affiliates are using ransomware as a service. Overall, ransomware has increased 62% globally since 2019 and 158% in North America alone. The growth can be attributed to a few areas: Ransomware provides optionality for attackers. Once an attacker has both exfiltrated and encrypted the data of interest, they can offer to unlock the data—or threaten to release it publicly if the ransom is not paid. Ransomware has a proven business model with a lack of consequences, depending on where the attackers geographically reside. Ransomware can be delivered via multiple different vectors of compromise so no one product or solution solves for ransomware. Without comprehensive visibility, defense, and response capabilities, it is difficult to protect against ransomware. Perpetrators are often paid by cyber insurance carriers so they somehow feel they are not hurting the organization (i.e., hospitals, small businesses, etc.). Prevention is always the most effective defense against ransomware. It is key to maintain cybersecurity hygiene including ongoing strategic approaches for defense in depth, enhanced auditing verbosity, and continuous monitoring of deployed technologies. For full mitigation recommendations, please refer to the CISA best practices . As illustrated with the evolution of ransomware as a service techniques, tools are not enough to stop motivated attackers. Cyberattacks are carried out by humans, and they are getting smarter and more creative. As long as there are human attackers, you will need human defenders to ensure your organization is safe from a cyberattack. Human expertise, like that of a managed detection and response (MDR) team, is needed to detect and take action on threats and vulnerabilities before bad actors can do real damage. Learn more about MDR in our webinar Demystifying MDR for the Security Conscious Buyer . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Bridging the Compliance-Data Breach Gap in Healthcare Pondurance May 6, 2025 Facebook X (Twitter) LinkedIn Copy link The healthcare industry is one of the most highly regulated in the United States. To help ensure patient safety and well-being, improve access to care, and protect patient privacy, healthcare organizations must comply with numerous rules and requirements. When it comes to protecting patient health information, HIPAA is the gold standard. Its Privacy, Security , and Breach Notification Rules provide a strong compliance framework for the safety and confidentiality of protected health information (PHI), enforced by the HHS Office for Civil Rights. Despite extensive guidance and rigorous oversight, healthcare remains one of the most breached industries. Recent research by Xtelligent Healthcare and commissioned by Pondurance revealed that 60% of healthcare providers experienced four or more system failures, cyberattacks, or breaches over the past year. This, even though 71% of providers surveyed prioritize maintaining HIPAA compliance over other considerations. Which leads to a critical question: Why do compliance-focused healthcare organizations suffer from so many data breaches? We’ll explore possible answers and provide actionable strategies in this latest series of articles, that focuses on breach risks especially facing smaller and midsized healthcare organizations. This first article covers organizational and governance challenges contributing to data breaches and how to mitigate these risk factors. Organizational Risk Factors In healthcare organizations, privacy, security, risk, and compliance teams often live in their own silos, each with its own priorities and leadership. Even security and IT teams may have competing priorities, creating misconceptions about the value of core security practices. These misconceptions occur because security activities may be viewed as impacting access required for patient care. One such practice is vulnerability and patch management, which includes regular scanning, timely remediation, and verification through exploit testing. Through this process, security may identify vulnerabilities that need addressing. However, IT operations—tasked with keeping a robust and always-available set of critical systems running—may deprioritize or overlook patches that may risk disrupting services. Any unresolved vulnerabilities create an access point for attackers to exploit. Because of their unique priorities and focus, IT and security may be considered separate functions within the organization. While this distinction has its benefits, it also creates a natural tension between competing objectives—especially when it comes to financial and other resources. An organization’s top leaders and board should consider both IT and security as equally important to the organization and to patients, and fund each team accordingly. The Evolving Role of the CISO Progressive healthcare organizations are removing departmental barriers that put patient data privacy and security at risk. In particular, many healthcare CISOs are absorbing privacy functions. They’re also taking on more of a business role, with greater exposure to the C-Suite and the organization’s board of directors. IANS research reveals that CISO ownership of privacy increased from 35% to 47% over the past five years. “ With the rise in data breaches, regulations, and regulatory scrutiny outside your legal, risk, or compliance functions, CISOs are becoming a natural fit to