Quantum computing threatens the encryption behind digital trust. Doug Howard explains the Silent Quantum Window, post-quantum risk, and how to build resilience. The Foundation of Digital Trust Was Built for a World Without Quantum. That World Is Ending. Doug Howard September 8, 2026 Facebook X (Twitter) LinkedIn Copy link In the preceding articles of this series, I established the analytical framework that carries through everything that follows. Q-Day is the moment a quantum computer achieves the capability to break modern encryption at scale. A planned-for event, not a hypothesis, serious enough that NIST finalized an entirely new suite of post-quantum cryptographic standards in 2024 and the NSA mandated migration timelines for national security systems under CNSA 2.0. A timeline that artificial intelligence is actively compressing. C-Day , my original framing, is the capture moment: the strategic inflection point at which adversaries shift from opportunistic data theft to systematic, quantum-anticipatory collection. Harvesting encrypted data today with institutional patience, waiting for the quantum capability that will eventually make that encryption meaningless. I argued in Article 2 that C-Day has already occurred for the most sophisticated nation-state actors. The Silent Window, the period between C-Day and Q-Day, is not a warning period. It is an operational reality. The Silent Quantum Window is the time between C-Day and Q-Day. It started in the past and will continue in the future and it is what should be the thing in the back of your mind that has you dreading some point in the future. It is the data that you think is safely encrypted now … but 5, 10, or 15 years in the future will still result in damages to your organization or in some cases to individuals. It's the company's intellectual property, the files, emails, and communications that should never see the light of day. These concepts rest on a technical foundation that most security leaders understand in general terms but have never been required to examine precisely. That changes the moment quantum computing becomes a board-level conversation, which it is, and a compliance issue — which it is becoming. In this third article, I want to go beneath the surface on two fronts. First, the cryptographic architecture that quantum computing breaks — specifically, what it is, how it works, and what it protects. Second, and more importantly, what this means for how organizations need to think about resilience. Not just migration. Not just patching a protocol. Resilience — the capacity to absorb, adapt, and continue operating as both artificial intelligence and quantum computing fundamentally reshape the threat landscape simultaneously. Those two forces, AI and quantum, are not independent developments on parallel tracks. They are converging. And the organizations that understand the convergence, rather than treating each as a separate workstream, are the ones that will build security architectures capable of surviving what is coming. "The encryption protecting your organization's most sensitive communications and infrastructure was not designed to survive quantum computing. That is not a design flaw. It is a fact about physics. Resilience means building now for the world that physics is creating." — Doug Howard The Architecture of Modern Encryption To understand why quantum computing is a categorical threat to encryption, and why the resilience response has to be architectural rather than tactical, you first need to understand what modern encryption actually relies on. The most widely deployed public-key cryptographic systems in the world — RSA, Elliptic Curve Cryptography (ECC), and Diffie-Hellman key exchange — share a common foundation. Their security does not come from a secret algorithm. The algorithms are publicly known. Their security comes entirely from a mathematical assumption: that certain computational problems are so difficult that no classical computer, regardless of speed or scale, could solve them in any practical timeframe. RSA, developed in 1977 and still protecting the majority of internet communications today, derives its security from the difficulty of integer factorization — the problem of determining which two prime numbers, when multiplied together, produce a specific very large number. Factoring a 2048-bit RSA key using the best classical algorithm known would require computational effort measured in the lifetime of the universe. The security is not that factoring is impossible. It is that it is computationally impractical at the scale classical hardware can achieve. Elliptic Curve Cryptography , which underpins modern authentication systems, HTTPS certificates, and secure messaging protocols, relies on the elliptic curve discrete logarithm problem — a different mathematical structure, but the same fundamental approach: security through computational intractability. Diffie-Hellman key exchange , which allows two parties to establish a shared secret over a public channel without ever transmitting the secret itself, relies on the discrete logarithm problem in modular arithmetic. All three are broken by the same quantum algorithm. Quantum isn’t great, or even good, at a lot of things but this is what everyone agrees it will be amazing at .. decryption. What Shor's Algorithm Does and When It Becomes Real In 1994, mathematician Peter Shor published an algorithm designed for quantum computers that solves integer factorization and discrete logarithm problems in polynomial time. On a sufficiently capable quantum computer, a 2048-bit RSA key that would take a classical machine longer than the age of the universe to factor could be broken in hours. Possibly minutes. Shor's algorithm is proven. The only open question is scale: the algorithm requires fault-tolerant quantum computing at a size and stability that commercial systems have not yet achieved. That is precisely the engineering problem that IBM, Google, IonQ, and China's national quantum program are racing to solve. IBM's publicly published quantum roadmap makes the timeline concrete in ways the "7-to-15 years" consensus does not. IBM targets demonstrated quantum advantage — quantum outperforming classical computation on a meaningful problem — in 2026 . Their Nighthawk processor, currently running 7,500 gates on 360 qubits, scales to 10,000 gates on 1,080 qubits by 2027. Their first fault-tolerant quantum computer, capable of executing 100 million gates on 200 qubits, is targeted for delivery to clients in 2029 . Full-scale fault-tolerant systems running one billion gates on 2,000 qubits are projected for 2033 and beyond. That is one company's public roadmap, built for commercial clients, subject to engineering risks that could push timelines in either direction. It does not include classified national programs operating without commercial constraints or investor scrutiny. It does not account for the AI-driven acceleration of quantum engineering that I documented in the first article of this series. What it does tell us is that fault-tolerant quantum computing — the category that makes Shor's algorithm operationally dangerous at scale — is on a roadmap measured in years from today, not decades. The 2029 milestone for IBM's first fault-tolerant system is three years from now. Whatever credible assumptions you apply to the gap between IBM's commercial roadmap and a nation-state's classified program, the planning horizon is not 2035. It is significantly closer. What Quantum Actually Breaks The scope of the problem is not a single protocol or a narrow application category. The cryptographic standards that quantum computing invalidates protect the infrastructure that modern digital life depends on entirely. Transport Layer Security (TLS) . The protocol securing virtually every HTTPS connection. Every online banking session. Every electronic health record exchange. Every cloud application. Every SaaS platform. Every e-commerce transaction. The padlock in your browser exists because of TLS, and TLS rests on the cryptographic assumptions that Shor's algorithm breaks. Virtual Private Networks (VPNs) . The encrypted tunnels through which remote workforces, branch offices, and third-party vendors access corporate environments. The confidentiality of those connections depends on key exchange mechanisms quantum computing will break. Public Key Infrastructure (PKI) . The system of digital certificates that establishes trust across the internet. When your email server proves it is who it claims to be, when a software update verifies it came from a legitimate publisher, when a government system authenticates to a user, that trust is built on PKI. Quantum computing does not just break individual encrypted messages. It breaks the trust infrastructure that every digital system uses to verify identity. Digital signatures . The cryptographic mechanism proving a document, transaction, or piece of software has not been tampered with. Code signing certificates. Legal e-signatures. Financial transaction authorization. Document integrity verification in litigation, audit, and regulatory compliance contexts. Identity infrastructure . The authentication systems protecting access to corporate environments, government systems, financial networks, and critical infrastructure. Q-Day does not break one system. It breaks the foundation every system is built on. And that distinction — between a single vulnerability and a foundational failure — is precisely what makes resilience the right frame for how organizations need to respond. The Resilience Imperative: Beyond Migration Most of the post-quantum conversation in security circles focuses on migration — replacing vulnerable cryptographic algorithms with NIST-approved post-quantum equivalents. That is necessary. It is not sufficient. The organizations that will survive the AI-quantum convergence are not the ones that complete a cryptographic migration and consider the problem solved. They are the ones that build security architectures designed to absorb and adapt to continuous change — because both AI and quantum are not single events to prepare for, they are permanent, accelerating forces that will reshape the threat landscape on an ongoing basis. AI is already operating at machine speed on the offensive side of the security equation. Reconnaissance, phishing generation, credential stuffing, vulnerability exploitation, lateral movement — each of these attack phases is being automated and accelerated by AI tools available to adversaries today. Agentic AI — autonomous systems that can reason, adapt, and execute multi-step attack campaigns without human intervention — is not a future threat. It is a current one. The organizations defending against it with human-speed detection and response cycles are already at a structural disadvantage. Quantum, when it arrives at operational scale, will compound that asymmetry in a way that cannot be remediated by adding analysts or tuning rules. A quantum-capable adversary operating against a classically-defended environment is not a more powerful version of today's threat. It is a categorically different one. The convergence of these two forces — AI acceleration of quantum development, and quantum amplification of AI capability — means that the security architecture decisions organizations make in the next three to five years are not just about surviving the next breach cycle. They are about whether the organization's security posture will be structurally viable in 2030, 2033, and beyond. Resilience, in this context, means three things that go beyond algorithm replacement. First, architectural adaptability. The cryptographic infrastructure