Threat tactics, notable vulnerabilities, current trends, and data leaks were all discussed in our monthly webinar. Read the key takeaways in this blog. Novel Threat Tactics, Notable Vulnerabilities, Current Trends, and Data Leaks Pondurance January 26, 2024 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In December, the team discussed novel tactics, notable vulnerabilities, current trends, and data leaks. Novel Tactics To kick off the webinar, the Director of Incident Response discussed several novel tactics recently used by threat actors including: Supply chain attack . The incident response team uncovered a new supply chain attack related to CCTV updates. Ransomware actor LockBit developed a novel backdoor, C-sharp executable that allows it to hide at the network level and avoid detection as PowerShell communicates outbound. The exploit involves scanning en masse, enumerating the active directory, performing loud network-level scans, exfiltrating data, and encrypting the network. Citrix Bleed . Threat actors are using session hijacking to garner the session and establish persistence in the environment. From there, they install a backdoor and move laterally from the Citrix server to the domain controllers to the sequel servers. Confluence . Companies that use the Atlassian Confluence server experienced a mass exploitation in November. The threat actor moved laterally through the environment, exported data on the server, and encrypted it for extortion purposes. Single sign-on bypass. A recent bypass occurred through Okta as an employee’s account had a master password that was a local sign-on. The team stresses that local logins on administrator accounts, especially at a software-as-a-server level, are an easy entry point. Business email compromise (BEC) and ransomware. The team saw two times the normal volume of BEC and ransomware in November and December, and it expects to see a ramp-up during the holidays and into January, particularly involving the Citrix vulnerability and novel techniques. Vulnerabilities The Vulnerability Management Team Lead looked at vulnerabilities from November. As many as 2,200 vulnerabilities were disclosed, and 13 of those vulnerabilities were high risk. Of those 13, seven were zero-day vulnerabilities. The zero days included products from: Apple iOS – Two remote code execution vulnerabilities occurred, and updates were pushed to iPhone and iPad devices. Google Chrome – The vulnerability, tied to the Scia 2D graphics engine, impacted Chrome-based browsers, Chromebook, Chrome OS, and Android phones. The zero day required updates to devices as well as updates to Microsoft Edge, FireFox, and other lesser-known browsers. Microsoft – Three zero-day vulnerabilities occurred on Microsoft products, and all required a patch. SysAid IT on-premises software – The IT service management vulnerability, similar to the MOVEit vulnerability from June, targeted a wide range of industries and sectors. The team took an in-depth look at the ownCloud information disclosure vulnerability . OwnCloud is a backup or file sharing cloud-based solution located in Google Drive or Microsoft OneDrive. The vulnerability CVE-2023-49103 occurs in the GraphAPI extension of the software, and the installation is through Docker. The vulnerability affected roughly 12,000 victims in the United States and a few European countries, leaking data such as administrative passwords, mail server credentials, license keys, and server configuration information. The vulnerability can be resolved in two ways. One option is to update GraphAPI with a patch, version 0.2.1 or 0.3.1. Disabling the GraphAPI extension is not a viable option because exploitation is still possible when the extension is disabled. The second (and probably better) option is to upgrade ownCloud to at least 10.13.1 and make patches for CVE-2023-41904 and CVE-2023-41905. The upgrade also patches a few application bypass vulnerabilities. The team suggested that companies need to know if the software running in their environment is accessible over the internet and which versions of software are running. The team also saw new critical vulnerabilities in scans in November. The fixes for the vulnerabilities are software patches, such as Apache Tomcat (9.0.0.M1 through 9.0.83) and security updates for Microsoft .NET Framework and KB5032196. SOC Trends The Director of SOC Operations talked about upward and downward trends that the security operations center (SOC) team has observed. Phishing is trending up and remains the primary vector for attacks. The main reasons for the attacks are social engineering, credential harvesting, and malware delivery. In December, the SOC team saw three primary trends in phishing. First, PDFs are being used, containing the javascript or link to a malicious website. Second, threat actors are using password-protected documents and zip files to get past email filters. Ransomware and information stealer malware are commonly associated with this activity. Third, threat actors are using screensaver files to drop malware inside the user’s home directory. Endpoint detection and response solutions should catch this activity, but companies with their own internal threat hunting programs should look for it. Cryptomining is still active but on the downtrend, possibly due to the downward market swing in cryptocurrency as a result of the FTX collapse . However, with financial services companies pushing to establish bitcoin exchange-traded funds and a recent surge in the bitcoin market, the team expects to see more cryptomining in the near future. The team also has seen a recent trend in the creation of auto-forward rules on Microsoft Office 365 accounts. Pondurance has detection for such rules, and the social engineering tactic can be prevented by employing multifactor authentication and user awareness training. SOC Engineering The SOC Engineering Lead discussed the informative (and sometimes dark) topic of data leaks. The data may be used by governments, advertisers, third parties, or others for legitimate or nefarious reasons. A person can experience data leaks in a multitude of ways including: Smart devices. Phones, texts, TVs, doorbell cameras, and security cameras can gather information and even spy on individuals while at home, at work, in the car, or taking a walk. Listening devices. Home assistant devices like Alexa and even internet-connected baby monitors can become listening devices for threat actors. Also, Comcast systems in boardrooms can be used to eavesdrop on conversations. Apps. People use apps to start the car, listen to music, make travel plans, and more, and third parties will pay money for the information contained in those apps. Most Americans also have social media apps on their phones but don’t know how much data the apps are collecting. TikTok , for example, collects every setting on a phone, including access to messages, contacts, and web browsing history. In addition, Apple and Google recently revealed that foreign governments are monitoring their push notifications to spy on individuals, and the companies have no leverage to stop the governments from asking for notifications if they want to do business in those countries. Proximity. Data leaks can happen when in close proximity to a retail store. Beacons, or small tech devices that send signals to smartphones, are installed to track where consumers walk inside a store. That way, if a consumer is spending time in the laundry detergent aisle, he or she may get a digital ad for Tide. There are even ultrasonic beacons that emit sounds that people can’t hear, but smartphones can. Using these beacons, advertisers can develop individual profiles on consumers based on the data they collect, such as where they shop, what they buy, and which apps they use. Tracking. Loyalty cards, credit cards, and even license plates can leak data. And, of course, a person’s exact location can be identified using apps, GPS location, and satellite triangulation. Also, dust and scratches on a camera lens can be matched to an individual’s phone, and Facebook has a patent for technology that can determine whose camera took a particular photo based on the dark spots or pixelation within the image. Work issues. Every code, app, and device added to a network can potentially open a new avenue of exploitation. The team encouraged users to learn more about free services like VirusTotal and Word Cloud before using them. Also, the team stressed the pitfalls of renting a car and syncing a company phone to it, warning that the car will retain a copy of what’s on the phone including emails, images, and contacts. To protect against data leaks, the team recommends removing administrative rights from users, managing web browsers through active directory and Azure, and installing ad blocking software and extensions. Next Month The Pondurance team will host another webinar in January to discuss new cybersecurity activity. Check back next month to read the summary. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Minimize risk and ensure compliance with forensic-driven incident response strategies | Pondurance Why You Need Forensics in Incident Response—and How to Do It Right Pondurance March 12, 2025 Facebook X (Twitter) LinkedIn Copy link Incident response is a crucial aspect of cybersecurity, especially for midsized organizations struggling to stay ahead of cyberattacks that threaten their sensitive data and systems. When responding to a threat, many companies focus on quick detection and remediation. But failing to apply proper context and forensic investigation can lead to critical mistakes, leaving systems vulnerable to further attacks. When conducted under client-attorney privilege, forensic investigations help: Minimize risk exposure by keeping sensitive findings confidential. Provide legal teams with crucial forensic evidence to assess liability and compliance obligations. Determine whether a breach is notifiable under regulations such as GDPR, CCPA, HIPAA, and SEC cybersecurity rules. This is the third article in our series delving into data breach risks and how to mitigate them. In this article, we’ll explore the importance of forensic investigations and analysis in incident response, the limitations of traditional methods, and a share a better, more effective approach to incident response. The Rush to Remediate Without Context A common mistake during incident response is detecting a threat and immediately assuming its origin without a thorough forensic investigation. For example, your team may receive an alert indicating that remote access software was installed on a system and automatically conclude that the threat came via a phishing attack. This assumption, while plausible, may be incorrect. A proper forensic investigation might have revealed that the compromise occurred through an unpatched vulnerability in a public-facing application—not via phishing. It would have also revealed the full attack path the hacker took to achieve their objectives. Remediation without understanding every step of the attack path can result in: Persistent threats: The real