oversee privacy controls,” says Yunique Demann , senior director and data protection officer at NTT Data Americas. And a Trellix survey found that 84% of CISOs believe their role should have both a business and technical focus. These findings emphasize the importance of a defensible security posture, where CISOs understand business outcomes, instead of focusing only technical details. However, the global shortage of cybersecurity talent can make it difficult to attract and retain qualified employees, particularly experienced CISOs. And while many CISOs are learning to appreciate importance of data privacy, a trusted external partner can help bridge any gaps between an organization’s security and privacy teams. Governance Risk Factors Cybersecurity often has limited visibility at the board level, despite the board’s awareness of the frequency and security of healthcare data breaches. In 2024 alone, there were 703 data breaches of PHI impacting over 500 patients reported to HHS through their Office for Civil Rights (OCR). Yet only 28% of CISOs are considered “strategic,” in that they hold significant influence within the organization and with top leadership. Despite the well-known prevalence of healthcare breaches, there’s a clear gap between board governance of security and privacy and the teams responsible for such crucial activities. Several obstacles to better governance of healthcare organizations include: Lack of cybersecurity background. Board members typically lack the knowledge and experience required to address today’s cyber threats. In addition, there is no roadmap for setting up a board committee to focus on these types of risks. Over-focus on enforcement actions. An organization’s legal counsel will highlight “hotspot” issues that trigger enforcement actions, such as encryption. Other cybersecurity priorities are likely to be overlooked. Communication gaps. While security leaders may understand risk and cyber threats from a technical perspective, they may be unable to translate this risk into business language that board members can relate to. Underfunded programs. Similarly, security teams may fail to present clear, actionable risk assessments. Without an understanding of the risks and their business impact, executives may deny the budgets necessary to mitigate them. Misaligned risk priorities. An effective risk management program will align with the organization’s risk tolerance. While no systems are perfectly secure, there should be a balance between over-protection and vulnerability. Barriers to progress. Often, ego and a fear of admitting security gaps can prevent honest conversations about resource needs. A culture that encourages honest dialogue and collaboration across departments will lead to better outcomes. The Need for Improved Governance “Boards should elevate the issue of cyber risk as an enterprise risk management issue,” says John Riggi , senior advisor for cybersecurity at the American Hospital Association (AHA). “And they should ensure they receive regular briefings and updates on the cyber risk profile, and that adequate steps are being taken to mitigate the risk.” This is especially true when considering technology investments. Security and compliance should be integrated into the planning process from the beginning, rather than adding them after systems are chosen. Upleveling security at the board level ensures new technologies align with patient care goals and regulatory requirements. It also helps avoid costly issues down the line—even if it requires more effort upfront. How to Bridge the Gap Protecting sensitive patient data against breach risks and building a strong cybersecurity program are not overnight exercises. Fortunately, there are several strategies healthcare entities can implement to unite disparate teams and priorities—and create a universal goal to minimize breach risks to the organization and to patients. Conduct a Business Impact Analysis Many healthcare entities lack a comprehensive inventory of software and systems, which creates significant risk. A business impact analysis across all departments—not just IT—can help a healthcare organization better understand patient care workflows. This, in turn, uncovers critical systems that may be visible to only the IT team. CISOs, CIOs, and other security executives are now aware of and can prioritize these systems which directly impact patient care and other business outcomes. Prioritize Your Risks Identify your highest-priority risks first. While remedying those, work to gain consensus for your next risk priorities. Healthcare organizations are very collaborative, and organizational alignment takes time and effort. Create a “Culture of Shared Ownership” All stakeholders—clinicians, privacy, compliance, and risk—should have some responsibility for security within their organization. An article in the National Library of Medicine, “ Managing cybersecurity risk in healthcare settings , ” calls this concept “a culture of shared ownership.” The article notes that “Engaging clinicians in risk assessments, policy development, and technology selection ensures that security measures align with clinical workflows and address their concerns effectively.” Make Cybersecurity Part of Your Business Strategy Strong governance ensures that the board prioritizes and allots sufficient budget to cybersecurity. The business impact analysis can help CISOs clearly