an organization deploys today must be designed to change — not once, during a post-quantum migration, but continuously. Cryptography evolves. Standards are revised. Mathematical assumptions are revisited. An organization whose security architecture is tightly coupled to specific cryptographic implementations will face the same migration crisis again the next time the landscape shifts. Crypto-agility — the capacity to swap cryptographic primitives without redesigning the systems that use them — is not just a post-quantum best practice. It is the fundamental design principle of a resilient security architecture. Second, detection at machine speed. C-Day Scenario 2 — the silent, persistent collection operations that never trigger a classical detection event — is only invisible until you have the detection architecture to surface it. The same AI that is accelerating quantum development is the mechanism by which those operations become discoverable. AI-native detection platforms with continuous behavioral learning, anomalous outbound telemetry monitoring, and pattern recognition operating across data volumes no human analyst can process are not a competitive advantage in this environment. They are the baseline requirement for organizations that want to know what is happening inside their environments rather than learning about it years later from a forensic investigation. Third, operational continuity planning for a breach-assumed environment. The correct posture in the AI-quantum era is not the hope that cryptographic migration will prevent the breach. It is the assumption that some level of compromise, in some form, across some timeline, is a baseline condition — and the organizational investment in resilience, response, and recovery capability that assumption demands. The organizations that build for breach-assumed continuity now will recover faster, disclose more confidently, and face lower regulatory and litigation exposure when events occur. The ones that treat migration as a substitute for resilience planning will not. What NIST Has Done — and What It Does Not Solve In August 2024, NIST finalized the first three post-quantum cryptographic standards in its history. ML-KEM (formerly CRYSTALS-Kyber) for key encapsulation — replacing the Diffie-Hellman and RSA-based key exchange mechanisms that protect most encrypted communications. ML-DSA (formerly CRYSTALS-Dilithium) and SLH-DSA (formerly SPHINCS+) for digital signatures — replacing the RSA and ECC-based mechanisms that establish trust across PKI, code signing, and authentication infrastructure. These are finished standards, designed to resist attacks from both classical and quantum computers, reviewed through an eight-year global evaluation process. The NSA endorses them. CISA has published migration guidance built on them. Federal agencies are under mandate to develop post-quantum migration roadmaps. What the NIST standards provide: a destination. A set of quantum-resistant algorithms that, correctly implemented, will remain secure against the quantum threat as currently understood. What they do not provide: the migration itself, the organizational inventory that makes migration possible, or the detection capability that addresses C-Day Scenario 2 while the migration is underway. One additional point deserves emphasis. NIST's evaluation process surfaced a cautionary data point: one of the initial post-quantum candidates, SIKE, was broken by a classical computer in 2022 — after years of evaluation. The algorithms NIST ultimately standardized are believed to be quantum-resistant on strong mathematical grounds. That belief is well-founded. It is not a guarantee. An organization that migrates to post-quantum standards in a rigid, one-time implementation has made a brittle bet. An organization that achieves crypto-agility in the process of migration has built the capacity to respond when the mathematics is inevitably revisited. The Operational Gap Most Organizations Are Not Facing Most security leaders, when they engage seriously with the post-quantum problem, focus on the wrong question. They ask: "When do we need to migrate?" The right question is: "Do we even know what we would need to migrate?" A 2023 assessment found that most enterprise organizations do not have a complete, accurate inventory of where cryptography lives in their environment. Not where it should live — where it actually lives, today, including in firmware, legacy systems, third-party SaaS dependencies, and applications whose administrators have never examined the underlying cryptographic implementation. Cryptography is embedded everywhere. It is in the TLS handshake your web applications initiate thousands of times per second. It is in the firmware of your network switches, your industrial control systems, your building management systems. It is in the certificate authorities your organization trusts, in the software signing chains that validate every update your endpoints receive, in the authentication tokens your identity provider issues. It is in legacy systems no one has opened in a decade because they work and nobody has given the underlying cryptography a second thought. The post-quantum migration is not a software update. It is a systematic cryptographic inventory exercise followed by a phased replacement program that touches every system in the environment — including systems whose owners may not know they run cryptography, and including third-party dependencies over which your organization has no direct control. This inventory gap is not a future quantum problem. It is an operational deficiency that exists today, regardless of when Q-Day arrives. An organization that does not know where its cryptography lives cannot protect it, cannot migrate it, and cannot accurately assess its C-Day exposure. That gap closes deliberately, with investment and effort — or it gets closed for you, under regulatory pressure or after a breach that makes the stakes impossible to ignore. Federal Mandates and the Private Sector Cascade The federal government has made the policy decision. The question is when and how it cascades into private-sector compliance with enforcement teeth. NSM-10 directed federal agencies to inventory cryptographic systems, identify those most vulnerable to quantum attack, and begin migration planning. CISA published its post-quantum roadmap. CNSA 2.0 established migration timelines for national security systems, with requirements taking effect now. Apple has deployed post-quantum cryptographic protections in iMessage through the PQ3 protocol. Google is testing post-quantum cryptography in Chrome. These are not theoretical preparations — they are production deployments by organizations whose engineering teams have already concluded the threat is real and the timeline is short. The defense industrial base is the first private-sector category in the path of this regulatory wave. CMMC has been revised before and will be revised again. Post-quantum cryptographic requirements for defense contractors handling Controlled Unclassified Information are a logical and likely near-term evolution. Organizations in the defense industrial base treating post-quantum migration as a future problem are making the same miscalculation those organizations made about multi-factor authentication before it became a hard CMMC requirement. Beyond defense: the SEC's 2023 cybersecurity disclosure rules create a materiality framework that applies to known, foreseeable risks. The NSA, CISA, and NIST have established a documented knowledge baseline on quantum risk. An organization's argument that its board was unaware of a known, material cybersecurity risk is increasingly difficult to sustain. The Howard Projection By 2027 , CMMC will incorporate post-quantum cryptographic requirements as a condition of certification for contractors handling sensitive Controlled Unclassified Information categories. The initial requireme By 2027 , CMMC will incorporate post-quantum cryptographic requirements as a condition of certification for contractors handling sensitive Controlled Unclassified Information categories. The initial requirement will demand a documented cryptographic inventory and migration roadmap with milestones — not full migration. Organizations that cannot produce that documentation will face certification risk. The defense industrial base will spend 2027 and 2028 conducting the cryptographic inventory they should have started in 2024. By 2028 , at least one major class-action lawsuit will be filed against a financial institution or healthcare system for failure to implement post-quantum cryptographic protections following a breach where forensic evidence demonstrates quantum-assisted decryption of previously harvested data. The legal argument will be straightforward: the organization had documented notice of the quantum risk through NSA, CISA, and NIST guidance; had access to NIST-standardized mitigations; and chose not to act. That argument will be legally viable, and it will permanently reshape how boards treat post-quantum migration as a fiduciary matter. By 2029 , IBM's publicly stated target for delivering its first fault-tolerant quantum computer to clients, the security implications of quantum computing will shift from theoretical to demonstrated. Whether IBM's roadmap holds precisely or slips by twelve to eighteen months, the arrival of fault-tolerant commercial quantum capability in this timeframe will be the event that forces every board conversation from "when should we start?" to "why haven't we finished?" Organizations that have not completed their cryptographic inventories by 2029 will be initiating emergency migrations under conditions they could have managed strategically. By 2030 , post-quantum cryptographic posture will be a standard due diligence line item in M&A transactions involving regulated industries, critical infrastructure, or defense-adjacent sectors. An incomplete or undocumented cryptographic inventory will be treated the same way an unresolved regulatory finding or an unpatched critical vulnerability is treated today — as a deal-pricing factor. Organizations that have made documented progress will command a premium. Those that have not will accept the discount. By 2040 , organizations still operating legacy RSA or ECC-based cryptographic infrastructure for sensitive communications will face effective uninsurability for quantum-related breach events, non-compliance with every major regulatory framework in the United States and European Union, and exclusion from federal contracting. That outcome is not speculative. It is the logical conclusion of a regulatory and market trajectory that is already moving. The only variable is whether individual organizations get ahead of it or are caught by it. What Comes Next The next installment of this series addresses the dimension of the quantum threat that is simultaneously the most underestimated and the most consequential for how security operations will evolve over the next two decades. Artificial intelligence and quantum computing are not developing on separate timelines that eventually converge. They are accelerating each other now. AI is solving the hardest engineering problems in quantum hardware development. Quantum computing, at scale, will amplify certain AI capabilities in ways that will reshape the offense-defense balance in security operations entirely. I will argue, in that article, that the organizations building AI-native security infrastructure now are not just addressing today's threat landscape. They are making the only architectural investment that will remain structurally viable as these two forces converge — and that the gap between organizations that understand this and those that do not will be the defining fault line in enterprise security over the next decade. The foundation of digital trust we rely on today was built for the computational landscape of 1977, refined over decades, and deployed at a scale its designers could not have imagined. It has served us extraordinarily well. It will not survive Q-Day intact. Resilience is not a synonym for migration. It is the capacity to operate, detect, respond, and recover in a world where the cryptographic assumptions have changed and the adversary is operating at machine speed. Building that capacity is the work of the Silent Window. The window will not stay open. This is the third article in the series "The Quantum Clock Is Ticking." Previous articles are available at pondurance.com/blog/the-quantum-clock-is-ticking and pondurance.com/blog/the-quantum-clock-is-ticking-c-day . About the Author: Doug Howard is the CEO of Pondurance, an AI-powered managed detection and response firm providing MDR, digital forensics and incident response, and cyber advisory services. He previously served in the U.S. Air Force and held roles at the Pentagon. He writes on cybersecurity, artificial intelligence, and emerging threats at the intersection of national security and enterprise risk. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