entry point remains open for attackers to exploit again. Incomplete recovery: Additional malicious activity, such as data exfiltration, may go unnoticed. Regulatory and legal consequences: If an organization underestimates the breach impact, it may fail to comply with disclosure regulations, leading to fines and lawsuits. To address these issues, organizations must adopt a forensic-first approach to incident response, using methodologies like the Cyber Kill Chain and the MITRE ATT&CK framework to understand and validate how an attack unfolded. Understanding the Cyber Kill Chain and the MITRE ATT&CK Matrix Lockheed Martin developed the Cyber Kill Chain , a seven-step model that outlines the logical progression of a cyber-attack: Reconnaissance : The attacker gathers information about the target. Weaponization : The attacker creates or configures malware for deployment. Delivery : The malware is delivered (e.g., via phishing, drive-by downloads). Exploitation : The attacker exploits a vulnerability to execute malware. Installation : The malware is installed on the compromised system. Command & Control (C2) : The attacker establishes communication with the compromised system. Actions on Objectives : The attacker achieves their goal, such as data theft or ransomware deployment. Incident response teams are most often brought in at later stages of the kill chain, especially the Installation and Actions on Objectives phases. The cyber kill chain provides a valuable reference point for forensic investigation. If ransomware is installed, then the forensic analyst can logically conclude that something happened before and after the attack. While the kill chain provides a high-level attack progression, the MITRE ATT&CK framework breaks it down into specific techniques that adversaries use. It categorizes tactics like initial access, persistence, privilege escalation, and exfiltration, with real-world techniques observed in attacks. By mapping detected activities to MITRE ATT&CK techniques, organizations gain precise insights into how an attacker infiltrated their systems and what actions they took. Curious how our platform can help you apply the Cyber Kill Chain and MITRE ATT&CK? Request a demo to see it in action. The Role of Forensics in Incident Response: A Case Study The diagram above shows a hypothetical event—the installation of remote access software—and two possible ways to respond to the incident. In the first instance, the red arrow shows how a member of the security team: Fails to account for the steps between the event and the initial access point—in other words, they don’t apply context. Thus, they mistakenly conclude the event was due to a phishing attack. Also, doesn’t use context to account for what happens after the remote access software was installed—that data was exfiltrated and encrypted, a potential data breach. As the green arrows show, forensics takes two concurrent paths. The forensic analyst: Works backward, step by step, from the detected event to correctly identify the initial access point—exploiting a vulnerability in a public-facing application, not via phishing. Identifies the attack aftermath. Since there was unauthorized data exposure, the incident response team can properly remediate and contain the incident. This approach illustrates how a forensic analyst can use the Mitre ATT&CK matrix within the context of the cyber kill chain to hypothesize how an attack occurred. The kill chain framework says that something happened before the software was installed and that something will occur as a result of the installation. Based on this reasoning, the analyst can use the ATT&CK matrix to determine each step the attacker took, from initial access point to final impact. Conducting a forensic investigation within the context of these two frameworks offers three critical benefits: Uncovering the full attack chain, to accurately identify each step the attacker took to achieve their objectives, such as exfiltrating data. Enabling full remediation. Rather than removing a non-existent phishing threat, the incident response team can patch the vulnerability in the external-facing application. The team could also remediate other techniques the attacker used to achieve their objectives. Mitigating the legal and regulatory impact of a potential breach , by properly identifying what data was accessed, and when and how it was accessed. Best Practices for Forensics in Incident Response If your organization is like most, you have limited cybersecurity resources, and implementing a robust incident response process may seem daunting. However, building your incident response plan on accurate and complete forensic findings can reduce your breach risk . Lowering your risk helps minimize business impact, preserve your reputation, and comply with regulatory and compliance obligations. Here are a few best practices for midsized organizations to consider: Develop an incident response plan ahead of time. Define roles and responsibilities for security, IT, and legal teams. Establish escalation procedures for when forensic investigation is necessary. Identify external forensic experts or incident response firms to engage when needed. Train your security team to apply context to forensic investigations. Encourage security teams to question assumptions rather than jumping to conclusions. Train staff on the MITRE ATT&CK framework to recognize possible attack paths. Implement tabletop exercises to simulate forensic-driven incident response scenarios. Apply holistic threat detection across your organization. Use managed detection and response ( MDR ) software to collect and analyze data from endpoints, network, logs, identity systems, cloud, apps, and IoT devices. With intelligence from your MDR solution, gain a complete, real-time view of threat activity and capture detailed forensic data. Support your technology with human intelligence. A security operations center staffed with analysts, threat hunters, and incident responders can conduct accurate forensic investigations to support breach determination. Let the forensics guide your remediation. Conduct a forensic investigation before taking action. For example, a vulnerability scan will detect thousands of vulnerabilities in your systems. Rather than addressing them all, let forensics identify and recommend fixing the one vulnerability that the attacker used. Avoid prematurely deleting compromised systems or logs. Otherwise, critical evidence may go missing, and you may have to assume a worst-case scenario. This means fixing all possible problems not only the one that actually occurred. Learn from incident data. • Use forensic findings from an incident to improve security defenses proactively. • Leverage threat intelligence reports to prioritize vulnerability patching. • Build your security defenses based on accumulated findings from incident response casework. Remember legal considerations. Conduct forensic investigation under attorney-client privilege to protect sensitive findings. Understand forensics reports may be considered factual evidence , making them subject to subpoenas. Maintain clear documentation of all findings and remediation actions. Plan how to share your findings. It’s a race against time— providing answers to the IT team before legal counsel focuses on what data was accessed or exfiltrated and thus invokes privilege over the investigation. After all, data access is what ultimately drives fines and class action risks. Right-size your incident response. Use an independent forensics and incident response team , and apply privilege only for severe incidents that could be breaches. Have your existing security team use these forensic techniques for less-severe incidents. This ensures you accurately determine and can remediate the vulnerability the attacker exploited to gain entry into your systems. Conclusion: Think Like a Forensic Investigator Incident response is more than just detecting and remediating threats—it’s about understanding how and why an attack happened to prevent future incidents. Midsized organizations must move beyond surface-level analysis and adopt a forensic mindset, using methodologies like the cyber kill chain and MITRE ATT&CK framework to get to the truth. By slowing down and applying context to what was detected before taking action, organizations can ensure that their response is accurate, comprehensive, and legally defensible—ultimately reducing their breach risks. Experiencing a breach? Contact us: 888-385-1720 Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

The healthcare industry is a prime target for hackers, with the average amount of time it takes to recognize a breach being seven weeks longer than any other industry. Learn more in this blog.|The healthcare industry is a prime target for hackers, with the average amount of time it takes to recognize a breach being seven weeks longer than any other industry. Learn more in this blog. Healthcare CISOs Can Solve Data Security and Privacy Together Pondurance June 22, 2021 Facebook X (Twitter) LinkedIn Copy link I was recently asked by Healthcare IT Today about data privacy as it concerns healthcare organizations. As an industry, they continue to be a prime target for hackers — if not the leading one. The average cost of a breach for the healthcare industry now stands at $7.13 million (the highest of any sector), compared to less than $4 million for organizations overall. What’s more, it takes 329 days for hospitals and other healthcare organizations to identify and contain a breach (i.e., the life cycle of an incident), or seven weeks longer than the average life cycle for companies in general. Again, healthcare leads all sectors in this category. Given the circumstances, the industry’s chief information security officers (CISOs) and their teams are firmly focused on implementing new tools and practices to better protect their digital assets. But with a wave of global regulations now in place and more likely to come, they cannot solely frame their resources and objectives on cybersecurity as a stand-alone effort, as data privacy has emerged as a critical priority as well. Specifically, the European Union’s General Data Protection Regulation (GDPR) triggered the wave by requiring businesses to design personal data protection into the development of their products and services. In addition, they must document how and where data is stored, how it is processed, and most importantly, give consumers control over how organizations can use their data. In the U.S., at least a half-dozen states have followed up with similar regulations. To comply with the recently passed California Privacy Rights Act (CPRA) , for example, businesses must minimize their usage, retention, and sharing of personal information to what is reasonably needed to conduct their stated intent (i.e., the GDPR’s data minimization principle). Organizations will also have to deploy security measures that assure the confidentiality, integrity, and accessibility of personal data. If they fail to do so and a subsequent attack exposes personal information, affected consumers