Can iPhones get malware? Learn why traditional antivirus doesn't work on iOS and discover the best ways to protect Apple mobile devices. Cybersecurity 101: Is There Anti-Malware for Apple Phones and Tablets? Michael DeNapoli June 25, 2026 Facebook X (Twitter) LinkedIn Copy link Many readers have asked for opinions on anti-malware tools for iOS and iPadOS (Apple’s operating systems for phones and tablets, respectively). The truth of the matter is that there aren’t any antivirus or anti-malware tools that function on Apple mobile devices in the same way as we’re all used to on Windows, MacOS, or Linux devices. That is not to say that there are no options for defensive controls, they just don’t do the same things as anti-malware tools do on other devices. Let’s dig into this topic. First things first, mobile devices are indeed vulnerable to attack. Both Android and iOS/iPadOS are susceptible to being attacked by threat actors. The attack surface created by mobile devices accessing company resources (like email, file systems, etc.) shouldn’t be discounted in any way. While it is true that Apple mobile devices are much more difficult to directly attack, they’re just as vulnerable to social engineering, exploitation of vulnerabilities, and other forms of attack as Android devices are. Apple devices can also get stuck with malware that slips through Apple’s review process in the App Store - it’s rare, but it has absolutely happened. Outdated iOS or iPadOS software may also contain vulnerabilities that threat actors can leverage to gain access to otherwise locked-off areas of the device. While there are advocates of Apple products who will - even to this day - say that Apple mobile devices don’t have viruses (and that’s true in an extremely strict technical sense), both Apple and Android devices are an attack surface for any organization - so you do need to defend them. What’s different between Android and Apple mobile? Android devices, by default, allow for a user to install software from multiple sources - including just directly downloading an app from any website. Of course this can be changed to prevent unauthorized app installations (see the information about Mobile Device Management below). Android also has somewhat fewer restrictions than Apple mobile devices do when it comes to what permissions and access an app can obtain as the user uses it. Alphabet has done a tremendous amount of work to change that in recent years, so the gap between the two mobile platforms is very quickly closing in that regard. Apple, again by default, only permits installation of apps from the Apple App Store. While organizations can choose to install custom applications, this isn’t something that cannot happen without significant device management and control, as well as the organization setting up infrastructure specifically to support this operation. Apple also utilizes a set of “enclaves” - separations between different operations on the phone or tablet. For example, applications cannot access data from other applications without explicitly asking for permission, and no apps get to access the cryptographic security components of the device directly at all. To be very clear here, both methodologies have both positives and negatives from user experience and security perspectives. One is not objectively “better” than the other - they simply work differently and therefore present different security exposures to an organization. Android makes it much easier to allow organizations to distribute their own applications, while Apple makes it much easier to control and secure the device itself. This also means Android is more susceptible to rogue applications getting installed, and Apple makes it almost impossible to scan for malware like we would on any laptop or desktop. So, how do you protect Apple devices? While anti-malware (in the sense of what we do on desktops and servers) isn’t possible to run on Apple mobile devices, there are absolutely things that an organization can do in order to limit the attack surface of Apple mobile devices being used by employees. The most common are: Restricting access by mobile devices. This is the most straight-forward, but also the most limiting to your users. You can say that organizational resources like email systems and company web applications can only be accessed by managed devices. This includes laptops, desktops, servers, and other resources that are part of an Active Directory, EntraID, or Google Workspace domain; or may be using tools like Virtual Private Networks (VPN’s) combined with settings which only allow a user to connect if they’re on the VPN. Restriction alone isn’t a total security solution, so it must be used with other tools to protect the organization. A rogue application will also be able to communicate over a VPN, so that by itself still leaves gaps. Organizations can also restrict access to web-based applications by requiring the use of a Secure Browser (Island Browser, Prisma Access Browser, etc.). These tools allow the organization to strictly regulate what applications and data the user can access, how they can use it, how it can be shared (or not shared) with mobile apps, etc. Mobile Device Management (MDM). Tools like Microsoft InTune, Jamf, and others allow organizations to control mobile devices. This includes restricting what settings can be changed, when updates happen, what apps can be installed, and many other configuration options. The drawback is that the organization now has total control over the mobile device, which may cause significant friction with users - especially if they’re being asked to give up control of a device that they personally own. Different vendors offer different levels of direct device control, and it is possible to combine MDM with other methods to produce a light-touch approach while still restricting the users’ access to organizational systems. Network controls. Multiple security controls for organizational networks can also be brought to bear for use in mobile security. We touched on VPN’s above, but there are also Secure Service Edge (SSE) and Secure Access Service Edge (SASE) tools like Prisma Access and Zscaler that have mobile clients for Apple (and Android). By setting up SSL decryption, these tools can scan all network traffic moving into or out of the device for known malware, phishing links, attempts to download apps on Android, and a whole host of other things that happen as the device is communicating with the outside world. Some EDR/XDR platforms. While this is really more of tools like CrowdStrike and SentinelOne performing the methods above, if you are using the enterprise versions of many EDR/XDR platforms you can have them provide mobile security as well. Most will provide SSL decrypting VPN connectivity and analyze things like if the device has been modified (“jailbroken”) or if specific permissions have been changed in a way that weakens device security. For the most impact, these tools must be combined with some form of MDM, but can provide a much lighter touch than full device management would require. This means that these solutions can be more palatable to users who have permission to use their personal devices for work purposes. For Android devices, many of these tools can act very closely to how they act on laptops and desktops, but they are more limited on Apple mobile devices due to iOS/iPadOS restrictions. Your organization will most likely use a combination of these tools and techniques to create a security framework that works both to protect the organization and is acceptable to end-users even if they’re using their own personal devices. It is not uncommon, for example, to have an MDM solution install a device profile on an iPhone which simply checks to make sure the device is up to date and has a strong passcode combined with FaceID/TouchID. Access to email is limited to just the official apps from Microsoft (Outlook) and/or Gmail, but those platforms are configured to restrict the apps from downloading organization files onto the mobile device. A Secure Browser allows access to organization web-apps, and restricts downloading any organizational data to the device or sharing it with other apps. This allows users a measure of privacy for their personal devices, but also ensures that a compromised device will be of extremely limited use to a threat actor and will be very easy to cut off from all access once the incursion is discovered. Summing it up Apple mobile devices (iPhones, iPads, etc.) are susceptible to threat activity. While they cannot be impacted by “viruses” in the traditional sense, they most definitely can be leveraged by a threat actor through social engineering, apps that access organizational data in an unapproved way, or just a user or Apple themselves making mistakes. While there are no “anti-malware” tools that work on Apple mobile the way they can work on Android or laptops and other devices, there are options to allow for the safe use of Apple mobile devices. A combination of tools and techniques can be brought to bear to allow users to utilize mobile devices while not exposing the organization to a large attack surface increase at the same time. About the Author: Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

