The Department of Homeland Security and TSA updated pipeline cybersecurity requirements. Learn how how to navigate these new challenges.|The Department of Homeland Security and TSA updated pipeline cybersecurity requirements. Learn how how to navigate these new challenges.|The Department of Homeland Security and TSA updated pipeline cybersecurity requirements. Learn how how to navigate these new challenges. Pipeline Providers Face Challenges With New Cybersecurity Requirements Pondurance August 9, 2021 Facebook X (Twitter) LinkedIn Copy link After experiencing the Colonial Pipeline attack , Americans have a heightened awareness that infrastructure operations, including pipelines, water treatment plants and other operational technology (OT)-based organizations that control the critical flow of liquids and bring stability to our day-to-day activities, are being targeted by cyberattacks. The nation is waking up to how dependent we are on our fragile infrastructure. Even short-term disruptions have given us a glimpse into the potential economic impact interruptions, like a pipeline cybersecurity attack, can have on the US. In response, the Department of Homeland Security (DHS) and the Transportation Security Administration (TSA) have amplified their focus on pipeline cybersecurity requirements. Twice in the last 45 days, these agencies have released directives for critical pipeline providers. The first directive from TSA was publicly released , and a second directive from DHS with very specific requirements and timelines recently was sent to a subset of the most critical 3,000 pipeline providers. No one, including the pipeline providers, would argue that the directives include unusually strict requirements or that they significantly exceed basic best practices. However, directive timelines impose serious budget and resource requirements on many of the pipeline providers. The common question is, why? Is there some known new threat? Well, you don’t need to be a National Security Agency or DHS threat intelligence analyst to know this threat has been around since the 1980s. But what has changed is the expansion of the threat surface area and landscape due to the connection of increasingly cyber dependent systems into the OT environments and the greater need for remote access to maintain and monitor systems (some driven by COVID-19 and some simply driven by resource restraints). In addition, IT and cybersecurity debt created over the years, as budgets were pushed year to year, has left teams stretched thin and struggling to maintain a patchwork of complex systems and applications. And candidly, we need to recognize some complicity in making sure all parties understand the real risk to our nation. If it makes you feel better (which it shouldn’t), most other countries are in similar or even worse situations than the U.S. What we’ve seen in the last year are early indications of a much larger storm of compromises on the horizon. I was personally impacted by the Colonial Pipeline event, vacationing in North Carolina with the inability to get gas to return to Virginia. Being only a full tank away from home yet doubting I would find the simple commodity of gas vividly reminded me of just how fragile our infrastructure is today. If you’re a pipeline provider, what should you do, even if you haven’t yet been notified? Μake sure you have a plan in place for hitting the initial directives requirements and start setting expectations that the timeline may be accelerated for small and large providers. Even before reading the first or second directive, make sure you follow general best practices for critical OT environments, including: Segment your OT from corporate infrastructure. Even with extreme financial considerations, tools and systems must be completely separated including identity, network management systems, and cybersecurity systems and management. Protect the connections where corporate or access cross into OT (which should rarely occur) with the utmost diligence (i.e., multi-factor authentication, post-level blocking, limited access, minimal service accounts, etc.). Make sure you have high-fidelity monitoring with a program that provides continuous improvements. Properly manage your password policy and enforce it with technology guardrails. Know that bad things happen to good people and companies so always have and practice your incident response plan. The belief that our nation’s critical infrastructure extends beyond the reach of sophisticated cyberattacks is a significant underestimation of our enemies. The Colonial Pipeline incident clearly demonstrated the impact of threats posed by increasingly sophisticated and resourceful hackers. It also affirmed the importance of accelerating the security maturity of our critical infrastructure, with the help of trusted cybersecurity partners. If pipeline providers take on these cyber challenges today, the nation may look forward to a future where the critical infrastructure is better protected from attack. For a broader perspective, learn more about key factors contributing to cyberattacks and more recommendations in our blogs: 3 Factors Contributing to Cyberattacks and Recommendations to Protect Your Organization , Critical Infrastructure (CI) Cybersecurity: Is CMMC the Answer? Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

President Biden's memo emphasizes federal cybersecurity regulations to urge companies to take action against ransomware threats. Learn more.|President Biden's memo emphasizes federal cybersecurity regulations to urge companies to take action against ransomware threats. Learn more. President Biden’s Cybersecurity Memo — What You Need To Know Pondurance June 4, 2021 Facebook X (Twitter) LinkedIn Copy link President Joe Biden sent out a memo building on the Cybersecurity Executive Order. As stated in the memo, the number and size of ransomware incidents have significantly increased. Security of both private and public sector infrastructure remains a top priority. Under Biden’s leadership, the Federal Government will be working with partners around the globe to disrupt and deter ransomware threat actors by “disrupting ransomware networks, working with international partners to hold countries that harbor ransomware actors accountable, developing cohesive and consistent policies towards ransom payments and enabling rapid tracing and interdiction of virtual currency proceeds,” according to Biden’s memo. As highlighted, even within the private sector, no organization large or small is safe from these nefarious attacks. This means the private sector has a critical role to play in protecting itself and consumers against ransomware threats. Biden’s memo is urging companies to view ransomware as a threat to their core business operations rather than just as a risk of data theft. The keys to understanding the risks involved in cybercrime are ensuring there is a comprehensive cybersecurity strategy in place to detect and mitigate threats as they occur and having a contingency plan in place to respond to cyber incidents. Key stakeholders within an organization should discuss the increasingly common risk of ransomware and other threats and evaluate their current corporate security posture against these recommendations. Implement the five best practices from President Biden’s Executive Order: Multi-factor authentication (MFA) — We recommend using MFA and prioritizing the use of an application (like Google Authenticator or Microsoft Authenticator) before SMS (text message). Along with other controls, our NIST/Cybersecurity Framework assessment can help organizations identify missing or partially implemented controls and prioritize improvements. Endpoint detection and response (EDR) — Our Managed Detection and Response (MDR) service provides endpoint detection, response, and threat hunting across all endpoints, as well as strong next-generation threat prevention that outperforms traditional antivirus. Encryption — We recommend using encryption to secure digital assets in transit and at rest. Encryption can protect sensitive information by using algorithms to scramble or code sensitive information, making it readable only with a decryption key. Our Application and System Architecture Reviews have helped many customers identify gaps such as missing encryption. Employment of a skilled security team — While a good recommendation, this remains challenging for most organizations. Through our MDR service , our security operations center (SOC) acts as an extension of your internal team, monitoring and hunting for threats 24/7 and combining artificial intelligence with our expert analysts. The sharing and incorporation of threat information in your defense — Through our MDR and Incident Response (IR) services , our analysts apply their expertise to analyze a client’s environment and uncover previously unknown threats. Threat intelligence is collected from these investigations and combined with our network of sensors and intelligence from public and private sector partnerships. Our clients receive the benefit of threat intel sharing through our fully managed services and threat briefing. Backup your data, system images, and configurations. Test them regularly and keep the backups offline. As a best practice, store all backups off-site, away from your existing infrastructure. All backups should always be encrypted to protect your data from theft and other forms of extortion in the event attackers gain unauthorized access to your network. Pondurance is able to assist with Business Continuity Planning and Review along with Incident Response Planning . Update and patch systems promptly. Many organizations struggle to keep up with the latest vulnerability and lack a sense of what to patch first. Our Vulnerability Management Program provides guided recommendations tailored to patch and remediate cybersecurity