The Department of Homeland Security and TSA updated pipeline cybersecurity requirements. Learn how how to navigate these new challenges.|The Department of Homeland Security and TSA updated pipeline cybersecurity requirements. Learn how how to navigate these new challenges.|The Department of Homeland Security and TSA updated pipeline cybersecurity requirements. Learn how how to navigate these new challenges. Pipeline Providers Face Challenges With New Cybersecurity Requirements Pondurance August 9, 2021 Facebook X (Twitter) LinkedIn Copy link After experiencing the Colonial Pipeline attack , Americans have a heightened awareness that infrastructure operations, including pipelines, water treatment plants and other operational technology (OT)-based organizations that control the critical flow of liquids and bring stability to our day-to-day activities, are being targeted by cyberattacks. The nation is waking up to how dependent we are on our fragile infrastructure. Even short-term disruptions have given us a glimpse into the potential economic impact interruptions, like a pipeline cybersecurity attack, can have on the US. In response, the Department of Homeland Security (DHS) and the Transportation Security Administration (TSA) have amplified their focus on pipeline cybersecurity requirements. Twice in the last 45 days, these agencies have released directives for critical pipeline providers. The first directive from TSA was publicly released , and a second directive from DHS with very specific requirements and timelines recently was sent to a subset of the most critical 3,000 pipeline providers. No one, including the pipeline providers, would argue that the directives include unusually strict requirements or that they significantly exceed basic best practices. However, directive timelines impose serious budget and resource requirements on many of the pipeline providers. The common question is, why? Is there some known new threat? Well, you don’t need to be a National Security Agency or DHS threat intelligence analyst to know this threat has been around since the 1980s. But what has changed is the expansion of the threat surface area and landscape due to the connection of increasingly cyber dependent systems into the OT environments and the greater need for remote access to maintain and monitor systems (some driven by COVID-19 and some simply driven by resource restraints). In addition, IT and cybersecurity debt created over the years, as budgets were pushed year to year, has left teams stretched thin and struggling to maintain a patchwork of complex systems and applications. And candidly, we need to recognize some complicity in making sure all parties understand the real risk to our nation. If it makes you feel better (which it shouldn’t), most other countries are in similar or even worse situations than the U.S. What we’ve seen in the last year are early indications of a much larger storm of compromises on the horizon. I was personally impacted by the Colonial Pipeline event, vacationing in North Carolina with the inability to get gas to return to Virginia. Being only a full tank away from home yet doubting I would find the simple commodity of gas vividly reminded me of just how fragile our infrastructure is today. If you’re a pipeline provider, what should you do, even if you haven’t yet been notified? Μake sure you have a plan in place for hitting the initial directives requirements and start setting expectations that the timeline may be accelerated for small and large providers. Even before reading the first or second directive, make sure you follow general best practices for critical OT environments, including: Segment your OT from corporate infrastructure. Even with extreme financial considerations, tools and systems must be completely separated including identity, network management systems, and cybersecurity systems and management. Protect the connections where corporate or access cross into OT (which should rarely occur) with the utmost diligence (i.e., multi-factor authentication, post-level blocking, limited access, minimal service accounts, etc.). Make sure you have high-fidelity monitoring with a program that provides continuous improvements. Properly manage your password policy and enforce it with technology guardrails. Know that bad things happen to good people and companies so always have and practice your incident response plan. The belief that our nation’s critical infrastructure extends beyond the reach of sophisticated cyberattacks is a significant underestimation of our enemies. The Colonial Pipeline incident clearly demonstrated the impact of threats posed by increasingly sophisticated and resourceful hackers. It also affirmed the importance of accelerating the security maturity of our critical infrastructure, with the help of trusted cybersecurity partners. If pipeline providers take on these cyber challenges today, the nation may look forward to a future where the critical infrastructure is better protected from attack. For a broader perspective, learn more about key factors contributing to cyberattacks and more recommendations in our blogs: 3 Factors Contributing to Cyberattacks and Recommendations to Protect Your Organization , Critical Infrastructure (CI) Cybersecurity: Is CMMC the Answer? Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

President Biden's memo emphasizes federal cybersecurity regulations to urge companies to take action against ransomware threats. Learn more.|President Biden's memo emphasizes federal cybersecurity regulations to urge companies to take action against ransomware threats. Learn more. President Biden’s Cybersecurity Memo — What You Need To Know Pondurance June 4, 2021 Facebook X (Twitter) LinkedIn Copy link President Joe Biden sent out a memo building on the Cybersecurity Executive Order. As stated in the memo, the number and size of ransomware incidents have significantly increased. Security of both private and public sector infrastructure remains a top priority. Under Biden’s leadership, the Federal Government will be working with partners around the globe to disrupt and deter ransomware threat actors by “disrupting ransomware networks, working with international partners to hold countries that harbor ransomware actors accountable, developing cohesive and consistent policies towards ransom payments and enabling rapid tracing and interdiction of virtual currency proceeds,” according to Biden’s memo. As highlighted, even within the private sector, no organization large or small is safe from these nefarious attacks. This means the private sector has a critical role to play in protecting itself and consumers against ransomware threats. Biden’s memo is urging companies to view ransomware as a threat to their core business operations rather than just as a risk of data theft. The keys to understanding the risks involved in cybercrime are ensuring there is a comprehensive cybersecurity strategy in place to detect and mitigate threats as they occur and having a contingency plan in place to respond to cyber incidents. Key stakeholders within an organization should discuss the increasingly common risk of ransomware and other threats and evaluate their current corporate security posture against these recommendations. Implement the five best practices from President Biden’s Executive Order: Multi-factor authentication (MFA) — We recommend using MFA and prioritizing the use of an application (like Google Authenticator or Microsoft Authenticator) before SMS (text message). Along with other controls, our NIST/Cybersecurity Framework assessment can help organizations identify missing or partially implemented controls and prioritize improvements. Endpoint detection and response (EDR) — Our Managed Detection and Response (MDR) service provides endpoint detection, response, and threat hunting across all endpoints, as well as strong next-generation threat prevention that outperforms traditional antivirus. Encryption — We recommend using encryption to secure digital assets in transit and at rest. Encryption can protect sensitive information by using algorithms to scramble or code sensitive information, making it readable only with a decryption key. Our Application and System Architecture Reviews have helped many customers identify gaps such as missing encryption. Employment of a skilled security team — While a good recommendation, this remains challenging for most organizations. Through our MDR service , our security operations center (SOC) acts as an extension of your internal team, monitoring and hunting for threats 24/7 and combining artificial intelligence with our expert analysts. The sharing and incorporation of threat information in your defense — Through our MDR and Incident Response (IR) services , our analysts apply their expertise to analyze a client’s environment and uncover previously unknown threats. Threat intelligence is collected from these investigations and combined with our network of sensors and intelligence from public and private sector partnerships. Our clients receive the benefit of threat intel sharing through our fully managed services and threat briefing. Backup your data, system images, and configurations. Test them regularly and keep the backups offline. As a best practice, store all backups off-site, away from your existing infrastructure. All backups should always be encrypted to protect your data from theft and other forms of extortion in the event attackers gain unauthorized access to your network. Pondurance is able to assist with Business Continuity Planning and Review along with Incident Response Planning . Update and patch systems promptly. Many organizations struggle to keep up with the latest vulnerability and lack a sense of what to patch first. Our Vulnerability Management Program provides guided recommendations tailored to patch and remediate cybersecurity risks across applications and infrastructure. Test your incident response plan. Our Red Teaming and Security Incident Response Planning services ensure that our clients are prepared in the event of an incident. They accelerate the time it takes to investigate and contain an incident, determine exposure through forensic analysis, and restore operations. Check your security team’s work. Use a pen tester. Our Penetration Testers and Red Teamers perform focused testing to exploit vulnerabilities and penetrate systems to mirror the behavior of a real-world attacker, providing you with guided recommendations on how to harden these gaps. Segment your networks. Our Application and System Architecture Reviews help customers understand the gaps in their network design and segmentation strategy, keeping corporate business functions and other operations separated. At the same time, we know that organizations must maintain 360-degree visibility across all connected devices. Our MDR service eliminates blind spots along with actively monitoring these assets on a 24/7 basis. This includes monitoring protected or quarantined segments for anomalous and malicious IP traffic patterns. Ransomware has disrupted numerous organizations, especially amid the COVID-19 pandemic. Healthcare is especially vulnerable to ransomware, and we will continue to see an uptick in attacks in this industry. Hospital networks and medical devices that require an internet connection to improve and monitor patient care are particularly vulnerable to downtime caused by ransomware. The financial impact of ransomware attacks is multifaceted. The rising costs of these attacks include business disruption, revenue loss, exposure of protected health information (PHI), fines and HIPAA violations, and ransomware negotiations. Pondurance offers a comprehensive suite of cybersecurity solutions that can provide your organization with pre-incident, incident, and post-incident strategies that can elevate your cybersecurity maturity model to protect you from today and tomorrow’s cyber threats. Recognized by Gartner, Pondurance provides 24/7 U.S.