Meet Dustin Hutchison, Pondurance Vice President Services and Chief Information Security Officer. Gain insight on cybersecurity jobs, too. Get to Know Dustin Hutchison, Pondurance VP Services and CISO Pondurance February 4, 2022 Facebook X (Twitter) LinkedIn Copy link For this month’s leadership spotlight, we spoke with Dustin Hutchison, Vice President Services and Chief Information Security Officer (CISO) at Pondurance. Dustin has an impressive academic background that culminated in a doctorate in philosophy with a dissertation on cloud computing in healthcare. His strong belief in learning and teaching continues as a leader at Pondurance and adjunct professor at various colleges. Dustin began his cyber career focused on HIPAA compliance for a small hospital. He credits the combination of education and business opportunities as a key to his success in the cybersecurity field. How did you get into cybersecurity? My start in cybersecurity really was born out of compliance. Early in my career, I was focused on workstation, server, and networking — some general IT things — and because of the timing, HIPAA in healthcare was a relatively new thing. I was at a small hospital. We had a really small staff, no cybersecurity team, and so I was suddenly responsible for HIPAA compliance. That led me down the path of privacy and security. How did you grow into the leadership role you’re in today? Early in my career when I transitioned from pure break/fix and general IT and really started to focus on compliance and cybersecurity, I realized I needed a seat at the table. And what I mean by that is, from a leadership standpoint, learning the vocabulary of business, not just focusing on pure technology. After I finished my undergrad, I went on and got an MBA, took 10 days off after that and got my Ph.D. Education plus the opportunity from an organization standpoint really kind of led me down that path. What was the biggest lesson you learned as you moved up in your career? I think the biggest lesson I learned is really focusing on the technology, understanding the tech but knowing that you’re trying to solve a business problem. And so that’s one of those issues from an IT standpoint that’s always present. IT and cybersecurity are there to enable a business, and so understanding what the business is trying to do is really the primary key. Why would someone be excited to join your team? Joining the Pondurance team, especially on the services side, is an exciting thing. The exposure to so many different customers, environments, and networks is just outstanding, and plus the collaboration between the teams. So when you think about a security analyst getting exposed to compliance or pen testing or application security, you’re not siloed in one role. You get exposed to a lot of different things. As an adjunct professor, what advice do you give to students starting a cybersecurity career? I teach undergrad all the way up to doctorate level students, so there’s a lot of different experiences and knowledge that come out of those different levels. I think it’s really important for inexperienced and emerging students to understand that there’s a lot to learn and they need to really get that experience and that exposure, and that doesn’t always happen on the job. It doesn’t always happen at school. Sometimes your education is in your own hands, even if you have great professors and great curriculum. So I also recommend being open to shifting gears. You may go into the field thinking, “Hey, I want to be a pen tester when I grow up.” And as you start working toward that, working in your home lab, doing some different things, you may quickly realize that you’re more interested in something else. So being open-minded to how broad the cybersecurity field is, is really important. What advice would you give someone who is interviewing with you for an open role? Getting interviewed is really an opportunity to reverse engineer the opening. So, you look at the job description, what the company is looking for, and then understand what you’re good at, and then work to fill in those gaps. And then, also being transparent about what you do and you don’t know. I tell a lot of my students that you’re not going to come out of school knowing it all, so looking at those job descriptions, doing what you can in a home lab environment, or doing some additional research or reading really goes a long way. Then, when you’re being interviewed, relating the question back to your own personal experience in that context is really important. What qualities do you look for in people who are starting their careers? When you’re starting your career, realizing that you’re rarely going to be a solo contributor without a team is important. Knowing that you’re going to work and learn with and from other people is really important. So understanding the dynamics of teamwork, understanding the importance of asking questions when you don’t know something is really important, and then also understanding deadlines and expectations, so if something’s not clear, being okay with asking for help and advice. The technical skills — most people are motivated and driven by because it’s fun — those come a little bit more naturally. Rounding that out with those new, personal, transferable skills is really key. What are the opportunities today for people interested in a career in cybersecurity? Cybersecurity is growing rapidly. My favorite on-ramp for cybersecurity is the security operations center analyst, or the SOC analyst. The reasoning is, you’ve got a huge safety net of a team, you’ve got flexibility from a role standpoint, plus there’s a lot of opportunity to grow from a knowledge perspective within that role. And then, understanding where you are and being exposed to some of those other opportunities, such as pen testing or application security, is really important. Also from a consulting standpoint or professional services perspective, a lot of times, those types of employees have a lot more experience, but there are opportunities for students and inexperienced employees to understand regulatory compliance and how to perform risk assessments in the cybersecurity field also. What kind of mentorship opportunities are available at Pondurance? The mentorship opportunities at Pondurance are really vast, right out of the gate. We are a collaborative, sharing team anyway, and so you see that across the board. Any new employees have that safety net of a mentor that goes hand in hand with their onboarding. A consultant, for example, won’t run a solo project for quite a while. They will spend a lot of time shadowing another consultant. The same goes with the security operations center analyst, or a SOC analyst, where they are grouped with other people that are working a specific shift. They are given specific responsibilities, and they’ve got someone that they can escalate anything that they find to and then also the expectation of QA, or quality assurance review, before anything goes customer-facing. Interested in joining the Pondurance team? View our current openings! Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Our commissioned study by Forrester Consulting found that most SMBs lack 24/7 cybersecurity coverage. What are they doing to address their technology and skills gaps? The SMB’s 24/7 Challenge: Cybercriminals Work Around-the-Clock – Shouldn’t You? Pondurance August 22, 2022 Facebook X (Twitter) LinkedIn Copy link Zzzzz … that’s the sound of IT and security professionals at small and medium-size businesses (SMBs) sleeping soundly at night because they have around-the-clock cybersecurity coverage, many of whom allocated some of their limited budgets to managed security services partners. At least, that’s the sound your SMB should aspire to for your IT and cybersecurity team. In the realm of cybersecurity, much is written about the varying needs of organizations depending on the industry they’re in, their size (both in terms of number of employees and revenue), their geographic location, and more. Five or 10 years ago, any news of cyberattacks would likely focus on large enterprises – they were the “whales” with the money, people, and intellectual property that attracted cybercriminals like moths to a flame. But today? SMBs now dominate news of ransomware and other cyberattacks. From hospitals and schools to retailers and manufacturers, the news is full of stories of smaller organizations being brought to their knees by a breach. Bad actors no longer discriminate between the “big guys” and the “little guys”; SMBs are now the primary targets because they often lack the technologies and staffing for adequate cybersecurity protection. Where, exactly, are most SMBs on their path to cybersecurity maturity today? Although Pondurance has been providing managed and consulting security services to SMBs for