risks across applications and infrastructure. Test your incident response plan. Our Red Teaming and Security Incident Response Planning services ensure that our clients are prepared in the event of an incident. They accelerate the time it takes to investigate and contain an incident, determine exposure through forensic analysis, and restore operations. Check your security team’s work. Use a pen tester. Our Penetration Testers and Red Teamers perform focused testing to exploit vulnerabilities and penetrate systems to mirror the behavior of a real-world attacker, providing you with guided recommendations on how to harden these gaps. Segment your networks. Our Application and System Architecture Reviews help customers understand the gaps in their network design and segmentation strategy, keeping corporate business functions and other operations separated. At the same time, we know that organizations must maintain 360-degree visibility across all connected devices. Our MDR service eliminates blind spots along with actively monitoring these assets on a 24/7 basis. This includes monitoring protected or quarantined segments for anomalous and malicious IP traffic patterns. Ransomware has disrupted numerous organizations, especially amid the COVID-19 pandemic. Healthcare is especially vulnerable to ransomware, and we will continue to see an uptick in attacks in this industry. Hospital networks and medical devices that require an internet connection to improve and monitor patient care are particularly vulnerable to downtime caused by ransomware. The financial impact of ransomware attacks is multifaceted. The rising costs of these attacks include business disruption, revenue loss, exposure of protected health information (PHI), fines and HIPAA violations, and ransomware negotiations. Pondurance offers a comprehensive suite of cybersecurity solutions that can provide your organization with pre-incident, incident, and post-incident strategies that can elevate your cybersecurity maturity model to protect you from today and tomorrow’s cyber threats. Recognized by Gartner, Pondurance provides 24/7 U.S.-based Security Operations Center (SOC) services powered by analysts, threat hunters, and incident responders who utilize our advanced cloud-native platform to provide organizations with continuous cyber risk reduction. Learn more about our MDR services in our guide: 5 Things to Consider When Choosing an MDR Provider . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

In this blog, you’ll learn more about the cyber application process, artificial intelligence (AI), state laws and regulations, and acts of war. Read now. Hot Topics in Cyber Insurance Pondurance September 20, 2023 Facebook X (Twitter) LinkedIn Copy link Cyber insurance has been available as an add-on or standalone business policy since the early 2000s. Organizations have been able to buy high-quality cyber insurance at a reasonable cost to offset the risks that businesses have faced as they’ve gone through digital transformations the past decade and in parallel have faced with the rapid growth of cyber threat actors. Depending on the policy, covered risks can include a forensic investigation, litigation expenses, regulatory defense expenses and penalties, data recovery, data breach notification to customers, system and network repair, and much more. In 2020 and 2021, cyberattacks, particularly ransomware attacks, increased significantly in frequency and cost. As much as 66% of all organizations reported that they were hit by ransomware in 2021, and the average ransom payment was $812,360, according to Sophos’ The State of Ransomware 2022 . As a result, cyber insurance policies increased in cost in 2022, and insurers began imposing stricter requirements to qualify for a policy. Today, the cyber insurance market is a $16.66 billion industry that is growing by leaps and bounds. By 2030, the market is expected to expand to more than $84 billion. Doug Howard, CEO of Pondurance, speaks to audiences at conferences and webinars, fielding questions about the changes that continue to alter the threat landscape and impact the cyber insurance industry. He knows firsthand that technology leaders at organizations are eager to learn the latest information about cybersecurity. Currently, the hot topics of interest include the cyber application process, artificial intelligence (AI), state laws and regulations, and acts of war, to name a few. Cyber Application Process Most organizations seek out cyber insurance to protect their businesses against threats, but the hurdles for getting cyber insurance have been raised. For instance, last year, insurers required organizations to have multifactor authentication (MFA), better patch management programs, and better endpoint protection to qualify for cyber insurance. Today, insurers need to know not only that an organization has these technologies but, more importantly, that the technologies have been implemented and operationalized. There’s a long list of items that most insurers require for a cyber insurance policy, including now managed detection and response , and it’s important to implement these requirements prior to the application process. “Executives and boards want to know what variables impact their ability to get cyber insurance,” said Doug. “It’s common to get questions since people want to obtain cyber insurance or they already have cyber insurance and want to know what hurdles they will have with their renewals. The last thing any executive wants is to be denied cyber insurance and need to explain this to their investors and board.” AI The global AI market totaled $428 billion in 2022 and is expected to surge to more than $2 trillion by 2030, according to Fortune Business Insights . Decision-makers may believe that they can execute AI for their networks to solve all of their cybersecurity problems, but that’s not the reality. Human attackers must be confronted by human defenders, making people the most important component of any comprehensive cybersecurity program. The hot topics in AI right now involve attribution, said Doug. Who performed the attack? Was it a machine? Was it a group? Also, organizations want to better understand how to keep their sensitive personal information from becoming part of the AI database, which could trigger regulatory privacy violations and a cyber insurance claim. AI is evolving rapidly and will benefit the defender, but it will also benefit the attacker who has less rules to live by, if any. State Laws and Regulations Increasingly, states are passing cybersecurity legislation and regulations to combat the rise in cyberattacks and encourage organizations to implement better cyber practices. New laws, such as the New York Department of Financial Services Cybersecurity Regulation , are having a positive impact on the security of U.S. companies. However, organizations are finding it difficult to track, understand, and comply with all the regulations that govern their industries. Such regulations can impact an organization’s ability to qualify for cyber insurance, adding even more reason for organizations in every industry to stay up to date on regulatory compliance. Acts of War War, terrorism, and insurrection typically fall under an acts of war exclusion in a traditional insurance policy. However, a cyber insurance claim can involve nation-states making hostile attacks on U.S.-based organizations and holding data and business operations hostage in exchange for a ransom payment. The courts have been busy defining what constitutes an act of war in cybersecurity. “If it’s a declared state-sponsored foreign actor — which it rarely is, by the way — that’s not covered because it’s a state action,” said Doug. “But that’s a pretty dangerous road to go down for an insurance company. The exclusion is also a competitive variable for companies choosing a cyber insurance policy.” Conclusion The threat landscape continues to evolve year after year, and the cyber insurance industry is evolving with it. Over the next few months, Pondurance will discuss each of the above cyber insurance topics in greater detail, as well as introduce other important cybersecurity issues as they emerge. For our most recent blog on cyber insurance, check out Applying for Cyber Insurance: How to Get Accepted. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Enhance Your Defense Against BEC Attacks. Discover advanced strategies designed to combat Business Email Compromise (BEC) attacks effectively. This resource goes beyond mere awareness, offering actionable insights and techniques to protect your organization from potential threats. Beyond Awareness: Advanced Strategies to Stop BEC Attacks in Their Tracks Max Henderson, Dustin Hutchison Ph.D. December 11, 2024 Facebook X (Twitter) LinkedIn Copy link Business email compromise (BEC) attacks typically involve a threat actor gaining access to a legitimate email account through phishing and using it to manipulate internal communications, such as deceiving employees into transferring money or sharing sensitive data. This past week, along with colleagues Kamran Salour and Ryan Cook from Lewis Brisbois, we presented a webinar discussing how organizations can reduce risks and mitigate damages from these insidious types of cyber threats. The frequency of such attacks has increased in recent years. In 2023, the FBI’s Internet Crime Complaint Center received 21,489 BEC complaints with $2.9 billion in adjusted losses. Additionally, the IBM Cost of Data Breach Report 2024 found that 10% of BEC attacks also resulted in the breach of personally identifiable information (PII) by the compromised organization requiring notification of regulatory authorities and affected individuals under applicable U.S. federal and state data breach laws. Pondurance also has witnessed a rise in BEC activity. In 2024, approximately 