August Cyber Threat Download™ Pondurance August 18, 2025 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. Threat trends Malicious threat actors are continuing to use proven tactics to exploit their victims. Our team noted that the following attack methods are still a primary concern: Ransomware. These attacks top the list of security threats, especially with the risk of attack from threat actor groups like Scattered Spider . Currently, the highest indicator of a ransomware attack is the launch of an application, such as AnyDesk.exe, B2.exe, or Acronis.exe, in rapid succession or in a short time frame. Pondurance has alerting in place for such tactics, techniques, and procedures, and the team suggests blocking Pastebin and other nonbusiness file sharing sites for added protection. Business email compromise (BEC). These threats have a high success rate due to user error, meaning that users mistakenly open malicious emails or attachments or click on links that lead them to credential harvesting sites and adversary-in-the-middle attacks . Many successful attacks result in Office 365 mailbox access where the threat actors create mailbox rules to hide their activity. To combat BEC attacks, the team recommends ongoing user awareness training for all employees. Tabletop exercises , formal and informal, are also recommended to keep organizations safe from cyber threats. Tabletops are simulations of real-world cyber incidents that allow participants to discuss what their roles, actions, and decisions should be during a cybersecurity threat. These exercises test an organization’s incident response plan to identify any gaps in the response processes or overall security plan. A formal tabletop exercise typically walks an organization through an established incident to learn from what happened during the event. An informal tabletop exercise is a casual, role-playing approach and, often times, is a more creative way to walk through incident response scenarios and discuss how different teams or departments would respond to particular hypotheticals. Informal tabletops can include any groups in an organization, and even third parties, and can be used for team-building and training purposes at meetings or conferences. The Pondurance team encourages organizations to “gamify” an informal tabletop exercise to add fun and creativity to the experience. For example, participants can roll dice like a Dungeons and Dragons game or use playing cards like the incident response game Backdoors & Breaches. SharePoint vulnerabilities Microsoft Office SharePoint on-premise exploits started on July 8 with two initial SharePoint vulnerabilities . The first one is an authentication bypass vulnerability that allows an unauthorized threat actor to perform spoofing over a network. This exploit occurs when the threat actors send a crafted HTTP POST request to /_layouts/15/ToolPane.aspx using a spoofed referer header sent to _layouts/SignOut.aspx. The second one is a remote code execution vulnerability that allows authorized threat actors to execute code over a network. This second vulnerability is chained with the first one to achieve remote code execution through a single HTTP POST request. The initial vulnerabilities received patches. Later, two additional vulnerabilities surfaced that were bypasses of the first two patches. The vulnerabilities affected Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server 2016. Microsoft released security updates for the bypass vulnerabilities. The team has seen some instances of the SharePoint vulnerabilities but not much evidence of lateral movement or privilege escalation, so far. To investigate, the team suggests that organizations using SharePoint servers search their Internet Information Services logs for a large number of HTTP POST requests, as that may indicate an exploitation. Also, payloads deployed through this exploit often harvest the machine keys of the server, and once the threat actors have access to the machine keys, they no longer need the vulnerability for bypass authentication. Instead, they can authenticate and continue to run code on that specific server. If the investigation points to an exploit, remediation is important. The team suggests conducting a forensic review of the system to determine if any hands-on-keyboard activity or lateral movement has occurred. If the machine keys were leaked, they must be rotated. As a precaution, the team suggests rotating the machine keys even without evidence of an exploit — and, of course, patching is important. The team expects that these attacks will likely evolve over time as more threat actors access the proof-of-concept code for the vulnerability. In particular, the team expects to see remote access tools, such as backdoors and Cobalt Strike, deployed to the system. Notable vulnerabilities Approximately 4,300 vulnerabilities were disclosed in June, and seven of those disclosed vulnerabilities were actively exploited. Three proof-of-concept codes were released for Qualcomm, Windows, and Naver/Billboard.js. As a monthly trend, the team saw high-profile vulnerabilities that were quickly exploited, especially following the release of a proof-of-concept code. Also on trend, many threat actors now maintain a library of exploits for older vulnerabilities that they use once they gain access to a cyber environment. During Microsoft Patch Tuesday in June, 66 reported vulnerabilities were addressed. Of those 66, nine were critical vulnerabilities, one was a zero-day vulnerability, and multiple patches were released for the affected products. The zero day is a remote code execution vulnerability that focuses on web-distributed authorizing and versioning. The team provided details about an iOS zero-click campaign and a router path traversal vulnerability. iOS zero-click campaign . This attack successfully targeted two European journalists by deploying Paragon Solutions’ Graphic spyware on their iOS devices. Threat actors exploited an iOS security flaw handling of iPod links that were populated in iMessage without user interaction. From there, they established the command-and-control server. Patch updates were released for iOS 18.3.1. Router path traversal vulnerability . This exploit impacts all firmware versions of the D-Link DIR-859 Wi-Fi routers. The attack leverages a malicious POST request to XML that leads to failure to remove the ../, which dumps the credential session IDs and configuration data from the PHP files. A proof-of-concept code was released, but patches will not be released for this vulnerability because the devices are end of life. The team recommends that organizations using D-Link DIR-859 routers purchase new routers. During Microsoft Patch Tuesday in July, 137 reported vulnerabilities were addressed — twice the number reported in June. Of those 137, 14 were critical vulnerabilities, and all but one of those critical vulnerabilities were remote code execution flaws. One of the 137 vulnerabilities was a zero-day exploit. The zero day is an information disclosure vulnerability that affects the Microsoft SQL Server, but there is no known exploitation of the vulnerability in the wild. Telemetry Last month, the team discussed telemetry — how data from multiple sources is collected and analyzed to understand what is happening within an environment — and compared three host-logging tools: group policy object (GPO), endpoint detection and response (EDR), and Sysmon. This month, the team followed up the discussion by answering a few important telemetry questions. When a user increases the GPO audit levels or enables Sysmon, does it take up more computer space? Mostly no. Windows, including PowerShell, has a default of 20 megabytes (MB) for most event logs, and Sysmon defaults to 64MB. When the logs are full, they overwrite themselves, pushing the oldest records out while writing the newest records to the full log. Will this increase the LogScale storage amounts and push a client over the limit? The amount of logs and data will increase. If the limits are exceeded, Pondurance will work with the client to tune as much as possible. The limits are not rigid, and the client will not get cut off from service because the service will scale with the data being sent. If data does increase, how is the tuning handled? Pondurance does most of the tuning, including event enablement, and we can review sources that can help the client cull or filter data or can suggest how to dial back to get to a desired level. Sidecar configurations can be used to remove log sources or event codes. Log forwarders can also be used to filter, but Sidecar is preferred. Both ways are effective for removing the extra data. How do Pondurance’s rules compare to Sysmon’s rules? When compared to the Sigma HQ rules, Pondurance’s alert rules have similar percentages to the Sysmon rules. In all three sets of rules, more than 1,000 rules are written for process creation. Sysmon ID 1 and Windows ID 4688 are the most crucial event IDs to log, especially if an organization is not using a top-tier EDR solution. The team reminded organizations that Windows 10 support, including security updates, will expire on Oct. 14, 2025. There are ways to extend Windows 10 support . However, the team recommends that any organization still using Windows 10 should upgrade to Windows 11 . About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our security operations center, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Threat Intelligence Update: Node.js Compromise Events Pondurance September 16, 2025 Facebook X (Twitter) LinkedIn Copy link Editor’s note: This is an emergent story, and therefore some information may become outdated quickly. Additional updates will be made to this story as new intelligence and information becomes available. Update: September 17, 2025 – the current list of known and/or suspected NPM packages has dramatically increased and continues to grow. Pondurance recommends that anyone wishing to see the most up-to-date list of packages visit StepSecurity’s threat intelligence page for the most recent updates. Pondurance continues to monitor the list of packages known or suspected to be compromised for potential customer impact. Initial article: September 16, 2025 - 13:00 Eastern US Multiple news agencies and threat intelligence organizations have reported on an evolving set of threat activities that began on or about September 8, 2025. A well-known and respected developer of software components within the Node.JS community (a JavaScript runtime environment) using the username “qix-” (real name: Josh Junon) fell victim to a phishing attack, and temporarily lost control of his code repositories. This compromise included the code for several broadly-used packages like “chalk” and others. As these packages were used in a significant number of other developers’ codebases, the infected versions of these packages made their way into potentially hundreds of platforms, tools, and products from multiple developers and vendors. On or about September 15, 2025; these compromised packages were discovered to be able to compromise other packages within the same NPM tenancy where they had been incorporated/installed. While the total number of impacted products and software tools is unknown at this time, about 18 packages managed/maintained by qix- were confirmed to be compromised, with as many as 40 other packages suspected to have been impacted, these numbers are likely to increase over time as more information is received. The nature of the malicious code (and its ability to self-propagate) makes defining total numbers and scope difficult at best. What happened: qix- received a malicious email designed to trick a user into revealing credentials and other login information (phishing). Through interacting with the email and subsequent site