Agentic AI Can Increase Speed, Scale, and Effectiveness of Exploits for Threat Actors Pondurance April 6, 2026 Facebook X (Twitter) LinkedIn Copy link Over the past few years, organizations have been adopting generative artificial intelligence (AI) tools that focus on creating prompt-based content such as text, images, and code. Now, agentic AI is taking center stage with its autonomous abilities to accomplish more complex goals with little or no human oversight. Agentic AI is helping organizations work more productively and efficiently in their business pursuits. However, on the flip side, agentic AI is also helping threat actors work at increased speed, scale, and effectiveness in their malicious exploits. Today, a threat actor's average breakout time, or how long a threat actor has between initial access and lateral movement toward an objective, has dropped to only 29 minutes , which is a 65% increase in speed from 2024, according to CrowdStrike's 2026 Global Threat Report . Threat actors are still heavily reliant on unpatched vulnerabilities, stolen credentials, and security misconfigurations to penetrate a target's environment, but the speed, scale, and effectiveness are much improved with agentic AI. In addition, nation-states and threat actors have increased their AI-enabled attacks by 89% year over year, and less sophisticated threat actors are using agentic AI — with its lower barrier to entry in terms of cost and required knowledge — to jump into the cyber action with more advanced attacks. All in all, agentic AI has set the stage for 2026 to be a busy year for cybersecurity. Increased speed, scale, and effectiveness Use of agentic AI by threat actors is not currently widespread. So far, Microsoft has not seen any large-scale use of it, but CrowdStrike reports that more than 90 organizations have had a threat actor exploit their own legitimate AI tools to execute malicious commands and steal data. In the incidents where threat actors have used agentic AI, the speed, scale, and effectiveness of it have been impressive. The first documented case of a threat actor successfully using autonomous agentic AI for a cyberattack happened in mid-September 2025, when a Chinese state-sponsored threat actor group used Anthropic's Claude Code agentic AI tool to conduct a sophisticated espionage campaign. The group infiltrated 30 organizations globally and succeeded in a few of those attempts, using little human intervention. The agentic AI tool selected the targets, conducted the exploits and intrusions, exfiltrated the data, and gained persistence. In all, the threat actor used AI to perform 80%-90% of the attack . In its policy report, Anthropic claimed, "the AI made thousands of requests, often multiple per second—an attack speed that would have been, for human hackers, simply impossible to match." As the first case shows, the speed of cyberattacks using agentic AI is machine-fast. Agentic AI helps threat actors move faster, make quicker decisions, and rapidly adapt to unexpected changes within an environment to achieve their malicious goals in a shortened time frame. Traditionally, threat actors have spent considerable time researching one or a few targets, searching for vulnerabilities, making decisions once inside the network, and exfiltrating data. Now, with agentic AI, the scale of an exploit can be much larger because a threat actor can run reconnaissance and make initial access attempts on dozens, thousands, or even millions of targets at once — and the speed with which they do it allows them to make multiple attempts, further increasing the volume of attacks. Agentic AI performs tasks that would otherwise take an entire team of threat actors to do. Now, an effective exploit can be done by only a small number of threat actors — or a single threat actor — in a reduced time frame. The tasks can be complex tasks, such as reconnaissance, privilege escalation, or lateral movement, performed across a global attack surface. And agentic AI allows threat actors to readily adjust their exploits as attack conditions change. Threat actors don't have to stay with a set plan and fail when the plan fails. Instead, they can stay flexible and adaptive, switching tactics as they go, from emails to text messages to job board alerts. Overall, according to Unit 42's Global Incident Response Report 2026 , the use of agentic AI can improve the rate of success at every stage of an attack. Lower barrier to entry Threat actors, particularly nation-state actors and established ransomware groups, have typically had the money and depth of knowledge required to perform sophisticated cyberattacks. But agentic AI has lowered the barrier to entry for conducting exploits. Now, new threat actors with less money and technical know-how are entering the cyber arena. Less money needed. For a relatively low cost, inexperienced threat actors can use agentic AI to implement a cyberattack. The lower cost allows them to experiment with agentic AI at all stages of an exploit. Small groups of threat actors or a solo actor can profile targets, steal credentials, analyze stolen datasets, and even develop ransomware in a short span. In-depth experience not required. Threat actors don't need the same level of experience that was once required for a cyberattack because agentic AI can do much of the work for them — at breakneck speed. Threat actors working with autonomous agentic AI can make mistakes during an attack, then quickly learn from those mistakes, make adjustments, and try the exploit again and again until they get it right. Even while threat actors sleep, agentic AI can keep working 24/7 to achieve the set goals for a successful exploit. Conclusion Agentic AI is indeed helping organizations work more productively and efficiently, but it's also helping threat actors at all levels of sophistication work at increased speed, scale, and effectiveness. Increased use of agentic AI by threat actors will likely mean a busy year ahead for cybercriminals and cyber defenders alike. To combat the use of agentic AI by a threat actor, Pondurance has launched Kanati, the industry’s first agentic security operations center designed for autonomous operations within a managed detection and response service. Kanati replaces alert-driven, error-prone workflows with a coordinated system of AI agents that operate continuously throughout the full threat life cycle. To learn more about Pondurance's Kanati, read our blog post. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Pondurance wins awards in MDR, Healthcare Cybersecurity, and Virtual CISO | Pondurance Pondurance Celebrates Triple Win in 2025 Cybersecurity Excellence Awards! Pondurance March 12, 2025 Facebook X (Twitter) LinkedIn Copy link We are thrilled to announce that Pondurance has achieved a remarkable trifecta at the 2025 Cybersecurity Excellence Awards! Honored as winner for awards in three prestigious categories—Managed Detection and Response (MDR), Healthcare Cybersecurity, and Virtual Chief Information Security Officer (CISO)—Pondurance continues to honor its commitment to eliminating breach risks for midmarket organizations. In a challenging environment where midmarket organizations grapple with significant hurdles in defending against cyber threats, Pondurance firmly believes that they deserve the same level of comprehensive cybersecurity solutions as their larger counterparts. Our purpose-driven ethic aims to create a more equitable landscape, providing quality tools and services to organizations facing funding constraints or difficulties in attracting top cybersecurity talent. "We congratulate Pondurance on the outstanding achievement of being selected as winner in the ' Managed Detection and Response (MDR) ', ' Healthcare Cybersecurity ', and ' Virtual CISO ' categories of the 2025 Cybersecurity Excellence Awards," said Holger Schulze, founder of Cybersecurity Insiders. "Their extraordinary innovation, customer support excellence, and industry leadership set them apart in a very competitive industry." At the heart of our accomplishments lies the newly introduced Pondurance Platform 2.0 . This cutting-edge, cloud-native platform underscores our unwavering commitment to outpacing cybercriminals. By harnessing risk-based technologies, we enhance the efficacy of threat detection and speed to response, effectively mitigating data breach risks for midmarket organizations. "We are honored to have been acknowledged as winners in this year's Cybersecurity Excellence Awards in three categories that are at the heart of how we protect our customers," said Doug Howard, CEO of Pondurance. "This recognition reflects our relentless commitment to safeguarding our customers from cyberattacks and the risks that can lead to devastating data breaches." If you're interested in learning more about how we're continuously improving our services and helping our customers navigate the ever-changing cyber landscape, check out our platform page . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Pondurance reveals a major campaign targeting ConnectWise's ScreenConnect, using counterfeit foreign domains and local account creation to bypass security controls. Indicators of compromise have been shared with ConnectWise to enhance user protection. Ransomware Affiliates Targeting ScreenConnect Cloud Instances Pondurance December 13, 2024 Facebook X (Twitter) LinkedIn Copy link The Pondurance cybersecurity research team is aware of at least one major ransomware campaign to infiltrate and take over cloud management consoles for ConnectWise’s ScreenConnect remote monitoring and management product, which is considered one of the most utilized products in the IT management space. This approach utilizes two major areas of concern: the registering of foreign domains that use ScreenConnect.com .namespace (e.g., ScreenConnect.com.so ), which are extremely effective at social engineering users, and the ability to create local accounts with unregistered email addresses within the console itself to bypass existing controls. Below are two examples of registered domains abusing ScreenConnect’s name within top-level domain space in Cameroon (. com.cm ) and Somalia (. com.so ). Pondurance has shared indicators of compromise with the incident response team at ConnectWise. This first area of spoofing the valid website, Screenconnect.com, is sent as a redirect from AWSTrack.me, which is a legitimate, AWS-hosted click-and-track tool . The threat actor’s phishing kit captures multifactor authentication to initiate a session into the administrator console. ConnectWise ScreenConnect Cloud is particularly effective at session timeouts, requiring reauthentication. Thus, attacks that utilize session tokens, like those in Microsoft 365, appear to be mostly mitigated. Therefore, the threat actors abuse a separate component of the console to survive the timeout. Pondurance’s research indicates that threat actors are able to create a new user and delegate administrative privileges, regardless of whether the new user’s email is valid. It should be noted that new registrants for a trial version of ConnectWise must be for a valid company email and cannot use common email providers such as gmail.com. However, after creation, no such constraints or limitations are applied by default. For example, Pondurance was able to create a local account for test@pppondurance.com, where pppondurance.com does not require verification and where @pppondurance.com is not a valid domain or email address. While creating a new company domain and applying a new MX record are rather trivial, these actions would add time to scaling this criminal campaign. Moreover, this local account can bypass existing security controls applied to the organization’s tenant. The campaign ultimately results in ransomware deployment through the product itself, with a normal life cycle of reconnaissance, credential harvesting , backup deletion, and antivirus disabling. Pondurance understands the phishing emails are acting as fake New Login on Your ScreenConnect Instance notices from ScreenConnect. Below is an image of a legitimate notice from ScreenConnect for login activity. It is important to note that the legitimate notice contains no link to Review Activity and asks you to log in to the portal on your own accord. Pondurance is aware that links once legitimately existed in these notifications, but have since been removed by ConnectWise at some point in the previous year. Pondurance advises that clients should not click on any link associated with these login notices that may appear as "Review Now". The ongoing campaign targeting ConnectWise's ScreenConnect underscores the importance of awareness regarding potential threats in the cloud management landscape. Understanding how attackers operate enables organizations to better protect themselves against these tactics. It's essential to remain cautious with login notifications and implement strong security measures, such as verifying email addresses and using reliable authentication methods. At Pondurance, we are dedicated to helping organizations navigate these challenges and safeguard their sensitive information. By staying informed and proactive, organizations can maintain the integrity of their IT systems in an ever-evolving digital environment. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Explore effective strategies against phishing attacks, browser security risks, and recent vulnerabilities in our latest webinar recap. Cyber Threat Download™: A monthly threat intelligence newsletter from Pondurance Pondurance February 19, 2025 Facebook X (Twitter) LinkedIn Copy link Welcome to the first edition of the new Cyber Threat Download™ newsletter from Pondurance. Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management and compliance share their insights with the cybersecurity community in order to ensure that our customers and partners stay on top of recent trends in threats, and how to ensure they don’t evolve to cause harm to organizations. Please feel free to share this with colleagues and other interested parties on social media. Threat trends Our team has noted certain trends when it comes to recent attacks focused on intrusion, operational disruption or financial harms to organizations. The following three trends are notable in that they aren’t new, but they are all increasing in frequency, presumably due to the fact that they continue to prove successful for malicious actors. Phishing emails . These attacks are trending up, including emails with links or attachments and emails where the attacker masquerades as a known user. The vast majority of phishing emails link to credential harvesting webpages. To reduce the risk of phishing threats, the team recommends enabling MFA — though threat actors are finding ways to bypass it — and offering user awareness training. Credential stuffing attacks . These attacks, also known as password sprays, are trending up. Okta and Microsoft 365 have built-in protections against credential stuffing attacks. Okta uses adaptive MFA with behavioral detection and dynamic zones, and Microsoft 365 has a similar feature under Azure Active Directory Identity Protection. Ransomware . No surprise, these attacks are still the most prevalent threat on the internet. The team is seeing manual deployment of ransomware where the threat actor has to break into the network and stage, deploy, and execute the ransomware. Interestingly, social engineering type attacks have been trending down to nearly zero. The reason for this isn’t clear although it may be due to more consistent use of end user security awareness training as well as increased adoption of multi-factor authentication by user organizations. Incident response learnings A recent exploit using a targeted phishing campaign as the initial threat vector actors provides a case example for how a malicous actor can execute an account takeover in order to get access to remotely monitor network devices. They leverage malicious domain registrations, including foreign domains, and local account creations to gain access to a ScreenConnect remote monitoring and management console. To execute such an attack, the threat actor sends the user a phishing email with a link that enables the threat actor to gain access to the environment via a credential harvesting attack. Then, the user is presented with a fake login to a ScreenConnect instance email. Once the user provides a username, password, and sometimes multifactor authentication (MFA) information, the threat actor gains