-based Security Operations Center (SOC) services powered by analysts, threat hunters, and incident responders who utilize our advanced cloud-native platform to provide organizations with continuous cyber risk reduction. Learn more about our MDR services in our guide: 5 Things to Consider When Choosing an MDR Provider . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

In this blog, you’ll learn more about the cyber application process, artificial intelligence (AI), state laws and regulations, and acts of war. Read now. Hot Topics in Cyber Insurance Pondurance September 20, 2023 Facebook X (Twitter) LinkedIn Copy link Cyber insurance has been available as an add-on or standalone business policy since the early 2000s. Organizations have been able to buy high-quality cyber insurance at a reasonable cost to offset the risks that businesses have faced as they’ve gone through digital transformations the past decade and in parallel have faced with the rapid growth of cyber threat actors. Depending on the policy, covered risks can include a forensic investigation, litigation expenses, regulatory defense expenses and penalties, data recovery, data breach notification to customers, system and network repair, and much more. In 2020 and 2021, cyberattacks, particularly ransomware attacks, increased significantly in frequency and cost. As much as 66% of all organizations reported that they were hit by ransomware in 2021, and the average ransom payment was $812,360, according to Sophos’ The State of Ransomware 2022 . As a result, cyber insurance policies increased in cost in 2022, and insurers began imposing stricter requirements to qualify for a policy. Today, the cyber insurance market is a $16.66 billion industry that is growing by leaps and bounds. By 2030, the market is expected to expand to more than $84 billion. Doug Howard, CEO of Pondurance, speaks to audiences at conferences and webinars, fielding questions about the changes that continue to alter the threat landscape and impact the cyber insurance industry. He knows firsthand that technology leaders at organizations are eager to learn the latest information about cybersecurity. Currently, the hot topics of interest include the cyber application process, artificial intelligence (AI), state laws and regulations, and acts of war, to name a few. Cyber Application Process Most organizations seek out cyber insurance to protect their businesses against threats, but the hurdles for getting cyber insurance have been raised. For instance, last year, insurers required organizations to have multifactor authentication (MFA), better patch management programs, and better endpoint protection to qualify for cyber insurance. Today, insurers need to know not only that an organization has these technologies but, more importantly, that the technologies have been implemented and operationalized. There’s a long list of items that most insurers require for a cyber insurance policy, including now managed detection and response , and it’s important to implement these requirements prior to the application process. “Executives and boards want to know what variables impact their ability to get cyber insurance,” said Doug. “It’s common to get questions since people want to obtain cyber insurance or they already have cyber insurance and want to know what hurdles they will have with their renewals. The last thing any executive wants is to be denied cyber insurance and need to explain this to their investors and board.” AI The global AI market totaled $428 billion in 2022 and is expected to surge to more than $2 trillion by 2030, according to Fortune Business Insights . Decision-makers may believe that they can execute AI for their networks to solve all of their cybersecurity problems, but that’s not the reality. Human attackers must be confronted by human defenders, making people the most important component of any comprehensive cybersecurity program. The hot topics in AI right now involve attribution, said Doug. Who performed the attack? Was it a machine? Was it a group? Also, organizations want to better understand how to keep their sensitive personal information from becoming part of the AI database, which could trigger regulatory privacy violations and a cyber insurance claim. AI is evolving rapidly and will benefit the defender, but it will also benefit the attacker who has less rules to live by, if any. State Laws and Regulations Increasingly, states are passing cybersecurity legislation and regulations to combat the rise in cyberattacks and encourage organizations to implement better cyber practices. New laws, such as the New York Department of Financial Services Cybersecurity Regulation , are having a positive impact on the security of U.S. companies. However, organizations are finding it difficult to track, understand, and comply with all the regulations that govern their industries. Such regulations can impact an organization’s ability to qualify for cyber insurance, adding even more reason for organizations in every industry to stay up to date on regulatory compliance. Acts of War War, terrorism, and insurrection typically fall under an acts of war exclusion in a traditional insurance policy. However, a cyber insurance claim can involve nation-states making hostile attacks on U.S.-based organizations and holding data and business operations hostage in exchange for a ransom payment. The courts have been busy defining what constitutes an act of war in cybersecurity. “If it’s a declared state-sponsored foreign actor — which it rarely is, by the way — that’s not covered because it’s a state action,” said Doug. “But that’s a pretty dangerous road to go down for an insurance company. The exclusion is also a competitive variable for companies choosing a cyber insurance policy.” Conclusion The threat landscape continues to evolve year after year, and the cyber insurance industry is evolving with it. Over the next few months, Pondurance will discuss each of the above cyber insurance topics in greater detail, as well as introduce other important cybersecurity issues as they emerge. For our most recent blog on cyber insurance, check out Applying for Cyber Insurance: How to Get Accepted. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Enhance Your Defense Against BEC Attacks. Discover advanced strategies designed to combat Business Email Compromise (BEC) attacks effectively. This resource goes beyond mere awareness, offering actionable insights and techniques to protect your organization from potential threats. Beyond Awareness: Advanced Strategies to Stop BEC Attacks in Their Tracks Max Henderson, Dustin Hutchison Ph.D. December 11, 2024 Facebook X (Twitter) LinkedIn Copy link Business email compromise (BEC) attacks typically involve a threat actor gaining access to a legitimate email account through phishing and using it to manipulate internal communications, such as deceiving employees into transferring money or sharing sensitive data. This past week, along with colleagues Kamran Salour and Ryan Cook from Lewis Brisbois, we presented a webinar discussing how organizations can reduce risks and mitigate damages from these insidious types of cyber threats. The frequency of such attacks has increased in recent years. In 2023, the FBI’s Internet Crime Complaint Center received 21,489 BEC complaints with $2.9 billion in adjusted losses. Additionally, the IBM Cost of Data Breach Report 2024 found that 10% of BEC attacks also resulted in the breach of personally identifiable information (PII) by the compromised organization requiring notification of regulatory authorities and affected individuals under applicable U.S. federal and state data breach laws. Pondurance also has witnessed a rise in BEC activity. In 2024, approximately 40% of all new digital forensics and incident response (DFIR) cases seen by the Pondurance team involved BEC. Our team found that two primary factors contributed to the substantial number of BEC attacks: multifactor authentication (MFA) bypass and the lack of optimization of cybersecurity products and services. Chart courtesy Security Week , March 7, 2024. In this article, we will delve into each of these factors, looking at how to use various cybersecurity tools and techniques to detect and mitigate BEC attacks in their early stages and suggesting best practices to prevent an attack. MFA bypass For the past few years, experts have stressed the importance of organizations having MFA enabled on all networks — even touting MFA as a “cure all” for many use cases. So when the Pondurance team tells organizations that 92% of all BECs they see involve instances where MFA is already fully enabled, the organizations are surprised and want to know how threat actors can get past MFA. Threat actors are constantly evolving their skills and searching for new ways to gain access to valuable data for financial gain. In 97% of all BEC cases seen by the Pondurance team, threat actors use readily available phishing kits . With phishing kits, threat actors can create fake websites where users believe they are signing in to, for instance, a Microsoft login page, though they’re not. The page prompts the user for a code, and when the user enters the code, it forwards it to the actual Microsoft login page. At that point, the threat actors have the user’s username, password, and session token. With that session token, the threat actors can log in again for a set period of time without having to submit MFA credentials again. They have successfully bypassed MFA. This scenario vividly illustrates the critical need for comprehensive security training for all users with access to an organization's applications, especially those stored in the cloud. Even with robust technologies like MFA in place, the human factor remains one of the most vulnerable points in any security strategy. By educating employees on recognizing phishing attempts, safe browsing habits, and the importance of verifying the authenticity of login requests, organizations can significantly reduce the