40% of all new digital forensics and incident response (DFIR) cases seen by the Pondurance team involved BEC. Our team found that two primary factors contributed to the substantial number of BEC attacks: multifactor authentication (MFA) bypass and the lack of optimization of cybersecurity products and services. Chart courtesy Security Week , March 7, 2024. In this article, we will delve into each of these factors, looking at how to use various cybersecurity tools and techniques to detect and mitigate BEC attacks in their early stages and suggesting best practices to prevent an attack. MFA bypass For the past few years, experts have stressed the importance of organizations having MFA enabled on all networks — even touting MFA as a “cure all” for many use cases. So when the Pondurance team tells organizations that 92% of all BECs they see involve instances where MFA is already fully enabled, the organizations are surprised and want to know how threat actors can get past MFA. Threat actors are constantly evolving their skills and searching for new ways to gain access to valuable data for financial gain. In 97% of all BEC cases seen by the Pondurance team, threat actors use readily available phishing kits . With phishing kits, threat actors can create fake websites where users believe they are signing in to, for instance, a Microsoft login page, though they’re not. The page prompts the user for a code, and when the user enters the code, it forwards it to the actual Microsoft login page. At that point, the threat actors have the user’s username, password, and session token. With that session token, the threat actors can log in again for a set period of time without having to submit MFA credentials again. They have successfully bypassed MFA. This scenario vividly illustrates the critical need for comprehensive security training for all users with access to an organization's applications, especially those stored in the cloud. Even with robust technologies like MFA in place, the human factor remains one of the most vulnerable points in any security strategy. By educating employees on recognizing phishing attempts, safe browsing habits, and the importance of verifying the authenticity of login requests, organizations can significantly reduce the risk of unauthorized access. A well-informed workforce is an essential line of defense against increasingly sophisticated cyber threats, fostering a culture of cybersecurity awareness that protects both the organization and its valuable data. Optimization IT and security teams purchase cybersecurity products and services with the best intentions to keep threat actors out of their networks and away from their users. However, despite their best intentions, frequently tools such as endpoint detection and response (EDR) software, aren’t carefully and precisely configured to minimize a threat actor’s ability to circumvent their detection capabilities . fully optimize the configurations of those tools. Conditional access controls must be properly configured at an optimal level, and alerts must be set up, carefully monitored, and fine-tuned periodically to catch real threats while minimizing false positives. There’s also a recent movement in cybersecurity toward requiring a higher-level (E3 or E5) license for many products, such as Microsoft O365. But many users with these higher-level licenses are not properly configuring the products to work for them. They don’t optimize to the full capacity and don’t realize that some of the security features have been moved to a higher-level license. In addition, given challenges in attracting and retaining highly qualified cybersecurity talent in today’s market, organizations would often benefit from tapping outside experts and managed detection and response (MDR) services in order to get optimal expertise focused on setup and configuration of key cybersecurity products. Early detection The earlier an in-house team or service provider can identify suspicious cyber activity in the network, the better. At Pondurance, our MDR and always-on security operations center (SOC) team, have extensive experience in catching BECs in the early stages of attacks in a couple of different ways. First, it’s physically impossible for a user to be in two places at once, so we monitor for multiple logins happening simultaneously from both the network sensor and the Microsoft login. When the team sees this scenario, it’s a telltale sign that something bad is happening. Second, our MDR leverages advanced machine learning and uses SOAR— security orchestration, automation, and response — technology to assist our analysts understanding and automate the escalation of threats to ensure a faster response time. After all, when an organization is confronted with a malicious threat actor, every minute counts. Best practices Our team at Pondurance has compiled a list of best practices that organizations can implement to reduce the likelihood of a BEC attack. As mentioned earlier, phishing awareness training ranks as a top recommendation. Every organization has vulnerabilities from a human risk standpoint, so it’s necessary to keep every employee in the know about how to avoid BEC attacks due to phishing emails. It also helps your organization in demonstrating intent and compliance with various regulations in areas of cybersecurity, data privacy and breach notification. Following training, organizations need to identify which employees are at the highest risk of clicking on a malicious link in an email. For these “phish-prone” users, Pondurance suggests more frequent training and testing and, if that’s not enough, recommends restricting access and permissions to the bare minimum required for the job. Conclusion It’s important for organizations to protect themselves from BEC attacks on many different fronts. In addition to phishing awareness and training, these suggest several additional best practices, such as using endpoint protection, principle of least privilege, and continuous monitoring, to reduce the likelihood of an attack. BEC attacks are on the rise, and organizations need to know why these attacks happen and how to safeguard their valuable data. Check out the complete list of Pondurance’s best practices to protect your organization against a BEC attack . Authors: Max Henderson: Max Henderson is the Assistant Vice President of Digital Forensics and Incident Response at Pondurance. Max’s 10-year tenure at Pondurance has included casework featured on CBS’ 60 Minutes , while he also serves as a recurring speaker on cybersecurity at Yale University and as an expert contributor on cybersecurity to CNN. Max has earned advisory board status at SANS Institute for his exemplary scores on the GIAC Reverse Engineering Malware certification. Like many in DFIR, Max started and rose through the ranks from the Pondurance SOC and was the founding member of Pondurance’s DFIR practice. Max has contributed to various federal investigations and indictments related to cybercrime, which resulted from several hundred forensics investigations related to ransomware, BEC, nation-state-funded attacks, zero-day vulnerabilities, insider threats, and exert witness testimony for cases at trial. Dustin Hutchison: Dustin Hutchison is the Vice President of Services and Chief Information Security Officer at Pondurance. Dustin has over 20 years of experience in information security, risk management, and regulatory compliance. Prior to joining Pondurance, Dustin was a risk and compliance professional focusing on HIPAA, Payment Card Industry Data Security Standard, and risk assessments for new technology acquisitions ranging from infrastructure solutions to patient care devices. Dustin is also currently an adjunct professor at Ivy Tech Community College, Sullivan University, Embry-Riddle Aeronautical University, and University of the Cumberlands, teaching undergraduate through doctoral level technology and cybersecurity courses. Dustin’s Ph.D. dissertation topic focused on the adoption of cloud computing in healthcare. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Cyberattacks are increasing in scale and size, making organizations question how to defend themselves. Learn how to protect your business with advice from Pondurance experts.|Cyberattacks are increasing in scale and size, making organizations question how to defend themselves. Learn how to protect your business with advice from Pondurance experts. Batting a Thousand: Pondurance MDR Services Hit a Home Run Pondurance November 16, 2021 Facebook X (Twitter) LinkedIn Copy link It’s the beginning of the season and you’re looking at a long roster of players—some in the major leagues, some in the minors—trying to pick the winners who will comprise your dream team. Only instead of a baseball lineup, you’re trying to pick the winning Managed Detection and Response (MDR) services provider, and the choices are overwhelming. Research and advisory firm, Gartner, says, “MDR services are available from a range of providers (well above 100 providers as of this research).” If you’re a small- to mid-sized (SMB) organization looking to partner with an MDR services provider, where do you start? How do you draft a “star player” from such a large list of potential MDR offerings to find the right fit for your organization? With its list of Representative Vendors, we believe the latest MDR research report from Gartner can be a great starting point. Called the Gartner® Market Guide for Managed Detection and Response Services* , this report defines and describes the MDR market and the specific services that providers can be delivering to meet the unique needs of the buying organization. Pondurance rounds all of the bases, and we believe we meet all of the attributes that Gartner ascribes to MDR services and successful service providers (and more). A look “into the dugout” at our 24/7/365 