communicate risk and focus resources on critical functions. With dangerous threats like ransomware affecting healthcare providers, business continuity and preparing for operational disruption should take on higher priorities. Benefit from Your Security Incidents Never miss an opportunity to take advantage of security incidents and data breaches. These experiences create a unique opportunity for increasing resource and technology investments, and aligning organizations to protect against cyber threats. Make Pondurance Your Trusted Partner These recommendations can help healthcare entities build a strong foundation for a cybersecurity program that protects regulated and sensitive data against breach risks. However, smaller and midmarket providers often lack the internal skills and resources to accomplish their cybersecurity goals. Pondurance can help. Our award-winning virtual CISO service offers trusted advisors and valuable resources that enable healthcare CISOs to achieve both short-term and long-term organizational goals. These services are ideal for midsized healthcare organizations that may lack the budget to for a full-time, top-level CISO. Whatever your needs, we’ll empower your security team with a sustainable cybersecurity program that aligns with your organizational goals and that your board can buy into. Contact us for more information. Get your copy of “ A Midsize Organization's Guide to Reducing Breach Risks in 2025 ” playbook. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Explore Pondurance's Case Studies. See how we've transformed clients with tailored cybersecurity solutions. Download now! Resources Case Study Cybersecurity as an Operational and Clinical RIsk Case Study Improving Threat Visibility and Response Across a Growing Franchise Network Case Study Pondurance SOC Bolsters Security Posture for Financial Institution Case Study Hospital Experienced Ransomware Threat, Undetected by EDR Case Study Azul Hospitality Group Safeguards Guest Data with MDR for Endpoints Case Study Hylant Protects Against Cyber Risk with MDR Services Case Study Pondurance as an Extension of a Large Retail Supercenter SOC Case Study Ball State University Partnering to Provide 24/7/365 MDR Protection Case Study K-12 School District Improves their Cybersecurity Posture with Managed Detection & Response Case Study Malware Thwarted MDR Manufacturing Case Study Case Study Pondurance Managed Detection and Response (MDR) for Healthcare Case Study Pondurance Incident Response (IR) for Manufacturing LOAD MORE FILTER ALL BEST PRACTICES CHECKLISTS CASE STUDIES EBOOKS INFOGRAPHICS PUBLISHED ARTICLES PRODUCTS & SERVICES RESEARCH VIDEO LIBRARY WEBINARS

Organizations need data protection to properly secure data and meet data privacy regulations. Learn more about data security in this blog.|Organizations need data protection to properly secure data and meet data privacy regulations. Learn more about data security in this blog. Data Privacy Is Not Data Security Pondurance May 20, 2021 Facebook X (Twitter) LinkedIn Copy link Personal data has become a lucrative business worth billions to organizations that can extract and refine it, giving them a granular view into customer behavior for marketing and personalization purposes. On the other hand, cybercriminals see this data as a valuable asset that can be sold for profit or leveraged in ransomware and extortion attempts. Data breaches and the rising cost are no laughing matter, which is why protecting consumer and employee personally identifiable information (PII) is critical for any organization. The average cost of a data breach can reach upward of $3.86 million per incident , including costs to recover operations, paying ransoms, and fines from data privacy regulations. Often organizations that handle data start thinking about data compliance and regulatory requirements before thinking about proper data security measures. For an organization to properly protect its data, securing sensitive information should never be an afterthought — and neither should data privacy . Both data protection and data security need to be a top priority. While they complement each other, there are differences between the two, which we highlight in the chart below. The measures an organization takes to prevent an unauthorized individual from accessing sensitive consumer PII, employee PII, or intellectual property are data security . While the regulatory and compliance factors of data focus on how to properly manage, collect, share, and delete data at the consumer’s request are data privacy . While data security and data privacy have different requirements, gaps in data security can put an organization’s data privacy goals at risk. In the event bad actors access consumer information due to weak cybersecurity, it is impossible for organizations to meet consent, policies, and data deletion requirements that fall under global and U.S. privacy regulations. Implementing strong cybersecurity allows organizations to prevent, detect, and respond to malicious activity that could jeopardize access to sensitive data. Many countries and states have differing levels of privacy regulations to protect personal data, and more regulations are being added. How do you know if your company falls within the scope of these new laws? And how can your company be ready with cybersecurity to meet the patchwork of state privacy laws? Tune in to our panel webinar with data privacy experts, You Can’t Protect Privacy Without Security . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