access to the account for the duration of that session token life cycle. Now, having access to the console, the threat actor is able to create a new user and potentially delegate administrative privileges, even if the new user email address is not valid. From there, using a ScreenConnect or ConnectWise control agent, the threat actor can remotely monitor and control any of the devices that the console is monitoring. To protect against such attacks, several recommendations were made: Monitor authentication and audit logs for your ScreenConnect console and all remote monitoring and management consoles Implement regular auditing of these accounts or any alerts for new users or logins Implement MFA for all accounts, though MFA does not completely mitigate the risk Maintain visibility into the accounts within your administrative consoles, so your team can immediately detect and act on any phishing email intended for continued malicious access to the console Train users on the elevated risk of this type of attack Notable vulnerabilities As many as 3,400 vulnerabilities were disclosed, and the year closed out with approximately 40,000 new common vulnerabilities and exposures. The large number of disclosed vulnerabilities to the increased number of products and applications released each year, a greater number of independent researchers looking for vulnerabilities, and more companies performing internal searches for vulnerabilities on their own products. As many as 42 — quite a high number — of the 3,400 disclosed vulnerabilities were high risk, due to either the presence of proof-of-concept codes on the internet or an association with previous exploits. Of those 42, three were actively exploited: one Windows vulnerability and two vulnerabilities impacting Cleo file transfer products. The Cleo file transfer product vulnerabilities illustrate how file transfer products are attractive targets for threat actors because they are used with important data. The vulnerabilities allow unauthorized file uploads and downloads that can lead to remote code execution. Indicators that your network may be compromised include transfer to an unusual IP address, presence of a Java-based remote access trojan on the network, evidence that a PowerShell instance is or has been active, presence of a Cobalt Strike beacon, and evidence of a pass-the-hash attack . The CL0P ransomware group released a list of 66 victims, urging the organizations to pay a ransom. Later, Blue Yonder and three other victims were specifically named, most likely due to refusal to pay the ransom demand. In December, 71 reported vulnerabilities were addressed during Microsoft Patch Tuesday. Among those 71, one was a zero-day vulnerability and 16 were critical vulnerabilities, including one privilege elevation vulnerability on Windows common log file system. The other vulnerabilities were all remote code execution vulnerabilities that impacted the Windows lightweight directory access protocol, the Hyper-V virtualization platform, message queuing, the local security authority subsystem service, and Windows remote desktop services. In January, 159 reported vulnerabilities — the most ever in January — were addressed at the Microsoft Patch Tuesday event. Of those 159, eight were zero-day vulnerabilities and 10 were critical. The zero days included three privilege elevation vulnerabilities on Hyper-V, three remote code execution vulnerabilities on Microsoft Access, a privilege elevation vulnerability on Windows app package installer, and a credential leak vulnerability on Windows Themes. This risk environment highlights just how essential it is for IT and security organizations to have a continuous and robust patching program to address these vulnerabilities. Deep dive into browser extension security risk Understanding the security implications of browser extensions is essential for safeguarding sensitive data. Tuning is crucial to ensure that escalations are relevant for clients. If a client encounters a false positive or prefers not to escalate an alert, it is important to respond instead of simply closing it. This approach enables effective adjustments. The significance of disclosing critical assets, such as hosts, IP addresses, VIP lists, and honey tokens, is also emphasized. Browser extensions, such as password managers and magnifiers, are scripts running inside the browser that have access to nearly everything in the browser, including all tabs, cookies, session IDs, URLs, and scripts. Installing browser extensions does not require administrative rights, as browser extensions can be selected directly from the app store. The store scans and checks the browser extensions, but most often, the checks are automated. Once a browser extension is downloaded and granted access to the network, the developers of the browser extensions have ways to bypass further reviews and updates, making it possible for them to change the entire code base without approval. When a browser extension is found to be malicious, it is simply removed from the store. But beyond that, the malicious browser extension remains on devices, including any browser extension that is synced from one device to another, until it is uninstalled or disabled by users or IT administrators. Store owners do not have the ability to remove an extension from an organization’s device. As an example of a browser extension security incident, data security company Cyberhaven was breached in December when a developer fell victim to a phishing exploit. The developer provided credentials to a threat actor who updated Cyberhaven’s GitHub and pushed out a new version of the browser extension. Cyberhaven noticed the breach within 60 minutes, but within that time, the updated code was used in 33 other browser extensions. Five of those 33 are still available in stores, and no endpoint detection and response solution has ever detected or removed the extensions. Other noteworthy browser extension security incidents include Web Developer (2024), DataSpii (2019), Apple-Safari Pitchofcase (2018), and Particle (YouTube) (2017). To control browser extensions, organizations should take the following actions: Remove administrative rights from users Prevent users from creating personal profiles in the browsers Use Group Policy Objects to administer user browsers Use the Google admin console for Chrome Additionally, the concept of chromoting is introduced, a technology where users can control a remote device from within the Chromium browser. Though currently an uncommon attack method, threat actors can use chromoting to remotely connect to browsers and computers. Your organization can protect against chromoting attacks by controlling user access to other computers using Chrome Remote Desktop. Chrome Remote Desktop can be turned on or off in the Google admin console. About the Pondurance Threat Intelligence Team: The Pondurance Threat Intelligence Team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our Security Operations Center (SOC), we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