will be able to sue the breached companies. If all of this sounds like a lot to take on, that’s because it is. Fortunately, cybersecurity and privacy compliance are not mutually exclusive disciplines, as steps are taken to best protect digital assets and devices serve as a solid foundation for an effective data privacy strategy. Security is about preventing unauthorized individuals from accessing data, whether it is intellectual property or the personally identifiable information (PII) of patients and employees. Privacy is about properly managing, collecting, sharing, and if necessary, deleting customer or patient data. Privacy compliance is a natural extension of proven security practices — both security and privacy depend upon the proper execution of data protection and management. To illustrate this, let’s present the following essential components for the two, starting where CISOs need to begin — cybersecurity: Cybersecurity Essential Components Encryption. Healthcare CISOs must use algorithms to scramble or code sensitive information, so it is readable only with a decryption key. With this, they’ll prevent adversaries from reading the information if they intercept it during an attack. Access control. This is all about accurately answering the “Are you who you say you are — and do you belong here?” question. If unauthorized parties gain access to, say, the domain controller, they can compromise critical accounts, user data, and proprietary/sensitive information. Human intelligence. Ongoing innovations such as automation and artificial intelligence are profoundly expanding the capabilities of security teams — but they cannot replace them. We will always need the human intuition of analysts , threat hunters, and incident responders to successfully fortify networks, systems, applications, and devices. Managed detection and response (MDR). CISOs have to establish deep visibility into all network, log, and endpoint activity, with 24/7/365 detection and response. But they may not have the personnel or budget to do so. That’s when they should consider bringing on an MDR partner to outsource many (if not all) of these responsibilities to proven experts in threat hunting, prevention, and mitigation. Data Privacy Essential Components Discovery and classification. With discovery, CISOs and their teams scan their digital ecosystem to identify where both structured and unstructured data exists. With classification, they categorize and prioritize all of their data according to privacy risk levels and considerations. Again, this demonstrates that privacy and security are not mutually exclusive. For years, security teams lived by the mantra, “You cannot defend what you cannot see.” The concept extends to discovery and classification for privacy. Minimization. As GDPR and the other regulations require, organizations must limit the amount of personal data collected and maintained; they should not hold on to every bit of it that they encounter. Optimal minimization will lead to a smaller digital footprint, thus reducing risk. Consent. Users such as patients want to know what a hospital plans to do with their data. To address this, regulations are directing organizations to gain consent from these individuals before any intended usage of their information. Deletion. As part of a comprehensive privacy policy, teams must be capable of deleting data at a user’s request. These steps ultimately lead to a quality that all healthcare organizations should aspire to today: transparency. All in all, people are concerned about how their data is collected, managed, and protected. Keeping them in the dark may produce short-term gains but will likely result in eventual regulatory violations or fines and reputational damage. By demonstrating their commitment to the highest of digital defense and data privacy oversight and disclosure standards, CISOs can greatly distinguish their organization’s value from the rest of the pack. That’s not just good for security and privacy, it’s good for business. Learn more about data privacy in our whitepaper Privacy Is Hard To Enact Without Security . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn more about Doug Howard, CEO, who started his career in the military at the Pentagon learning the value of a higher-calling mission, a broad experience base, and networking. Get to Know Doug Howard, Pondurance CEO Pondurance February 8, 2022 Facebook X (Twitter) LinkedIn Copy link For this month’s leadership spotlight, we spoke with Doug Howard, CEO at Pondurance. Doug’s impressive cybersecurity career started at the Pentagon where he learned the value of a higher-calling mission from the military, a broad experience base, and networking. He embraces these values today and constantly strives to learn and share what he knows with co-workers, clients, and the industry. How did you get into cybersecurity? I lived in a small town, grew up in a trailer park, and wanted to get out of the small town environment. One of the paths I’d seen some friends of mine take was the military, so I went into the military and selected the U.S. Air Force branch. When I went through the onboarding process, they gave an SAT type of test and, based on the scoring, I got to choose my first assignment, my job role, and my location. No depth perception, so never flying, so option 2 … I wanted to go into communications and tech at that time, and IT encryption type of tech was very interesting to me. I scored high, so I got Hawaii. Because I had a girlfriend in North Carolina at the time, I traded Hawaii for the Pentagon. The girlfriend didn’t last, but the career did! I was assigned to the Pentagon at Cheyenne Mountain in Colorado and did a short stint in Israel as well. At Cheyenne Mountain, I worked on joint Chief of Staff initiatives to increase cyber detection capabilities and data encryption approaches within the Department of Defense interconnect to other government agencies and third parties. These experiences set my foundation for a purpose-built higher calling of work in cybersecurity. I think we all have a role to play in the industry, we have a role to play for our clients, and we have a role to play in our national defense. What is one of your greatest strengths? Dealing with stress is probably one of my big strengths. I tend to digest and leverage stress as a strength. At the Pentagon, I remember I was sitting in front of a console that controlled a DoD satellite, and we lost the satellite. (This is a much longer story; it wasn’t my fault!) I had Colin Powell, who was a three-star general at the time, put his hand on my shoulder and say, “Son, there are people dying around the world right now because we can’t communicate with them [from the Pentagon].” I think that set the context for the rest of my life. Whether you’re an individual contributor or you’re an executive, you have stress. Over your career, you learn to deal with that stress in different ways. Your stress high points are going to be the reference points that make everything below that high point easier to consume, and it gives you a relative comparison to what other people are going through. In other words, how I respond to and process stress is relative to “people might die”. That’s not to be confused with urgency, but it puts things in context and keeps you calm when you need to be. What helped you grow into the cybersecurity leadership role you’re in today? The more experience you have broadly across multiple different functions, the better you’re going to be able to lead teams, the better you’re going to be able to interact with clients, the better you’re going to be able to add value across that spectrum, and so building toward that momentum of having a cross-functional experience was part of the early career foundation that I built. I’ve done sales, I’ve done operations, I’ve done product management, and I’ve done marketing. That built a great foundation for me. Early on, I also learned the strength of a network. I built a strong network by connecting on LinkedIn and by meeting people who really inspired me, staying in contact with them every six months, and getting their advice. Your aspiration in life should be to never have to interview for a job. You should have people calling you and saying you are a perfect fit for this particular role and pulling you into those roles rather than you going out and doing searches for jobs when it’s time to make a move. It’s always nice to be able to have a group of people calling you, asking you to come work with them. That’s especially important as you get to executive levels, having a strong network of executives who really want you to come and work alongside them or with them in a particular company. Any advice for those starting their career? The biggest thing when starting your career is networking with the people you’ve done internships with. If you haven’t done internships, do them. They’re a great way to get to know industry participants. They’re a great way to get experience. They’re a great way to test out a company to see if your culture really does fit. If someone were to interview with you for an open role, what advice would you give? I think the biggest role for anybody interviewing for a job is to be yourself. You don’t want to come and represent yourself as a particular type or culture fit or something just to fit within what you perceive we are. Rather, come in, talk about how you best work in an environment, what support system works best for you, what the right cultural fits are for you, and then, if those things line up, it’s a magical combination. We look for that in every employee. What qualities are you looking for in a job applicant? I think the key characteristic of any good employee is a genuine desire to know more. If you ask a question and somebody gives you an answer and you stop there, I believe that’s probably not a good stopping point. You should drill down into it to really understand the context, understand what they’re saying, and know how they came to that answer over time. That’s where the experience is, learning about how people came to a conclusion, how they researched a particular topic, and why they came to the conclusion they did. Just based on the facts, you may come to a different conclusion and be able to have a conversation and information exchange, right from the very beginning. Ultimately, we look for somebody genuinely looking to learn. If you’re a relatively junior security operations center analyst, for example, we want to know if you’ve been building your own lab. Have you been able to do research of your own? Have you been able to download open source tools and play with those in a lab environment? Those types of characteristics in an entry level position are extremely important, as well as what you’ve done to develop your career over time, both within your job role and outside your existing employment. What’s the mentorship program like at Pondurance? Mentoring has a few aspects. One is formal where you mentor someone and are going to achieve something over a period of time, which you can only do with a certain number