years now, we were interested in calibrating a bit – taking a deeper dive into the state of cybersecurity maturity within SMBs today. To do this, we commissioned a study from Forrester Consulting to explore how SMBs are evolving their cybersecurity operations practices to protect their organizations and the people they serve. We wanted to know: Do SMBs feel especially targeted by cyber threats? Are they seeing an increase in the number and types of cyberattack attempts on their organizations? Are they properly equipped with the right cybersecurity resources to address today’s cyber threats? Do SMBs manage their own internal security operations centers (SOCs), or do they outsource? And do they run them 24/7? Have they been able to hire and keep qualified security experts? Do they rely on outside partners to help fill skills and technology gaps? If so, how much? What are the cybersecurity tools and technologies they believe are critical to improving their detection and response capabilities? If they rely on external partners, what do they need and expect from a partner? What outcomes do they expect for their businesses? These are some of the questions that are addressed in the study, titled Attackers Don’t Sleep, But Your Employees Need To . Maybe the title gives it away – the study found that, while 81% of small and medium-size businesses surveyed are monitored by a SOC ( encouraging! ), most–57% of SMB’s–do not operate 24/7 ( discouraging! ). Sixty-seven percent of respondents’ organizations have 1 to 10 full-time employees solely dedicated to cybersecurity — and that’s everyone providing security support, including whoever might be staffing an SOC. At the higher end of the SMB category are organizations as large as 2,500 employees with $2 billion in annual revenue, so that’s not a lot of security staffing to protect the business and its people and assets. Around-the-clock security operations coverage can run the limited staff within an SMB absolutely ragged. SMBs are relying on external partners for both platforms and services to close their people, process, and technology gaps The 232 U.S.-based cybersecurity operations leaders that were surveyed are practical about where they need help, and many are looking to external partners to fill their skills and technology gaps. Indeed, respondents report spending 60% of their cybersecurity operations budget on managed and consulting security services. Sixty-seven percent of respondents “report that engaging external security operations partners is crucial to maturing their security operations practices.” Pondurance wants to be that partner, and as it turns out, the services we deliver – powered by best-in-class technologies – line up directly with the detection and response investments at the top of many an SMB’s “wish list.” When asked, “In which of the following areas is your organization interested in engaging an external security operations partner?,” these leaders responded that, in the next 12 months, they plan to implement managed detection and response (MDR) (38%), extended detection and response (XDR) (47%), and digital forensics and incident response (DFIR) (48%). Endpoint detection and response (EDR) (31%), a vulnerability management program (28%), and a SIEM platform (28%) round out the list. These are just some of the findings in Attackers Don’t Sleep, But Your Employees Need To . In the weeks ahead, we’ll dive a little deeper into more of the findings, including what, specifically, SMBs cite as “the most important drivers of engaging an external security operations partner.” (Spoiler alert: Pondurance “checks all the boxes.” ;-)) Also, please join us for an enlightening webinar with Lyndon Brown, Chief Strategy Officer at Pondurance, and guest speaker Jeff Pollard, VP Principal Analyst at Forrester Consulting, as they discuss the findings of this Forrester Consulting study and provide guidance for achieving the 24/7 SOC coverage required to help SMBs respond to cyber threats and help their teams get a good night’s sleep. Zzzzz… Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Agentic AI in the SOC: How It Reduces Alert Fatigue and Improves Threat Detection Pondurance March 27, 2026 Facebook X (Twitter) LinkedIn Copy link Alert fatigue is a real threat, both to security teams and the organizations they protect. It occurs when security analysts are constantly overwhelmed by a flood of false positives or low-priority alerts, which often leads to burnout and the risk of overlooking true or high-priority threats. A recent PwC paper noted that security operations center (SOC) analysts receive anywhere from 10,000 to 50,000 alerts daily, 30-40% of which go unreviewed. The paper also notes how manual triage and context gathering cause response times to be measured in hours or days. As threat actors increasingly use AI to launch more sophisticated threats at scale, traditional SOCs will be unable to defend their organizations against growing breach risks. To stay ahead of AI-enabled threats, modern SOCs are turning to agentic AI, which has been proven to accelerate threat analysis, significantly reduce false positives, and contain high-confidence threats at machine speed. This Q&A with Michael DeNapoli, a Senior Solutions Architect at Pondurance, explores how agentic AI enhances threat detection for SOCs, mitigating breach risk for organizations and protecting security teams against alert fatigue. Q: Exactly what is agentic AI, and how does it differ from generative AI? Michael: Agentic AI differs from generative AI in one key way: generative AI mainly responds to prompts, while agentic AI is built to complete tasks. A generative model like ChatGPT takes a question, analyzes it, and returns an answer. An agentic system starts with a goal, then works through the steps on its own—breaking the task into subtasks, gathering what it needs, iterating, and refining its work without waiting for a new prompt each time. A useful way to think about agentic AI is as a skilled worker. You assign the task, and the worker figures out how to get it done. For example, if asked to estimate a customer’s daily log ingestion rate, a generative AI can provide an answer based on the initial inputs. But, if properly trained for that task, agentic AI can dig deeper on its own. It can review server types, log sources, and prior examples until it reaches a more complete conclusion. Q: How can agentic AI improve threat detection for SOC analysts? Michael: Agentic AI takes on the high-volume, repeatable work that consumes most analyst time. In practice, known threats account for roughly 80% of activity. While tools like SIEM and SOAR help, they still leave a large share of alerts requiring investigation. Agentic AI handles that remaining volume by analyzing alerts the way a SOC analyst would—reviewing historical logs, correlating events, and anticipating likely next steps—often in two or three minutes instead of the 10–20 minutes it might take a human. This dramatically increases processing speed without sacrificing quality. Just as important, it reduces analyst fatigue. Repetitive alerts are a primary driver of burnout. By offloading that work, agentic AI frees human analysts to focus on complex, novel threats that require human ingenuity and creativity. The result is a more balanced SOC: faster investigation at scale, stronger coverage, and better use of human expertise where it matters most. Q: How does agentic AI enhance threat detection through contextual insights, as opposed to simply generating alerts? Michael: In a traditional SOC, a SIEM flags potential issues based on correlation rules—but these alerts only indicate potential threat activity, not whether a real threat exists. Agentic AI picks up where alerts leave off. It analyzes what triggered the alert, then iteratively builds context—reviewing historical data, prior decisions, and related activity within the environment. It asks: Has this happened before? Was it benign or malicious? What additional signals should be present if this is a true threat? By continuously enriching alerts with context, it determines whether they are false positives, contained incidents, or active threats requiring escalation. It also quantifies risk and potential impact, drawing on prior events and threat intelligence—mirroring how a human analyst investigates, but completing the process much faster. Because multiple agents operate in parallel, this approach scales efficiently across dozens of environments at once—handling growing data volumes without overloading analysts or requiring constant headcount expansion. Q: How does—and how will—agentic AI affect the work of a SOC analyst? Michael: Agentic AI will fundamentally change the day-to-day work of a SOC analyst by removing much of the repetitive, low-value effort that drives alert fatigue. Today, analysts spend a