In this blog you’ll gain insights into a threat intelligence review, notable vulnerabilities and trends, and a closer look at Akira ransomware. Read now! Akira Ransomware, Threat Intelligence, and more Pondurance November 22, 2023 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In October, the team provided a threat intelligence review, discussed notable vulnerabilities and trends, and offered a closer look at Akira ransomware. Threat Intelligence Review The Director of Incident Response, introduced the webinar with a few high-level cyber trends. He reviewed the evolution of ransomware from the early days when the primary entry method was email attachments to today’s more sophisticated techniques including stealing credentials and social engineering tactics. Ransomware groups like BlackCat, also known as AlphaV, use tactics such as posing as an employee when calling a company help desk for assistance or logging in to an endpoint detection and response device to gain access. Other notable shifts in entry methods include social engineering on phishing attacks, watering hole attacks , and living-off-the-land techniques . He recommended that all companies enable multifactor authentication (MFA) at all levels to help keep threat actors out of their networks. He also discussed the importance of putting a baseline policy in place for approved IT management tools. He explained the geographical shift and political realignment of ransomware groups since the start of the Russia-Ukraine war. The original groups have fractionalized, realigned, and stabilized. Now, as winter approaches, he expects a spree of cyberattacks to occur, particularly from Eastern Europe. Recently, companies that had data stolen by Royal ransomware — and even companies that paid the ransom — are seeing re-extortion, where a new group shows up with the old data set and demands payment. He stressed the importance of finding the vulnerability at the perimeter associated with the initial attack to avoid having a second group come in using that same initial vulnerability. Overall, he predicts an increase in ransomware attacks due to more vulnerabilities, social engineering, and email delivery and highly suspects that ransomware attacks will reach an all-time high in the coming months. Vulnerabilities and trends The Vulnerability Management Team Lead looked at vulnerabilities and trends from the prior month, noting that “September was a remarkable month and not in a good way.” As many as 2,100 vulnerabilities were disclosed, and 22 vulnerabilities were high risk. Of those 22, 14 were zero-day vulnerabilities, which is the largest number of zero days in the past 12 months. These zero days impacted products from Microsoft, Apple, Adobe, Google, WordPress, Progress, and JetBrains. He discussed each of the zero-day vulnerabilities, providing basic guidance on how the vulnerability impacts the victim’s network and how to remediate it: Pegasus spyware . CVE-2023-41064 and CVE-2023-41061 chain together to deploy Pegasus spyware. The spyware is a zero-click attack that does not require the user to click on a link or enter credentials since delivery of the message accomplishes the threat actor’s goal. Microsoft vulnerabilities. CVE-2023-36082 is a privilege elevation vulnerability that impacts Microsoft Streaming Service Proxy. CVE-2023-36761 allows a threat actor to masquerade as an authorized user to gain access to sensitive data under that user’s account. Libvpx. This vulnerability affects Chrome browsers and impacts video encoding libraries. The vulnerability can be remediated by updating Chrome, Microsoft Edge, Firefox, and Chrome-based browsers. In addition, Signal, Telegram, and 1Password can be affected. To remediate these products, update the individual products and incorporate the new patch library. WebP Codec. More than 700 known applications are impacted by this video encoding library vulnerability, including Facebook, YouTube, Gmail, older versions of Microsoft Office, Gimp, and ImageMagick. All must be updated to remediate the vulnerability. Cisco ASA and FTD. This vulnerability is a brute-force attack against a Cisco virtual private network (VPN) where MFA is not enabled and there is no limit to the number of username-password attempts. Once accessed, the threat actor can establish a clientless SSL VPN session on the targeted device. The VMP team lead recommended upgrades and patches to remediate. He also reviewed Cisco’s mitigation suggestions including limiting the number of allowed consecutive failed logins, disallowing clientless SSL VPN protocol, setting simultaneous logins for users to zero, and using dynamic access policies to stop VPN tunnels. Akira ransomware The SOC Operations Lead provided a closer look at Akira ransomware , which first appeared as ransomware as a service in March. The commonly used initial threat vector of compromise (CVE-2023-20269) affects Cisco VPN products where MFA is not enabled. The primary targets for Akira ransomware are companies in the materials, manufacturing, and finance industries, usually small businesses of less than 200 employees in the United States and Canada. He explained that the Pondurance team has observed Akira ransomware in action. In each instance, Akira used Cisco AnyConnect without MFA as the primary compromised vector and all login pages were available with internet key exchange version 2 authentication enabled. In addition, no backdoor was installed after exploitation in 85% of the detections, but the threat actor used AnyDesk remote desktop application when a backdoor was installed. Once inside, the threat actor typically used living-off-the-land tactics for credential dumping and traded data using WinRAR and WinSCP. Akira ransomware uses identifiable tactics, techniques, and procedures (TTPs) within a network. He outlined those TTPs and discussed the type of evidence the Pondurance team looks for: Persistence – creation of a domain-level account or an account where the threat actor can log in at will Defense evasion – off-the-shelf tools such as PowerTool and KillAV that disable antivirus-related processes Discovery – tools such as PCHunter, SharpHound, net Windows, and IP scanners Credential access – tools used to scrape credentials, such as Mimikatz and LaZagna Laternal movement – internal remote desk protocol connections Command and control – remote desktop or management tools, such as Radmin, AnyDesk, or RustDesk, installed on an endpoint Exfiltration – WinRAR, WinSCP, and FileZilla uploads The SOC Operations Lead also reviewed the controls that Pondurance has implemented and explained the preventative steps that companies can take to help minimize the risk of Akira ransomware. The steps include implementing training to help users identify phishing emails and other attacks, patching devices, enabling multifactor authentication, and auditing permissions of user accounts. Next month The Pondurance team will host another webinar in November to discuss new cybersecurity activity. Check back next month to read the summary. For more information check out our latest blogs Experiencing a breach? Contact Us Emergency IR Hotline: 888.385.1720 Email: dfir@pondurance.com Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

LastPass first disclosed details of a being hacked in August 2022. Read about the history of the breach and actions to take if affected. LastPass Hacked – What Now? Pondurance January 3, 2023 Facebook X (Twitter) LinkedIn Copy link History of the Breach LastPass first disclosed details of the breach in August 2022, and they have issued several updates over the past months with the most recent being just before Christmas (Dec 22 2022). Here is a summary of each disclosure on that timeline: August 25, 2022 Unauthorized party gained access to parts of the developer environment at LastPass through an individual compromised developer account. The unauthorized party took some source code and proprietary technical information. September 15, 2022 The unauthorized party was in the developer environment for four days. The incident did not involve any access to customer data or encrypted password vaults November 30, 2022 Unusual activity within a third-party cloud storage service was detected. Previously gained knowledge facilitated this incident. The unauthorized party gained access to certain elements of customer information. December 22, 2022 The threat actor obtained customer account information such as names, billing addresses, email addresses, telephone numbers, and their encrypted vaults. The encrypted data is strongly encrypted and requires that a customer’s master password be decrypted first. Key Takeaways One of the key takeaways from these disclosure statements is that this wasn’t a single hack that took place in August. This was a series of compromises that built off of each other ultimately resulting in the loss of significant customer data. We don’t know based on the disclosures what the initial access was to the developer environment, but one likely scenario is both phishing that resulted in malware on the developer system and providing command and control access to the developer tools and environment. Over time, the attacker was able to pivot and target a separate employee to gain two critical pieces of information: access keys to a cloud environment and decryption keys for that cloud environment. This means the attacker was able to easily download copies of those vaults and the other customer data there. The