of people. Another is doing mentoring sessions where you can talk about your experiences with larger groups of people. I do that with the interns, for example, and the other management team members do that as well. Then, there’s a kind of informal mentoring where someone is stuck and needs help. As a mentor, you need to be a sounding board and make sure people feel comfortable coming to you for one-on-one conversations, so they don’t feel uncomfortable telling you that they’re not able to solve something. You can help them through those situations rather than having them feel a sense of personal failure that they couldn’t get over that hump. What is the main reason someone should choose a cybersecurity career at Pondurance? Working at Pondurance is an exciting opportunity for both people coming into the industry and people with experience for a few reasons: We have a recognition of a higher-calling mission. We’re building a learning environment so that everybody has an opportunity to continually learn, and we expand that every year. We’re in a hyper growth industry and a hyper growth company that creates opportunities to move into new responsibilities, new roles, or management, if that’s your desire. There’s a lot of expandability within the company. Also, we’re a tech-enabled company, so we don’t believe that human beings doing everything manually is the right approach, nor do we believe that you can solve all problems with technology. We believe that to empower an individual, it’s about using technology to do the simple things — the things that are repetitive, the things that nobody really wants to do manually — and bringing the intelligence aspect of the human being to that tech platform to become a tech-enabled differentiator in the marketplace. That will allow us to really change the industry from where it is today, which is too much manual work and too much reliance on technology only, and blend those things together as a differentiator for the employees, the industry, and the customers. Interested in joining the Pondurance team? View our current openings! Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

This blog discusses monthly notable vulnerabilities and trends, security operations center metrics, and insights on a recent SOC engineering exercise. Read now! Vulnerabilities, Alert Metrics, and Phishing Exercises Pondurance January 4, 2024 Facebook X (Twitter) LinkedIn Copy link All industries are experiencing the ongoing threat of cyberattacks, and healthcare is no exception. The financial impact of a cyberattack can wreak havoc on the bottom line. More importantly, a cyberattack at a healthcare organization can risk patient safety and cost lives. In a recent report , researchers analyzed more than 200,000 infusion pumps that automatically deliver medications and nutrients to patients and found that 75% contained at least one known security gap. More than half were susceptible to two known vulnerabilities dating as far back as 2019. Vulnerabilities are the flaws in software or hardware that enable attackers to take unauthorized actions or gain malicious access. Unpatched vulnerabilities leave healthcare organizations at an elevated risk of compromise. After all, it only takes one unpatched vulnerability for a data breach or ransomware attack to occur. The infusion pump findings are a microcosm of a larger security problem with medical devices. Increased access to wide-scale internet scanners allows even novice threat actors to identify unpatched or misconfigured systems. Every time a new medical device connects to a healthcare network, it can increase the risk to patient safety, hospital operations, and billing systems. But there are ways you can minimize the risks. Gain 360-degree visibility With a multitude of new medical devices, the attack surface has expanded, creating security blind spots for hospitals and medical facilities. Healthcare organizations need a holistic view of internal systems and security tools to properly defend against cyberattacks. With 360-degree visibility, your team can monitor and hunt for malicious activity across IT, cloud, and Internet of Things (IoT) assets. “Having 360-degree visibility ensures that no stone is unturned from a threat detection perspective,” said Lyndon Brown, Chief Strategy Officer at Pondurance. “All of a customer’s systems and infrastructure must be deeply monitored on a 24/7 basis to look for malicious or suspicious activity. This activity must then be investigated and stopped as soon as possible to prevent damage and loss.” Integrate incident response Before your team ever experiences a cyber event, you need an incident response plan in place as a strategy to identify, contain, eradicate, and recover from a cyberattack. A good incident response plan helps you know the vulnerable entry points in the network, recognize where your sensitive data resides, and understand how to quickly respond to a threat. And timeliness is key. Having an incident response retainer in place can ensure that an experienced incident response provider is ready to support you at a moment’s notice. According to IBM Security’s Cost of a Data Breach Report 2021 , it takes an average of 287 days to identify and contain a data breach, and the longer it takes to identify and contain the breach, the more costly it is. “The amount of damage caused by an attack generally correlates with the time it takes to detect said attack,” said Lyndon. “Integrated incident response enables organizations to stop threats before systems can be damaged or patient safety can be impacted.” Employ vulnerability management Threat actors will use any means necessary to gain access to your networks, endpoints, or servers. Unpatched vulnerabilities are one of the primary sources of access for cyberattackers to steal sensitive data, harm systems and applications, infect malware, and more. In fact, 60% of all breaches are the result of unpatched vulnerabilities. As it relates to medical devices, there is a need to know every medical device on the network, promptly replace outdated devices, and discover any vulnerabilities that require attention. “A vulnerability on someone’s laptop can potentially impact medical devices connected to the same network — and a flaw in an ill-maintained IoT device can put the business systems at risk,” said Lyndon. “Vulnerability management is about identifying, prioritizing, and patching the most critical ones. Without this, organizations leave large holes open that attackers can exploit.” Talk with Pondurance The infusion pumps report reminds the healthcare industry of its many vulnerabilities in the cyber landscape. But there are ways to protect your organization from cyberattackers. Pondurance offers Managed Detection and Response to provide 360-degree visibility across networks, endpoints, logs, and the cloud; integrated Incident Response to stop threats before harm occurs; and a Vulnerability Management Program to reduce the attack surface to protect sensitive data and keep patients safe. To learn more about cybersecurity for healthcare providers, check out our resources. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

To fight hidden cyber threats, you need access to your data, understand what it’s telling you and have the human expertise to act on threats.|To fight hidden cyber threats, you need access to your data, understand what it’s telling you and have the human expertise to act on threats. Stop Hidden Cyber Threats From Sneaking Past Your Defense Pondurance December 9, 2021 Facebook X (Twitter) LinkedIn Copy link Large cyber incidents such as the Darkside ransomware attack and Hafnium’s exploits on Microsoft Exchange, emphasize the importance of recognizing risk before it’s too late. Cybercriminals are intelligent and creative, they seem to come up with new ways to enter an organization’s network daily. To investigate and fight hidden cyber threats, you need access to your data, understand what it’s telling you and have the human expertise to act on any possible threats. In this blog, we use the example of identifying NBA offensive threats to relate to identifying cyber threats. The common denominator? Data and human expertise are required. NBA Offensive Threats Sports analysts use many metrics to identify offensive threats. To find the greatest threat, analysts use the 50-40-90 rule . This rule states that anyone who completed a season shooting field goals at least 50% of the time, 3 pointers at least 40% of the time, and free throws at least 90% of the time, can score from anywhere on the court. This makes them one of the greatest offensive players. Only 9 NBA players and 1 WNBA player have achieved this goal including players like Kyrie Irving, Steve Nash, Stephen Curry, and Kevin Durant. In the 2020-2021 season, 5 players came close to hitting 50-40-90 — Chris Paul, Kawhi Leonard, Tobias Harris, Kevin Durant, and Stephen Curry. Even though they did not hit the 50-40-90 in the 2020-2021 season, they are still a huge offensive threat because of their efficiency. So how does this relate to cybersecurity? Just like these sports analysts, it is important that your company looks at the data and cyber risks that could enter your organization. If the threat is overlooked because you don’t know what data you’re looking at or are overwhelmed with alerts, the threat could slip by. Cost of Cyber Threats The cost of cyber threats continues to rise across all industries and it can be detrimental to any organization. Nearly 89% of companies have experienced a data breach in the past 3 years. The healthcare industry specifically saw a 55% increase in cyberattacks in 2020 alone. These cyberattacks can lead to ransomware costing organizations upwards of $4.4 million per breach. As the number of threats increases and the cost of these threats increases, it is important to have a tough defense ready to take action. Prepare Your Defense The best defense against human attackers is human defenders . Some key tips to identify and stop cyber threats are: Know your assets Prioritize your greatest strengths Maintain full visibility across your IT and cloud environments Hunt for threats 24/7 Defend and adapt your strategy Don’t get caught off guard! Prepare your defense and find a security partner that can assist. Remember, the first step is to identify the true threat. Learn more about how a managed detection and response (MDR) provider can partner with you to find hidden threats in our blog: Batting a Thousand: Pondurance MDR Services Hit a Home Run. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Cyberattacks go up when natural disasters strike. Be prepared.