remotely-delivered modern security operations center (SOC) will reveal: An open, managed technology stack that provides best-in-class detection and response across network, endpoint, log and cloud infrastructure. A fully staffed, US-based team of security analysts and experts that interacts with you daily—either directly or online through a cloud-based service portal—and who significantly enhance your overall security knowledge and capabilities. Proven processes for detection and response that are customized to your security goals and requirements. Robust remote response capabilities, including the ability to provide closed-loop Incident Response (IR), where we partner closely with you to respond to threats through instant triage and integrated IR services. While we use proprietary artificial intelligence (AI) and machine learning (ML) technologies in our SOC, humans and human intelligence are critical when it comes to identifying real threats. The elite and well-trained security analysts, threat hunters and incident responders that are unique to Pondurance have often been the difference between swift containment and business impact. Gartner states, “Other elements of MDR are emerging in the market, but are not yet commonplace.” We believe Pondurance delivers capabilities like these, including: Providing Digital Forensics and Incident Response (DFIR). Our experienced team of Incident Responders, Incident Handlers, and Forensic and Malware Specialists work to guide you every step of the way to identify, contain, eradicate and recover from a breach. The ability to monitor and detect threats across a diverse range of telemetry sources including networks, logs, endpoints and cloud environments—AWS, GCP and Azure—as well as SaaS applications. Offering a Vulnerability Management Program (VMP) and other validation capabilities. A key component of the Pondurance MDR solution, our VMP combines periodic vulnerability scanning with penetration testing. We continually identify, categorize and prioritize vulnerabilities, and provide actionable insights to mitigate potential threats. Providing your team with the ability to upload malware samples for us to analyze, as well as access to “raw” log data in case you want to hunt alongside us. Enabling your team to have two-way conversations through the Pondurance Scope dashboard, providing you with an immediate and easy method to converse directly with our SOC team. Most providers only provide access via tickets. We believe our risk-based strategy and approach to cybersecurity with our vCISO services and MyCyberScorecard , through our acquisition of Bearing Security, also sets us apart from other MDR providers. Pondurance is specifically focused on addressing the cybersecurity needs of underserved SMB organizations. If you have limited investments in security technologies or lack the staff and skills to support a 24/7/365 SOC, we can provide comprehensive threat defense through our MDR services. If you’ve already made significant security investments in tools and people, we can partner with you to complement your current security operations. Threat containment and mitigation: Providing our clients with an all-star defense to stop the opponent from scoring runs We believe that the Gartner report reinforces the importance of another key service provided by Pondurance: Rapid, proactive response to detected threats. By combining automation and human expertise, we’re able to very quickly identify a threat and take action to mitigate even the most sophisticated cyberattacks. An example of our ability to act quickly on a threat came recently with a manufacturing client . An employee at our client accidentally visited a fraudulent site and was served a malicious download for a fake Chrome update. The download created a remote backdoor for the attacker, who leveraged toolsets to dump credentials and attempted to move laterally within the environment. Our 24/7/365 SOC team detected the initial access and took immediate action, reporting the malicious activity to the client’s security team and isolating the compromised endpoint before the attacker could take further action. Get a jump on the ‘22 draft: Stack your lineup today You may have seen this quote from Gartner before: “By 2025, 50% of organizations will be using MDR services for threat monitoring, detection and response functions that offer threat containment and mitigation capabilities.” Why wait to add your organization to the ranks of those using MDR services? The time is now—not 2024 or 2025—to begin putting MDR to work protecting your organization. Small to mid-sized businesses have oversized targets on their backs, often because they just don’t have the staff or budget to invest in cybersecurity the way large enterprises do. Bad actors never take a break, so organizations without the proper security controls in place are on borrowed time. Pondurance can help you stack your lineup by providing you with affordable enterprise-class MDR and DFIR services, staffed by a team of some of the best threat hunters in the world. If you use the Gartner Market Guide for Managed Detection and Response Services to evaluate MDR providers, we believe you’ll find that Pondurance hits a home run, offering all of the key capabilities organizations need to detect, respond, contain and mitigate threats. Request a demo to learn more and be sure to download a complimentary copy of the report . *Gartner, Market Guide for Managed Detection and Response Services, by Pete Shoard, Craig Lawson, Mitchell Schneider, John Collins, Mark Wah, Andrew Davies, 25 October 2021. *** Gartner Market Guide for Managed Detection and Response Services, Pete Shoard, Craig Lawson, Mitchell Schneider, John Collins, Mark Wah, Andrew Davies, 25 October 2021. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Gartner is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Pondurance is proud to be a finalist in three categories of the 2025 Cyber Insurance Awards, showcasing our team's dedication to exceptional cybersecurity solutions. Celebrating Our Team's Achievement as Finalists in the Cyber Insurance Awards USA 2025 Pondurance February 20, 2025 Facebook X (Twitter) LinkedIn Copy link At Pondurance, our commitment to empowering our customers to eliminate data breach risks is at the forefront of everything we do. We are honored by the trust they place in us, and it is this focus that has driven us to be recognized as finalists in the prestigious Intelligent Insurer's Cyber Insurance Awards USA 2025. We are proud to share that we have been nominated in not one, but three categories: Cyber Security Solution Provider of the Year Cyber Insurance Incident Response Provider of the Year Cyber Security Consulting Services Provider of the Year A Testament to Our Team's Hard Work This significant recognition underscores the hard work and commitment of our exceptional team. Each member plays a crucial role in providing top-notch cybersecurity solutions, consulting services, and effective incident response strategies. Their talents and determination exemplify our mission to protect and empower our customers in eliminating breach risks. Commitment to Cybersecurity Excellence Being selected as finalists in these categories affirms our team's ability to tackle complex cybersecurity challenges head-on. We have cultivated a culture of collaboration and continuous learning, ensuring that our experts stay ahead of the curve with the latest security trends and technologies. This commitment not only benefits our customers but also strengthens our internal dynamics, making Pondurance a leading force in the cybersecurity industry. Celebrating Team Achievements While we are proud of this recognition, it is the accomplishments of our individual team members that truly make us exceptional. From our incident response specialists who work tirelessly to neutralize threats, to our consulting professionals who provide invaluable guidance to customers, the depth of talent within Pondurance is remarkable. Each department works cohesively, and the synergy we create through teamwork allows us to deliver innovative solutions that are effective and tailored to meet our customers' unique needs. This award nomination is a celebration of all the late nights, brainstorming sessions, and steadfast dedication that our team has invested in their work. Looking Ahead: Continuing the Journey As we celebrate this achievement, our focus remains on the future. The cyber landscape is continually shifting, presenting new challenges that require our unwavering commitment to quality and innovation. Being recognized as finalists in these awards is not just an accolade; it is motivation for us to enhance our services and bolster our capabilities to serve our customers better. We are incredibly grateful to our customers and partners who trust Pondurance with their cybersecurity needs. Your support drives us to achieve greater heights, and we are committed to delivering the highest level of service in response to your feedback and needs. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Pondurance experts share the latest cybersecurity insights on web compromises, critical vulnerabilities, social engineering scams, GentleKiller ransomware, and EDR threats. August Cyber Threat Download™ Pondurance August 17, 2026 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. DFIR insights The digital forensics and incident response (DFIR) team is seeing an increase in compromises on multiple sites that use WordPress, Joomla, and ColdFusion. The team discussed two specific cases. In the first case, a client had not updated Joomla since 2021, and 14 webshells — pieces of code that allow a threat actor to access the backend of a website without having to log in to the actual infrastructure — were present. Some webshells dated back as far as 2019, and six webshells appeared this year following a June 5 announcement that an improper access control vulnerability in Joomla's JCE editor extension allows for the creation of new editor profiles for unauthenticated users, resulting in PHP code being uploaded and executed. A proof-of-concept code was posted on GitHub on June 8, and the Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on June 10. The team saw one threat actor compromise the system six different times using six different webshells. Ultimately, the threat actor changed the administrator password and redirected the site. In the second case, a client website had 10 vulnerable WordPress plug-ins that required updates. However, for unknown reasons, the third-party vendor had not made those updates. On June 9, administrator-level users were created on a WordPress site via authentication bypass. Then, on June 10, an unauthenticated bypass vulnerability in UpdraftPlus was announced, but the client was already compromised. On June 21, one of the new administrator accounts added a ClickFix captcha to the site, and on June 22, when internal users logged in to the website, they executed the ClickFix captcha. As a result, several computers were compromised, and the threat actor attempted to execute ransomware. The team recommends that clients using third-party hosts for their websites review their contracts to ensure that plug-ins are receiving prompt updates. Notable vulnerabilities As many as 8,002 newly disclosed vulnerabilities were reported in July — by far, the highest number of vulnerabilities ever reported. Of those 8,002 vulnerabilities, there was known exploitation of 59 of them, which included 36 impacted vendors. More than 40% of these 59 exploits were remote code execution vulnerabilities. Online proof-of-concept codes were made available for 53 of the vulnerabilities, which is a whopping 90% of them, increasing the likelihood that threat actors will exploit the products. The dramatic increase in proof-of-concept codes stems from an increased use of artificial intelligence (AI). Researchers are using AI to assist in finding new vulnerabilities and help them write the proof-of-concept codes that explain how to exploit the vulnerabilities. The team spotlighted the many vulnerabilities that impacted Google Chrome in July. On July 1, Google announced updates to address 382 vulnerabilities that impacted the Google Chrome browser. Fifteen of the vulnerabilities were ranked as critical severity and 67 were ranked as high severity, but there were no known exploitations. The team showed the enhanced vulnerability management program (eVMP) data that they use to track vulnerabilities, which included the ones for Google Chrome. The eVMP data shows real-time information so that the team can see patching activity, new vulnerabilities as they occur, and how clients are reacting to the vulnerabilities. Typically, the team sees spikes in data when the Microsoft Patch Tuesday vulnerabilities are reported, but this instance was the first time the team had seen such a large spike for non-Microsoft product vulnerabilities. At the time of the spike, the team sent a notice to eVMP clients to explain what was happening, why it was present in their data, and how to address it. During Microsoft Patch Tuesday in June, 206 reported vulnerabilities were disclosed, including 37 critical vulnerabilities and three zero days. The zero days included privilege elevation, security feature bypass and denial-of-service vulnerabilities. Then, during the Microsoft Patch Tuesday in July, as many as 622 reported vulnerabilities were addressed — a record number that was three times the number reported in June. Of those 622 reported vulnerabilities, there were 62 critical vulnerabilities and two zero days, both of which were privilege escalation vulnerabilities. SOC insights Threat actors are clever at convincing users that they are a trusted source available to help with computer issues. The security operations center (SOC) team has recently seen an uptick in such social engineering scams, particularly impersonation attacks using Microsoft Teams . The team discussed the basic steps of a social engineering attack, offered red flags for identifying an attack, and recommended actions to take. Email bombing . To start a social engineering attack, threat actors flood a user's inbox with unwanted emails, such as marketing subscriptions or sales pitches. When unusual emails appear in a short time frame, the user should calmly assess the situation and report it directly to the IT or security team. Fake IT support. Threat actors impersonate internal help desk agents using spoofed corporate aliases to address fake security updates, technical issues, or urgent support requests. If someone claiming to be a support person with the IT department makes initial contact, the user should verify the situation with the known help desk. Remote access request. Threat actors request remote access to the user's computer using desktop tools such as Quick Assist and AnyDesk. If the support person instructs the user to ignore warnings and download software from an unfamiliar link, the user should not do it. Users should never share credentials or grant remote access during an unsolicited interaction. Device compromise. Once the threat actor has the user's credentials or has been granted remote access, the device has been compromised. If the support person asks the user to approve security prompts, disclose credentials, or provide a multifactor authentication (MFA) code, the user should report the incident to the security team. Attacker activity. After a compromise, the user may experience activity such as the opening of unexpected command windows, sensitive file access, or loading of unusual software on the device. The user should safely disconnect the device to minimize the amount of exfiltration, and the IT or security team should immediately reset the credentials. Users can be tricked by social engineering scams, but organizations can proactively implement measures to protect users against attacks. The team recommends that all organizations use hardening and allowlists to restrict external access to Teams. Also, organizations should implement training to teach users to recognize external chat warnings and suspicious IT support requests and learn the process for how the internal help desk verifies its identity to users. If an organization does not have a process in place, the team recommends establishing one. GentleKiller activity The detection engineering team discussed how threat actors are using multiple techniques to terminate and disable endpoint detection and response (EDR) and antivirus (AV) products. Of particular interest, the team discussed how The Gentlemen, a financially motivated threat actor group, manages the ransomware-as-a-service platform known as GentleKiller , and the group's affiliates carry out the attacks. The attacks consistently begin at the internet-exposed edge infrastructure. The group targets Fortinet FortiGate and Cisco devices using credential brute-force attacks, exploitation of known vulnerabilities, and access purchased from initial-access brokers. The group actively tracks a few newly disclosed vulnerabilities, then pivots specifically to CVE-2025-7771 . EDRs operate in user mode and kernel mode , but the Windows kernel, which is Ring 0, has the highest level of privilege. The attack method uses bring your own vulnerable driver (BYOVD), which abuses a legitimately signed yet vulnerable kernel driver to execute the attacker-controlled code in Ring 0. EDRs are not able to defend against malicious code executing in Ring 0, making BYOVD an effective attack technique. Once in Ring 0, the attacker can bypass operating system protections, manipulate kernel memory, and disable or terminate the EDR and AV drivers and protected processes before executing ransomware. Organizations can check to see if BYOVD policies are enabled by running PowerShell. If the result is 1, the policies are enabled. If the result is 0, the policies are not enabled. The team discussed several ways organizations can harden against GentleKiller attacks including patching edge devices, using allowlists for administration, implementing internal network segmentation, using the best authentication possible on internet-reachable remote desktop protocols and remote workstations, not allowing users to be local administrators, using phishing-resistant MFA , and backing up and testing data. About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our SOC, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Understanding the process for CMMC and knowing what to expect from the process can minimize confusion. Learn how to overcome the certification challenges in this blog.