risk of unauthorized access. A well-informed workforce is an essential line of defense against increasingly sophisticated cyber threats, fostering a culture of cybersecurity awareness that protects both the organization and its valuable data. Optimization IT and security teams purchase cybersecurity products and services with the best intentions to keep threat actors out of their networks and away from their users. However, despite their best intentions, frequently tools such as endpoint detection and response (EDR) software, aren’t carefully and precisely configured to minimize a threat actor’s ability to circumvent their detection capabilities . fully optimize the configurations of those tools. Conditional access controls must be properly configured at an optimal level, and alerts must be set up, carefully monitored, and fine-tuned periodically to catch real threats while minimizing false positives. There’s also a recent movement in cybersecurity toward requiring a higher-level (E3 or E5) license for many products, such as Microsoft O365. But many users with these higher-level licenses are not properly configuring the products to work for them. They don’t optimize to the full capacity and don’t realize that some of the security features have been moved to a higher-level license. In addition, given challenges in attracting and retaining highly qualified cybersecurity talent in today’s market, organizations would often benefit from tapping outside experts and managed detection and response (MDR) services in order to get optimal expertise focused on setup and configuration of key cybersecurity products. Early detection The earlier an in-house team or service provider can identify suspicious cyber activity in the network, the better. At Pondurance, our MDR and always-on security operations center (SOC) team, have extensive experience in catching BECs in the early stages of attacks in a couple of different ways. First, it’s physically impossible for a user to be in two places at once, so we monitor for multiple logins happening simultaneously from both the network sensor and the Microsoft login. When the team sees this scenario, it’s a telltale sign that something bad is happening. Second, our MDR leverages advanced machine learning and uses SOAR— security orchestration, automation, and response — technology to assist our analysts understanding and automate the escalation of threats to ensure a faster response time. After all, when an organization is confronted with a malicious threat actor, every minute counts. Best practices Our team at Pondurance has compiled a list of best practices that organizations can implement to reduce the likelihood of a BEC attack. As mentioned earlier, phishing awareness training ranks as a top recommendation. Every organization has vulnerabilities from a human risk standpoint, so it’s necessary to keep every employee in the know about how to avoid BEC attacks due to phishing emails. It also helps your organization in demonstrating intent and compliance with various regulations in areas of cybersecurity, data privacy and breach notification. Following training, organizations need to identify which employees are at the highest risk of clicking on a malicious link in an email. For these “phish-prone” users, Pondurance suggests more frequent training and testing and, if that’s not enough, recommends restricting access and permissions to the bare minimum required for the job. Conclusion It’s important for organizations to protect themselves from BEC attacks on many different fronts. In addition to phishing awareness and training, these suggest several additional best practices, such as using endpoint protection, principle of least privilege, and continuous monitoring, to reduce the likelihood of an attack. BEC attacks are on the rise, and organizations need to know why these attacks happen and how to safeguard their valuable data. Check out the complete list of Pondurance’s best practices to protect your organization against a BEC attack . Authors: Max Henderson: Max Henderson is the Assistant Vice President of Digital Forensics and Incident Response at Pondurance. Max’s 10-year tenure at Pondurance has included casework featured on CBS’ 60 Minutes , while he also serves as a recurring speaker on cybersecurity at Yale University and as an expert contributor on cybersecurity to CNN. Max has earned advisory board status at SANS Institute for his exemplary scores on the GIAC Reverse Engineering Malware certification. Like many in DFIR, Max started and rose through the ranks from the Pondurance SOC and was the founding member of Pondurance’s DFIR practice. Max has contributed to various federal investigations and indictments related to cybercrime, which resulted from several hundred forensics investigations related to ransomware, BEC, nation-state-funded attacks, zero-day vulnerabilities, insider threats, and exert witness testimony for cases at trial. Dustin Hutchison: Dustin Hutchison is the Vice President of Services and Chief Information Security Officer at Pondurance. Dustin has over 20 years of experience in information security, risk management, and regulatory compliance. Prior to joining Pondurance, Dustin was a risk and compliance professional focusing on HIPAA, Payment Card Industry Data Security Standard, and risk assessments for new technology acquisitions ranging from infrastructure solutions to patient care devices. Dustin is also currently an adjunct professor at Ivy Tech Community College, Sullivan University, Embry-Riddle Aeronautical University, and University of the Cumberlands, teaching undergraduate through doctoral level technology and cybersecurity courses. Dustin’s Ph.D. dissertation topic focused on the adoption of cloud computing in healthcare. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Cyberattacks are increasing in scale and size, making organizations question how to defend themselves. Learn how to protect your business with advice from Pondurance experts.|Cyberattacks are increasing in scale and size, making organizations question how to defend themselves. Learn how to protect your business with advice from Pondurance experts. Batting a Thousand: Pondurance MDR Services Hit a Home Run Pondurance November 16, 2021 Facebook X (Twitter) LinkedIn Copy link It’s the beginning of the season and you’re looking at a long roster of players—some in the major leagues, some in the minors—trying to pick the winners who will comprise your dream team. Only instead of a baseball lineup, you’re trying to pick the winning Managed Detection and Response (MDR) services provider, and the choices are overwhelming. Research and advisory firm, Gartner, says, “MDR services are available from a range of providers (well above 100 providers as of this research).” If you’re a small- to mid-sized (SMB) organization looking to partner with an MDR services provider, where do you start? How do you draft a “star player” from such a large list of potential MDR offerings to find the right fit for your organization? With its list of Representative Vendors, we believe the latest MDR research report from Gartner can be a great starting point. Called the Gartner® Market Guide for Managed Detection and Response Services* , this report defines and describes the MDR market and the specific services that providers can be delivering to meet the unique needs of the buying organization. Pondurance rounds all of the bases, and we believe we meet all of the attributes that Gartner ascribes to MDR services and successful service providers (and more). A look “into the dugout” at our 24/7/365 remotely-delivered modern security operations center (SOC) will reveal: An open, managed technology stack that provides best-in-class detection and response across network, endpoint, log and cloud infrastructure. A fully staffed, US-based team of security analysts and experts that interacts with you daily—either directly or online through a cloud-based service portal—and who significantly enhance your overall security knowledge and capabilities. Proven processes for detection and response that are customized to your security goals and requirements. Robust remote response capabilities, including the ability to provide closed-loop Incident Response (IR), where we partner closely with you to respond to threats through instant triage and integrated IR services. While we use proprietary artificial intelligence (AI) and machine learning (ML) technologies in our SOC, humans and human intelligence are critical when it comes to identifying real threats. The elite and well-trained security analysts, threat hunters and incident responders that are unique to Pondurance have often been the difference between swift containment and business impact. Gartner states, “Other elements of MDR are emerging in the market, but are not yet commonplace.” We believe Pondurance delivers capabilities like these, including: Providing Digital Forensics and Incident Response (DFIR). Our experienced team of Incident Responders, Incident Handlers, and Forensic and Malware Specialists work to guide you every step of the way to identify, contain, eradicate and recover from a breach. The ability to monitor and detect threats across a diverse range of telemetry sources including networks, logs, endpoints and cloud environments—AWS, GCP and Azure—as well as SaaS applications. Offering a Vulnerability Management Program (VMP) and other validation capabilities. A key component of the Pondurance MDR solution, our VMP combines periodic vulnerability scanning with penetration testing. We continually identify, categorize and prioritize vulnerabilities, and provide actionable insights to mitigate potential threats. Providing your team with the ability to upload malware samples for us to analyze, as well as access to “raw” log data in case you want to hunt alongside us. Enabling your team to have two-way conversations through the Pondurance Scope dashboard, providing you with an immediate and easy method to converse directly with our SOC team. Most providers only provide access via tickets. We believe our risk-based strategy and approach to cybersecurity with our vCISO services and MyCyberScorecard , through our acquisition of Bearing Security, also sets us apart from other MDR providers. Pondurance is specifically focused on addressing the cybersecurity needs of underserved SMB organizations. If you have limited investments in security technologies or lack the staff and skills to support a 24/7/365 SOC, we can provide comprehensive threat defense through our MDR services. If you’ve already made significant security investments in tools and people, we can partner with you to complement your current security operations. Threat containment and mitigation: Providing our clients with an all-star defense to stop the opponent from scoring runs We believe that the Gartner report reinforces the importance of another key service provided by Pondurance: Rapid, proactive response to detected threats. By combining automation and human expertise, we’re able to very quickly identify a threat and take action to mitigate even the most sophisticated cyberattacks. An example of our ability to act quickly on a threat came recently with a manufacturing client . An employee at our client accidentally visited a fraudulent site and was served a malicious download for a fake Chrome update. The download created a remote backdoor for the attacker, who leveraged toolsets to dump credentials and attempted to move laterally within the environment. Our 24/7/365 SOC team detected the initial access and took immediate action, reporting the malicious activity to the client’s security team and isolating the compromised endpoint before the attacker could take further action. Get a jump on the ‘22 draft: Stack your lineup today You may have seen this quote from Gartner before: “By 2025, 50% of organizations will be using MDR services for threat monitoring, detection and response functions that offer threat containment and mitigation capabilities.” Why wait to add your organization to the ranks of those using MDR services? The time is now—not 2024 or 2025—to begin putting MDR to work protecting your organization. Small to mid-sized businesses have oversized targets on their backs, often because they just don’t have the staff or budget to invest in cybersecurity the way large enterprises do. Bad actors never take a break, so organizations without the proper security controls in place are on borrowed time. Pondurance can help you stack your lineup by providing you with affordable enterprise-class MDR and DFIR services, staffed by a team of some of the best threat hunters in the world. If you use the Gartner Market Guide for Managed Detection and Response Services to evaluate MDR providers, we believe you’ll find that Pondurance hits a home run, offering all of the key capabilities organizations need to detect, respond, contain and mitigate threats. Request a demo to learn more and be sure to download a complimentary copy of the report . *Gartner, Market Guide for Managed Detection and Response Services, by Pete Shoard, Craig Lawson, Mitchell Schneider, John Collins, Mark Wah, Andrew Davies, 25 October 2021. *** Gartner Market Guide for Managed Detection and Response Services, Pete Shoard, Craig Lawson, Mitchell Schneider, John Collins, Mark Wah, Andrew Davies, 25 October 2021. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Gartner is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Pondurance is proud to be a finalist in three categories of the 2025 Cyber Insurance Awards, showcasing our team's dedication to exceptional cybersecurity solutions. Celebrating Our Team's Achievement as Finalists in the Cyber Insurance Awards USA 2025 Pondurance February 20, 2025 Facebook X (Twitter) LinkedIn Copy link At Pondurance, our commitment to empowering our customers to eliminate data breach risks is at the forefront of everything we do. We are honored by the trust they place in us, and it is this focus that has driven us to be recognized as finalists in the prestigious Intelligent Insurer's Cyber Insurance Awards USA 2025. We are proud to share that we have been nominated in not one, but three categories: Cyber Security Solution Provider of the Year Cyber Insurance Incident Response Provider of the Year Cyber Security Consulting Services Provider of the Year A Testament to Our Team's Hard Work This significant recognition underscores the hard work and commitment of our exceptional team. Each member plays a crucial role in providing top-notch cybersecurity solutions, consulting services, and effective incident response strategies. Their talents and determination exemplify our mission to protect and empower our customers in eliminating breach risks. Commitment to Cybersecurity Excellence Being selected as finalists in these categories affirms our team's ability to tackle complex cybersecurity challenges head-on. We have cultivated a culture of collaboration and continuous learning, ensuring that our experts stay ahead of the curve with the latest security trends and technologies. This commitment not only benefits our customers but also strengthens our internal dynamics, making Pondurance a leading force in the cybersecurity industry. Celebrating Team Achievements While we are proud of this recognition, it is the accomplishments of our individual team members that truly make us exceptional. From our incident response specialists who work tirelessly to neutralize threats, to our consulting professionals who provide invaluable guidance to customers, the depth of talent within Pondurance is remarkable. Each department works cohesively, and the synergy we create through teamwork allows us to deliver innovative solutions that are effective and tailored to meet our customers' unique needs. This award nomination is a celebration of all the late nights, brainstorming sessions, and steadfast dedication that our team has invested in their work. Looking Ahead: Continuing the Journey As we celebrate this achievement, our focus remains on the future. The cyber landscape is continually shifting, presenting new challenges that require our unwavering commitment to quality and innovation. Being recognized as finalists in these awards is not just an accolade; it is motivation for us to enhance our services and bolster our capabilities to serve our customers better. We are incredibly grateful to our customers and partners who trust Pondurance with their cybersecurity needs. Your support drives us to achieve greater heights, and we are committed to delivering the highest level of service in response to your feedback and needs. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Pondurance experts share the latest cybersecurity insights on web compromises, critical vulnerabilities, social engineering scams, GentleKiller ransomware, and EDR threats. August Cyber Threat Download™ Pondurance August 17, 2026 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. DFIR insights The digital forensics and incident response (DFIR) team is seeing an increase in compromises on multiple sites that use WordPress, Joomla, and ColdFusion. The team discussed two specific cases. In the first case, a client had not updated Joomla since 2021, and 14 webshells — pieces of code that allow a threat actor to access the backend of a website without having to log in to the actual infrastructure — were present. Some webshells dated back as far as 2019, and six webshells appeared this year following a June 5 announcement that an improper access control vulnerability in Joomla's JCE editor extension allows for the creation of new editor profiles for unauthenticated users, resulting in PHP code being uploaded and executed. A proof-of-concept code was posted on GitHub on June 8, and the Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on June 10. The team saw one threat actor compromise the system six different times using six different webshells. Ultimately, the threat actor changed the administrator password and redirected the site. In the second case, a client website had 10 vulnerable WordPress plug-ins that required updates. However, for unknown reasons, the third-party vendor had not made those updates. On June 9, administrator-level users were created on a WordPress site via authentication bypass. Then, on June 10, an unauthenticated bypass vulnerability in UpdraftPlus was announced, but the client was already compromised. On June 21, one of the new administrator accounts added a ClickFix captcha to the site, and on June 22, when internal users logged in to the website, they executed the ClickFix captcha. As a result, several computers were compromised, and the threat actor attempted to execute ransomware. The team recommends that clients using third-party hosts for their websites review their contracts to ensure that plug-ins are receiving prompt updates. Notable vulnerabilities As many as 8,002 newly disclosed vulnerabilities were reported in July — by far, the highest number of vulnerabilities ever reported. Of those 8,002 vulnerabilities, there was known exploitation of 59 of them, which included 36 impacted vendors. More than 40% of these 59 exploits were remote code execution vulnerabilities. Online proof-of-concept codes were made available for 53 of the vulnerabilities, which is a whopping 90% of them, increasing the likelihood that threat actors will exploit the products. The dramatic increase in proof-of-concept codes stems from an increased use of artificial intelligence (AI). Researchers are using AI to assist in finding new vulnerabilities and help them write the proof-of-concept codes that explain how to exploit the vulnerabilities. The team spotlighted the many vulnerabilities that impacted Google Chrome in July. On July 1, Google announced updates to address 382 vulnerabilities that impacted the Google Chrome browser. Fifteen of the vulnerabilities were ranked as critical severity and 67 were ranked as high severity, but there were no known exploitations. The team showed the enhanced vulnerability management program (eVMP) data that they use to track vulnerabilities, which included the ones for Google Chrome. The eVMP data shows real-time information so that the team can see patching activity, new vulnerabilities as they occur, and how clients are reacting to the vulnerabilities. Typically, the team sees spikes in data when the Microsoft Patch Tuesday vulnerabilities are reported, but this instance was the first time the team had seen such a large spike for non-Microsoft product vulnerabilities. At the time of the spike, the team sent a notice to eVMP clients to explain what was happening, why it was present in their data, and how to address it. During Microsoft Patch Tuesday in June, 206 reported vulnerabilities were disclosed, including 37 critical vulnerabilities and three zero days. The zero days included privilege elevation, security feature bypass and denial-of-service vulnerabilities. Then, during the Microsoft Patch Tuesday in July, as many as 622 reported vulnerabilities were addressed — a record number that was three times the number reported in June. Of those 622 reported vulnerabilities, there were 62 critical vulnerabilities and two zero days, both of which were privilege escalation vulnerabilities. SOC insights Threat actors are clever at convincing users that they are a trusted source available to help with computer issues. The security operations center (SOC) team has recently seen an uptick in such social engineering scams, particularly impersonation attacks using Microsoft Teams . The team discussed the basic steps of a social engineering attack, offered red flags for identifying an attack, and recommended actions to take. Email bombing . To start a social engineering attack, threat actors flood a user's inbox with unwanted emails, such as marketing subscriptions or sales pitches. When unusual emails appear in a short time frame, the user should calmly assess the situation and report it directly to the IT or security team. Fake IT support. Threat actors impersonate internal help desk agents using spoofed corporate aliases to address fake security updates, technical issues, or urgent support requests. If someone claiming to be a support person with the IT department makes initial contact, the user should verify the situation with the known help desk. Remote access request. Threat actors request remote access to the user's computer using desktop tools such as Quick Assist and AnyDesk. If the support person instructs the user to ignore warnings and download software from an unfamiliar link, the user should not do it. Users should never share credentials or grant remote access during an unsolicited interaction. Device compromise. Once the threat actor has the user's credentials or has been granted remote access, the device has been compromised. If the support person asks the user to approve security prompts, disclose credentials, or provide a multifactor authentication (MFA) code, the user should report the incident to the security team. Attacker activity. After a compromise, the user may experience activity such as the opening of unexpected command windows, sensitive file access, or loading of unusual software on the device. The user should safely disconnect the device to minimize the amount of exfiltration, and the IT or security team should