|Cyberattacks go up when natural disasters strike. Be prepared. Operation “Be Prepared”: Cyber Lessons Learned from Disaster Preparedness Drills Pondurance October 26, 2021 Facebook X (Twitter) LinkedIn Copy link In August of this year, Pondurance partnered with the Indiana National Guard, the Indiana Executive Council on Cybersecurity (IECC), the State’s Office of Technology and Department of Homeland Security–among others–to conduct a disaster preparedness drill . This multi-agency effort revolved around an emergency response to an earthquake and included a cybersecurity exercise intended to help the state be well prepared for the cyberattacks that would likely come during an actual disaster. I had an opportunity recently to contribute an article to Government Technology on the need for cyber preparedness during natural disasters, and the importance of having an incident response (IR) plan in order to be prepared for any resulting cyberattacks. *** When natural disasters strike—hurricanes, wildfires, earthquakes, floods—communities are at their most vulnerable. People are alarmed and distracted. Sadly, cybercriminals see the opportunity in the chaos. They take advantage of the confusion to create more havoc by targeting physical infrastructure like electric grids, fuel pipelines and water systems with ransomware attacks. Increasingly, when natural disasters happen, the number of attacks immediately spikes. Indeed, many cyber events are now directly linked to physical events. For example, states like Louisiana and Florida routinely see an exponential rise in cyberattacks following hurricanes. But we aren’t sitting idly by, and the government and businesses are fighting back too. They’re organizing cybersecurity efforts like Operation Homeland Defender, a drill at Muscatatuck Urban Training Center in Indiana, to test preparedness and bolster defenses. The most recent event this summer included the Indiana National Guard, local first responders, Indiana Task Force One and others. I’m proud that our company was also invited to participate. Muscatatuck is the Department of Defense’s largest urban training facility. It is a “real” city that includes a built physical infrastructure, including a water distribution and pump station with multiple active SCADA systems (supervisory control and data acquisition), 3G and 4G meshed network, IoT testing grounds, a hospital and even a U.S. “embassy.” It is an ideal place to run realistic training and testing scenarios in the event of a cyber event and see firsthand how defenses hold up. It’s a wargames facility built for the modern era of cyberattacks blending both physical and cyber into a common realm. The Operation Homeland Defender drill involved a simulated earthquake followed by a cyberattack, with hackers swooping in amid the chaos. Specifically, the bad guys attacked the water system and tried to shut it down as the National Guard deployed its defense tools to protect networks, people and property. During any natural disaster, there will be network outages and various other disruptions. Most will be the result of physical damage. But others may be caused by opportunistic hackers. For instance, if the water system goes down after an earthquake, it’s normal to assume that the outage is due to the quake, not a cyberattack. It is critical that IT and security personnel don’t miss the true cause of the outage amid the “noise” which could obviously lead to an extended outage which would, in the real world, result in hundreds if not thousands of lives lost. In the Operation Homeland Defender drill, it was indeed the bad guys who attacked the water system, in an attempt to sow more chaos and demand a multimillion-dollar ransom to turn the system back on. The exercise was designed to help security personnel differentiate between cyber impacts and physical impacts. The objective was to introduce an unknown variable—i.e., a ransomware attack—and demonstrate how failing to identify that variable can have a prolonged and devastating impact. Imagine, for instance, a major winter storm across the eastern U.S. burying communities under 5 feet of snow. And imagine, at the same time, a cyberattack on the power grid that leaves impacted communities without heat. It’s hard to comprehend the tremendous amount of hardship and even death that this kind of attack would cause. Cybercriminals know this—and they can force communities to pay a very high price to turn the power back on. This is the scenario, and many others, I outlined in Security 2020 when it was published by Wiley in 2010. That’s why it is so important for every state in the nation to hold full-scale disaster drills like Indiana’s Operation Homeland Defender: to test and better prepare their response. The reality is that many of our systems—systems that are fragile to begin with—are even more vulnerable to attack during a natural disaster or other physical event. There is a saying in sports: the best defense is a good offense. On the field of a cyber battle, the reverse is true. State and local governments must better prepare their defense by regularly running disaster drills and simulations that combine threats posed by physical and cyber events. The more they practice, the better their response will be and the fewer surprises they haven’t anticipated. It is no longer good enough to rely on a manual or checklist that nobody ever reviews or tests. No response plan works well unless you’ve picked it up and practiced it. How should you respond to a request for ransom? How and when should you engage your cyber insurance group? How can you quickly mitigate any damage? Ideally, your incident response plan should be reviewed and audited continuously. In addition, key stakeholders should be involved in the planning and execution process of the IR plan to ensure that they are prepared for a cybersecurity incident. Also, assess your security team and determine if your internal security operations center (SOC) has enough analysts to monitor, detect and respond to threats on a 24/7 basis. This can help you determine whether you have enough staff on hand or need to implement a Managed Detection and Response (MDR) service to help fill the gaps, mitigate blind spots in your security posture and provide log activity of your digital landscape. Our nation’s infrastructure systems are increasingly interconnected and linked to computer networks. As cyberattacks continue to evolve, there is a need for heightened vigilance and more effective response procedures. Drills like Indiana’s Operation Homeland Defender should serve as a reminder that we need to do everything in our power to keep pace with cyber threats and stay one step ahead of those who would do us harm. Do you have an incident response plan in place? Learn how to best set up your plan in our eBook: Incident Response Planning . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Retailers must keep cybersecurity a priority when preparing for the holidays. Read about retail cyber threats and how to defend against them. Retailers Prepare for the Holiday Season — and Cybersecurity Threats Pondurance November 23, 2022 Facebook X (Twitter) LinkedIn Copy link The holiday shopping season brings an annual surge in sales and revenue for retailers. With it, comes a threat worse than coal in your stocking: cyberattacks. During the holidays, retailers experience the anxiety of managing a larger volume of transactions, delivering the perfect consumer experience, and ensuring all orders are filled and delivered in a timely manner. In addition, they must also worry about cyber threats. Cybersecurity should be top of mind for retailers year-round, and it’s especially critical during the holidays. In 2021, holiday sales grew 14%, reaching $886.7 billion, while e-commerce fraud attempt rates rose by 19%. Unfortunately, not all retailers have the resources to boost their cyber defenses as the hectic holiday season approaches. But your retail business can take steps to stay safe during the holidays. You need to recognize the common cybersecurity threats for retailers and know how to improve your security posture. Common Retail Threats Retailers have experienced numerous threats in 2022 and should be aware that a cyberattack on retail businesses ranks high on the holiday wish list of cybercriminals. Phishing, malware, SQL injection, and distributed denial-of-service (DDoS) attacks are the most common threats for retail businesses during the holidays. Phishing. Stressed retailers and distracted consumers can fall victim to phishing scams this holiday season. Cybercriminals intentionally capitalize on the holiday chaos to catch their victims off guard, using ploys like fake customer satisfaction surveys and bogus shipping notifications. Retailers and security teams must be prepared to combat an influx of phishing, spear-phishing , and social engineering scams during this time of year. Security awareness training can prepare employees to spot these threats. Malware. Cybercriminals steal valuable payment data from retailers and consumers. One common execution is infecting point-of-sale (POS) devices with malware . If your business is using legacy systems or outdated software, it may be vulnerable to bad actors and known exploits. Like all technology, it’s important to constantly update your POS systems to stay safe. SQL injection. Though unsophisticated, this type of code injection attack against retail businesses can be highly effective during a period of high activity, such as Black Friday or Cyber Monday. Cybercriminals attack a retailer’s website through an unpatched vulnerability to steal consumer payment data during an online purchase or redirect links to a malicious website. That’s why it’s crucial to monitor your data security practices, identify your vulnerabilities, and manage and patch those vulnerabilities with updates to keep attackers from penetrating your network. DDoS attacks. During a holiday sale, a slowdown or complete halt to consumer purchases can be a devastating financial blow for a retail business. But that’s the goal of a DDoS attack . In such an attack, the cybercriminal disrupts the normal flow of traffic on a server or network by overwhelming its capacity with fake internet traffic. As a result, actual consumers are unable to access the retailer’s website or services, forcing the retailer to miss out on sales. In 2022, DDoS attacks increased year over year by 109%, according to the California Business Journal. The average DDoS attack costs between $20,000 and $40,000 for every hour it continues. How To Improve Your Security Posture Retailers need to prepare before the holiday season begins. Taking a few important steps can help keep your retail business merry and bright this holiday season. Patch and update vulnerabilities . Cybercriminals will attempt to exploit any weakness in your network to gain access, but you can help keep them out with timely patches and updates. Increase staff . Human attackers must be confronted by human defenders, so make sure your cybersecurity team is fully staffed to confront potential cyber threats. Offer employee training . Having employees who are aware of and knowledgeable about cybersecurity can help mitigate attempted attacks during the holiday season. Work with a security service provider . Your retail business needs the right cyber defenses in place to protect against an attack, and partnering with a provider service such as managed detection and response (MDR) is a smart way to mitigate risk and manage the high volume of threats. Take Action As a retailer, you count on the holiday season surge in sales and revenue to round out your year. But you must keep in mind that cybercriminals are working against you to undermine your best efforts. Know the cybersecurity threats you may encounter and how to improve your security posture. It may be the difference between coal in your stocking and money in your pocket. Learn how Pondurance MDR can help your retail business defend against a cyberattack during the holiday season. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Can iPhones get malware? Learn why traditional antivirus doesn't work on iOS and discover the best ways to protect Apple mobile devices. Cybersecurity 101: Is There Anti-Malware for Apple Phones and Tablets? Michael DeNapoli June 25, 2026 Facebook X (Twitter) LinkedIn Copy link Many readers have asked for opinions on anti-malware tools for iOS and iPadOS (Apple’s operating systems for phones and tablets, respectively). The truth of the matter is that there aren’t any antivirus or anti-malware tools that function on Apple mobile devices in the same way as we’re all used to on Windows, MacOS, or Linux devices. That is not to say that there are no options for defensive controls, they just don’t do the same things as anti-malware tools do on other devices. Let’s dig into this topic. First things first, mobile devices are indeed vulnerable to attack. Both Android and iOS/iPadOS are susceptible to being attacked by threat actors. The attack surface created by mobile devices accessing company resources (like email, file systems, etc.) shouldn’t be discounted in any way. While it is true that Apple mobile devices are much more difficult to directly attack, they’re just as vulnerable to social engineering, exploitation of vulnerabilities, and other forms of attack as Android devices are. Apple devices can also get stuck with malware that slips through Apple’s review process in the App Store - it’s rare, but it has absolutely happened. Outdated iOS or iPadOS software may also contain vulnerabilities that threat actors can leverage to gain access to otherwise locked-off areas of the device. While there are advocates of Apple products who will - even to this day - say that Apple mobile devices don’t have viruses (and that’s true in an extremely strict technical sense), both Apple and Android devices are an attack surface for any organization - so you do need to defend them. What’s different between Android and Apple mobile? Android devices, by default, allow for a user to install software from multiple sources - including just directly downloading an app from any website. Of course this can be changed to prevent unauthorized app installations (see the information about Mobile Device Management below). Android also has somewhat fewer restrictions than Apple mobile devices do when it comes to what permissions and access an app can obtain as the user uses it. Alphabet has done a tremendous amount of work to change that in recent years, so the gap between the two mobile platforms is very quickly closing in that regard. Apple, again by default, only permits installation of apps from the Apple App Store. While organizations can choose to install custom applications, this isn’t something that cannot happen without significant device management and control, as well as the organization setting up infrastructure specifically to support this operation. Apple also utilizes a set of “enclaves” - separations between different operations on the phone or tablet. For example, applications cannot access data from other applications without explicitly asking for permission, and no apps get to access the cryptographic security components of the device directly at all. To be very clear here, both methodologies have both positives and negatives from user experience and security perspectives. One is not objectively “better” than the other - they simply work differently and therefore present different security exposures to an organization. Android makes it much easier to allow organizations to distribute their own applications, while Apple makes it much easier to control and secure the device itself. This also means Android is more susceptible to rogue applications getting installed, and Apple makes it almost impossible to scan for malware like we would on any laptop or desktop. So, how do you protect Apple devices? While anti-malware (in the sense of what we do on desktops and servers) isn’t possible to run on Apple mobile devices, there are absolutely things that an organization can do in order to limit the attack surface of Apple mobile devices being used by employees. The most common are: Restricting access by mobile devices. This is the most straight-forward, but also the most limiting to your users. You can say that organizational resources like email systems and company web applications can only be accessed by managed devices. This includes laptops, desktops, servers, and other resources that are part of an Active Directory, EntraID, or Google Workspace domain; or may be using tools like Virtual Private Networks (VPN’s) combined with settings which only allow a user to connect if they’re on the VPN. Restriction alone isn’t a total security solution, so it must be used with other tools to protect the organization. A rogue application will also be able to communicate over a VPN, so that by itself still leaves gaps. Organizations can also restrict access to web-based applications by requiring the use of a Secure Browser (Island Browser, Prisma Access Browser, etc.). These tools allow the organization to strictly regulate what applications and data the user can access, how they can use it, how it can be shared (or not shared) with mobile apps, etc. Mobile Device Management (MDM). Tools like Microsoft InTune, Jamf, and others allow organizations to control mobile devices. This includes restricting what settings can be changed, when updates happen, what apps can be installed, and many other configuration options. The drawback is that the organization now has total control over the mobile device, which may cause significant friction with users - especially if they’re being asked to give up control of a device that they personally own. Different vendors offer different levels of direct device control, and it is possible to combine MDM with other methods to produce a light-touch approach while still restricting the users’ access to organizational systems. Network controls. Multiple security controls for organizational networks can also be brought to bear for use in mobile security. We touched on VPN’s above, but there are also Secure Service Edge (SSE) and Secure Access Service Edge (SASE) tools like Prisma Access and Zscaler that have mobile clients for Apple (and Android). By setting up SSL decryption, these tools can scan all network traffic moving into or out of the device for known malware, phishing links, attempts to download apps on Android, and a whole host of other things that happen as the device is communicating with the outside world. Some EDR/XDR platforms. While this is really more of tools like CrowdStrike and SentinelOne performing the methods above, if you are using the enterprise versions of many EDR/XDR platforms you can have them provide mobile security as well. Most will provide SSL decrypting VPN connectivity and analyze things like if the device has been modified (“jailbroken”) or if specific permissions have been changed in a way that weakens device security. For the most impact, these tools must be combined with some form of MDM, but can provide a much lighter touch than full device management would require. This means that these solutions can be more palatable to users who have permission to use their personal devices for work purposes. For Android devices, many of these tools can act very closely to how they act on laptops and desktops, but they are more limited on Apple mobile devices due to iOS/iPadOS restrictions. Your organization will most likely use a combination of these tools and techniques to create a security framework that works both to protect the organization and is acceptable to end-users even if they’re using their own personal devices. It is not uncommon, for example, to have an MDM solution install a device profile on an iPhone which simply checks to make sure the device is up to date and has a strong passcode combined with FaceID/TouchID. Access to email is limited to just the official apps from Microsoft (Outlook) and/or Gmail, but those platforms are configured to restrict the apps from downloading organization files onto the mobile device. A Secure Browser allows access to organization web-apps, and restricts downloading any organizational data to the device or sharing it with other apps. This allows users a measure of privacy for their personal devices, but also ensures that a compromised device will be of extremely limited use to a threat actor and will be very easy to cut off from all access once the incursion is discovered. Summing it up Apple mobile devices (iPhones, iPads, etc.) are susceptible to threat activity. While they cannot be impacted by “viruses” in the traditional sense, they most definitely can be leveraged by a threat actor through social engineering, apps that access organizational data in an unapproved way, or just a user or Apple themselves making mistakes. While there are no “anti-malware” tools that work on Apple mobile the way they can work on Android or laptops and other devices, there are options to allow for the safe use of Apple mobile devices. A combination of tools and techniques can be brought to bear to allow users to utilize mobile devices while not exposing the organization to a large attack surface increase at the same time. About the Author: Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Reducing Cyber Risk with the Microsoft Tools You Already Have Pondurance, Michael DeNapoli February 2, 2026 Facebook X (Twitter) LinkedIn Copy link Midmarket organizations overwhelmingly rely on Microsoft Windows and Office 365/Microsoft 365 to run their businesses. Email, documents, collaboration, identity, and endpoints are tightly integrated into these platforms. That convenience, however, also makes them a frequent target for attackers. The good news is that security tools are available in many organizations’ existing Microsoft 365 environments, including Microsoft Defender, for protecting endpoints, identity, and other key areas. When properly configured and with supporting processes in place, these tools help reduce cyber risk and organizations respond faster when something goes wrong. This Q&A with Michael DeNapoli, a senior solutions architect at Pondurance, explores how midmarket organizations can better protect Windows and Microsoft 365 environments by making smarter use of what they already own, and where external detection and response support can add value. This article is the first in a series on improving cybersecurity and reducing breach risks with the tools you already have—and how a trusted partner like Pondurance can help. Why are midmarket organizations especially vulnerable to Microsoft-focused