|Understanding the process for CMMC and knowing what to expect from the process can minimize confusion. Learn how to overcome the certification challenges in this blog. Overcome the Certification Challenges for CMMC Pondurance November 2, 2021 Facebook X (Twitter) LinkedIn Copy link Suppliers within the defense industrial base, including contractors and subcontractors, now must undergo assessments to prove that they can sufficiently perform cybersecurity capabilities as specified in the Cybersecurity Maturity Model Certification (CMMC) from the Department of Defense (DoD) when pursuing certain types of business. Many suppliers are concerned about the changes in their businesses and operational practices that could occur as a result of these new requirements. Specifically, small and midsize suppliers worry that the CMMC requirements are too burdensome on their budgets and personnel, and one of the most consistent issues for suppliers is confusion about what and how much needs to be done to attain certification. CMMC requires that suppliers meet the security maturity level requirement for the projects they wish to bid on. Pondurance believes suppliers should evaluate their own readiness and ability to pass an assessment by working with a registered provider organization (RPO) to identify any gaps and make adjustments before the organization undergoes its final audit. Finally, they must pass an assessment conducted by an authorized third-party assessment organization (C3PAO) to achieve certification, a process they will need to undergo every three years. While the process for certification can be difficult, it can be made more manageable for suppliers when they know what to expect. There are many challenges that suppliers face as they prepare for CMMC , including mapping the government information on their networks, understanding the controls required, knowing how to perform the testing needed, and figuring out the workloads and costs involved. Fully Mapping the CUI The DoD implemented CMMC to protect sensitive government information or data, known as controlled unclassified information (CUI), throughout the supply chain. Contractors and subcontractors alike must understand what CUI is and all of its relevant forms. CMMC requires that suppliers track and understand where the CUI resides on their networks. Suppliers must gain a complete understanding of what CUI they have and which systems it touches to ensure proper scope, without blindly adding CMMC controls where they are not needed. Also, suppliers need to map life cycle data flows to ensure accuracy and completeness. Understanding the Controls CMMC can require satisfying hundreds of security practices for compliance, depending on which maturity level is desired. As maturity levels increase, the number of security practices increases, resulting in proving performance over a larger set of controls. Maturity level 1 requires 17 security practices, level two requires 72 security practices, and level three requires 130 security practices. Suppliers should take the time to understand the full scope of the practices and ensure they are able to produce acceptable evidence and artifacts to prove that they have met each of them. Deploying, Testing, Remediating, and Validating There is no participation award for the CMMC. A supplier either meets the requirements for certification or it doesn’t. Preparation and readiness are key to ensuring that a supplier is ready for a final assessment. A supplier may assess its own readiness for the assessment , but many suppliers will choose to work with an RPO for advice, consultation, and recommendations to help them identify and close gaps. RPOs are U.S.-owned companies that have passed a background investigation, committed to a code of professional conduct, signed an agreement with the CMMC Accreditation Body, and have at least one authorized registered practitioner on staff at all times. Understanding the Workload and Costs While working through the CMMC requirements, suppliers should be prepared for additional workloads and costs. The new requirements can drive additional needs for new tools, skills, and resources for tasks that have not previously been performed. The costs can involve operational costs, such as tools, personnel, and time to perform the controls in a compliant manner, and administrative costs, such as managing the assessment, working with the C3PAO, managing internal compliance, and understanding the controls, policies, and procedures. Conclusion Yes, the process for CMMC can be difficult, but knowing what to expect can minimize the worries and confusion. Suppliers should face the challenges head-on to experience the reward of certification following the first assessment with a C3PAO. Learn more about CMMC in our panel discussion Successfully Navigating Through CMMC: What You Need To Know. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn what to expect after a cyber incident, from containment and evidence preservation to forensic investigation, recovery, and long-term improvements. After a Cyber Incident: What to Expect Pondurance September 16, 2026 Facebook X (Twitter) LinkedIn Copy link When a cyber incident occurs, the first decisions an organization makes can affect everything that follows, from the forensic investigation to business recovery. Acting quickly matters, but so does preserving evidence, involving the right people, and understanding their roles in the response. In this Q&A, Abbey Mirelli , an incident response manager at Pondurance, explains what organizations should expect during the first days and weeks following an incident and what they can do now to prepare for an effective response. Q: What should an organization do immediately after discovering a cyber incident? Abbey: The priority is to contain the incident without destroying evidence. If you can isolate an affected system, that might mean disconnecting it from the network. If multiple systems are affected, you may need to isolate a network segment. Before doing that, however, consider the potential impact on business operations. Containment doesn’t mean immediately cleaning up the affected systems. Avoid deleting files, running cleanup tools, or reinstalling operating systems. Those actions can destroy evidence that a forensic team may need to determine what happened and whether data was accessed or affected. Document what you observe and look for indications of a broader compromise. Check your endpoint detection and response (EDR) platform for alerts or unusual activity, or to help quickly isolate endpoints that were affected. From there, escalate the incident according to your incident response plan. If you have cyber insurance, that generally includes notifying your carrier according to your policy’s requirements. Legal counsel is also recommended to become involved. Depending on your coverage, your insurer may help engage an approved forensic vendor or breach counsel. A useful rule for the initial response is: isolate , preserve , document , and escalate . Q: What happens once the response team is assembled? Abbey: There is typically an initial scoping call involving the organization and outside parties engaged in the response. The purpose is to establish what happened, what has been discovered, and what actions have already been taken. It also allows everyone to establish their responsibilities. Legal counsel can advise on communications and determine whether the incident creates legal, regulatory, contractual, or notification obligations. Once engaged, the forensic team begins collecting and analyzing evidence. The insurer handles questions about coverage, expenses, and approved vendors. Forensics and legal will not be able to answer questions about what your insurance policy covers. Leadership should also be involved because the organization may need to make important decisions about recovery and business continuity while the investigation is ongoing. Sometimes, those hard decisions may have to be made with incomplete information as the forensic team continues its work. Regular status calls help keep everyone coordinated as the response progresses. Depending on the incident, those calls may happen once or twice a day. The forensic team can provide preliminary findings, while legal counsel evaluates the potential implications of those findings. Q: What should organizations expect during the first week? Abbey: During the first week, the investigation and recovery are typically happening at the same time. The forensic team will work to develop a timeline of the incident, identify which systems were affected, and investigate whether data may have been exfiltrated. Legal counsel can then use those findings to evaluate potential reporting and notification requirements. This is also where understanding your data becomes important. Organizations need to know what types of data they have and where that information resides. Is sensitive information stored in email, on servers, or on employee workstations? Those details can become important when it comes to evaluating the potential impact of an incident. Sometimes, the organization may need to begin restoring systems before the forensic investigation is finished. In some instances, you can’t necessarily wait until you have all the forensic answers before starting recovery. The two workstreams often need to proceed simultaneously, with recovery decisions being made as new forensic information becomes available. Q: What happens in the weeks following an incident? Abbey: Some forensic questions can take longer to answer, particularly when investigators are trying to determine exactly what data may have been accessed. That means the forensic investigation and work with legal counsel may continue even after the immediate operational response has passed. While all of this work continues, the organization should document lessons learned, including whether responsibilities were clear, if decisions could have been made more efficiently, and if investigators had access to the logs and other information they needed. This is also the time to identify longer-term security improvements. For example, the organization might determine that it needs longer log retention or improvements to a particular technology or security control. The goal isn’t simply to respond faster next time, as quicker isn’t always better. The goal is to make sound decisions and identify changes that can better prepare the organization for the next incident. Q: What should organizations put in place before an incident occurs? Abbey: Organizations often underestimate how long recovery can take. A good place to start is with recovery planning. This includes the maintenance and testing of offline and immutable backups , and understanding what recovery would look like if critical systems were unavailable for several days. Know your recovery time objective (RTO) and recovery point objective (RPO) for critical systems. Make sure important logs are