logins, attackers gained control of tokens used to grant access to code libraries controlled by qix- on the NPM code management platform. This platform, used by thousands of developers, does use modern and secure techniques to avoid this kind of incursion. qix- was deceived into believing that his Multi-Factor Authentication (MFA) tokens for NPM had been invalidated, and during the process of resetting these tokens, the threat actors were able to obtain fraudulent access to his NPM account. From there, the attackers inserted malicious code into multiple otherwise legitimate packages which were in use by thousands (and potentially millions) of developers around the world. This malicious code, when run, would seek out additional access tokens of whichever developer used the infected packages in their own NPM tenancies. Once additional tokens were acquired, the malicious code then copied itself into other packages maintained by the same developer, essentially converting these packages into additional infection vectors for more and more NPM accounts and repositories. When these newly-infected packages were then used by additional developers, the cycle continued. The full extent of this self-propagation is not yet fully defined, but Pondurance Threat Intelligence is watching the situation closely. Additionally, it is suspected that some of the infected packages downloaded additional malicious code capable of stealing cryptocurrency transactions and wallet information. This has yet to be confirmed as part of this specific incident, and may be attributed to a prior, similar, incident. Who performed the attack: The identity of the threat actors is currently unknown, with only some overall indicators tying the instances of compromise and attack together. First, the NPM packages containing malicious code appear to have originated from the compromised packages originally accessed via the attack on qix-. Secondly, all of the most recently compromised packages attempt to perform operations such as token extraction and exfiltration to a public repository labeled as “Shai-Hulud” and attempt to propagate to other packages if/when possible. The points of commonality do indicate a single threat actor/threat group is responsible for the overall sequence of attacks since September 7th/8th, but this has yet to be verified. It is also possible that multiple threat actors are using the same root code packages. What should be done to protect against/contain the attack: Pondurance customers should consult with their Technical Account Manager to determine if any suspicious activity has been detected within their organizations’ networks. All organizations should determine if developers have used any packages created and/or maintained by qix- within their own software, repositories, plugins, and/or other NPM packages. The inclusion of a “ bundle.js ” bundle that is not expected to be part of the package is an early Indicator of Compromise (IOC). The current list of known compromised qix- packages follows, though this is subject to change. ansi-styles@6.2.2 debug@4.4.2 chalk@5.6.1 supports-color@10.2.1 strip-ansi@7.1.1 ansi-regex@6.2.1 wrap-ansi@9.0.1 color-convert@3.1.1 color-name@2.0.1 is-arrayish@0.3.3 slice-ansi@7.1.1 color@5.0.1 color-string@2.1.1 simple-swizzle@0.2.3 supports-hyperlinks@4.1.1 has-ansi@6.0.1 chalk-template@1.1.1 backslash@0.2.1 If any of these packages, any packages which have had a “ bundle.js ” bundle added, or any others known or suspected to be developed/maintained by qix- are in use, upgrade to the latest versions of these packages immediately. All code housed within the same repositories as any code using any of these packages must be considered suspect, and an immediate code review must be undertaken to verify that the packages are clean, or remediation efforts must be taken. All organizations should closely monitor security news and updates from vendors of any applications used in their environments. More vendors will be issuing updates to software and tools over the coming days as those vendors discover that one or more infected packages were incorporated into their own code. Any software updates available should be applied as quickly as possible - even if this could cause a disruption to business operations. The ability of these infected packages to gain additional malicious components at a future point means that any compromised software can become a launchpad for malware without warning, so updates should be classified as critical/highest priority. What Pondurance is doing: Pondurance staff is tracking vendor advisories; at this time we have not seen reputable confirmation that named security products were compromised via this npm incident. The Pondurance team will continue to evaluate the situation in the coming days/weeks as a high-priority/high-severity situation, and remediate accordingly whenever a compromised package may have been utilized anywhere in the Scope platform or other areas of Pondurance technology. Information on current status can be obtained through your Pondurance TAM and/or through the “Recent Announcements” section of the Scope dashboard. Any Pondurance customer should feel free to reach out to their Technical Account Manager, or contact Pondurance staff through the Scope dashboard. This post will be updated with new information and intelligence as it becomes available. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

September Cyber Threat Download™ Pondurance September 18, 2025 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. Threat trends Malicious threat actors are continuing to use proven tactics to exploit their victims. Our team noted that the following attack methods are a primary concern: Script-based escalation. Most of these attacks involve PowerShell scripts through unusual vectors, such as temporary data locations, removable drives, or odd network shares. Often, the threat actor will attempt to create tasks to establish permanence. Brute force attack. These exploits usually involve threat actors accessing accounts through varied IPs across large locations or through an IP accessing multiple accounts atypical of their login histories. The Pondurance team recommends that clients protect themselves against a brute force attack with user awareness training , proper password hygiene, and blocking of malicious domains. The Pondurance team discussed the importance of creating a cyber safety culture to prevent security breaches. The team recommends assigning permissions to accounts on a least privilege basis, offering training to teach awareness and proper caution rather than using click-and-learn education, using verification when dealing with any unexpected communications, and scrutinizing the urgency of any sudden request. The team also presented a brief case study of a malicious inbox rule, reviewing the triggers for concern, the effects of such a rule, why a malicious inbox rule is bad, and how to mitigate. Akira activity Since March 2023, ransomware group Akira has impacted hundreds of business and critical infrastructure organizations and claimed millions of U.S. dollars in proceeds. Akira’s earlier focuses were on Windows operating systems and VMware ESXi virtual machines. Currently, the group has expanded to Linux operating systems and Hyper-V machines. Also, as a ransomware-as-a-service operation, Akira partners with other threat actors for individual attacks and shares in the extortion fees. The group targets U.S. materials organizations and law firms, organizations that run a virtual private network (VPN) service without multifactor authentication (MFA) configured, and Cisco and Fortinet capabilities. Lately though, SonicWall vulnerabilities are the group’s primary focus. The SonicWall vulnerability allows Akira threat actors to attack improper access control flaws to exploit weak or misconfigured security settings and gain unauthorized access to sensitive systems. They gain access by exploiting local accounts most often when accounts are migrated from a lower-generation SonicWall device to a newer one that has SSL VPN enabled but did not undergo a password reset after migration. Once the threat actors gain access, they disable the security tools and encrypt the systems. In the past month, the Pondurance team has seen nine or more cases attributed to Akira, which is significant compared with last quarter when only three cases occurred. For those cases, the average dwell time was four days, and the average time to exfiltrate data was approximately 36 hours. These cases highlight the importance of credential rotation of perimeter appliances during migration, MFA with strong password policies, and alerting for the tools Akira typically uses and the behavior that typically begins an encryption event. The team sees several common indicators of compromise (IOCs) for Akira’s ransomware. In particular, threat actors are placing their encryption payload or ransomware executable in the program data folder. Also, using specific tools can be an IOC such as: Remote access tools like AnyDesk and RustDesk for persistence Ngrok or Cloudflare for secure tunneling to expose local servers or services WinRAR for data compression and Rclone and WinSCP to exfiltrate data Scanners such as Advanced IP Scanner or Angry IP Scanner Mimikatz and Kerberos ticket stealer for credential harvesting As a possible new tactic, technique, and procedure, Akira threat actors are renaming folders after endpoint detection and response tools, such as AVG or SentinelOne, and then placing their tools within those folders. Notable vulnerabilities Approximately 4,000 vulnerabilities were disclosed in July, and 22 of those disclosed vulnerabilities were actively exploited — a significant jump from the 10 to 15 actively exploited vulnerabilities usually seen each month. Fifteen proof-of-concept codes were released on the internet. During Microsoft Patch Tuesday in July, 66 reported vulnerabilities were addressed. Of those 66, nine vulnerabilities were critical, and there was one zero day that was a remote code execution vulnerability. Multiple patches were released for the affected products. The team briefly discussed three of the critical vulnerabilities: CrushFTP alternate channel vulnerability . Nearly 300,000 CrushFTP instances are exposed to the public internet, mostly in the United States. But only specific versions with the DMZ proxy feature disabled have the vulnerability. For the attack, the threat actor targets the Crush administrator account, sending a specially crafted HTTP POST request