attacks? Michael: The answer is largely about scale and predictability. Most midmarket organizations use Windows on endpoints and Office 365/Microsoft 365 for email and collaboration. Attackers target what they know will be there. MacOS certainly continues to gain traction in the business world, but Windows is going to be present in nearly every organization. When threat actors go after Windows and Microsoft applications, they are not making a judgment about the security maturity of a specific organization. They are playing a numbers game. Midmarket organizations often face additional constraints. Many operate with small IT teams that must balance security with daily operational demands. Dedicated security roles may not exist, and even when security tools are licensed, they are not always fully configured or consistently maintained. Attackers understand this reality and design their campaigns accordingly. What types of vulnerabilities are most common in Windows and Microsoft 365 environments? Michael: Most successful attacks exploit ordinary weaknesses rather than rare or highly technical flaws. Outdated operating systems, unpatched applications, and unmanaged third-party software remain common entry points. Endpoints that are not regularly updated create opportunities for attackers to gain a foothold. Microsoft is responsible for securing the Microsoft 365 cloud itself, but organizations remain responsible for securing the devices, tenancies, and users that access those services. If an attacker gains control of a workstation, they often do not need to exploit Microsoft 365 directly. They can simply use the applications that are already running and authenticated. Vulnerabilities also extend beyond technology. User behavior, update discipline, and internal processes all play a role. When users install unapproved software, delay updates, or hesitate to report mistakes, risk increases even if the underlying platform is well designed. What types of attacks succeed most often in Microsoft environments? Michael: Business email compromise remains the most common and effective attack against Microsoft-centric organizations. Email addresses are easy to discover, and passwords are often reused. Without strong authentication controls and the ability to recognize unusual user behaviors, attackers who obtain credentials can quietly access sensitive communications and data. Once inside an email account, attackers can read confidential messages, download files, create inbox rules to hide activity, and impersonate trusted users. Because email sits at the center of most business processes, even a single compromised account can expose a large amount of sensitive information. Ransomware is a close second. These attacks often begin when a user is tricked into running malicious software. Or, they may be tricked into following convincing instructions that fraudulently appear to come from Microsoft itself, or another legitimate and/or trusted source. In other cases, attackers gain remote access and deploy ransomware directly. While ransomware is not exclusive to Microsoft environments, Windows endpoints are a common entry point simply because they are so widely used. What general steps can IT and security teams take to mitigate the risk of these attacks? Michael: One of the most effective steps is also one of the least glamorous: keeping systems and applications consistently updated. Many organizations already license tools such as Microsoft Intune as part of their Microsoft 365 subscription. Intune can help manage updates in a way that minimizes disruption. Updates can be scheduled, users can be prompted with clear deadlines, and reboots can occur overnight rather than during working hours. When updates are predictable and automated, resistance tends to drop. Users are far more likely to comply when they understand what is happening and when it will occur. User training also plays an important role, but expectations must be realistic. Training should focus on helping users recognize common warning signs rather than trying to turn them into security experts. Mistakes will still happen. The goal is to reduce the number of successful attacks and ensure that users report issues quickly when something feels off. Perhaps most important is creating an environment where users feel safe speaking up. When employees know they can report a mistake without fear of punishment, security teams gain valuable time. Early reporting allows passwords to be reset, tokens to be rotated, and access to be reviewed before real damage occurs. While repeated disregard for security is a disciplinary issue, the occasional mistake shouldn’t put an employee in fear of losing their livelihood. How can organizations in Microsoft environments use their existing security tools to improve cybersecurity—and how does Pondurance MDR help organizations optimize these tools? Michael: First of all, there’s Microsoft 365 (M365) Defender , which has many features to increase cybersecurity resilience. These capabilities include blocking emails with foreign character sets and emails from known malicious senders; removing scripts and other executable code from emails; and blocking any attachment types that aren’t necessary for users to receive in an email (like EXE, IMG, DMG, and SVG files—all of which are routinely used in attacks). Pondurance continually watches for new threat intelligence, advising customers on new file types to block, new features which can be turned on, and other information about how to configure Office 365/Microsoft 365 and M365 Defender for the best security while still allowing users to get their work done. Second is Microsoft Defender XDR , which requires ongoing maintenance and configuration—the days of “set it and forget it” endpoint defenses are long gone. As new forms of attacks are discovered, new ways to use existing attacks emerge, and how we use endpoints themselves change, configuration and settings for Defender XDR must also be updated. For example, file junction points—long seen as a safe and normal part of Windows—are now considered to be too dangerous to allow unrestricted use. Pondurance can advise on and even assist in the configuration of Defender XDR over time. Threat research, lessons learned from incident response operations, and what Pondurance currently assists our customers with all contribute to how we can help make sure Defender XDR is working at its best. Finally, organizations using Entra ID alone, or in a hybrid configuration with on-premises Active Directory , can take advantage of native features like multi-factor authentication (MFA), single sign-on (SSO), and user application portals. Entra ID can work with third-party tools that offer these features. However, many organizations don’t know that much of this functionality is already available to them with their Entra ID licensing. Using Entra ID to its fullest also allows MDR providers like Pondurance to monitor identity use (and misuse) in near-real-time, and to take actions such as locking accounts and resetting credentials when unusual or outright malicious activity is discovered. What is your primary takeaway for midmarket organizations that rely on Microsoft tools to run their business? Michael: Windows and Office 365/ Microsoft 365 are foundational tools for most organizations, and they are not inherently the problem. Risk increases when tools are misconfigured/not configured, updates are delayed, processes are inconsistent, or users are afraid to speak up when an inevitable mistake occurs. Organizations in Microsoft environments that effectively use their available security tools, focus on keeping systems current, and encourage early reporting of security incidents are far better positioned to avoid or limit the impact of cyber threats. Defend your Microsoft environment against malicious attackers with Pondurance MDR. Get the solution guide. Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

How to Protect Your Midsized Organization from AI-fueled Cyberattacks Pondurance April 7, 2025 Facebook X (Twitter) LinkedIn Copy link Artificial intelligence is transforming how midsized organizations operate. While some companies adopt AI faster than others, they’re discovering how new AI tools and applications can deliver value across every aspect of the business. Many organizations use generative AI, which relies on user input, to personalize content, automate repetitive tasks, analyze complex data to identify patterns and trends, and improve product design and development. Progressive companies are embedding a newer type of AI—called agentic AI —into their business processes. Agentic AI systems can act autonomously to achieve a complex goal with limited supervision. Use cases include self-driving cars, smart homes, more intuitive customer chatbots, personalized healthcare, and automated workflow management. This fourth article in our series on minimizing breach risks discusses the specific and significant risks the use of AI can have on your organization. We’ll discuss how AI is enabling more deceptive and successful cyberattacks, how to evaluate AI risk, and how to protect your organization against both external threats and internal risks. How AI Puts Your Data at Risk AI can increase the likelihood for a data breach in two key ways : Smarter external cyber-attacks Your organization’s use of sensitive data in AI tools and applications Supercharged Cyberattacks AI makes existing cyber threats much more effective and harder to detect. It speeds up open-source intelligence gathering, so attackers can more easily research individuals or organizations and craft highly targeted attacks. Instead of manually piecing together information, they can use AI to generate better, more convincing phishing messages in seconds. In particular, AI makes phishing attacks harder to detect. Attackers can use AI to refine the tone of an email, making it friendlier and more persuasive, so it blends in with everyday business communications. Since sales and marketing teams already use AI for personalized outreach, people are becoming desensitized to polished, AI-generated messages—making it easier for phishing emails to slip through unnoticed. The risk goes even deeper when attackers gain access to a user’s email account. AI can analyze past messages, learn the person’s writing style, and generate responses that perfectly mimic their tone and cadence. Business email compromise (BEC) attacks are difficult to spot because the fraudulent messages will feel completely authentic. And it’s not just emails—deepfake voice and video technology are also improving. The old advice of “just call to verify” won’t always be reliable if attackers can clone voices convincingly. The more AI advances, the harder it becomes to confirm whether someone is who they say they are. Employee and Organizational Use of AI When assessing internal risks, think about how you handle sensitive or confidential information in your AI tools. Are you using AI as part of your product or service, or is it strictly for internal purposes? The tools you choose also matter—free, open-source options