centralized, retained long enough to reconstruct an incident, and accessible to those who need them. Running a full incident response exercise is helpful for an organization so people understand their responsibilities rather than assuming the IT team or other employees will know what to do when an incident occurs. This includes having a clear call tree with primary contacts and backups. Talk with your cyber insurer before an incident occurs so you understand when and how the insurer must be notified, which forensic firms and breach counsel are approved under your policy, and which actions or expenses require prior authorization. Be sure to keep your policy number and other critical insurance information somewhere you can access even if your normal systems are unavailable. Finally, make sure your security incident response plan reflects how your organization will actually respond. The first hours of an incident are not the time to figure out who should be called, where evidence is stored, or who has authority to make critical business decisions. An effective incident response depends on more than the actions taken after an attack. Organizations that know who to call, what systems and data they need to protect, how they will recover, and what information investigators will need are better positioned to make informed decisions when an incident occurs. Join us on September 22 at 12 PM ET for The Business of Breach Readiness , a practical conversation about what effective preparation looks like across incident response, cyber insurance, and legal. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

A Forrester Consulting study commissioned by Pondurance explores whether SMBs are relying on a security operations centers to protect their business and people. Do SMBs Have Security Operations Centers, or SOCs? Pondurance August 4, 2022 Facebook X (Twitter) LinkedIn Copy link This blog is the third in a series that explores specific findings from Attackers Don’t Sleep, But Your Employees Need To , a Forrester Consulting study recently commissioned by Pondurance. ***** How many cybersecurity experts does it take to run a SOC? That’s not the start of a joke, but rather a sincere question that industry analysts and security vendors might all answer a little differently. But there’s probably one thing everyone knowledgeable about what it takes to staff and maintain a SOC could agree on: it takes significant resources, both in terms of technology and people, to run a SOC. Let’s back up for a moment and define what a security operations center, or SOC, is. A SOC is “a centralized function operating as first responders for attempted intrusions with responsibilities that include detection, analysis, investigation and response on a 24/7 basis.” (Check out the nifty new infographic with this definition and a few other interesting factoids.) When it comes to staffing a SOC, it takes a combination of highly skilled security analysts, threat hunters and incident responders all working in concert to find, validate and remediate incoming cyberthreats. Supplementing those people with artificial intelligence (AI) certainly helps, but there’s no AI out there smart enough to separate out real threats from the many alerts and false positives that might be detected. Layer in all of the security technologies needed to monitor, detect and respond to threats across networks, logs, endpoints and clouds, and you’re looking at a lot of people . Understanding the significance of a SOC to the overall security posture of an organization, we were interested to know whether small and medium-size businesses (SMBs) today are relying on a SOC to protect their business and people. The Forrester Consulting study, Attackers Don’t Sleep, But Your Employees Need To , asked a few questions related to this: If applicable, which of the following best describes the current state of your security operations center (SOC)? How many employees work for your internal SOC? When does your SOC operate? The State of the SMB SOC As we shared when we announced the availability of this study in July, we were impressed to learn that 81% of SMBs surveyed reported being monitored by a SOC; only 19% of the 232 respondents said “We don’t have a SOC at this time”. Not bad! As the data revealed, it turns out more than 53% of SMBs surveyed ultimately need to rely on an external partner for some or all of their SOC coverage. As a managed detection and response (MDR) services provider protecting our clients with around-the-clock SOC coverage, we were pretty happy to see this response, not just because it reinforces the market opportunity for Pondurance, but because it demonstrates a smart use of security budget by SMBs; they can get so much more cybersecurity protection outsourcing to a partner that can bring best-in-class technologies and a broad security skillset working on their behalf 24 hours a day, 7 days a week, 365 days a year. Staffing On the staffing question, for the 28% of organizations that reported “We staff our own internal SOC”, 64% of them responded that they have 10 or fewer employees staffing the SOC, and almost one-third have 5 or fewer. It’s true that some of the SMBs running their own SOC appear to be well-staffed and we applaud those organizations for recognizing that, to use a corny but apt phrase, it takes a village and many different skills to run an effective SOC. But for those that have 10 or fewer employees staffing their SOC? These are NOT enough resources to operate 24/7 without exhausting those employees. Hours of Operation Of the SOC-specific findings in the Forrester Consulting survey, the most concerning is that 57% of respondents reported that their SOC—whether in-house, hybrid or fully-outsourced—operates only during business hours, or extended business hours. If cybercriminals were asked the question “What are your hours of operation and who are your preferred targets?”, you know what they’d likely say? “We operate 24/7/365 and love to strike on holidays and weekends. SMBs are our preferred targets because they’re usually not as well protected but their money spends the same and their corporate data is just as valuable on the black market.” Last summer, the Cybersecurity and Infrastructure Security Agency (CISA) put out an Alert, Ransomware Awareness for Holidays and Weekends , in which they stated that, in partnership with the Federal Bureau of Investigation (FBI), they “have observed an increase in highly impactful ransomware attacks occurring on holidays and weekends—when offices are normally closed—in the United States, as recently as the Fourth of July holiday in 2021.” And that’s just ransomware… there are so many other vicious attack vectors. The Necessity of a SOC Here’s the thing: a SOC is the way to reduce risk to your organization. Period. A SOC is the right collection of technologies and people–security analysts, threat hunters, threat intelligence and incident response experts—all working together to detect and respond to cyberthreats. If you’re a SMB and can find the scarce security talent and fund the best-in-class technologies necessary to run a SOC, that’s fantastic! But be sure it operates 24/7, because cyberattackers don’t respect business hours and will strike at the most inopportune times. If you need a partner, however, to provide your organization with 24/7 SOC services, Pondurance can bring you the experts and technologies you need to sock-it! to the bad guys and protect your organization from cybercrime. Read the other blogs in this series: Modern problems require modern solutions – The SMB path to comprehensive cybersecurity The SMB’s 24/7 Challenge: Cybercriminals work ‘round the clock – shouldn’t you? Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

The REvil ransomware gang attacked against managed service provider (MSP) Kaseya Ltd. Learn how to protect yourself from potential threats.|The REvil ransomware gang attacked against managed service provider (MSP) Kaseya Ltd. Learn how to protect yourself from potential threats. What You Should Know — REvil Supply Chain Ransomware Attack Affects Thousands of Businesses Worldwide Pondurance July 19, 2021 Facebook X (Twitter) LinkedIn Copy link Last week the REvil ransomware gang, believed to operate out of Eastern Europe and Russia, launched a ransomware attack against managed service provider (MSP) software company Kaseya Ltd. This ransomware attack affected a myriad of businesses and public agencies worldwide by exploiting zero-day vulnerabilities in Kaseya’s Virtual System/Server Administrator (VSA) software. According to the Federal authorities , the attack has affected thousands of companies — making this the single largest ransomware attack to date. On July 2, 2021, Kaseya released a statement on their website confirming the ransomware incident and advised they have shut down their SaaS servers as a cautionary measure to prevent further spread. Kaseya mentioned they immediately notified customers via email. Even though Kaseya mentioned that the attack only affected on-premises customers, many of their customers provide IT services to small businesses such as restaurants, financial services, including travel and leisure, which can affect their customers’ clients as well. For example, a Swedish grocery chain was forced to close at least 800 stores because their cash register software supplier was a victim of the attack. The attack over the holiday weekend highlights the importance of having 24/7 monitoring across your entire digital landscape. The level of sophistication and timing was planned to ensure the attack was undetected until staff returned from their holiday weekend. Supply chain attacks such as these affect more than just the direct customers of the provider, they are intended to rapidly spread to their consumers as a soft attack. The U.S. Government launched a new website to