significant portion of their time reviewing the same types of alerts over and over—work that is necessary, but often tedious and mentally draining. By offloading that repetitive triage to agentic AI, analysts can focus on the alerts that truly require human attention—complex, ambiguous, or novel threats. This shift allows them to spend more time on engaging investigations without constantly interrupting that work to handle routine cases. The impact is twofold. First, burnout is reduced because analysts are no longer overwhelmed by volume or stuck in monotonous workflows. Second, performance improves, because analysts can concentrate on high-priority threats without distraction—reducing the likelihood that something important is missed. Importantly, this isn’t about replacing SOC analysts. It’s about enabling them to do the work humans are best at. The goal is a more sustainable, engaging role—one that helps retain skilled professionals and keeps them invested in the work over the long term. Discover Kanati™, Agentic AI SOC from Pondurance Pondurance Kanati is the first agentic AI SOC designed for autonomous operations within a managed detection and response (MDR) service . It replaces alert-driven, error-prone workflows with a coordinated system of AI agents that operate continuously throughout the full threat lifecycle. With Kanati, security teams receive lightning-fast threat analysis, a dramatic reduction in false positives, and sub-second containment for high-confidence threats. Initial performance measurements of Kanati demonstrate: 90% faster threat analysis with AI-powered confidence rating and containment 80% reduction in false positive tickets 10x improvement in contextual enrichment and correlation of threats 100% coverage of alerts resulting in all alerts investigated with full analytical rigor Using agentic AI, Kanati helps security operations combat threats that move at machine-speed, providing fast, accurate detection, analysis and containment that can make the difference between a minor inconvenience and a successful ransomware attack or data breach. Visit pondurance.com or email kanati@pondurance.com for more information or to request a demo. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

This month, Pondurance provides an update on the current cybersecurity threat landscape and notable vulnerabilities. Novel Threat Tactics, Notable Vulnerabilities, and Current Trends for May 2024 Pondurance June 17, 2024 Facebook X (Twitter) LinkedIn Copy link Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In May, the team discussed threat intelligence, vulnerabilities and trends, threat hunting, and the product road map. Threat Intelligence The Senior Digital Forensics and Incident Response (DFIR) Consultant discussed trends from the first quarter that have continued through April, including ransomware, business email compromise (BEC), lone wolf extortion attacks, and the aftermath of the ConnectWise ScreenConnect vulnerability. Ransomware threats have not slowed down, and most ransomware cases the team works on stem from virtual private network (VPN) vulnerabilities. Potentially, any VPN can be compromised, so organizations must ensure that controls such as multifactor authentication (MFA) are in place. The team also sees targeted data exfiltration in nearly every ransomware case. In addition, threat actors are using remote monitoring and management and legitimate tools such as AnyDesk, TeamViewer, and ConnectWise ScreenConnect for persistence. The Senior DFIR Consultant suggested that this trend is largely due to the success that next-generation endpoint detection and response (EDR) solutions have had catching malware. BEC attacks have changed, primarily due to MFA. Now, the team sees more attacker-in-the-middle phishing, where threat actors insert themselves in email conversations between two users, intercepting all emails and adding malicious links and information. The team also sees BECs becoming part of a larger phishing campaign, using all mailbox users as access brokers to gain access to data and even selling access to those accounts. Dwell time for BECs is less than 24 hours, so the team suggests keeping a close eye on inbox rules creation, sign ins, and possible travel. Lone wolf extortion attacks saw a slight uptick in April. These individual threat actor exploits are usually simple attacks such as tech support scams leading to data exfiltration or the exploitation of a simple web app vulnerability. In addition, the team is still seeing the aftermath of the on-premise ConnectWise ScreenConnect vulnerability that was first exploited in February and has been heavily leveraged by threat actors. Vulnerabilities and Trends The Vulnerability Management Program (VMP) Team Lead reviewed notable vulnerabilities from April. As many as 2,500 vulnerabilities were disclosed, and 14 of those vulnerabilities were high risk. Of those 14, four have a known proof of concept code on the internet and seven were known to be exploited in the wild on products including CrushFTP, Palo Alto, some Cisco devices, a Google Pixel device, Microsoft Windows, and some Linux distributions. The VMP Team Lead talked in detail about a few of these vulnerabilities: The CrushFTP vulnerability (CVE-2024-4040) allows a remote threat actor with low-level privileges to access and potentially exfiltrate all files stored on the CrushFTP tool. It follows a theme the team is seeing where file transfer programs or any remote access product accessible over the internet can be exploited. The Palo Alto PAN-OS vulnerability (CVE-2024-3400) was exploited on March 26 and April 11 by UTA0218, a group of state-sponsored threat actors targeting perimeter devices. To conduct the exploit, the threat actor creates a reverse shell, then downloads executables, exfiltrates configuration data, compromises sensitive credentials, and moves laterally throughout the network. To mitigate, Palo Alto users must apply the released patches and updates. Also, users with a threat protection subscription can receive threat prevention IDs for the device. The Cisco vulnerability is also thought to be a state-sponsored threat actor because the attack lacks financial motivation and has a high level of sophistication. For the attack, two vulnerabilities (CVE-2024-20353 and CVE-2024-20359) are chained together to allow the threat actor to achieve remote compromise of the device. A line dancer, or memory-resident shellcode interpreter, allows the threat actor to carry out network surveillance, and a Line Runner backdoor provides persistence on the device. In addition, antiforensics are employed throughout the process to cover the threat actor’s tracks. The team recommends that all users update the devices and software running on them. In May, a Chrome zero-day vulnerability (CVE-2024-4761) was exploited in the wild and disclosed by Google. This use-after-free vulnerability can be used to corrupt data on a device, cause a system to crash, or execute an arbitrary code that will ultimately lead to additional malware being deployed on the system. Since the vulnerability occurs in the visual component of the open-source Chromium code, other Chromium-based browsers are impacted, including Microsoft Edge. Organizations running Edge, Chrome, or any Chromium-based browser must apply the updates and restart the browsers for the updates to apply. At the time of the webinar, there were seven vulnerabilities impacting Chrome. Threat Hunting The SOC Director talked about upward and downward trends that the team is currently monitoring on client networks. Phishing emails with a financial lure are still on the rise, especially tax rebates and refunds. The use of artificial intelligence services, such as ChatGPT, is making phishing emails harder to identify due to more convincing language and correct grammar. To reduce the risk of an attack, the team suggests the continuation of user awareness training. Ransomware is still the most prevalent malware attack, though the team is not seeing many successful infections. Malware delivery via phishing emails is on the rise. These attacks usually occur through links in the body of emails, link attachments, and PDF attachments containing JavaScript (but typically not ActionScript) that lead to a malicious website. Also, password-protected documents and zip files are often associated with these attacks. The team recommends blocking password-protected files at the email gateway and setting up a whitelist or allowlist to permit password-protected files from known partners. Malware delivery via drive-by websites is trending way down, though it’s still a threat. The team encourages organizations to continue patching operating systems and applications to stay safe. Product Road Map The Director of Product Management provided an overview of the Pondurance road map for 2024. Next Month The Pondurance team will host another webinar in June to discuss new cybersecurity activity. Check back next month to read the summary. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn how AI is reshaping cyber threats, fueling smarter phishing and BEC attacks, and discover practical steps to strengthen your organization's defenses. How AI Is Changing the Cyber Threat Landscape — and What To Do About It Pondurance June 30, 2026 Facebook X (Twitter) LinkedIn Copy link Organizations are adopting artificial intelligence (AI) at a fast pace to increase productivity and improve efficiency. Unfortunately, threat actors also are adopting AI to drive cyberattacks. As much as 87% of organizations experienced an AI-enabled cyberattack in 2025, and globally, there was a 47% rise in AI-enabled cyberattacks , according to DeepStrike's AI Cyber Attack Statistics 2025, Trends, Costs, Defense . When an organization experiences an attack, the average AI-driven breach costs an alarming $5.72 million . Abbey Mirelli, Incident Response Manager, and Brooke Weiss, Incident Response Consultant, both on the Pondurance team, have seen firsthand how AI has changed cybersecurity. They recently presented detailed information on how AI is reshaping the threat landscape, how AI-enabled attacks have changed business email compromise (BEC) attacks, and ways organizations can defend against AI-enabled attacks. Reshaping the threat landscape AI is rapidly transforming how organizations operate and changing how threat actors work. Threat actors can attack faster and more relentlessly than ever before. Plus, the ease of use and the price point for purchasing AI tools offer a lower barrier of entry for new threat actors to launch and execute sophisticated AI cyberattacks. In particular, threat actors are using AI to improve phishing and BEC attacks, making traditional security indicators less reliable and significantly increasing phishing click-through rates. Full visibility is an AI-related challenge for most organizations. As AI adoption accelerates, the number of common security gaps in the network increases, leaving organizations more vulnerable to possible attacks. These security gaps include weak identity controls, lack of multifactor authentication (MFA) enforcement, insufficient cloud logging, poor open authorization (OAuth) governance, limited visibility into AI tool usage, and an overreliance on traditional email security controls. Many organizations don't know how employees are using AI tools, and many employees don't know the policies for using AI. The lack of knowledge can be a result of many issues including: Outdated acceptable use policies. The use of AI is expanding so rapidly that organizations are having a difficult time keeping up with changes to the AI governance policies. Many organizations are still defining what acceptable AI usage actually means and where sensitive data should or should not be used. It's important to have up-to-date AI governance policies in place. Logging and visibility gaps. Organizations often lack visibility into what data is being entered, what tools are being tracked, and what information is being retained externally by employees. AI output influence. AI-generated recommendations and responses can directly influence user decisions, actions, and business operations. Implementation of proper validation or oversight of AI output ensures that decision-makers are relying on accurate information to make the best decisions possible. AI can affect decisions on every level, but its impact on large-scale decision-making is critical to understand from security, operational, and infrastructure perspectives. For security, all organizations should establish oversight, approval workflows, and validation processes to ensure that AI-driven decisions are reasonable, explainable, and aligned with security and business objectives. For operations, organizations must determine where humans are required, define acceptable risk tolerances, and make sure employees understand when AI outputs should be challenged rather than accepted as fact. The team suggested that infrastructure may be the most important perspective because, without proper governance, visibility, and testing, organizations risk introducing automated decisions that create unintended outages, misconfigurations, or cascading operational issues across environments. Changing BEC attacks BEC attacks involve unauthorized threat actors gaining access to a legitimate email account through social engineering tactics, such as emails, texts, or phone calls. AI tools such as ChatGPT, Claude, and Copilot are changing the email environment, making it easier for threat actors to craft more targeted, credible phishing emails to use for credential harvesting and other malicious actions. In 2025, there was a 46% increase in AI-generated phishing content, and a 25% increase in phishing messages that bypass traditional filters , according to AI Cyber Attack Statistics 2025, Trends, Costs, Defense . The team explained how threat actors are able to use AI-powered reconnaissance and AI-generated malware for a greater likelihood of success with a phishing scam. Threat actors use AI-powered reconnaissance to identify who to target, research the target to personalize the email content, and know how to quickly inject themselves into email conversations. AI-generated malware can be downloaded and can change from one device to the next. The malware often installs a remote management tool, such as AnyDesk or ScreenConnect, which is a legitimate tool, where the threat actors can log in, manipulate the operations, gain access, and take control of the system. Recently, the team has seen an increase in AI-enabled device code phishing attacks. Device code phishing is an attack where an email with a link or attachment to a suspicious webpage is sent to a target within an organization. The attack differs from traditional phishing in three ways: It uses device authentication to bypass MFA, the code isn't generated until the link is clicked on, and it uses AI to create unique automations rather than scripts to inject the threat actors into the process. In a device code phishing attack, threat actors ask a service, such as Microsoft or Google, for a device code, and the service provides it. The threat actors then send the device code to the target, and the target enters the code, username, password, and MFA code for the legitimate service. The service generates an access token, and the threat actors recover the access token. Once the threat actors have access, several different actions typically occur. Threat actors will look through the mailbox to identify if the user is a good target for their objective. They will create rules within the environment to hide their actions from the account owner, including deleting emails that warn of a suspicious login, and they commonly inject themselves into the email conversations. Also, threat actors will sometimes use application registration, domain spoofing, and document sharing to further their malicious actions. Finally, once the goals have been completed or if the threat actors suspect they will be caught, they send mass phishing emails to find new potential victims. Defending against AI-enabled attacks AI-enabled attacks are allowing threat actors to attack faster and more relentlessly, so organizations need to strengthen the overall security of their threat landscapes. The team discussed several specific defensive actions that organizations should take to protect against AI-enabled attacks: Control access and integrations. Organizations should control particular accesses and integrations to keep threat actors from exploiting them for financial gain or other nefarious reasons. Organizations should disable unnecessary device code authentication flows , limit long-term token persistence, review OAuth permissions and token-based persistence mechanisms, and review and limit software-as-a-service connectors, plug-ins, browser extensions, and application programming interfaces (APIs) that integrate with AI tools. Improve visibility and monitoring. Organizations need to monitor AI platform activity. They should improve visibility into AI-related usage by logging prompt activity, connector access, file interactions, API usage, and authentication events associated with enterprise AI platforms. Organizations also should monitor device code sign-ins, impossible travel, and anomalous sessions where threat actors often gain legitimate access to accounts but for illegitimate purposes. Set clear policies. Organizations should establish AI usage governance that defines approved AI tools, acceptable use cases, prohibited data types, and security review requirements before deploying the AI platforms. Also, organizations should establish processes that require humans to validate and oversee AI-generated recommendations, security guidance, operational actions, and automated workflows. Train users. Training must expand beyond traditional phishing training. Instead, users need to understand modern identity phishing techniques, so they know how to recognize AI-enabled phishing scams and what to do if they experience suspicious activity. Conclusion The adoption of AI by organizations and threat actors alike has changed the cybersecurity landscape. Organizations need to understand how these changes affect cybersecurity and ways they can defend against threat actors using AI for their malicious exploits. For more detailed information about how AI is changing the cyber threat landscape, watch the webinar on-demand. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn about the challenges SMBs face in cybersecurity backed by data from the Forrester Opportunity Snapshot. Read more here. Modern Problems Require Modern Solutions – The SMB Path to Comprehensive Cybersecurity Pondurance July 29, 2022 Facebook X (Twitter) LinkedIn Copy link This digital world we live in can be a real jungle sometimes. Companies and individuals consume and produce more data each day, heck every second, than our minds can even fathom. And bad actors are trying to gain access or prevent you from gaining access to that data, creating costly and sometimes catastrophic problems. The digital attack surface is so broad and the cost of breaches so devastating that no one can treat cybersecurity as an afterthought. There was a time where cyberattacks mostly targeted large enterprises, but as we all know, that is no longer the case. Not only that, the techniques and technologies hackers use today are becoming increasingly more sophisticated, and it’s harder than ever to maintain a cybersecurity posture that protects you on all fronts. I was recently the victim of a cyberattack that I can admit was pretty impressive. Someone was able to put a fraudulent charge on my credit card by making it look like one of my kids had made a purchase on an online game she frequently plays and makes purchases in. I was able to flag that threat and help my daughter change her password, but the next day a similar charge appeared on my credit card statement. Only this time, it was made to look like my other kid had purchased something in a game he always plays. At this point, I realized a more complicated game was afoot. It appeared someone had attained information from one family member and was using it to infiltrate other accounts. It also appeared they were planning to play the long game, making very small, incremental charges that appeared to be normal spending by my kids. If I were not so maniacal about my finances, this could have continued unnoticed for a long time! Smash cut to me, the family IT guy, frantically trying to change and document every password associated with every account for every family member. So. Many. PASSWORDS! It took hours. And I’m just one guy, with one credit card, who only got hit for less than $20. Imagine being in that situation, only now it’s your job with millions of dollars and your entire reputation at stake. This is the reality for many IT and cybersecurity pros working in small and medium-size businesses (SMBs) today. Many of the challenges they face in trying to stay protected, things like a lack of expertise or 24/7 coverage, are the same challenges that led to my own situation. But these can’t be solved by changing a few passwords. Skilled attackers, complex environments, and resource constraints – it’s all too much Pondurance recently commissioned a study from Forrester Consulting to explore how SMBs are evolving their cybersecurity operations practices to protect their organizations and the people they serve. Part 1 of this blog series discusses some of the findings in Attackers Don’t Sleep, But Your Employees Need To as they relate to where SMBs are along the path to cybersecurity maturity. What I want to focus on here are the findings surfaced by the study that illuminate the truly monumental challenges these organizations face. As the study notes, “Business leaders should no longer ask, ‘Could this happen to our organization?’ because yes — it most certainly can.” Indeed. Seventy-five percent of respondents indicated that they have seen an increase in cyberattacks over the last three years. And, eerily, these organizations are experiencing similar challenges to the ones I was facing in my own life, only on a much larger, more critical scale! Let’s take a look at the biggest issues facing the SMBs that Forrester Consulting polled for this study as they try to maintain protection from cyberthreats: 57% doesn’t have 24/7 security operations coverage 42% lacks the skills and expertise necessary to maintain a strong security posture 38% notes an increase in attacker sophistication as a major challenge 36% struggles to provide employees with the right security tools The study also notes that SMBs struggle with detection and response to endpoint, network, and cloud-based threats. The risk is compounded by the fact that many significantly lack the resources, expertise, and general bandwidth to focus on strategic activities like developing plans and playbooks and conducting thorough post-breach investigations. Worst of all, many of them are not even monitoring their environments around-the-clock. SMBs aren’t quite as bad off as a guy changing all his passwords in the middle of the night, but this is a little too close for comfort. Insufficient resourcing is a critical gap Attackers Don’t Sleep, But Your Employees Need To study sheds light on the most difficult to overcome cybersecurity challenges facing SMBs today and indicates that lack of resources and expertise is quite possibly the most critical of them all. When asked, “In which of these areas does your organization struggle with lack of resources (expertise and/or bandwidth)?,” the majority of respondents identified either a significant or at least some lack of resources committed to continuous monitoring and response capabilities for external third-party risks, network-based threats, and endpoint-based vulnerabilities. Not only that, the majority also indicated that lack of resources is preventing them from maintaining incident response plans, conducting digital forensics, and even containing incidents quickly. Those are some major vulnerabilities being left to chance with short-staffed teams! This is why, naturally, the respondents report spending 60% of their cybersecurity operations budgets on managed and consulting services. It’s clear that many SMBs need a partner to ensure around-the-clock monitoring and incident response, not to mention help maturing their cybersecurity posture. Where do SMBs go from here? Knowing you need help is only half the battle. With so many choices in the managed detection and response (MDR) and managed security services space, it’s imperative that SMBs select the right provider for their specific needs. Pondurance not only delivers every service on that SMB “wish list” with a combination of best-in-class technology, 24/7 coverage, and some of the best cybersecurity talent in the industry but does so with an emphasis on collaboration and communication with clients. Pondurance’s high-touch approach and commitment to defending the human experience have proven to be successful for clients looking to shore up their security posture and evolve with the ever-changing threat landscape. Stay tuned as we dive deeper into more of the findings from Attackers Don’t Sleep, But Your Employees Need To report here at the Pondurance blog, and please join us for an enlightening webinar with Lyndon Brown, Chief Strategy Officer with Pondurance, and guest speaker Jeff Pollard, Vice President, Principal Analyst with Forrester Consulting, as they discuss the findings of this Forrester Consulting study and provide guidance for achieving the 24/7 security operations center coverage required to help SMBs respond to cyber threats. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Read this blog to learn more about the cybersecurity trends that Niloo Razi Howe highlighted in her testimony to Congress.