HOME / ASSET INVENTORY MODULE How to Grow Vulnerability Management Into Exposure Management READ REPORT » ASSET INVENTORY MODULE Maximize MDR effectiveness with total asset visibility Continuously monitor asset risk, with ease GET A DEMO OUR ASSET INVENTORY MODULE HELPS YOU… Find and fix coverage gaps Continuous network monitoring detects unsecured endpoints immediately. No device goes unprotected — so nothing slips through the cracks. Prioritize high risk assets Get a risk score for every asset. Quickly see which assets hold the highest value, and which pose the biggest threat, so you can prioritize remediation, support compliance, and lower breach risks. Up-to-date Asset Inventory Reduce the confusion and inefficiency caused by disparate data sources. Our platform integrates with your existing tools to give you a single source of truth for your environment. Better visibility, smarter protection Locking your front door isn’t much protection if you leave a window open. The same is true for running MDR without full visibility. You need to know not only what endpoints exist, but also what level of risk they pose. Yet maintaining an up-to-date, risk-scored asset inventory is no small challenge. With dispersed workforces and dynamic tech environments, it’s all too easy for assets to go undetected — and unprotected. Pondurance Asset Inventory Module simplifies the process of finding and prioritizing IT assets. What is an Asset Inventory? An Asset Inventory is a list of all your IT assets — e.g. all the devices, systems, and applications in your IT environment. An up-to-date inventory is critical to ensure visibility across your entire attack surface and ensure nothing goes unprotected. 66% of organizations lack visibility into cyber risk — Forbes Put Continuous Threat Exposure Management (CTEM) into action Gartner recommends adopting CTEM to stay proactive against emerging threats. Asset visibility is the first step toward that goal. Spot exposures before attackers do Focus remediation on the riskiest assets Strengthen resilience over time DOWNLOAD GARTNER REPORT “An enterprise’s attack surface isn’t simply a massive map of the exterior of the organization, but rather a combination of its most visible and critical assets.“ REPORT: How to Grow Vulnerability Management Into Exposure Management REPORT: How to Grow Vulnerability Management Into Exposure Management ASSET INVENTORY MODULE FEATURES Tools to strengthen visibility Complete asset visibility Continuous monitoring Centralized dashboard Proprietary risk score Complete asset visibility See your entire network at once. Our inventory pulls data from EDRs, eVMP, and customer lists to give you full coverage — and meet a critical requirement for Continuous Threat Exposure Management (CTEM). See what Pondurance can do for you Let us help you envision how Pondurance can eliminate breach risks for your organization with a quick, personalized demo. We promise, no hard sell. GET A DEMO STILL HAVE QUESTIONS? Check out these Frequently Asked Questions Is the Asset Inventory module included in Pondurance MDR? Yes, the Asset Inventory module is the latest enhancement to Pondurance’s innovative, next-generation MDR platform. It provides customers with broad visibility into their IT landscape with particular emphasis on the level of overall cyber risk, exposure and vulnerabilities posed by those assets. Is there an additional cost for Pondurance MDR customers? The new Asset Inventory module is included at no additional cost for all existing and new Pondurance MDR customers, regardless of package or configuration. It is available immediately in your MDR portal. Your Pondurance rep is available to answer any questions you may have about the new capabilities. To learn more about the Pondurance MDR, including the Asset Inventory Module, request your free personalized demo today. How does the Asset Inventory Module improve my cybersecurity? You can’t protect what you can’t see. By automatically identifying and monitoring all your assets, the module helps you close visibility gaps, reduce exposure, and focus remediation on what matters most — the assets that pose the highest risk. To learn more about the Pondurance MDR, including the Asset Inventory Module, request your free personalized demo today. What makes Pondurance MDR different from other asset management tools? Unlike generic inventory tools, Pondurance ties each asset to a proprietary risk score based on real exposure and vulnerability data. That means you don’t just see what’s on your network — you know which assets could cause the most damage if breached. Does the module integrate with my existing tools? Yes. The Asset Inventory module pulls data from supported EDR platforms like CrowdStrike and SentinelOne, as well as from the Pondurance Exposure & Vulnerability Management (eVMP) service or your own uploaded lists — ensuring broad, accurate visibility. How does the Asset Inventory module support Continuous Threat Exposure Management (CTEM)? Pondurance’s Asset Inventory module provides the foundational visibility CTEM requires — a current, risk-scored view of every asset in your network. This allows organizations to continuously assess and reduce exposure as part of a proactive, ongoing defense strategy.