help organizations provide guidance and resources to defend against the rise in ransomware. StopRansomware.gov helps organizations to understand the threat of ransomware , mitigate risk, and know what steps to take in the event of an attack. For the Kaseya ransomware incident, customers using the Virtual System/Server Administrator (VSA) software should download the Kaseya VSA Detection Too l to analyze their systems to determine if there are any indicators of compromise (IoCs) present. The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) recommend that organizations do the following: Shut down Kaseya VSA servers immediately Enable multifactor authentication (MFA) Limit communication with remote monitoring and management (RMM) to known IP address pairs Place administrative interfaces of RMM behind a virtual private network (VPN) or a firewall on a dedicated network to eliminate man-in-the-middle access If you believe you have been impacted by the VSA software or another cyberattack , Pondurance clients can rest assured that our SOC analysts are monitoring their network, endpoints, logs, and cloud infrastructure for IoCs. Our closed-loop incident response ensures that our SOC works directly with your team to deliver digital forensics and incident response services with an experienced security analyst that investigates and contains the incident. As IoCs associated with cyberattacks are detected, our security analysts will contain the threat while alerting you of any suspicious activity. Pondurance customers can contact their account manager for any questions or recommendations regarding the REvil ransomware attack on Kaseya VSA software. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Explore 24/7 incident response services, and how Pondurance helps its clients to reduce breach risk. OUR APPROACH Our proven incident response process Identify Identify and detect an incident as soon as possible Eradicate Eliminate the threat and prevent recurrence Respond Orchestrate communications with stakeholders and return to normal operations Contain Stop the incident and reduce impact Need Help with Incident Response? Download our Key Steps to Include in Your Incident Response Plan GET THE CHECKLIST HOME / SOLUTIONS / INCIDENT RESPONSE (IR) INCIDENT RESPONSE Get back to business faster and with less breach risk Digital Forensics and Incident Response (DFIR) driven by Human Expertise GET A DEMO DOWNLOAD INFO SHEET » INCIDENT RESPONSE FOR A FULL RECOVERY An efficient, effective defense against growing data breach risks When every minute counts, you need specialized cybersecurity experts to help you respond to a compromise, minimize losses, and prevent future incidents. Pondurance delivers digital forensics and incident response services with an experienced team capable of guiding you and your organization every step of the way. 100+ Severe breach incidents managed by Pondurance annually Challenges & Pain Points A delayed or uncoordinated response increases the time it takes to contain and remediate a threat Shortage of security talent makes internal IR resources expensive to hire and retain Difficulty with collecting and analyzing data may leave sensitive or protected information exposed Without proper digital forensics, your organization is at risk for business disruption and legal action How Pondurance Can Help Partner with a ready-to-respond team when crises arise Rapidly identify, detect, and contain incidents, to reduce their impact Provide critical digital forensics to support investigations and fuel your legal action plans Minimize business disruption and return to normal operations PONDURANCE INCIDENT RESPONSE FEATURES Ready to partner when crises arise Breach Preparedness Full-service incident response team Litigation support and investigative services Breach Preparedness Be ready when incidents occur with an IR plan built for fast deployment. The plan integrates your internal response plans, insurance policies, and legal team to fit your unique requirements. WHY PONDURANCE Pondurance is the only MDR solution built to eliminate breach risks Complete mid-market cybersecurity solution Pondurance MDR comes complete with all the tools mid-market organizations need for efficient, effective detection and response. We meet you where you are. We'll work with your EDR if you have one, provide one if you don't, and include access to our SIEM, continuous risk assessments, and world-class threat intelligence feeds and analysis. Access to trusted advisors Our trusted security advisors become an extension of your team, rounding out any gaps in your internal security resources. From a virtual CISO, to our expert analysts and threat hunters, to certified consultants for risk assessments, compliance audits, and more, we work to provide everything and everybody you may need to eliminate breach risks and ensure cybersecurity and data privacy compliance. Rapid implementation Get up and running fast. Pondurance integrates with your existing security stack, minimizing downtime and disruption. We can meet you where you are in your cybersecurity journey, and adapt or scale our services as your needs mature in the future. Proprietary risk analytics Cut through noise to surface the highest-risk threats first. As a modern MDR solution, Pondurance correlates telemetry across all potential threat entry points and incorporates world-class threat intelligence to better validate and contextualize alerts. Our proprietary Pondurance Exposure Index™ provides continuous threat exposure management (CTEM). Visibility across entire attack surface Get 360-degree visibility in our consumer-grade user portal. Ingest data from your entire attack surface — endpoints, network, identity, apps, cloud, and IoT — and view it in one centralized dashboard. Integrate with existing infrastructure We believe you shouldn't have to rip out tools and technologies you've already invested in and are happy with. The cloud-native Pondurance Platform integrates any existing EDR tools you have, and ingests logs from hundreds of existing network, identity, cloud, app and IoT systems. The result is rapid and easy implementation — without creating security gaps or overlapping capabilities. GET A FREE 30 MIN DEMO REAL CUSTOMER STORIES “For a midsized organization, Pondurance MDR services play a crucial role in bolstering the capacity of security teams.” — Manager, IT Security and Risk Management, Retail REAL CUSTOMER STORIES “They immediately proved their value and earned our trust due to their immense expertise and guidance throughout the entire process.” — Steve Long, CEO, Hancock Health REAL CUSTOMER STORIES “Having a 24/7 SOC with Pondurance actively looking for IoC’s and threat hunting (with their knowledge of what is happening with other customers) gives us peace of mind without having to staff that skillset in-house” — Manager of IT Operations and Security, Insurance See what Pondurance can do for you Let us help you envision how Pondurance can eliminate breach risks for your organization with a quick, personalized demo. We promise, no hard sell. First name Last name Business Email By submitting this form I agree with the Pondurance Terms of Use and Privacy Policy GET A DEMO We will never sell your data SEE WHAT TO EXPECT STILL HAVE QUESTIONS? Check out these Frequently Asked Questions Frequently asked questions Comparison campaign Arctic Wolf PHI FAQs General 1. Is alert triage purely automated — or does a human SOC analyst add insight? Every alert in the Pondurance platform is reviewed and triaged by a certified, U.S.-based SOC analyst who understands your unique risk profile and then works directly with your team. Automation supports our process — but real humans add the insight and context needed to reduce false positives and alert fatigue. 2. What happens when a threat is detected in your environment — and how fast? When a threat is detected, our SOC analysts jump into action. We immediately validate the threat to minimize false positives, contextualize it based on global threat intelligence, prioritize it based on your unique risk, and take immediate action to disrupt and contain it when possible. Then, we alert your team with actionable next steps. Unlike some providers, we don’t just send alerts — our SOC analysts help your team contain and resolve threats in real time. 3. Will you have direct access to dedicated U.S.-based SOC analysts? With Pondurance, you interact directly with the certified SOC analysts who are monitoring threats to your environment 24/7. They’ll get to know your name, your business, and your unique risk profile. While a “concierge” model sounds nice, it's really just a way to reduce the number of certified analysts and reduce the ratio of SOC analysts to customer accounts. 4. Can the vendor support your overall compliance and risk management needs? Pondurance was built to help mid-market organizations who handle PHI and PII meet all their cybersecurity needs and regulatory requirements, without straining internal resources. These organizations need more than MDR for threat detection, analysis and remediation and top-tier digital forensics and incident response (DFIR). Our full suite of advisory services — including risk assessment, penetration testing, compliance audits, and more — ensure you can eliminate risk efficiently and effectively, with one trusted provider. 5. How do you ensure you’re not overpaying for capabilities you don’t need? Pondurance tailors your solution based on size, risk, and existing tools you’re already using. Our flexible, volume-based pricing means you only pay for what you need — not bloated features you’ll never use. Unlike some providers who will sell you a one-size-fits-all “black box” MDR. Our platform includes unlimited user seats, your team can scale and collaborate freely — without tracking licenses or worrying about rising costs.