data taken can be divided into two categories, account information and unencrypted vault data. The account information should be considered exposed and includes: Company names End user names Billing addresses Email addresses Telephone numbers IP addresses The vaults are encrypted but also include unencrypted data such as website URLs. This has a number of implications for customers involved. If you were a LastPass user with a vault copied, the only thing preventing that vault from being fully exploited is your LastPass Master Password. Due to the fact the attacker has an offline copy of the vault the attacker can brute force the Master Password. If you have a strong Master Password and follow all of the posted minimum recommendations by LastPass, you are probably not under immediate threat of having the encryption cracked quickly or ever. What to do now It’s still a good idea and recommended to change your Master Password. Also consider changing the passwords on all accounts within the vault. Focus on your personal critical accounts first. Be on the lookout for highly targeted phishing emails. The data exposed already includes a large amount of useful information for crafting highly targeted phishing attempts. Be particularly wary of anyone asking for your Master Password. No one should ever be asking for that. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

December Cyber Threat Download™ Pondurance December 10, 2025 Facebook X (Twitter) LinkedIn Copy link Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. Data exfiltration in the cloud Not all tools used by threat actors are malicious malware. Rclone , a command line program with no graphical user interface, is a free and open source for file transfer and syncing. The program is ideal for threat actors to use for exploits because it’s a legitimate tool that’s not always detected by endpoint detection and response solutions. The digital forensics and incident response team recently worked an unusual case that exposed how a threat actor accessed a client’s entire Google Drive environment and transferred the data using Rclone. In the case, the Qilin ransomware group leveraged a single account that many employees at the organization use to access Google Drive from a single system. When the Qilin group accessed the system, a live session was in progress on Google Drive. The group stole the session token from that specific browser and reconfigured Rclone to sync all the data from the organization’s Google Drive to the group’s own infrastructure. The team recommends that organizations take action to prevent exploitation of data on the cloud. The most critical action is to use the principle of least privilege, or only giving employees access to the accounts and data necessary to perform their jobs. Organizations can also configure the applications for Google Drive, as well as Azure, Amazon Web Services, and other platforms, to limit access and the applications that access the data. In addition, they should establish a limitation on session durations and ensure security around specific access keys to stay secure. Notable vulnerabilities More than 4,300 vulnerabilities were newly disclosed in October, similar to what the team saw in September, and 32 of those disclosed vulnerabilities were actively exploited, double the number reported in September. Microsoft accounted for eight of the 32 vulnerabilities; however, a wide range of products and operating systems were impacted, including Broadcom, Adobe, Motex, Oracle E-Business Suite (EBS), Dassault Systemes, and Apple. As many as 21 proof-of-concept codes were released on the internet, making the information available for threat actors to use to exploit vulnerabilities. The team discussed the Oracle EBS attack in detail. The CL0P ransomware group, known to exploit zero-day vulnerabilities, steal data, and attempt to extort ransoms from its victims, exploited this SyncServlet vulnerability. The attack occurs when a POST request creates a malicious template in the XDO_TEMPLATES_B database table and stores an Extensible Stylesheet Language file payload in the LOB_CODE/XDO_LOBS directory. The payload is then decoded into Java classes, allowing the threat actor to gain unauthenticated remote code execution. Two Java payloads, Goldvein and SageGift, occur in memory, followed by execution of additional Java class files. After the attack, an extortion email is sent to executives from compromised third-party email accounts. The attack potentially exposes as many as 1,400 Oracle EBS instances across industries in the United States, Europe, and Asia. During Microsoft Patch Tuesday in October, a record-high 172 reported vulnerabilities were addressed. Of those 172, eight were critical vulnerabilities, and three were zero-day exploits. Multiple patches were released for the affected products. In November, 63 reported vulnerabilities were addressed during Microsoft Patch Tuesday, a significant decrease from October. Of those 63, five were critical vulnerabilities, and one was a zero-day exploit. The zero day was a privilege elevation vulnerability for Windows Kernel. Microsoft released patches for the zero day and the critical vulnerabilities, including Windows Graphics Component, Nuance PowerScribe, Microsoft Office, DirectX Graphics Kernel, and Visual Studio. As a final reminder, the team discussed that Microsoft no longer supports Windows 10. However, Microsoft does offer extended security updates for critical vulnerabilities that are discovered, but clients must enroll in the updates program to receive those critical patches. SOC trends The security operations center (SOC) team is always looking for new trends in threat activity so it can respond to changes and keep clients safe. Currently, the SOC team is seeing an uptick in the following activity: Use of Direct Send. Threat actors have ramped up their use of Microsoft 365’s Direct Send as a vector to deliver spoofed messages to victims. To execute this attack, they simply need the domain name, a valid recipient, and the smart host or email server. From there, without logging in or having any user credentials, the threat actors can send a Direct Send email that appears to come from an internal address. Indicators for this exploit include users sending emails to themselves, command line user agents or PowerShell coming through as user agents, suspicious attachments or file names, and the use of a QR Code in email bodies. To protect against a Direct Send attack, organizations can configure to reject Direct Send via PowerShell, if appropriate. Also, organizations should offer phishing training to employees to ensure that they know to look for suspect, unfamiliar, unexpected emails and attachments. Holiday-focused phishing emails . At year-end, the team commonly sees attacks based around end-of-year activities such as holiday events, annual budgets, and audits. The team is seeing the generation of malicious inbox rules, which is visible in over 90% of successful business email compromise attacks, so employees need to be on the lookout for these types of attacks. New employees are more likely to fall victim to these scams. The team also discussed preventative controls, tuning, and feedback loops with clients. The team showed numbers for alerts worked, threat tickets raised, and percent escalated over the past few months. As clients provide feedback for tuning, the team narrows down the number of alerts worked, while the number of threat tickets raised stays fairly consistent. As a result, the percent escalated increases. For example, in July, there were 15,371 alerts worked and 1,066 threat tickets raised for a percent escalated total of 6.93%. Every month since, the percent escalated has increased. In late November, there were 9,400 alerts worked and 1,165 threat tickets raised for a percent escalated total of 12.39%. The higher percentage means the team is spending its time more efficiently and creating more worthwhile escalations for clients. LogScale CrowdStrike LogScale is a centralized log management and observability platform that collects, stores, and analyzes log and event data. LogScale offers case-sensitive searching and index-free log searching for log data, high compression data, and data that uses parallel