April Cyber Threat Download™ Pondurance April 28, 2026 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. Investigation data Having access to data during a digital forensics and incident response investigation helps the team find answers to questions about what happened during a cyber event. Team members recently investigated an event where having comprehensive data made a substantial difference in the outcome of the investigation. In early February, team members investigated what appeared to be an unauthorized access event that stemmed from a virtual private network (VPN), but they soon realized that they were dealing with known exploited vulnerability CVE-2025-48983 . The remote code execution flaw was a critical vulnerability, with a score of 9.9, in the mount service of Veeam Backup & Replication. The threat actors gained access using stolen active directory credentials for a low-level privileged account. The client had SentinelOne's deep visibility module, which gathers every network connection that the system makes and receives. The detailed telemetry data helped the team prove that this particular vulnerability was indeed exploited. Team members could see the network connections one second before the actual execution. From there, they could see the VPN access, the backup mount service hosted on port 6170 on the Veeam server, the creation of the local user account, the harvesting of actual credentials out of the backups, and the installation of Oracle VirtualBox and how the threat actors used it to create a virtual machine from one of the backups of the domain controller. The high level of visibility allowed the team to learn what happened during the attack and mitigate the risks associated with it. From the data gathered, the team determined that the threat actors were initial access brokers . Initial access brokers gain access to environments and escalate privileges to the domain administrator. Then, they leave the environment and sell that access to a larger ransomware operator who conducts the exploit at a later time. The team, along with the client, contained the environment and eradicated the threat actors before they could cause any further harm. Notable vulnerabilities As many as 4,811 newly disclosed vulnerabilities were reported in February. That's a large number for the month, and the team expects the number to keep increasing in future months. Of those 4,811, 13 zero-day vulnerabilities were actively exploited on eight different products, including Notepad++, and six of those 13 vulnerabilities were tied directly to Microsoft. Proof-of-concept codes were released online for four of the vulnerabilities, increasing the possibility that threat actors may exploit the products. As a monthly trend, the vulnerability management team discussed the vulnerability that affects Notepad++ and the WinGUp Updater, versions 8.8.9 and earlier. This attack started in July 2025 when a Chinese nation-state group exploited the Notepad++ vulnerability as a complex supply chain attack, made up of three different attack chains. This download of code without integrity check vulnerability occurs because WinGUp Updater does not cryptographically verify what's being installed, meaning that it doesn't run a check to verify whether a file has been modified. As a result, the threat actor can place a malicious file on the infrastructure that a consumer can unwittingly download and run with the WinGUp Updater. On Feb. 10, the proof-of-concept code was posted online, and the Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on Feb. 12. Notepad++ recommends that all users upgrade to version 8.9.1. During Microsoft Patch Tuesday in February, 59 reported vulnerabilities were addressed, which is a relatively low number of vulnerabilities. Five of those were critical vulnerabilities, and six were zero-day exploits, including privilege elevation, security feature bypass, and denial-of-service vulnerabilities. In March, 82 reported vulnerabilities were addressed during Microsoft Patch Tuesday. Of those 82, eight were critical vulnerabilities, including remote code execution and privilege elevation flaws. There were no zero-day vulnerabilities for the month. Credential theft and measures for prevention Threat actors primarily gain initial access to networks by logging in with stolen credentials. Stolen credentials allow threat actors to bypass traditional security controls and evade detection to ultimately take over accounts, steal data, deploy ransomware, and take other malicious actions to seek their objectives. The security operations center (SOC) team discussed two methods recently used in credential thefts. The methods aren't new, but they are increasing in