over the alternate channel. Once exploited, the threat actor runs commands on the underlying operating system and gains administrator access over the HTTPS channel. IOCs include the creation of a default account with administrator privileges, new administrator accounts, and long, random user IDs. Wing FTP Server . Almost 10,000 servers to the public internet were exposed to this exploit. The attack takes advantage of a null byte flaw that allows threat actors to inject Lua code into the user session files to gain access. Then, local users are created, giving the threat actor accounts for login. Following access, the threat actors perform a curl command test, attempt an installation of ScreenConnect, and attempt a Beacon download from the command-and-control (C2) server. Microsoft SharePoint vulnerability . Numerous threat actor groups, including China-based Storm-2603, are known to be exploiting this flaw on on-premises SharePoint servers using LockBit, Warlock, and X2anylock ransomware variants. The exploit requires the chaining together of four specific SharePoint vulnerabilities. The groups use multiple tools such as PsExec and Masscan throughout deployment and also use domain name system and HTTP-based backdoors to communicate with the C2 server. In addition, the groups deploy a custom antivirus terminator tool that incorporates a signed driver into the tool to kill the security processes. During Microsoft Patch Tuesday in August, 107 reported vulnerabilities were addressed. Of those 107, 13 were critical vulnerabilities, and one was a zero-day exploit. The zero day is a privilege elevation vulnerability that affects Windows Kerberos. Numerous critical patches were released, including patches for Microsoft Word, Hyper-V, and Microsoft Message Queueing. Session hijacking More and more often, threat actors are stealing, copying, and intercepting session IDs and using them for malicious purposes. These attacks, known as session hijacking , allow a threat actor to take over a valid user session to gain unauthorized access to a website or application. By stealing the session ID, the threat actor can pass as the legitimate user, bypass MFA, and perform malicious actions. A successful session hijacking attack starts when the user logs in, provides a password, and is challenged with MFA. These simple actions are enough to allow a threat actor to steal the user’s credentials and hijack the session for anywhere from 24 hours to 30 days or longer. Session stealing methods can be passive attacks or active attacks. A passive attack typically involves a man-in-the-middle attack using fake phishing pages that appear to be legitimate. The user enters credentials, including MFA, and the threat actors incept the information. The team warns that a generic-looking sign-in page can be a giveaway that it’s a phishing attempt, especially if the URL doesn’t match the service provider that the user is logging in to. An active attack can happen in a few different ways: Malware installed/running on host. This attack uses a browser extension to gain the same rights as the user running it and can find the sessions, copy them, and send the sessions to the threat actor. Cross-site scripting. This popular method exploits a vulnerability in a legitimate website’s code. It tricks the browser into running the malicious code, which copies the session and relays it back to the threat actor. Session fixation. In this active attack, the threat actor sends a legitimate link with a session ID to a service, and the user authenticates using the session ID. Then, the threat actor can visit the first URL sent and log in. Fortunately, organizations can take several preventative measures to safeguard against passive and active attacks. The team recommends using short sessions, which require user logout after inactivity, and using the step-up protocol, which requires that users must reauthenticate or, at a minimum, prove they are in possession of the MFA device or know the user’s password. In addition, organizations can require passkey presence, disable the Keep Me Logged In setting, configure risk-based and conditional policies, require enrolled devices, block foreign countries, require MFA, block risky users, and enforce token binding . For future prevention, the team briefly discussed Device Bound Session Credentials (DBSC) for browsers and Demonstrating Proof of Possession (DPoP). Both DBSC and DPoP require users to prove that they possess the asymmetic cryptographic key. As a final takeaway, the team reminded organizations that Windows 10 support will expire on Oct. 14. Fifty-five percent of clients now have Windows 11, and the team recommends that the other 45% should upgrade to Windows 11 . About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our security operations center, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape.  Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

How Your Business and Employees Can Outsmart Tax Scammers Pondurance April 9, 2025 Facebook X (Twitter) LinkedIn Copy link How Your Business and Employees Can Outsmart Tax Scammers Tax season is a busy time for finance and payrolls teams, accountants—and scammers. While tax fraud is a year-round problem, the IRS warns that scammers exploit the busy tax season to escalate attacks. Many scams are targeted at individuals, but businesses are not immune. And even though fraudsters use tried-and-true schemes, such as IRS impersonation, they’ve added generative AI to their arsenal. It’s easier than ever to craft communications that deceive finance and payroll teams—and your employees—into sharing sensitive data. To protect your employees and your organization against tax scams this season, it’s important to: Understand how scammers use emotion to trick victims. Know the common scams fraudsters use. Learn how AI enables more successful attacks. Practice good cybersecurity hygiene. Scammers’ Scare Tactics The IRS notes how scammers mislead potential victims about tax refunds, credits, and payments. They want personal, financial, or employment information—or your money. There are red flags that a tax scammer may be at work: Create a sense of urgency Use isolation tactics or threats Promise a big payday Set up suspicious website links It all comes down to emotion. “When people are under pressure and under anxiety, they might do something with the speed that they’re not thinking through it and not doing their research,” said Amy Nofziger , director of victim support at the AARP Fraud Watch Network. The Tricks of a Tax Scammer Here are a few common scams to watch out for in 2025: IRS Impersonation Scammers pretending to be from the IRS work in a number of ways: Initiate contact by email or over social media asking for personal or financial information. Send text messages offering tax relief, tax credits, or help creating an online account. Set up fake websites pretending to be the IRS. Use phone scams: Pretending to be the IRS, scammers call taxpayers, threatening arrest, deportation, or other consequences. Demand immediate payment with gift cards. IRS: How to Avoid Tax Scams Form W-2 Email Scam A scammer, impersonating a company executive, will send a fraudulent email to HR or payroll requesting they immediately send W-2 data , which includes wages earned, taxes withheld, and social security numbers. The fraudster uses this confidential information to file fraudulent returns for tax refunds. IRS Explainer Video on W-2 Scams Invoice Fraud Fraudsters use false invoices to claim a transaction that never took place, or to inflate the value of a genuine transaction. This allows a business to reduce their taxable income by deducting the amount of the fraudulent invoice. Invoice fraud enables a scammer to: Avoid paying taxes Launder money Finance illegal activities Defraud the IRS Tax Scams in the Time of AI AI makes it easier for scammers to get access to a legitimate email account through phishing —an attack known as business email compromise (BEC) . Fraudsters can mimic the tone and style of genuine communications to request sensitive tax documents or transfer money. Scammers may also use deepfake videos, audio, or images to trick employees. Smarter than Scammers Scammers thrive in the chaos of tax season, but your organization can use proven cybersecurity strategies and employee training to protect sensitive personal information and stop tax fraud. Teach employees to learn how and when the IRS contacts them and to be aware of the latest tax scams . Tailor cybersecurity training to specific roles—such as for finance and payroll teams. Require two or more people to approve tax-related payments. Implement multi-factor authentication (MFA) to prevent unauthorized access. Monitor for unusual activity, using tools to detect and alert you to erratic or unexpected employee behavior. Tax season will come and go, but fraudsters are always finding ways to financially gain from sensitive employee, customer, or patient information. Unauthorized exposure of confidential information increases your risk for a data breach . Your organization must be vigilant against these attacks, implementing a robust cybersecurity program and building a culture of cybersecurity across all teams. Want to improve your cybersecurity and eliminate breach risks? Contact us for a demo today. We’re here to help. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn how to safeguard your organization effectively with a risk-based approach, covering protection, detection, and response strategies. Protect, Detect, and Respond Using a Risk-Based Approach Pondurance June 14, 2024 Facebook X (Twitter) LinkedIn Copy link The National Institute of Standards and Technology (NIST) Cybersecurity Framework provides guidelines for organizations to use in their cybersecurity efforts. The NIST categories include identify, protect, detect, respond, and recover. Pondurance, a managed detection and response services provider with a 24/7 security operations center (SOC), uses those same five categories to develop cybersecurity programs for clients. In a recent webinar, Dustin Hutchison, Chief Information Security Officer and Vice President of Services at Pondurance, discusses Pondurance’s risk-based approach to cybersecurity . A risk-based approach focuses on your organization’s specific cyber risks and considers what your organization wants to accomplish and what it needs to protect. He provides definitions and explains the steps involved in each of the five categories. In this blog, we’ll review Dustin’s discussion of the protect, detect, and respond categories, including the importance of 360-degree visibility, risk response, and 4D detection. 