scanning and MapReduce. The team uses this fast, efficient tool for SIEM, compliance, and incident response — and clients can take advantage of LogScale, too. The team recommends that all clients use the built-in tutorial to learn how to use LogScale. The tutorial explains what clients need to know to use it, and the dashboarding is quick and easy. To search using LogScale, clients need to start by casting the widest net possible with @rawstring and can later narrow down the parameters to get faster, more efficient searches. Everything in a data record is contained on @rawstring. To begin, type in @rawstring = /crowdstrike/i . Clients with logs have a log repository (customer code - -norm-log). Clients who also have a network sensor have a log repository plus a network repository (customer code - -norm-network). A client with both should specify the repository to use to speed up and narrow down results. Clients can scroll through the results and then add #data_source to the next line to further narrow down the search. The team also explained how data and alerts flow through LogScale. First, the data is enriched, tagged, normalized, and backed up to S3. Then, it goes to the repositories. Log data comes from the client data sources and goes to the log repository, and network data comes from a Pondurance network server and goes to the network repository. Clients with both log and network data see a combination of the two in their View, and clients with log-only data see a single data type in their View. Dashboards and custom alerts are also created in the client’s View. The SOC team can see the two different client Views, log and network alerts are applied to all clients equally against the two Views, and threat hunting takes place across all Views. The team highly recommends that clients use LogScale as it provides unmatched searching capabilities. If clients need assistance in using LogScale, the team is available to help. About the Pondurance threat intelligence team The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our SOC, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

CISOs and CIOs must find a way to effectively report on cybersecurity metrics for the board. Learn five steps for reporting to your board. Why Communicating Effectively With Your Board on Cybersecurity Is More Important than Ever Pondurance February 7, 2022 Facebook X (Twitter) LinkedIn Copy link In the face of escalating threats like ransomware, supply chain attacks, and social engineering exploits , boards of directors are more concerned than ever about cybersecurity. This situation presents chief information security officers (CISO) and chief information officers (CIO) with a challenge – and an opportunity. The challenge is to clearly and effectively communicate highly technical security information to a business-focused audience. The opportunity is to win support for your security strategy, projects, and budget requests. Are you prepared to present cybersecurity metrics to your board? Our new whitepaper, 5 Best Practices for Reporting to Your Board About Cybersecurity , provides practical guidance on reporting to your board of directors, with the goal of building a strong and trusting relationship that can pay off during a serious incident. The key is recognizing that board members view security through a business lens. To meet their needs, you should frame your presentation in business terms: the effect of a threat or security measure on revenue, client acquisition and retention, brand reputation, shareholder confidence, etc. This whitepaper describes the full process of quarterly cybersecurity metrics reporting, including conducting due diligence, choosing the best format for your presentation, and selecting relevant information and metrics regarding current risks, projects, controls, and results of audits and tests. Get tips about the most effective way to: Categorize risks Explain risks in financial or other business terms Depict impact and probability Describe security controls Convey the implications of audits and penetration tests You’ll also benefit from a discussion about special board meetings that may be called in the event of a data breach or in preparation for a major business change, such as an acquisition. Your board of directors plays a vital role in the overall security posture of your organization. Your success in educating them about cybersecurity – both the good and the bad – can be instrumental in your company’s defense against and mitigation of current and future threats. Download the Pondurance whitepaper, 5 Best Practices for Reporting to Your Board About Cybersecurity . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Can your IP address identify or track you online? Learn how IP addresses work, when they can be linked to you, and how VPNs affect online privacy and tracking. Cybersecurity 101: Can My IP ID Me? Michael DeNapoli July 7, 2026 Facebook X (Twitter) LinkedIn Copy link A very common question I hear is, “Can my IP address let someone identify who I am or track my actions?” The short answer is a solid “sort of,” so let’s dive into this topic. What is an IP address? Your Internet Protocol (IP) address is a string of characters that identifies your device whenever you’re using a network of any kind. This includes - but isn’t limited to - your home WiFi, work network, cellular data networks, the WiFi in the airport and on airplanes, etc. What that IP address will look like can take one of two forms: IP version 4 (IPv4) or IP version 6 (IPv6). IPv4 was the standard for all network communications for decades, but as it is made up of four numbers from 0 to 255, there is a limit to how many addresses can exist at any given time. IPv6 came along to fix that problem, and is steadily becoming more and more common both with company networks and across the Internet in general. Each network assigns your device an IP address for that network whenever you connect to it, so a machine can have more than one IP address if it is able to connect to more than one network (such as a phone connected to both WiFi and cellular data). IPv4 addresses will always be a “dotted quad” - a combination of four numbers from 0 to 255 with a decimal between each number. 101.43.186.10 and 192.168.50.3 are both examples. IPv6 is significantly more complicated, but boils down to eight groups of four hexadecimal values each (0-9, A-F), separated by colons. Some zeroes (specifically leading zeros and groups that are entirely made up of zeroes) are frequently edited out of IPv6 addresses for ease-of-reading, so 2001:0db8:85a3:0000:0000:8a2e:0370:7334 is a valid IPv6 address, but 2001:db8:85a3::8a2e:370:7334 is the same IPv6 address . No matter if your device was assigned an IPv4 or IPv6 address (or both), this address identifies your device on any given network. There’s one more concept to explore before we move on - dynamically assigned addresses. For the vast majority of networks, a device is not assigned a permanent IP address. Mostly, this is because of the limitations of IPv4 (so that your network wouldn’t run out of IP addresses just because old devices aren’t on the network anymore), but has carried over into the IPv6 world as well. When your device joins a network, it is highly likely that a dynamically-assigned IP address (typically through technologies like Dynamic Host Configuration Protocol or DHCP) will be assigned to that device for a period of time ranging from minutes to weeks. When the time is up, a new IP address is assigned to the device. This even happens on things like firewalls and cable modems and other routers. Your Internet Service Provider (ISP) dynamically assigns an IP address to the networking device for a fixed period of time, then gives the device a new IP when that time is up. How does that identify me? The short answer is that it doesn’t identify you at all. What it does do is identify your device , and that means that whatever that device does can be logged for later review. Most companies and ISP’s alike will keep logs of what any given device did while on the network for some period of time - ranging from less than a week in some cases to over seven years if bound under certain regulations. Since whatever issued the IP address to that device