immediately reset the credentials. Users can be tricked by social engineering scams, but organizations can proactively implement measures to protect users against attacks. The team recommends that all organizations use hardening and allowlists to restrict external access to Teams. Also, organizations should implement training to teach users to recognize external chat warnings and suspicious IT support requests and learn the process for how the internal help desk verifies its identity to users. If an organization does not have a process in place, the team recommends establishing one. GentleKiller activity The detection engineering team discussed how threat actors are using multiple techniques to terminate and disable endpoint detection and response (EDR) and antivirus (AV) products. Of particular interest, the team discussed how The Gentlemen, a financially motivated threat actor group, manages the ransomware-as-a-service platform known as GentleKiller , and the group's affiliates carry out the attacks. The attacks consistently begin at the internet-exposed edge infrastructure. The group targets Fortinet FortiGate and Cisco devices using credential brute-force attacks, exploitation of known vulnerabilities, and access purchased from initial-access brokers. The group actively tracks a few newly disclosed vulnerabilities, then pivots specifically to CVE-2025-7771 . EDRs operate in user mode and kernel mode , but the Windows kernel, which is Ring 0, has the highest level of privilege. The attack method uses bring your own vulnerable driver (BYOVD), which abuses a legitimately signed yet vulnerable kernel driver to execute the attacker-controlled code in Ring 0. EDRs are not able to defend against malicious code executing in Ring 0, making BYOVD an effective attack technique. Once in Ring 0, the attacker can bypass operating system protections, manipulate kernel memory, and disable or terminate the EDR and AV drivers and protected processes before executing ransomware. Organizations can check to see if BYOVD policies are enabled by running PowerShell. If the result is 1, the policies are enabled. If the result is 0, the policies are not enabled. The team discussed several ways organizations can harden against GentleKiller attacks including patching edge devices, using allowlists for administration, implementing internal network segmentation, using the best authentication possible on internet-reachable remote desktop protocols and remote workstations, not allowing users to be local administrators, using phishing-resistant MFA , and backing up and testing data. About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our SOC, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Understanding the process for CMMC and knowing what to expect from the process can minimize confusion. Learn how to overcome the certification challenges in this blog.|Understanding the process for CMMC and knowing what to expect from the process can minimize confusion. Learn how to overcome the certification challenges in this blog. Overcome the Certification Challenges for CMMC Pondurance November 2, 2021 Facebook X (Twitter) LinkedIn Copy link Suppliers within the defense industrial base, including contractors and subcontractors, now must undergo assessments to prove that they can sufficiently perform cybersecurity capabilities as specified in the Cybersecurity Maturity Model Certification (CMMC) from the Department of Defense (DoD) when pursuing certain types of business. Many suppliers are concerned about the changes in their businesses and operational practices that could occur as a result of these new requirements. Specifically, small and midsize suppliers worry that the CMMC requirements are too burdensome on their budgets and personnel, and one of the most consistent issues for suppliers is confusion about what and how much needs to be done to attain certification. CMMC requires that suppliers meet the security maturity level requirement for the projects they wish to bid on. Pondurance believes suppliers should evaluate their own readiness and ability to pass an assessment by working with a registered provider organization (RPO) to identify any gaps and make adjustments before the organization undergoes its final audit. Finally, they must pass an assessment conducted by an authorized third-party assessment organization (C3PAO) to achieve certification, a process they will need to undergo every three years. While the process for certification can be difficult, it can be made more manageable for suppliers when they know what to expect. There are many challenges that suppliers face as they prepare for CMMC , including mapping the government information on their networks, understanding the controls required, knowing how to perform the testing needed, and figuring out the workloads and costs involved. Fully Mapping the CUI The DoD implemented CMMC to protect sensitive government information or data, known as controlled unclassified information (CUI), throughout the supply chain. Contractors and subcontractors alike must understand what CUI is and all of its relevant forms. CMMC requires that suppliers track and understand where the CUI resides on their networks. Suppliers must gain a complete understanding of what CUI they have and which systems it touches to ensure proper scope, without blindly adding CMMC controls where they are not needed. Also, suppliers need to map life cycle data flows to ensure accuracy and completeness. Understanding the Controls CMMC can require satisfying hundreds of security practices for compliance, depending on which maturity level is desired. As maturity levels increase, the number of security practices increases, resulting in proving performance over a larger set of controls. Maturity level 1 requires 17 security practices, level two requires 72 security practices, and level three requires 130 security practices. Suppliers should take the time to understand the full scope of the practices and ensure they are able to produce acceptable evidence and artifacts to prove that they have met each of them. Deploying, Testing, Remediating, and Validating There is no participation award for the CMMC. A supplier either meets the requirements for certification or it doesn’t. Preparation and readiness are key to ensuring that a supplier is ready for a final assessment. A supplier may assess its own readiness for the assessment , but many suppliers will choose to work with an RPO for advice, consultation, and recommendations to help them identify and close gaps. RPOs are U.S.-owned companies that have passed a background investigation, committed to a code of professional conduct, signed an agreement with the CMMC Accreditation Body, and have at least one authorized registered practitioner on staff at all times. Understanding the Workload and Costs While working through the CMMC requirements, suppliers should be prepared for additional workloads and costs. The new requirements can drive additional needs for new tools, skills, and resources for tasks that have not previously been performed. The costs can involve operational costs, such as tools, personnel, and time to perform the controls in a compliant manner, and administrative costs, such as managing the assessment, working with the C3PAO, managing internal compliance, and understanding the controls, policies, and procedures. Conclusion Yes, the process for CMMC can be difficult, but knowing what to expect can minimize the worries and confusion. Suppliers should face the challenges head-on to experience the reward of certification following the first assessment with a C3PAO. Learn more about CMMC in our panel discussion Successfully Navigating Through CMMC: What You Need To Know. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

To fight hidden cyber threats, you need access to your data, understand what it’s telling you and have the human expertise to act on threats.|To fight hidden cyber threats, you need access to your data, understand what it’s telling you and have the human expertise to act on threats. Stop Hidden Cyber Threats From Sneaking Past Your Defense Pondurance December 9, 2021 Facebook X (Twitter) LinkedIn Copy link Large cyber incidents such as the Darkside ransomware attack and Hafnium’s exploits on Microsoft Exchange, emphasize the importance of recognizing risk before it’s too late. Cybercriminals are intelligent and creative, they seem to come up with new ways to enter an organization’s network daily. To investigate and fight hidden cyber threats, you need access to your data, understand what it’s telling you and have the human expertise to act on any possible threats. In this blog, we use the example of identifying NBA offensive threats to relate to identifying cyber threats. The common denominator? Data and human expertise are required. NBA Offensive Threats Sports analysts use many metrics to identify offensive threats. To find the greatest threat, analysts use the 50-40-90 rule . This rule states that anyone who completed a season shooting field goals at least 50% of the time, 3 pointers at least 40% of the time, and free throws at least 90% of the time, can score from anywhere on the court. This makes them one of the greatest offensive players. Only 9 NBA players and 1 WNBA player have achieved this goal including players like Kyrie Irving, Steve Nash, Stephen Curry, and Kevin Durant. In the 2020-2021 season, 5 players came close to hitting 50-40-90 — Chris Paul, Kawhi Leonard, Tobias Harris, Kevin Durant, and Stephen Curry. Even though they did not hit the 50-40-90 in the 2020-2021 season, they are still a huge offensive threat because of their efficiency. So how does this relate to cybersecurity? Just like these sports analysts, it is important that your company looks at the data and cyber risks that could enter your organization. If the threat is overlooked because you don’t know what data you’re looking at or are overwhelmed with alerts, the threat could slip by. Cost of Cyber Threats The cost of cyber threats continues to rise across all industries and it can be detrimental to any organization. Nearly 89% of companies have experienced a data breach in the past 3 years. The healthcare industry specifically saw a 55% increase in cyberattacks in 2020 alone. These cyberattacks can lead to ransomware costing organizations upwards of $4.4 million per breach. As the number of threats increases and the cost of these threats increases, it is important to have a tough defense ready to take action. Prepare Your Defense The best defense against human attackers is human defenders . Some key tips to identify and stop cyber threats are: Know your assets Prioritize your greatest strengths Maintain full visibility across your IT and cloud environments Hunt for threats 24/7 Defend and adapt your strategy Don’t get caught off guard! Prepare your defense and find a security partner that can assist. Remember, the first step is to identify the true threat. Learn more about how a managed detection and response (MDR) provider can partner with you to find hidden threats in our blog: Batting a Thousand: Pondurance MDR Services Hit a Home Run. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Cyberattacks go up when natural disasters strike. Be prepared.