360-degree Visibility Assessing risk is an ongoing activity for a cybersecurity program, even as it moves into the protect and detect stages of the process. Full visibility of the threat landscape can reduce the risk and impact of a cyberattack and even reduce the time it takes to remediate an incident. As part of a risk-based cybersecurity approach, Pondurance offers 360-degree visibility to allow your organization to see the big cybersecurity picture and provides high-fidelity monitoring of your endpoint detection and response solution, vulnerable data, native application programming interface, networks, logs, clouds, and netflow to protect your most valuable assets. Risk response Before a cyber threat is ever detected in your environment, it’s important to understand your organization’s risk response, meaning the actions your organization has chosen to take to manage the impact of the risk. Dustin talks about the different ways organizations respond to risk including: Acceptance – Do nothing, recognizing that the risk is low enough that it doesn’t require action. Dustin discusses the importance of knowing, from an IT or cybersecurity perspective, who should be the person within the organization to accept the cyber risk or responsibility. Avoidance – Decide not to take an action to minimize the risk. For example, if your organization is looking at a new system and the vendor can’t implement compensating controls, you may decide you need to avoid the risk and not take that action. Mitigation – Take some action to minimize the likelihood or impact of a risk. Organizations use cybersecurity policies and processes, such as firewalls or encryption, to minimize the risk or impact of a cyber threat. Sharing or transferring – Move the risk to a third party. Your organization may be inclined to push risk to a third party or some other mechanism to remove the burden of or responsibility for the risk. However, Dustin tells why reputational damage is still likely even if you share or transfer the risk to a third party. Every organization has its own unique cyber risks and ways of dealing with those risks. Using a risk-based approach to cybersecurity, Pondurance considers your organization’s response to risk when determining the appropriate protect and detect strategies and guides you to respond to risk in a way that will safeguard your organization from a harmful attack. 4D Detection Today, cyber threats loom for organizations of every size, in every industry. Detection and response are necessary to keep your organization safe from such threats. Threat hunters and SOC analysts monitor incoming alerts and constantly analyze those alerts to determine if the threats warrant escalation. But, as Dustin explains, not every threat comes with an alert. Threat hunters and SOC analysts also must proactively hunt for and detect threats 24/7 across all networks, endpoints, logs, and clouds to protect again cyberattacks. Pondurance’s risk-based approach can help your organization monitor and analyze alerts in real time to reduce alert fatigue for your team and conduct threat hunting and detection with your specific cyber risks in mind. Our high-fidelity detection allows us to quickly and accurately detect and respond to cyber threats using advanced technologies and methods such as machine learning , artificial intelligence, and cross-customer modeling. Conclusion A risk-based approach focuses on your organization’s cyber risks and considers what your organization wants to accomplish and what it needs to protect. That way, your organization protects, detects, and responds using the best cyber strategies for your unique cyber risks. Watch the webinar to learn more about the five categories involved in Pondurance’s risk-based approach to cybersecurity. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

The Civilian Cybersecurity Reserve Act addresses vulnerabilities and breaches by building on existing military reserve programs. Learn more.|The Civilian Cybersecurity Reserve Act addresses vulnerabilities and breaches by building on existing military reserve programs. Learn more. Creating a Civilian Cybersecurity Reserve Pondurance April 29, 2021 Facebook X (Twitter) LinkedIn Copy link I was recently asked about a Civilian Cybersecurity Corps and how to maximize its scale and potential by NextGov . The pace at which the Biden administration and the 117th Congress are addressing gaps in our national cybersecurity strategy, including by nominating and appointing incredibly talented and experienced individuals like Chris Inglis (National Cyber Director), Jen Easterly (Director, CISA), and Anne Neuberger (National Security Council), is impressive. And so is the pace at which our adversaries act. The clock is ticking, and we must adopt a posture that is as bold, agile, and creative as the criminals and nation-states that are embedded in our networks and carrying out operations against us. For example, today, a bipartisan group of lawmakers has introduced legislation to create a “Civilian Cybersecurity Reserve”, a National Guard-like program under the auspices of both the Department of Homeland Security (DHS) and Department of Defense (DoD) to address growing cybersecurity vulnerabilities and breaches faced by the U.S. government. Under the bill, which is being cosponsored by Sen. Jacky Rosen (D-Nev.) and Sen. Marsha Blackburn (R-Tenn.) and cosponsored in the House by Reps. Jimmy Panetta (D-Calif.) and Ken Calvert (R-Calif.), the DOD and DHS secretaries would appoint members of the cyber reserve to six-month positions in the department as federal civil service employees. Joining the reserve corps would be voluntary and by invitation only and requires prior federal government or military service. This effort would augment the work being done already by the National Guard’s reserve corps, which has successfully leveraged civilian talent to build cybersecurity capability within its ranks to both defend its own networks as well as provide support when called into service by states or the federal government. The proposal follows the recommendations of the National Commission on Military, National, and Public Service and the Cyberspace Solarium Commission, and builds on the 2021 National Defense Authorization Act that directed DOD officials to look into options for building a cyber reserve force. Legislatively, the idea for a Civilian Cyber Corps was proposed almost 20 years ago in the bipartisan proposal for a National Emergency Technology Guard (NETGuard) that was in the Homeland Security Act of 2002. The Homeland Security Act of 2002 envisioned but did not follow through with the creation of a National Emergency Tech Guard program, a corps of volunteers whose training is funded by the government and who can be deployed during periods of crisis to restore critical systems and services to their communities. There is no question that finding ways to shore up cybersecurity talent and mobilize that talent in times of crisis is critical. While a Civilian Cybersecurity Reserve should help address existing talent gaps when responding to federal, state, and perhaps local government entities, it still leaves a critical gap with respect to cybersecurity needs in the private sector, which is under similar assault by both malicious nation-state adversaries as well as criminal organizations. While starting with a Reserve Cyber Corps that addresses U.S. government needs makes sense, Congress should consider quickly organizing and funding a similar program focused on private sector needs, tapping private sector expertise, especially with respect to technical knowledge of private-sector networks. Today, by and large, the target of ransomware attacks is small and midsize businesses and government entities that hold valuable information but are under-resourced when it comes to IT and cybersecurity. These organizations often do not have the budget to build specialized security teams and, even if they do, have difficulty recruiting and retaining top talent. As a result of their limited resources, they have limited ability to respond to ransomware attacks in real-time. Ultimately, it is the communities that suffer when their schools, hospitals, and small businesses are taken down by cyber adversaries. While the current proposal would potentially support municipalities in recovering from these attacks, the private sector organizations impacted would still have to fend for themselves. Much as there is a pool of government and military workers who can be tapped for a government reserve corps, there is a vast pool of private-sector cybersecurity talent that can be cultivated and mobilized when there is a widespread incident impacting tens of thousands of organizations simultaneously as we are experiencing right now. The federal government, and especially the military, limits who can join their ranks with some combination of physical fitness, college degree, citizenship, and age qualifications and limitations, as well as a security clearance requirement. These limitations together with the six-month service requirement will disqualify a large portion of the cybersecurity workforce who would otherwise be motivated to serve their nation and their communities during times of crisis. As pointed out by Natasha Cohen and Peter Singer in their proposal for a Cybersecurity Civilian Corps over two years ago, true civilian corps could tap (a) older and retired cybersecurity professionals, (b) professionals working in the cybersecurity field with a desire to do volunteer work and perform civic service using their skills, (c) “white hat” hackers who don’t work full time in a cybersecurity job, (d) people who are in job transition, (e) independent contractors looking to fill gaps in their time and expand their networks, and even (f) stay-at-home parents. Removing the physical fitness, citizenship, age, and clearance requirements, as well as prior government or military service, creates the opportunity to tap this vast pipeline of talent. There is no question that the Biden administration and Congress are moving fast. But our adversaries are faster, more creative, persistent, and unconstrained by law and regulation. Unless we change our approach, they will continue to identify vulnerabilities in software used across varied networks for maximum impact with little to no fear of retaliation. They will continue to advance intrusion tools and tradecraft faster than gaps in cyber defenses can be closed. They will continue to use common anonymization platforms, open-source capabilities, and generalized toolkits and leverage inherent functionality built into operating systems to obfuscate their activity and make attribution difficult. They will continue to leverage our laws and regulations to enable their operations for maximum effect. And they will do all this at a pace and on a scale that will continue to be breathtaking. The first half of 2021 has been, should be, a wake-up call. And let’s be clear, there are no silver bullets when it comes to cybersecurity. It will take a series of actions, persistent and purposeful, to prevent, defend, and have resilience to cyber threats. The Civilian Cybersecurity Reserve proposal builds on our existing military reserve programs, and it is an important step forward. We need to begin taking leaps forward. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