knows what device was using any given IP address at any given time, this means the logs can correlate to identify which device (which was assigned a specific IP) was going to a specific website, or downloading a file, or communicating with other devices. When the IP address assigner (your company, your ISP, etc.) knows that an IP was assigned to a device on your account, that can loosely correlate to identifying you, but it’s far from concrete. For example, your company knows it assigned the IP address 192.168.1.14 to your work laptop. Your company also logged that you were signed into the machine during the time that IP address was assigned to it. If that IP address downloaded sensitive data from a file share, it is pretty safe to presume that you were the one who downloaded it. Yes, it’s possible that you left your laptop unlocked, and someone else downloaded the data using it, but it now becomes up to you to prove that, since the company knows you were logged in on the device that was assigned that IP address when the access happened. This is another reason to never leave an unlocked device unattended. In fact, based on the decision of a German court case that eventually went to the European Union Courts, IP addresses are considered Personally Identifiable Information (PII) in the EU whenever identifying who has been assigned that IP at a specific time is logically discoverable. In short, if a court could order your ISP to tell them if your device was assigned that IP at a specific time (which it is very possible to do), then your IP is considered identifiable to you. Can I stop this kind of tracking? Again, here, the answer is “sort of.” On a work network, it is unlikely you can stop IP tracking as you have no control over how IP addresses are assigned or how activity is logged. Your employer will follow the company/organizational policies to determine how things are assigned, logged, and tracked. On your home network, you have a bit more flexibility. You can use tools like a Virtual Private Network (VPN) software package to “mask” (hide) your true IP from websites and services. The short version is that the site or service only sees the VPN provider’s IP address, not yours. Then it becomes a matter of the policies of the VPN provider. How much do they log? How long do they hold the log data? If a VPN provider is subject to the jurisdiction of a given law enforcement agency, and the logs are retained, then the provider may be required to tell the law enforcement agency which user was assigned the VPN IP address, and you can have your identity discovered that way. NOTE: Neither this author nor Pondurance are lawyers, and you should seek legal advice from a qualified professional for all matters involving the laws and regulations that apply to you, your company, and your ISP. Summing it up The IP address that you are assigned when you connect your device to a network can be tied back to that device. If you are the owner of that device (or it was assigned specifically to you by your company), then it will be presumed that actions taken by a device assigned that IP address are attributable to you. This might require formal, legal requests; but this is something that is very possible from a technical perspective. While this doesn’t necessarily prove that you, specifically, performed those actions; it does mean that your assigned IP address can be used to identify you at a high-level. That is why the EU considers IP addresses as Personally Identifiable Information when actions are being logged (nearly always) and those logs are retained (depends on policy, but nearly always). A VPN may help obfuscate your real assigned IP address, but only if the VPN provider does not also keep logs on which VPN IP address was assigned to a specific user. Most VPN providers do retain such logs for varying amounts of time. So, yes, in theory your IP address can be used to identify and track you online. It may not be able to say for certain that it was you pressing the keys and moving the mouse around, but it can definitely be used to figure out a device that you use/own/were assigned was performing those actions. About the Author: Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Initial access of a Windows environment could lead to infostealer, remote access Trojan or even ransomware. Learn more about initial compromise threats and what to do about them in this blog.|Initial access of a Windows environment could lead to infostealer, remote access Trojan or even ransomware. Learn more about initial compromise threats and what to do about them in this blog. Initial Access Defense Techniques for Windows Pondurance November 9, 2021 Facebook X (Twitter) LinkedIn Copy link This blog focuses on stopping initial access on Windows hosts. Initial access in this context means compromise of a workstation in an environment. Many times, compromise of a workstation leads to infostealer, remote access Trojan (RAT) or even ransomware. There are some methods that can be used to reduce the chance of initial access being successful. This blog post doesn’t discuss user privilege. We recommend least privilege based on the user’s role when possible. Initial Compromise Threats Below are some of the threats when it comes to initial compromise based on our experience: Email is usually the biggest vector for initial compromise. We’ve seen emails being used for malicious attachments, linking to phishing sites and linking to downloads. PDFs are another vector, although it’s not as big as it may have been in the past. These days, we mostly see emails linking to another phishing site or download page. We haven’t seen much code execution via PDFs recently. Malicious Office documents are the biggest threat when it comes to code execution on workstations. The source of malicious documents is usually emails or a file downloaded by a user. In our experience, malicious Office files abuse features (macros, etc.), exploit a vulnerability, or link to phishing sites. Archives and compressed files can be sent via email or can also be downloaded. Files such as zip, iso or rar files are some of the file types. These files may contain scripts or sometimes executable files. In our experience, we’ve mostly seen RATs and infostealers being spread this way. User Downloads are threats related to users downloading files that shouldn’t be downloaded. The user may have downloaded the file for various reasons. Usually, we’ve seen users download potentially unwanted programs (PUP) and in some cases infostealers. Visibility and Logs Besides just having antivirus software, there are ways to detect these threats through logs. Process logs, PowerShell logs, and Sysmon logs can help detect some of the threats listed above. Process logs (event ID 4688) for example contain process path, parent process path, command line arguments and process ID. Hunting through this data or looking for odd parent-child process activity could help find threats. PowerShell logs (EID 4104, 4103) can also be helpful if malware abuses PowerShell for some of its functionality. Finally, Sysmon logs provide a lot of information related to process, network connections and more. Hunting through this data can help as well. What Do Some of the Initial Access Threats Look Like? It’s important to look at what some of the initial access threats look like to understand defense. BazarLoader https://tria.ge/211014-ws2m5sabb2/behavioral1 Above, we see wscript being used, then PowerShell is called, and finally regsvr32 is called. Maldoc https://tria.ge/211014-wprc1aahbl/behavioral1 Maldoc above shows PowerShell being used, then rundll32 being called. Trickbot https://tria.ge/211014-w3r7fsabc3/behavioral1 In the TrickBot example above, we see rundll32 being used as well. Besides the files mentioned above, there are also other LOLBIN/LOLBAS files that can get abused by malware or a threat actor. It’s worth reviewing MITRE ATT&CK and other threat reports to understand initial compromise. Initial Access Defense Now that some of the threats are defined, we can look at defending against those threats. It’s obviously impossible to stop every threat, especially with threats constantly evolving and evading defenses, but even stopping popular techniques could be helpful in