frequency due to the surge of artificial intelligence (AI)-enabled attacks. Lumma malware . This malware variant steals sensitive data such as passwords and bank account information. Threat actors spread the malware through phishing emails, fake downloads, malicious ads, and trojanized installers. The malware establishes persistence by adding files to the startup folder, making registry operation changes, and creating scheduled tasks. From there, it conducts system profiling, extracts login data from apps and browsers, and performs clipboard monitoring. The malware then sends the data to attack the command-and-control server, resulting in an account takeover and credential compromise. The team emphasized that users should reset credentials on all compromised accounts. AI-enabled phishing . For years, threat actors have used phishing emails to trick victims into clicking on malicious attachments or going to fake websites where they can steal credentials. But phishing emails were often identifiable as fakes due to poor grammar and awkward language. Today, with AI, phishing has evolved. The emails are quite believable to targeted victims, as threat actors now use web scraping data to personalize the substance of the emails and generative AI to write convincing email text. The team offered several preventative measures to keep threat actors from successfully stealing credentials with Lumma malware and phishing. A comprehensive prevention program should include endpoint hardening, email and web security, identity protection, and user and access controls. The team recommends patching, enforcing multifactor authentication, disabling browser-stored passwords, and blocking unapproved apps and extensions, among other measures. Also, since AI-enabled phishing is so prevalent, organizations should offer updated user training to help employees identify and block phishing attempts generated by threat actors using AI. About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our SOC, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

As ransomware attacks increase, you need both human expertise and technology to combat cybersecurity threats. Learn more in this blog.|As ransomware attacks increase, you need both human expertise and technology to combat cybersecurity threats. Learn more in this blog. Combat Ransomware with the Right Balance of Human Defenders and Technology Pondurance December 13, 2021 Facebook X (Twitter) LinkedIn Copy link Ransomware attacks are on the rise. Since the start of COVID-19 the number of attacks has increased by 400%. If a company experiences a ransomware attack, they may be on the hook for not just paying ransom but also recovery costs of the attack. Human attackers launch more sophisticated attacks every year. Responding to evolving cybersecurity threats requires human expertise. In this blog you will learn why your company needs both human expertise and technology to combat growing ransomware attacks. Growing Cybersecurity Threats: Ransomware has been on the rise because it is effective, lucrative, and easy. Vulnerabilities are growing as companies and people are using more software and networked devices than ever before. Easy-to-use malware is provided by “gangs” and they make 20-30% of the profit. These factors all pose threats to companies who are not prepared for a cyberattack. Companies are struggling to keep up with these attacks due to lack of talent, planning, and budget. The shortage of qualified cybersecurity experts makes it difficult to hire and retain talent, especially when the average annual salary for a cybersecurity engineer is close to $95,000 . With these expenses and lack of talent, companies are struggling to protect attack surfaces as they grow. Often, they turn to technology to support but human defenders are required in addition to respond to these evolving threats. Human Defense: Cyberattacks are launched by human attackers. Responding to these threats requires human expertise . While technology is important, it can pose new challenges such as difficulty deploying, configuring, and maintaining. Trained analysts have an advantage when detecting and responding to ransomware. They spot malicious code and warning signs, understand the context of alerts, and more. As the cybersecurity threat landscape continues to expand, it is important to provide the people, process, and technology to maximize your cybersecurity budget and reduce your risk of experiencing a cyberattack. Learn more about how a managed detection and response (MDR) provider can partner with your business to defend humans and human expertise against attackers who strive to disrupt lives. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026