President Biden made cybersecurity a top issue in his executive order, focusing on improving US cybersecurity regulations. Learn more.|President Biden made cybersecurity a top issue in his executive order, focusing on improving US cybersecurity regulations. Learn more. Removing Barriers and Enforcing Standards To Improve Cybersecurity at the National Level Pondurance May 17, 2021 Facebook X (Twitter) LinkedIn Copy link On Wednesday, May 12, President Joe Biden named cybersecurity a top national security issue and signed Executive Order 14028 , Improving the Nation’s Cybersecurity. His signature dried in the midst of a high-profile cyberattack against the Colonial Pipeline , which captivated the nation. His order primarily focused on directing government agencies to implement cybersecurity protocols aimed at boosting their defenses against cyberattacks in collaboration with the private sector. Below are some key takeaways on improving US cybersecurity regulations from the 15-page executive order. Removing Barriers for Information Sharing Currently, government contracts and policies restrict the ability of agencies and contractors to share information on cyberattacks with the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and other intelligence agencies. Biden’s executive order removes these barriers, encouraging sharing of information on threats, incidents, and risks. It also establishes a framework to ensure effective information sharing among agencies. Timely information sharing has been a game-changer in past cyberattacks, with information sharing and analysis centers (ISACs) being formed across a variety of different agencies. More broadly, when information is shared, breach victims and threat researchers are able to warn other organizations. For example, when FireEye notified the industry that it was impacted by the SolarWinds breach, the indicators shared enabled more widespread discovery. Since this was a supply chain attack, many organizations, including government organizations, were affected but may not have known they were victims if FireEye had not disclosed the information it did. Without this information sharing, the successful foreign campaign may still be operating. Requirement To Adopt Cybersecurity Hygiene Biden’s mandate for cybersecurity hygiene includes advancing toward zero trust architecture and speeding up the move to secure cloud services with the promise to invest in the resources needed to modernize. The executive order requires adoption of multifactor authentication (MFA), vulnerability management , and encryption incorporating standards from the National Institute of Standards and Technology (NIST). The executive order additionally calls for security log collection and deployment of endpoint detection and response (EDR) technology. Unfortunately, both of these technologies are notoriously difficult to manage, and the executive order makes no mention of how agencies will overcome this. For organizations that do not have the resources to wrangle these technologies in-house, we recommend looking at a managed detection and response (MDR) solution. At Pondurance, our MDR provides proactive security services backed by authentic human detection. Technology is not enough to stop cyber threats. Human attackers must be confronted by human defenders. Learn more about MDR in our eBook: 5 Things to Consider When Choosing an MDR Provider . Establishing a Cybersecurity Safety Review Board The Department of Homeland Security in consultation with the attorney general will establish a Cybersecurity Safety Review Board modeled loosely on the National Transportation Safety Board that investigates airplane crashes and other transit failures. The board will review and assess significant cyber incidents, threats, vulnerabilities, mitigation activities, and agency responses. On the board, there will be members from the Department of Defense, the Department of Justice, CISA, the National Security Agency, the FBI, and members from the private sector. Pilot Product Labeling Program The executive order starts a pilot product labeling program to better educate the government and commercial businesses on their purchase decisions. This program will be similar to the Energy Star program that makes it easy for consumers to identify energy-efficient products. When government or commercial organizations are looking at a new software vendor or a new program to integrate into their systems, the goal is to make it easy to tell if that vendor has the appropriate security in place to defend against today’s cyberattacks. A compelling concept, it will take significant public-private partnerships to define and manage such a labeling system. Historically, many breach victims passed a compliance audit shortly before they were breached, so the program will have to focus on a scoring system that more accurately correlates with the risk of a given product. Additionally, due to the dynamic nature of vulnerabilities and threats, it is a bit difficult to imagine a static labels system working. This is just a sample of the contents in the executive order released on Wednesday. While the executive order is focused on a number of the right solutions, many of these ideas have been floated around for years. The success of the executive order will ultimately come down to the ability of agencies, government contractors, and suppliers to implement the mandated defensive measure. Unfortunately, nothing in the executive order discusses methods for filling the cybersecurity vacancies that plague industry and government agencies. In her recent testimony to Congress, Pondurance Board Chair Niloo Howe proposed a number of ideas including the concept of a civilian cyber reserve force to help fill the immense talent gap. If your organization needs a cybersecurity review or needs to manage the risk posed by threats and vulnerabilities, reach out to us to discuss ! Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn how Gulf Coast Center strengthened its cybersecurity posture, improved visibility, and reduced risk through a strategic partnership with Pondurance. Behavioral Health Clinic Finds Success on Its Cybersecurity Journey Pondurance June 15, 2026 Facebook X (Twitter) LinkedIn Copy link For years, the healthcare industry has been a primary target for cyberattacks and tops the list as the most expensive industry for data breaches for the 12th year in a row. The average breach for a healthcare organization costs $7.42 million , according to IBM's Cost of a Data Breach Report 2025 . Healthcare organizations, such as large hospital systems and medical centers, are attractive targets because they store protected health information (PHI) including Social Security numbers, birth dates, and medical records that threat actors find financially valuable. Smaller hospitals, federally qualified health centers, and behavioral health clinics are also at risk of cyberattacks due to the large volume of PHI that they collect and store. When any organization suffers a cyberattack, the impact can involve downtime and data loss. When a healthcare provider gets hit, it can also impact patient access to care, crisis response, clinician access to patient records, clinical workflows, and the trust of the surrounding community — and that's especially impactful for behavioral health clinics serving a vulnerable population. In a recent webinar, Brian Stone, Chief Revenue Officer at Pondurance, was joined by Gulf Coast Center executives Felicia Jeffrey, CEO, and Dr. Devon Stanley, Chief Information Officer, to discuss cybersecurity as an operational and clinical risk rather than just a technical risk. Felicia and Devon briefly explained how they started their cybersecurity journey, challenges they had and what they did to overcome them, and how they have made progress as the journey continues. Starting out Gulf Coast Center is a local mental health authority and a certified community behavioral health clinic that provides accessible, efficient, and quality services to the people in Galveston and Brazoria counties in Texas regardless of their ability to pay. The organization offers services for mental health, substance use, and intellectual and developmental disabilities, as well as community education and disaster recovery support. The organization's niche is its ability to fill gaps in care in the community either by directly providing services or partnering with others in the community that can provide them. When Felicia and Devon started with Gulf Coast Center, the organization needed a modern system that aligned with its mission. They worked to balance security, compliance, and modernization while allowing the clinicians and staff to effectively do their jobs. They slowly added new tools and technology to the existing system to fill some of the gaps in the environment. As they made changes, they would ask each other, "What keeps you up at night?" The sleepless nights usually involved concerns about how to protect the system from a cyberattack. They knew the organization needed cybersecurity protection, but that knowledge led to other questions such as: How do we afford to do this? And can we afford not to do this? Felicia and Devon wanted to partner with a cybersecurity provider that believed in Gulf Coast Center's mission and vision and cared about its success. They wanted a provider that would grow with them, give them a road map to success, and assure that there would not be downtime. For a behavioral health clinic, operational downtime would affect patient access and clinician productivity. The organization also needed