|Cyberattacks go up when natural disasters strike. Be prepared. Operation “Be Prepared”: Cyber Lessons Learned from Disaster Preparedness Drills Pondurance October 26, 2021 Facebook X (Twitter) LinkedIn Copy link In August of this year, Pondurance partnered with the Indiana National Guard, the Indiana Executive Council on Cybersecurity (IECC), the State’s Office of Technology and Department of Homeland Security–among others–to conduct a disaster preparedness drill . This multi-agency effort revolved around an emergency response to an earthquake and included a cybersecurity exercise intended to help the state be well prepared for the cyberattacks that would likely come during an actual disaster. I had an opportunity recently to contribute an article to Government Technology on the need for cyber preparedness during natural disasters, and the importance of having an incident response (IR) plan in order to be prepared for any resulting cyberattacks. *** When natural disasters strike—hurricanes, wildfires, earthquakes, floods—communities are at their most vulnerable. People are alarmed and distracted. Sadly, cybercriminals see the opportunity in the chaos. They take advantage of the confusion to create more havoc by targeting physical infrastructure like electric grids, fuel pipelines and water systems with ransomware attacks. Increasingly, when natural disasters happen, the number of attacks immediately spikes. Indeed, many cyber events are now directly linked to physical events. For example, states like Louisiana and Florida routinely see an exponential rise in cyberattacks following hurricanes. But we aren’t sitting idly by, and the government and businesses are fighting back too. They’re organizing cybersecurity efforts like Operation Homeland Defender, a drill at Muscatatuck Urban Training Center in Indiana, to test preparedness and bolster defenses. The most recent event this summer included the Indiana National Guard, local first responders, Indiana Task Force One and others. I’m proud that our company was also invited to participate. Muscatatuck is the Department of Defense’s largest urban training facility. It is a “real” city that includes a built physical infrastructure, including a water distribution and pump station with multiple active SCADA systems (supervisory control and data acquisition), 3G and 4G meshed network, IoT testing grounds, a hospital and even a U.S. “embassy.” It is an ideal place to run realistic training and testing scenarios in the event of a cyber event and see firsthand how defenses hold up. It’s a wargames facility built for the modern era of cyberattacks blending both physical and cyber into a common realm. The Operation Homeland Defender drill involved a simulated earthquake followed by a cyberattack, with hackers swooping in amid the chaos. Specifically, the bad guys attacked the water system and tried to shut it down as the National Guard deployed its defense tools to protect networks, people and property. During any natural disaster, there will be network outages and various other disruptions. Most will be the result of physical damage. But others may be caused by opportunistic hackers. For instance, if the water system goes down after an earthquake, it’s normal to assume that the outage is due to the quake, not a cyberattack. It is critical that IT and security personnel don’t miss the true cause of the outage amid the “noise” which could obviously lead to an extended outage which would, in the real world, result in hundreds if not thousands of lives lost. In the Operation Homeland Defender drill, it was indeed the bad guys who attacked the water system, in an attempt to sow more chaos and demand a multimillion-dollar ransom to turn the system back on. The exercise was designed to help security personnel differentiate between cyber impacts and physical impacts. The objective was to introduce an unknown variable—i.e., a ransomware attack—and demonstrate how failing to identify that variable can have a prolonged and devastating impact. Imagine, for instance, a major winter storm across the eastern U.S. burying communities under 5 feet of snow. And imagine, at the same time, a cyberattack on the power grid that leaves impacted communities without heat. It’s hard to comprehend the tremendous amount of hardship and even death that this kind of attack would cause. Cybercriminals know this—and they can force communities to pay a very high price to turn the power back on. This is the scenario, and many others, I outlined in Security 2020 when it was published by Wiley in 2010. That’s why it is so important for every state in the nation to hold full-scale disaster drills like Indiana’s Operation Homeland Defender: to test and better prepare their response. The reality is that many of our systems—systems that are fragile to begin with—are even more vulnerable to attack during a natural disaster or other physical event. There is a saying in sports: the best defense is a good offense. On the field of a cyber battle, the reverse is true. State and local governments must better prepare their defense by regularly running disaster drills and simulations that combine threats posed by physical and cyber events. The more they practice, the better their response will be and the fewer surprises they haven’t anticipated. It is no longer good enough to rely on a manual or checklist that nobody ever reviews or tests. No response plan works well unless you’ve picked it up and practiced it. How should you respond to a request for ransom? How and when should you engage your cyber insurance group? How can you quickly mitigate any damage? Ideally, your incident response plan should be reviewed and audited continuously. In addition, key stakeholders should be involved in the planning and execution process of the IR plan to ensure that they are prepared for a cybersecurity incident. Also, assess your security team and determine if your internal security operations center (SOC) has enough analysts to monitor, detect and respond to threats on a 24/7 basis. This can help you determine whether you have enough staff on hand or need to implement a Managed Detection and Response (MDR) service to help fill the gaps, mitigate blind spots in your security posture and provide log activity of your digital landscape. Our nation’s infrastructure systems are increasingly interconnected and linked to computer networks. As cyberattacks continue to evolve, there is a need for heightened vigilance and more effective response procedures. Drills like Indiana’s Operation Homeland Defender should serve as a reminder that we need to do everything in our power to keep pace with cyber threats and stay one step ahead of those who would do us harm. Do you have an incident response plan in place? Learn how to best set up your plan in our eBook: Incident Response Planning . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Retailers must keep cybersecurity a priority when preparing for the holidays. Read about retail cyber threats and how to defend against them. Retailers Prepare for the Holiday Season — and Cybersecurity Threats Pondurance November 23, 2022 Facebook X (Twitter) LinkedIn Copy link The holiday shopping season brings an annual surge in sales and revenue for retailers. With it, comes a threat worse than coal in your stocking: cyberattacks. During the holidays, retailers experience the anxiety of managing a larger volume of transactions, delivering the perfect consumer experience, and ensuring all orders are filled and delivered in a timely manner. In addition, they must also worry about cyber threats. Cybersecurity should be top of mind for retailers year-round, and it’s especially critical during the holidays. In 2021, holiday sales grew 14%, reaching $886.7 billion, while e-commerce fraud attempt rates rose by 19%. Unfortunately, not all retailers have the resources to boost their cyber defenses as the hectic holiday season approaches. But your retail business can take steps to stay safe during the holidays. You need to recognize the common cybersecurity threats for retailers and know how to improve your security posture. Common Retail Threats Retailers have experienced numerous threats in 2022 and should be aware that a cyberattack on retail businesses ranks high on the holiday wish list of cybercriminals. Phishing, malware, SQL injection, and distributed denial-of-service (DDoS) attacks are the most common threats for retail businesses during the holidays. Phishing. Stressed retailers and distracted consumers can fall victim to phishing scams this holiday season. Cybercriminals intentionally capitalize on the holiday chaos to catch their victims off guard, using ploys like fake customer satisfaction surveys and bogus shipping notifications. Retailers and security teams must be prepared to combat an influx of phishing, spear-phishing , and social engineering scams during this time of year. Security awareness training can prepare employees to spot these threats. Malware. Cybercriminals steal valuable payment data from retailers and consumers. One common execution is infecting point-of-sale (POS) devices with malware . If your business is using legacy systems or outdated software, it may be vulnerable to bad actors and known exploits. Like all technology, it’s important to constantly update your POS systems to stay safe. SQL injection. Though unsophisticated, this type of code injection attack against retail businesses can be highly effective during a period of high activity, such as Black Friday or Cyber Monday. Cybercriminals attack a retailer’s website through an unpatched vulnerability to steal consumer payment data during an online purchase or redirect links to a malicious website. That’s why it’s crucial to monitor your data security practices, identify your vulnerabilities, and manage and patch those vulnerabilities with updates to keep attackers from penetrating your network. DDoS attacks. During a holiday sale, a slowdown or complete halt to consumer purchases can be a devastating financial blow for a retail business. But that’s the goal of a DDoS attack . In such an attack, the cybercriminal disrupts the normal flow of traffic on a server or network by overwhelming its capacity with fake internet traffic. As a result, actual consumers are unable to access the retailer’s website or services, forcing the retailer to miss out on sales. In 2022, DDoS attacks increased year over year by 109%, according to the California Business Journal. The average DDoS attack costs between $20,000 and $40,000 for every hour it continues. How To Improve Your Security Posture Retailers need to prepare before the holiday season begins. Taking a few important steps can help keep your retail business merry and bright this holiday season. Patch and update vulnerabilities . Cybercriminals will attempt to exploit any weakness in your network to gain access, but you can help keep them out with timely patches and updates. Increase staff . Human attackers must be confronted by human defenders, so make sure your cybersecurity team is fully staffed to confront potential cyber threats. Offer employee training . Having employees who are aware of and knowledgeable about cybersecurity can help mitigate attempted attacks during the holiday season. Work with a security service provider . Your retail business needs the right cyber defenses in place to protect against an attack, and partnering with a provider service such as managed detection and response (MDR) is a smart way to mitigate risk and manage the high volume of threats. Take Action As a retailer, you count on the holiday season surge in sales and revenue to round out your year. But you must keep in mind that cybercriminals are working against you to undermine your best efforts. Know the cybersecurity threats you may encounter and how to improve your security posture. It may be the difference between coal in your stocking and money in your pocket. Learn how Pondurance MDR can help your retail business defend against a cyberattack during the holiday season. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026