like ChatGPT allow public access to any data entered, while paid enterprise versions provide stronger security and administrative controls. Consider whether you’re using your own data to train large language models (LLMs) to refine prompts and results. If so, be aware that sensitive or proprietary information used in training can be at a higher risk of exposure. Also, think about how your employees interact with AI. Free tools can quickly generate useful outputs like meeting summaries or transcripts, but the prompts they use might contain sensitive employee, patient, customer, or company data. How to Assess AI Risk Risk is always a factor when adopting a new tool or application, and AI is no different. A recent World Economic Forum report offers a set of risk-based questions to help business leaders determine how and when to adopt AI in their organization. Has the appropriate risk tolerance for AI been established and is it understood by all risk owners? Are risks weighed against rewards when new AI projects are considered? Is there an effective process in place to govern and keep track of the deployment of AI projects? Is there clear understanding of organization-specific vulnerabilities and cyber risks related to the use or adoption of AI technologies? Is there clarity on which stakeholders need to be involved in assessing and mitigating the cyber risks of AI adoption? Are there assurance processes in place to ensure that AI deployments are consistent with the organization’s broader organizational policies and legal and regulatory obligations? At Pondurance, we recommend organizations follow NIST standards for risk management, specifically the Cybersecurity Framework (CSF) 2.0 and NIST SP 800-53 . NIST CSF 2.0 includes governance, making it a strong foundation for organizations updating their security policies. NIST SP 800-53 provides a comprehensive set of privacy and security controls. Our MyCyberScorecard platform assesses cybersecurity programs using these standards. Source: The NIST Cybersecurity Framework (CSF) 2.0 The recently released NIST AI Risk Management Framework integrates with existing NIST standards. Organizations can continue to follow these established best practices while evolving their risk management strategies to address emerging AI threats. And since NIST frameworks emphasize traceability—allowing organizations to assess once and report many times—NIST AI 600-1 is a practical choice for managing AI risks efficiently. Best Practices for AI Adoption To minimize breach risks when implementing AI tools and applications, consider the following best practices: Integrate your organization’s AI governance policies with your acceptable use policies to ensure data protection. Implement cybersecurity and awareness training, updating it to include emerging threats such as AI-fueled attacks. Establish vendor risk assessment policies to regulate third-party access—including from AI apps and large language models (LLMs). Regularly assess third-party risk, not just annually. Continuously update your cybersecurity program—including threat monitoring, incident response , and penetration testing—to account for new AI threats. Mitigate the harm from AI-generated phishing and social engineering attacks by limiting user access and implementing stronger identity and access controls. Compartmentalize user access to reduce the impact of successful attacks. Simply adopting zero trust for internal systems isn’t enough if third-party applications aren’t secured. Embrace AI, but Responsibly AI is a reality in your organization, whether or not you have formally adopted it. Your employees use it, possibly feeding open-source AI with sensitive data—one of many breach risks. Now is the time to to implement AI in a way that benefits your organization and end users—and always with security and compliance in mind. Trust Pondurance to help you mitigate risk from AI-powered threats. We’re the only managed detection response (MDR) cybersecurity service designed from the ground up to minimize data breach risk for mid-market organizations. We provide our mid-market customers with a platform, tools, and always-on security operations center (SOC), ensuring that sensitive data remains secure—before, during, and after incidents occur. Check out our new cybersecurity playbook, crafted to empower organizations like yours to strengthen their defense against evolving threats. “A Midsized Organization’s Guide to Reducing Breach Risks in 2025.” Playbook: Eliminating Breach Risks — 2025 Edition for midmarket organizations. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Agentic AI Can Increase Speed, Scale, and Effectiveness of Exploits for Threat Actors Pondurance April 6, 2026 Facebook X (Twitter) LinkedIn Copy link Over the past few years, organizations have been adopting generative artificial intelligence (AI) tools that focus on creating prompt-based content such as text, images, and code. Now, agentic AI is taking center stage with its autonomous abilities to accomplish more complex goals with little or no human oversight. Agentic AI is helping organizations work more productively and efficiently in their business pursuits. However, on the flip side, agentic AI is also helping threat actors work at increased speed, scale, and effectiveness in their malicious exploits. Today, a threat actor's average breakout time, or how long a threat actor has between initial access and lateral movement toward an objective, has dropped to only 29 minutes , which is a 65% increase in speed from 2024, according to CrowdStrike's 2026 Global Threat Report . Threat actors are still heavily reliant on unpatched vulnerabilities, stolen credentials, and security misconfigurations to penetrate a target's environment, but the speed, scale, and effectiveness are much improved with agentic AI. In addition, nation-states and threat actors have increased their AI-enabled attacks by 89% year over year, and less sophisticated threat actors are using agentic AI — with its lower barrier to entry in terms of cost and required knowledge — to jump into the cyber action with more advanced attacks. All in all, agentic AI has set the stage for 2026 to be a busy year for cybersecurity. Increased speed, scale, and effectiveness Use of agentic AI by threat actors is not currently widespread. So far, Microsoft has not seen any large-scale use of it, but CrowdStrike reports that more than 90 organizations have had a threat actor exploit their own legitimate AI tools to execute malicious commands and steal data. In the incidents where threat actors have used agentic AI, the speed, scale, and effectiveness of it have been impressive. The first documented case of a threat actor successfully using autonomous agentic AI for a cyberattack happened in mid-September 2025, when a Chinese state-sponsored threat actor group used Anthropic's Claude Code agentic AI tool to conduct a sophisticated espionage campaign. The group infiltrated 30 organizations globally and succeeded in a few of those attempts, using little human intervention. The agentic AI tool selected the targets, conducted the exploits and intrusions, exfiltrated the data, and gained persistence. In all, the threat actor used AI to perform 80%-90% of the attack . In its policy report, Anthropic claimed, "the AI made thousands of requests, often multiple per second—an attack speed that would have been, for human hackers, simply impossible to match." As the first case shows, the speed of cyberattacks using agentic AI is machine-fast. Agentic AI helps threat actors move faster, make quicker decisions, and rapidly adapt to unexpected changes within an environment to achieve their malicious goals in a shortened time frame. Traditionally, threat actors have spent considerable time researching one or a few targets, searching for vulnerabilities, making decisions once inside the network, and exfiltrating data. Now, with agentic AI, the scale of an exploit can be much larger because a threat actor can run reconnaissance and make initial access attempts on dozens, thousands, or even millions of targets at once — and the speed with which they do it allows them to make multiple attempts, further increasing the volume of attacks. Agentic AI performs tasks that would otherwise take an entire team of threat actors to do. Now, an effective exploit can be done by only a small number of threat actors — or a single threat actor — in a reduced time frame. The tasks can be complex tasks, such as reconnaissance, privilege escalation, or lateral movement, performed across a global attack surface. And agentic AI allows threat actors to readily adjust their exploits as attack conditions change. Threat actors don't have to stay with a set plan and fail when the plan fails. Instead, they can stay flexible and adaptive, switching tactics as they go, from emails to text messages to job board alerts. Overall, according to Unit 42's Global Incident Response Report 2026 , the use of agentic AI can improve the rate of success at every stage of an attack. Lower barrier to entry Threat actors, particularly nation-state actors and established ransomware groups, have typically had the money and depth of knowledge required to perform sophisticated cyberattacks. But agentic AI has lowered the barrier to entry for conducting exploits. Now, new threat actors with less money and technical know-how are entering the cyber arena. Less money needed. For a relatively low cost, inexperienced threat actors can use agentic AI to implement a cyberattack. The lower cost allows them to experiment with agentic AI at all stages of an exploit. Small groups of threat actors or a solo actor can profile targets, steal credentials, analyze stolen datasets, and even develop ransomware in a short span. In-depth experience not required. Threat actors don't need the same level of experience that was once required for a cyberattack because agentic AI can do much of the work for them — at breakneck speed. Threat actors working with autonomous agentic AI can make mistakes during an attack, then quickly learn from those mistakes, make adjustments, and try the exploit again and again until they get it right. Even while threat actors sleep, agentic AI can keep working 24/7 to achieve the set goals for a successful exploit. Conclusion Agentic AI is indeed helping organizations work more productively and efficiently, but it's also helping threat actors at all levels of sophistication work at increased speed, scale, and effectiveness. Increased use of agentic AI by threat actors will likely mean a busy year ahead for cybercriminals and cyber defenders alike. To combat the use of agentic AI by a threat actor, Pondurance has launched Kanati, the industry’s first agentic security operations center designed for autonomous operations within a managed detection and response service. Kanati replaces alert-driven, error-prone workflows with a coordinated system of AI agents that operate continuously throughout the full threat life cycle. To learn more about Pondurance's Kanati, read our blog post. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026