a provider that would extend its capabilities, offer 24/7 monitoring and response, and integrate into its workflows. Felicia and Devon talked with the board of directors about reinvesting the organization's limited resources into cybersecurity to stay modern and maintain a reliable system of care, and the board agreed that cybersecurity should be a priority. With everyone in agreement, Gulf Coast Center partnered with managed detection and response provider Pondurance to tackle its cybersecurity challenges. Overcoming challenges Though Felicia and Devon had worked hard to evolve the cybersecurity program with new tools and technologies, there were still gaps. Tools and technology were not fully integrated, visibility was inconsistent across the environment, and the cyber insurance policy required attention. The team needed to work together to overcome these challenges. Tools and technology. Modernization doesn't always mean purchasing more tools. For Gulf Coast Center, it also meant getting the maximum value from the technology that they already had. One of the first things the team did was conduct a thorough audit of its technology capabilities to see what tools the team had to work with. The team members were able to consolidate tools, reduce overlap, and identify ways to make improvements to endpoint management, identity protection, and visibility. Fully understanding the technology that they already had helped Gulf Coast Center quickly improve its security posture and build credibility with the board of directors as being responsible stewards of the cybersecurity investment. Visibility . Gaps in visibility didn't allow Gulf Coast Center to see what was happening across all endpoints, identities, cloud applications, and remote access devices in real time. With Pondurance's help, Gulf Coast Center was able to reduce the blind spots for a much clearer picture of what's going on in the environment. The organization's improved visibility included centralized monitoring, stronger identity controls, and actionable alerts. Now, Gulf Coast Center can see what assets it has, where the sensitive data is located, who has access to the data, and how fast the team can detect and respond to a threat. Cyber insurance . Every cybersecurity program can benefit from having a strong understanding of insurance coverages. The team went through the cyber insurance policy line by line and soon realized that it needed coverage that more closely aligned with the organization's overall strategy. Gulf Coast Center now has a cyber insurance policy that is right for its unique needs, so the team can feel confident about using the coverage if a cyber event occurs. Making progress Gulf Coast Center has made great strides in its cybersecurity program. The organization has created a true operational program that integrates its people, processes, technology, strategy, and governance into a comprehensive program. Today, it has greater visibility, stronger monitoring, better alerts, improved incident response, and faster detection abilities — and the organization is not done yet. Felicia and Devon still have items to address on the road map, but they know they don't have to accomplish everything at once. They continue to use a phased approach, starting with the most critical components, to get the organization to its destination. Overall, the cybersecurity program has reduced the risk to the organization and lowered the stress level of Gulf Coast Center's internal team. It has allowed for improved strategic alignment where the organization can focus on priorities, operations, and long-term goals. For Gulf Coast Center, cybersecurity is always a concern, but it's no longer a constant worry. The peace of mind from having a modern cybersecurity program and a partner like Pondurance allows the team to sleep well at night and have confidence in the system 24/7. Conclusion Healthcare organizations are attractive targets for cyberattacks, and behavioral health clinics are no exception. But can a smaller healthcare organization afford a cybersecurity program? Can it afford not to have one? Gulf Coast Center did its due diligence to find a way to successfully create a cybersecurity program to stay protected. Learn more about the organization's cybersecurity journey. Watch the webinar . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Is airplane WiFi safe? Michael DeNapoli breaks down the recent Delta WiFi incident, what likely happened, and how to stay secure while flying. Cybersecurity 101: On-Board WiFi Whoops Michael DeNapoli August 26, 2026 Facebook X (Twitter) LinkedIn Copy link A customer recently asked “What happened with the WiFi on that recent Delta air flight, and should I be worried about it?” The answer is “we don’t know for sure, but it was likely to be mostly harmless.” Let’s dive into the topic: On a Delta air flight from Las Vegas recently , the flight made the news because of issues with the on-board WiFi system. While the news made it out to be a dire emergency, the likelihood is that there wasn’t all that much going on. While - at the time of this writing - the investigation is still ongoing, there are more likely situations that could easily explain what happened. What we know: According to statements from both Delta and the Federal Aviation Administration (FAA), a second WiFi network identifier (known as a SSID) became available for users in the passenger cabin of the plane. This SSID, labeled “Delta WiFi Fast,” was not an official WiFi hotspot, and was not managed by the flight crew or by the airline. The flight crew quickly disabled all WiFi to the passenger cabin and alerted the passengers not to connect to the new SSID, and the flight continued towards its destination. The FAA continues to investigate the situation, but no final determination has been reached on any other facts of the incident. The story made the news because this flight was leaving Las Vegas at the end of one one of the largest hacker conferences, DEFCON; meaning that many persons with the knowledge and equipment to perform a WiFi takeover were likely to be on board the flight. Now, we should definitely point out what did NOT happen on this flight. There is no evidence or reports that the on-board WiFi was “hijacked” or taken over. Both the real WiFi SSID and the second, fake, SSID were available until the crew took the real one offline entirely. Additionally, the plane and its systems were never in any danger. Flight deck WiFi and all of the instruments and systems necessary to keep the plane safely in the air use completely different connections - separate WiFi SSID’s that are pre-set, and radio connectivity that doesn’t rely on WiFi at all. The plane and the passengers were not in any danger. What might have happened: Scenario 1 The more likely scenario is that someone on the plane turned on a WiFi travel router and named its SSID “Delta WiFi Fast.” Travel routers are fairly common tools used by technology professionals when we travel. They allow one WiFi connection to be shared by multiple devices, which is very handy when a hotel or other location charges for access to WiFi by device. The travel router connects to the official WiFi hotspot, and then broadcasts its own SSID that the user’s devices connect to, bridging the connection and sharing the WiFi bandwidth. Doing this on an aircraft is not recommended, as it can be confusing to passengers and crew, but security is still maintained and private information (when using HTTPS websites and secure apps) is still private. While the user of the travel router may be able to figure out what websites you visit, they can’t figure out what pages you visited or what data you shared back and forth with those websites. It’s possible that someone from DEFCON renamed their travel router to “Delta WiFi Fast” as some form of joke, or just to see who would connect to it instead of the official hotspot. What might have happened: Scenario 2 It is possible - though less probable due to info we’ll discuss below - that a specific type of portable router could have been powered up to snoop on other passengers. Commonly referred to as a “WiFi Pineapple” because of the most popular brand-name of such devices, these devices can dig much deeper into the data flowing across them from the unofficial hotspot to the real hotspot. With the proper configuration and planning, a pineapple can decode SSL traffic (HTTPS) and even keep a record of all transmissions and data that flows across it. This isn’t easy to do, and if done improperly will present several tell-tale signs that it is going on. Why scenario 1 is more likely The main reason why scenario 1 is more likely in this case is the lack of any mention of browser or application errors by passengers on the flight. If a pineapple were in use, the security certificates which encrypt and protect web and application traffic between you and websites and services would have recognized that things were not correct. The technique - SSL decryption - is common in corporate networks, but requires a tremendous amount of planning, configuration, and ongoing maintainance. Setting SSL decryption up properly at 35,000 feet is no small task, and will almost always fail and create very visible warning messages in any modern browser on either a mobile device or laptop. Mobile apps would also show error messages as the security chain they are expecting to be validated cannot be validated properly. Given the number of social media and Reddit posts about the incident, and the total lack of messages talking about browser or app errors, scenario 1 is significantly more likely to be what actually happened. So, is airplane WiFi safe? Overall, the answer is yes. Provided you are connected to the official WiFi hotspot (which you can find in the seat-back pamphlet) and you don’t ignore warnings or errors in browsers or apps, then your communications are protected. Even if you relay through a travel router, the owner can see your DNS calls (basically the online address of the websites you go to) but nothing else. Stick to sites that use HTTPS and apps that use basic security, and you will be browsing safely the whole trip. If your company requires the use of a VPN or other security tools, make sure they’re online and working even when you are in flight. In other words, follow basic online safety protocols and even if there’s a travel router tricking you into connecting to it, what you send back and forth is still unusable by the threat actor running the router. About the Author: Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn about phishing attempts that our SOC team stopped before they turned into ransomware attacks. Gain insights to help prevent attacks.