breach prevention. Email filter is an option. Blocking malicious files or extensions that are commonly used to send malicious files could be helpful. Besides blocking malicious file attachments, you can also block mail containing phishing links or links to file download. Some filtering may require having a service or an appliance. For Office files, there are obvious options such as blocking/disabling macros, not allowing external content to be loaded and blocking ActiveX (exploited recently). There are other hardening measures that can be taken, as well since the attack surface for Office is somewhat large. Changing the default application or default file opener can also be used to prevent execution of certain scripts and files. For example, not allowing .js, .hta or .vba files to be opened by the default application and opening them in Notepad could help. PowerShell can be disabled or can have its settings modified to not execute arbitrary/untrusted code. There are multiple options when it comes to PowerShell execution policy. There may still be ways around execution policies, depending on the policy however. Finally, Windows Firewall is another great option for defense. Windows Firewall actually allows you to block internet access for certain applications or executables. For example, you can disallow rundll32 from connecting to the internet completely. In addition to blocking internet access for certain applications, Windows Firewall also logs what is allowed or blocked on disk. Defenses described above may not always prevent initial access, but they may help reduce chances of an attack being successful. Additionally, there are other options such as attack surface reduction (ASR) and application allow listing, which can help reduce attack success. There are other things you should be doing as well, for example, hardening against privilege escalation on workstations. Interested in learning more about reducing the chances of a successful cyberattack? Our Managed Detection and Response (MDR) clients have 24/7 access to our Security Operations Center and communicate with our U.S.-based team regularly. Learn more about our MDR services. Resources MITRE ATTACK Initial Access Triage Sandbox Reports Process Log PowerShell Logging Sysmon Securing PowerShell in the Enterprise Hardening Microsoft 365, Office 2021, Office 2019 and Office 2016 PowerShell Execution Policies LOLBAS Mitigate commodity malware attacks with Windows Firewall rules Preventing Living off the Land Attacks Demystifying the Windows Firewall Hardentools Privilege Escalation Awesome Scripts SUITE Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Pondurance has won the 2025 Cybersecurity Excellence Award for Healthcare Cybersecurity, showcasing our commitment to protecting patient data. Pondurance Wins 2025 Cybersecurity Excellence Award for Healthcare Cybersecurity Industry Solution Pondurance February 28, 2025 Facebook X (Twitter) LinkedIn Copy link We are thrilled to announce that Pondurance has been recognized as the winner in the "Healthcare Cybersecurity Industry Solution" category at the 2025 Cybersecurity Excellence Awards. This prestigious accolade reflects our ongoing commitment to enhancing cybersecurity within the healthcare sector and protecting sensitive patient information while focused on eliminating breach risks. As the founder of Cybersecurity Insiders and organizer of the awards, Holger Schulze noted, "We congratulate Pondurance for your outstanding achievements. As we celebrate 10 years of recognizing excellence in cybersecurity, your innovation, commitment, and leadership set a powerful example for the entire industry." This recognition reinforces our team's dedication to developing innovative solutions that address the unique challenges faced by healthcare organizations in an increasingly complex and evolving threat landscape. In a time when data breaches are a critical concern for healthcare providers, our decades long commitment has been to delivering managed detection and response (MDR) services that prioritize the security of protected health information (PHI), along with industry-leading incident response and HIPAA security/compliance services. Our journey has been fueled by a strong passion for protecting our customers, and this award would not have been possible without the hard work and expertise of our dedicated team. We are committed to collaborating with healthcare organizations to implement robust cybersecurity measures that not only comply with regulations but also foster trust with their patients. We appreciate the support of our customers and trusted partners who have been integral to our success. Thank you for being part of our journey as we strive to ensure the security of healthcare systems and digital privacy of the American public. Stay tuned for more updates as we continue to lead the way in healthcare cybersecurity, protecting sensitive information for organizations across the industry. For more information about our award-winning solutions, check out our risk-based approach to cybersecurity for healthcare providers or learn more about our recognition at the Cybersecurity Excellence Awards here . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

October is Cybersecurity Awareness Month! This year’s theme highlights that cybersecurity is crucial for national safety. Discover how Pondurance can safeguard your organization and community. Building a Cyber Safe America: Why Cybersecurity Is Everyone’s Business Pondurance October 1, 2025 Facebook X (Twitter) LinkedIn Copy link October is Cybersecurity Awareness Month, and this year’s theme from CISA focuses on Building a Cyber Safe America . The initiative highlights a reality that impacts every business: cybersecurity is not simply an IT issue, but a national priority tied to public safety, economic security, and the resilience of our communities. Critical infrastructure is often associated with large-scale systems like power grids, hospitals, or transportation networks. Yet the truth is that this infrastructure relies on a much broader ecosystem of organizations. Schools, public safety agencies, local utilities, and especially small and medium-size businesses all play indispensable roles. Many businesses serve as suppliers, contractors, or manufacturers. Others provide services that directly support vital systems. This interconnectedness means that a single cyberattack against a smaller organization can create ripple effects across entire industries and communities. For B2B companies, the implications are clear: protecting your own organization is no longer just about safeguarding your data or operations. It is about protecting the larger supply chains, partners, and communities that depend on your resilience. A breach in one part of the network can jeopardize the trust and stability of the whole system. At Pondurance, we're committed to providing organizations of all sizes with access to enterprise-class cybersecurity through our elite managed services. Where many organizations struggle with limited budgets or stretched IT resources, we deliver the expertise and scale needed to stay ahead of evolving threats. Our offerings include Managed Detection and Response (MDR) with 24/7 monitoring to identify and stop threats in real time, Incident Response services to help organizations recover quickly and effectively, and Cybersecurity Advisory services that uncover risks, strengthen compliance, and build long-term resilience. By combining these services, we ensure that organizations are not only prepared to defend themselves but also equipped to thrive in an increasingly complex threat landscape. Cybersecurity is a shared responsibility, and every business has a role to play in securing the systems and services we all rely on. By investing in stronger defenses and embracing a proactive security culture, organizations can help protect themselves and contribute to the safety and stability of our communities. If you’re ready to bring enterprise-class cybersecurity to your organization, Pondurance is here to help. Connect with us today to learn more about our MDR, incident response, and advisory services—and join us in building a safer, more resilient future. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026