|Learn about phishing attempts that our SOC team stopped before they turned into ransomware attacks. Gain insights to help prevent attacks. Phishing Attempts Stopped Before Damage Could Be Done Pondurance August 25, 2021 Facebook X (Twitter) LinkedIn Copy link The Pondurance Security Operations Center (SOC) team works 24/7 to monitor, prevent, detect, investigate, and respond to cyber threats around-the-clock. Whenever we receive an alert, the team immediately goes to work to validate and determine the severity of the incidents. We act as an extension of our clients’ security teams or as their only security team with our eyes on the glass when they need it the most. Below are a few of the phishing incidents we’ve seen over the past few months: One of our Managed Detection and Response (MDR) clients experienced our team’s swift response when the client’s employee mistakenly interacted with a phishing email that caused the initial download of a JavaScript file. Fortunately, our analytics detected the chain of associated events and generated an alert based on visibility across the client’s environment. This allowed us to catch the bad actor before any real damage could be done. We called our client immediately and stayed on a conference line with our contacts there until they were able to isolate the host and begin investigating. We acted as another set of eyes for our client and involved our highly-skilled Incident Response team to further investigate the incident. Another client experienced a foreign login on an account. Our SOC team saw a user enter company credentials on a Microsoft Office phishing site and we immediately notified the client. Shortly after the foreign login, we detected a new inbox forwarding rule created for that account. We alerted the client immediately and asked the user to completely log out of all applications and devices. We forced a password reset on the account and stopped the foreign login from further access. The bad actor could have dug into this client’s systems and stolen data if these steps were not taken. Another client faced a significant risk when multiple users fell for phishing attacks. We detected this by continuously monitoring network data and identifying the IPs of all compromised users. We used the client’s current endpoint detection and response software to look for connections to the phishing site. We identified which users were connected to the phishing event and which browsers they were using. We then exported this information and provided it to the client. The client was able to quickly reset credentials for all compromised users and prevent a ransomware attack. Our clients benefit from our MDR service, a comprehensive 24/7 managed security service that applies a dynamic defense methodology, protecting clients from today’s and tomorrow’s cyber threats. We provide 360-degree visibility into our clients’ environments, removing blind spots to their endpoint, network, log, and cloud environments. Our highly skilled analysts, threat hunters, and incident responders detect and respond to threats while providing guided recommendations tailored specifically to an organization’s cybersecurity needs. Learn more about MDR in our eBook 5 Things To Consider When Choosing an MDR Vendor . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Manage Risk With a Comprehensive Gen AI Policy Pondurance September 25, 2025 Facebook X (Twitter) LinkedIn Copy link Midmarket organizations are adopting generative artificial intelligence (gen AI) at a fast pace, and with good reason. Gen AI offers the opportunity for innovation with significant benefits such as greater efficiency, enhanced customer service, streamlined processes, and increased productivity. But with the good comes the bad, and gen AI does have the potential for serious risks, such as inaccuracies, employee misuse, data privacy violations, cybersecurity breaches, and other consequential issues. To manage the risks, every organization should have a written gen AI policy in place. But only 44% of organizations have completed gen AI policies for their employees, according to Littler’s 2024 AI C-Suite Survey Report. That percentage, however, will likely increase since an additional 44% of respondents either have a gen AI policy in progress or are considering one. A well-written gen AI policy can act as a road map to guide your entire organization through the legal, ethical, reputational, and security challenges of using gen AI. Every organization will have a different set of circumstances to address within the gen AI policy, but here are a few important topics for your organization to consider. Governance Gen AI tools need capable humans to monitor them. The governance section explains who — whether departments, teams, or individuals — will manage the gen AI policy and processes. You’ll need to determine who will monitor the usage, oversee regulatory compliance, review the data outputs for accuracy, and communicate with employees about gen AI. It’s also important to designate who employees must report to with questions, for permissions, and with possible compliance violations. The policy should include a fixed timeline, whether that’s monthly, quarterly, or annually, for review of the gen AI policy and should explain how to make policy updates. Over time, gen AI tools will continue to evolve, and as they do, employees will want to use the latest tools on the market. The policy will need to provide employees with a detailed, step-by-step process — the who, what, where, when, and how — for getting approval of new gen AI tools. Usage Usage policy must be clear and concise so that employees understand precisely what they can do with gen AI tools — and, maybe more importantly, what they can’t do. The policy should list each tool that is acceptable to use at your organization and specify the intended purpose and use of the tool. The policy should explain who can use the tool by individual name, title, or department and take into consideration whether the gen AI policy will extend to vendors, contract workers, consultants, or other third parties. Detail any prohibited, restricted, or limited uses that apply. Data privacy, security, and integrity are important considerations when using gen AI tools. Employees and all users need to understand the risks involved when the gen AI tools have access to protected health information, personally identifiable information, confidential information and trade secrets, and any other sensitive data. Be sure to address the organizational procedures for how to keep data private, secure, and reliable. Employees also need to understand transparency when using gen AI. A few states now have laws, such as the California AI Transparency Act , that require disclosure if gen AI is used to create content. Your organization’s gen AI policy should explain in detail to employees how to disclose the use of gen AI to help build trust with customers and co-workers. Data output The data output by gen AI can be incorrect, biased, out of date, or contain sensitive information, and employees need to be aware of these possible issues. The gen AI policy needs to clearly reinforce the concept of verification. A human should always verify the information generated by gen AI before using it. Gen AI relies on large amounts of data, which can include sensitive data such as names, addresses, social security numbers, medical records, birth dates, and phone numbers. If an employee inputs sensitive data into the AI database, gen AI can output the sensitive data, ultimately causing compliance violations. Therefore, gen AI policy should set strict guidelines for the collection, storage, sharing, and processing of such data. Be sure to explain who in the organization is responsible for the data at each stage and how specific employees are allowed to interact with the data. Regulatory compliance Staying in compliance means following all state, federal, and international laws that may apply. Midmarket organizations, and particularly those in regulated industries, need a robust gen AI policy to help employees understand how their actions can violate the law and lead to fines, penalties, and lawsuits. Employees need to know who to contact to report potential gen AI compliance violations. Training and education Organizations should provide gen AI user awareness training to all employees. The gen AI policy should provide a training schedule, offer refresher courses for individuals who have experienced problems, and make sure employees know when the training is mandatory. Ongoing training can reduce risk as employees learn how to properly use gen AI tools and stay up to date on the evolving risks of the technology. The training should teach employees how to handle sensitive data (or not handle it at all), cover ethics issues such as transparency and bias prevention, and focus on the risks, such as inaccuracies, data privacy violations, and security vulnerabilities. In the gen AI policy, your organization will also want to schedule training to upskill employees, or prepare them for job changes as gen AI performs mundane tasks while employee work becomes more strategic. During upskill training, it’s important for employees to know that gen AI is meant to help humans do their jobs, not replace them. Risk management Midmarket organizations must understand the potential risks of using gen AI tools, including data privacy violations, security breaches, and exploitation by threat actors. Your gen AI policy should incorporate ongoing monitoring and scheduled risk assessments . A risk assessment enables an organization to assess the cyber landscape, identify potential risks and vulnerabilities, and prioritize the actions needed to stay safe while using gen AI. Pondurance recommends that organizations conduct an annual risk assessment and perform an additional risk assessment when the organization adds a new gen AI tool to the network. Conclusion Every organization should have a well-written, comprehensive gen AI policy in place to guide employees on how to interact with gen AI tools and minimize risk. Consider the topics that are relevant to your midmarket organization and build a gen AI policy to help employees succeed at the initial stages of gen AI innovation and into the future. Check out our comprehensive AI playbook here . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026