|Read this blog to learn more about the cybersecurity trends that Niloo Razi Howe highlighted in her testimony to Congress. New Technology Accelerates Opportunities for Cyberattacks Pondurance May 25, 2021 Facebook X (Twitter) LinkedIn Copy link The world is changing dramatically, partially fueled by the COVID-19 pandemic that forced every organization to accelerate its digital transformation. As we rapidly digitize infrastructures, adopt artificial intelligence (AI), and expand the Internet of Things (IoT), we should reimagine how we organize to defend against the cyber threats each new technology brings. Below are some of the cybersecurity trends that Niloofar Razi Howe highlighted in her testimony to keep in mind when rethinking how we defend against cyber threats. Ransomware attacks are one of the fastest-growing and most damaging cyber threats to organizations. With the disruption and ransomware costs, these attacks are estimated to cost between $40 billion and $170 billion globally . As many as 100 million ransomware cases have been observed over the last four years alone. The sophistication of bad actors’ techniques is increasing while they demand higher and higher ransoms over time with little fear of any consequences. Phishing attacks continue to be the top attack vector seen by our analysts. The number of reported incidents increased from first quarter to fourth quarter showing that more attackers are getting around tools. 33% of tickets from Q1 were created because of phishing attacks. Threat actors are getting smarter with their phishing techniques, and with more attacks, there are more opportunities for end-users to accidentally click the wrong link. IoT devices are another threat as security features are almost nonexistent in their design due to regulations and liability being rare. Most IoT devices have known vulnerabilities and have already become a key component of adversary attack tactics like botnets. Cybersecurity is essential as IoT device adoption grows in many business applications including manufacturing, agriculture, healthcare, power grids, and transportation. AI adoption is increasing across industries, from finance, manufacturing, pharma, and healthcare to applications such as cybersecurity. AI modeling is dependent on the integrity of data used in training its systems, and it’s important to protect that data from compromise and manipulation. While eliminating the threat of cyberattacks is almost impossible, there are actions we can take over time that can restore deterrence and lead to greater resilience. The issue is not when we suffer cyberattacks but how quickly we can react and recover from these cybersecurity trends. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Network Sensor Metadata Provides Context and Alert Enrichment The Value of a Network Sensor Pondurance November 22, 2024 Facebook X (Twitter) LinkedIn Copy link As the cybersecurity world evolves, organizations are increasingly reliant on technology and devices such as network sensors to protect their digital environments. Network sensors measure network performance, connectivity, and service availability, and they provide real-time and historical data for network administrators. These valuable devices also actively monitor network traffic for unusual activity and potential threats and trigger alerts on those activities and threats. A network sensor provides three core functions including generating security alerts, providing metadata , and enabling full packet capture to identify malicious activity. Though all three functions are important, the metadata component is key to fully understanding what’s happening on a network. In a recent webinar , Erik Mogus, Director of Product Management at Pondurance, discussed the role of the network sensor and explained how metadata gives context to an event and provides alert enrichment for security operations center (SOC) analysts. Context The more data points that analysts have, the better decisions the analysts can make. And better decisions from the analysts can lead to the generation of better tickets. Erik believes that the litmus test on the criticality of an alert ticket is: “Do I wake somebody up at 3 in the morning to notify them of this?” To make the determination about whether to wake a client, it’s important to understand the context — the who, what, where, when, and how — of the data. At Pondurance, the SOC team can integrate network data across endpoint detection and response (EDR) solutions, logs, or clouds. An EDR alert is sent when an action is malicious but not blocked. The metadata — which describes what happened two minutes before the event, during the event, and two minutes after the event — provides the context to determine the event’s significance. Metadata is also collected for logs and clouds, with an alert sent for suspicious and malicious activity for host events. If there’s an alert on an EDR, log, or cloud, the team can pull the metadata into that specific case and efficiently leverage it to understand the significance of the event. Alert enrichment The combination of an alert and metadata can create “enriched alerts” for clients. To illustrate the value of metadata, Erik used the example of a malicious domain detection, where a user clicks a phishing email with a known bad domain and an alert generates indicating that the user has clicked a malicious domain. However, a typical alert does not tell the SOC analyst whether something meaningful has occurred as a result of the user’s action. The analyst needs the combination of the alert and the metadata to reveal the bigger picture. Erik explained that SOC analysts need to know the answers to several questions to better understand the relevance of a malicious domain detection event. Which domain name did the host attempt to resolve? Did the domain name resolve? Did the host successfully connect? How did the host behave after connecting? Why else might this event have occurred? Where is this event occurring across all clients? A typical alert can sometimes answer these questions, but when an enriched alert generates, the analyst can always find the answers. With metadata, the SOC team can track the full event from minutes before, during, and minutes after the event to determine if something bad happened and the significance of it. “If we see this event, and we see the domain did resolve, the host did connect to it, the host did download traffic from that IR (incident response), and it’s spraying the inside of your network, we’re pretty confident something very bad is happening,” said Erik. “Without that network metadata, it’s almost impossible to be able to put all of that together to determine what the criticality of that event is.” Conclusion Cybersecurity continues to evolve, and network sensors are increasingly valuable devices for detecting activity and threats on the network. Learn more about Pondurance’s network sensor and the criteria that Erik and SOC analysts use to determine what activity and threats warrant a middle-of-the-night wake-up call. Watch the video. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

haveibeenpwned.com aggregates data breach notifications to help users understand their data and data breaches to protect against threats.|haveibeenpwned.com aggregates data breach notifications to help users understand their data and data breaches to protect against threats. Data Breach Notifications With haveibeenpwned.com Pondurance September 24, 2021 Facebook X (Twitter) LinkedIn Copy link Data breaches are frequently occurring, and the scale to which they affect organizations and users is massive. Oftentimes, organizations receive data breach notifications via third parties after the incident. As an organization, how are you supposed to react to this type of communication? For those that need more knowledge into which of your accounts have been affected, we recommend using Have I Been Pwned (HIBP). It is a free online tool that can help organizations and individuals learn if their accounts are compromised. It aggregates the data of compromised accounts to help users and organizations better protect themselves from the risks of cyberattacks. Conducting Domain Searches To get started, go to the HIBP website here and verify that the domain belongs to your organization. Data Breach Notification Actions and Considerations Understand the extent of the breach by searching for the compromised website here . This will include a list of data such as breach date and compromised data. It is important to note whether usernames and passwords appear in the compromised data section of the breach. View the data provided by HIBP to find the accounts that are compromised and understand the impact of the breach within the environment. This will also give a scope of compromised users to address in future steps. If the compromised data includes passwords and usernames , we recommend that you review the last password change date for that user account to ensure that the account has had a password change or rotation since the date of the breach. If there is uncertainty regarding the password change , we recommend that the password immediately be reset to ensure that the account cannot be accessed via stored credentials on the compromised website. We recommend that staff caution users who utilize work emails when registering for websites for personal use to help avoid the likelihood of appearing in this style of breach. We also recommend that staff educate users not to utilize the same password for personal use as they do for business use. For all data breach notifications that contain a more recent breach and critical information such as a password that was leaked, be sure to review the user’s login activity in your user management consoles. For users who perform critical functions or are considered VIP users , we recommend that they sign up here to be notified if their accounts are found in a future breach. When in doubt, Microsoft has great recommendations regarding password policies and management to follow, including: Maintain an 8-character minimum length requirement. Don’t require character composition requirements (e.g., *&^%$). Don’t require mandatory periodic password resets for user accounts. Ban common passwords to keep the most vulnerable passwords out of your system. Educate your users to not reuse their organization passwords for non-work-related purposes. Enforce registration for multifactor authentication. Enable risk-based multifactor authentication challenges. Are you interested in learning more about protecting your personal information and curating a safer experience online? Download our Employee Security Awareness Checklist for the best practices for online security. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn how AI is making phishing and social engineering attacks more convincing, and why employee awareness, verification, and quick reporting matter more than ever. Recognizing Social Engineering in the Age of AI Pondurance October 14, 2026 Facebook X (Twitter) LinkedIn Copy link For years, employees have been trained to recognize phishing by looking for familiar warning signs: a misspelled word, an unusual greeting, or a message that simply doesn't sound like something a colleague would write. Now, with artificial intelligence (AI) in the mix, those warning signs still have value but are becoming less reliable. AI gives threat actors an easier way to create polished messages that resemble everyday business communications. A phishing email can reference the right company, use natural language, and sound remarkably similar to a legitimate request. Use of AI changes what employees need to focus on to recognize social engineering scams. A convincing message can still lead to danger Social engineering attacks succeed when an employee is persuaded to take an action that benefits the threat actor. A message — received via email, text, chat, or another familiar communications channel — may ask an employee to log in, approve an authentication request, review a document, or change information associated with a business process. AI makes it simpler for threat actors to prepare those messages and do it convincingly. As Pondurance experts discuss in How AI Is Changing the Cyber Threat Landscape — and What To Do About It , threat actors can use AI to research potential targets and create more believable social engineering attempts. With AI, the quality of the writing is no longer a useful measure of whether a message is safe. The message may be well written either because an actual co-worker sent it or because a threat actor had access to the tools and information needed to make it convincing. Context matters more than polish Employees usually have an advantage that threat actors don't have: an understanding of how work normally gets done. Employees know whether a manager typically asks for certain information by email, whether the IT team normally sends login instructions through chat, and whether a vendor usually handles a request in a particular way. An unusual context can be one of the strongest signs that something is wrong. Thus, a message deserves more attention when the request feels out of place for the situation. Also, an unexpected sense of urgency can be meaningful, particularly when the employee is being pushed to act before there's time to verify the request. Employees don't need to analyze every message like a security investigator. Instead, simply taking a brief pause to consider whether the request fits the situation can be enough to interrupt an attack. When a request feels unusual, verification through a separate, trusted communications channel can help. Employees should be encouraged to call a known number or start a new conversation with the alleged sender of the message to halt the threat actor's control over the interaction. Authentication can be an element of a social engineering attack Some attacks are convincing because they use legitimate technology. As an example, the Pondurance detection engineering team recently highlighted an incidence of device code phishing , a tactic where a threat actor directs an employee through a legitimate authentication experience and gains access to the network as the user of the device. In device code phishing, an employee may recognize the login page, and the authentication process may work exactly as expected. In this particular incident, the threat actor convinced the employee to enter a code or start a login process that was never requested. A login request that appears without explanation should stop an employee from taking any further action. Also, when a multifactor authentication prompt arrives but the employee is not actively signing into an account, the employee should stop. Routine authentication should always have context. Social engineering has moved beyond the traditional phishing email Threat actors are finding ways to make employees participate more directly in malware delivery. One example is a ClickFix attack , where employees may encounter a fake technical error, security check, or captcha that instructs them to copy a command and run it on their computers. The instructions may resemble ordinary troubleshooting, which makes them difficult to recognize. Pondurance explains the tactic in Cybersecurity 101: A Whole New World of Malware Delivery . A ClickFix attack works because employees believe they are resolving a problem. But unexpected technical instructions should raise a red flag, particularly when a website requests that an employee open a command line tool or make a security-related change on a device. Organizations should implement policies that allow any employee who is unsure about a potential social engineering attack to easily consult the IT team before continuing. Reporting can be as important as recognizing the attack Even experienced employees can be fooled by a convincing message, but the actions taken after the initial incidence can make a significant difference in the outcome of the attack. If an employee realizes that he or she clicked on a suspicious link or approved an unexpected request, reporting the activity quickly gives the security team a chance to investigate while the incident is still developing. Pondurance's threat intelligence team has emphasized the value of "phishing amnesty," where employees are encouraged to report mistakes quickly without fear that they will be punished for coming forward. Phishing amnesty creates a healthier security culture and gives defenders another source of visibility. After all, the employee who clicked the link may also be the first person who realizes something is wrong that requires the immediate attention of the IT team. Employees need to trust their instincts Threat actors can create AI-enabled social engineering messages that look polished enough to pass a quick visual inspection. However, employees bring something deeper to the situation: familiarity with the people, processes, and tools they use every day. That familiarity can help them instinctively recognize when a request seems suspicious. Cybersecurity Awareness Month is a good opportunity for organizations to make employees aware that a convincing message is not automatically a trusted message. This week, organizations should ask employees to take actions that make it harder for threat actors to succeed, including pausing when a request feels unusual and verifying it through another trusted communications channel before taking action. A stronger security backstop can help Employees can't recognize every social engineering attempt, especially as attacks become more convincing due to AI, but there are ways to better the odds of success. Pondurance helps organizations strengthen the layers around their people through managed detection and response, incident response, risk management, and cybersecurity expertise designed to identify suspicious activity before it develops into a larger incident. Learn more about Pondurance and explore the many ways organizations can strengthen security to keep employees safe from cyber threats. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Cybersecurity 101: The Mythos Mystique Michael DeNapoli April 24, 2026 Facebook X (Twitter) LinkedIn Copy link Many, many readers have been asking about the recent announcements from Anthropic (the makers of Claude and other AI products) about its new Mythos model and Project Glasswing, which is leveraging that model. There are extremely differing opinions on Mythos - is it the most dangerous evolution of tooling in cybersecurity, or a positive impact as a defensive awareness and compensating controls approach. But let's go over the foundational basics first. Key Points Anthropic is developing a new AI model called Mythos for its premier product line, Claude. Mythos turned out to be an incredibly good threat researcher, finding vulnerabilities in many products across the technology world. Mythos has even discovered how to use those vulnerabilities to attack, creating concern in the cybersecurity world. However, only a select group of vendors have been provided with access to Mythos so they can create patches for their products. No actual threat actors have access to Mythos in any way. Mythos will not be intentionally publicly available until Anthropic has placed guardrails that, in concept, prevent Mythos from being used for cyber attacks. Bloomberg (and other news agencies) reported on April 21, 2026 that a small number of other persons have had access to Mythos via a 3rd-party vendor. Anthropic has not confirmed the validity of the research done by these news outlets, instead stating: "We're investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments." TheRegister later reported that unauthorized parties may indeed have accessed the platform in a limited capacity through a 3rd-party vendor. We will update this article as new information is available on the potential unauthorized access to Mythos. What is Mythos? Mythos is not a new product; it’s the next-generation model for Claude, Anthropic’s flagship Large Language Model (LLM) product line. Earlier versions of Claude are available publicly, which you can sign up to use on Anthropic’s website . Claude, Claude Code, and Claude API all allow users to ask questions on just about any topic, and develop code in multiple programming languages. These products run on top of a model, similar to how a car runs on an engine. Models are the underlying data systems and code that allow an artificial intelligence to “think” (though that’s a gross oversimplification). To date, Anthropic has created four large language models (LLMs) for Claude, and released three: ● Haiku: The fastest and cheapest of Claude models, Haiku is used primarily for chatbots and other use cases where speed is critical, and little reasoning is required. If a chatbot is pulling from knowledge bases and websites, then Haiku will get the job done. ● Sonnet: More expensive, and not as fast as Haiku, Sonnet analyzes and correlates information. Use cases include generating code in multiple development languages, adding context to messages in Slack or other platforms, and automating workflows without a ton of branching decision trees. ● Opus: This is the most expensive of the currently available models, built to deal with deep reasoning, making decisions, and handling things that require multiple steps with branching decision pathways. Opus is typically used to build agentic AI systems, for example. ● Mythos: This next-generation model extends the abilities of Opus significantly. It can reason faster, decide with more complex branching paths, and handle more concurrent operations. Mythos is not yet available to the general public, and won’t be for some time to come. Bottom line: Mythos is simply the next iteration of Anthropic’s AI model development. Eventually, it will be available in Claude and any other format that Anthropic makes publicly available. The company will certainly introduce new services and products based on Mythos in the future, while other 3rd parties will leverage the model for new services. Why is everyone alarmed over Mythos? When Mythos was developed to the point it could accept input (usually known as “prompts”), Anthropic found something remarkable: Mythos was extremely good at performing cybersecurity operations, even though it was not specifically built to do so. In fact, Anthropic and many cybersecurity experts got a sneak peek, and had significant concerns. The issue isn’t that Mythos can understand and make decisions on cybersecurity issues, it’s that Mythos can actually find new weaknesses in software, and then successfully exploit them for attack purposes. And it can do this all on its own once given the right sequence of prompts. Defining vulnerabilities and exploits A vulnerability is a weakness in something, such as a software program, a laptop or mobile device’s operating system, or even in a piece of hardware like the laptop itself. Vulnerabilities are the potential to make the application, system, or device do something that the original developers didn’t intend for it to do. An exploit is the series of steps necessary to use that vulnerability to perform something the system, application, or device isn’t meant to do. This usually involves programmatically accessing the vulnerable thing in a very specific way. It can lead to outcomes such as crashing systems or otherwise making resources unavailable, giving someone unauthorized access to data and/or settings, stealing data, or any other operations that are not meant to be possible. Threat researchers (both within vendor organizations and independent groups) will frequently identify new vulnerabilities after hours, days, or even weeks of experimenting on any given application or system. With this information, system developers and vendors can patch their systems to eliminate the vulnerability. Threat researchers may even take significant time to develop an exploit for the vulnerability, giving the developers and vendors an example they can use to better develop the patch. Threat actors and groups can also discover vulnerabilities and code exploits. Of course, they don’t give the developers or vendors any notice before they start using that knowledge to attack organizations, but it still takes these actors and groups significant time to figure out the vulnerability and build out the exploit to form a working attack, often weeks or months. A zero-day vulnerability is a vulnerability that becomes disclosed by a vendor/developer before the vendor or developer can build a patch to block an exploit. “Zero day” means that the vulnerability is disclosed to the general public without a patch, starting the clock on how long it’ll be before someone starts exploiting it and launching an attack. Mythos is hyperfast at finding vulnerabilities and creating exploits When properly prompted, Mythos can: Analyze an operating system, application, or other system for potential vulnerabilities Find unknown vulnerabilities Develop and run exploits against those vulnerabilities Mythos can do all this far more quickly than traditional threat researchers or threat actors can. In short, it could identify zero-day vulnerabilities and create exploits to use in attacking them, sometimes in minutes. As you might guess, this set the cybersecurity world on fire. Because of the potentially explosive nature of Mythos, Anthropic immediately began to mitigate the potential for damage. The company: Delayed the potential release date of Mythos and announced that Opus (the current top-of-the-line model) would continue. Only Anthropic can choose which people and organizations access Mythos today and in the near future. While some reporting has stated that others gained access to Mythos (see above), this has not yet been confirmed and is being denied by Anthropic. Created Project Glasswing. For this project, Anthropic gave limited access to Mythos to about 50 cybersecurity researchers and providers of major operating systems, applications, and hardware. The intent behind this project is to help ensure that anything Mythos could find (and it can find a lot) would already be visible to those who could then immediately and effectively patch their systems. Most critically, Anthropic has pledged to not release Mythos to the general public until they can build “guardrails” into the model. These guardrails would prevent Mythos from accepting prompts that would enable users with a Claude subscription to find new vulnerabilities and build new exploits. While there’s no announced timeframe for this, Anthropic has (as mentioned above) committed to limiting access to Mythos until this is completed. What does this mean for your organization Anthropic’s actions have had two major impacts for nearly every organization on the planet. Specifically: By limiting access to Mythos only to participants in Project Glasswing, Anthropic has allowed the technology to be put to good use. Vendors, developers, and researchers can now make their products and systems safer than ever - though we can expect to see many vendors releasing patches in the coming weeks. One hope is that many vulnerabilities will be found and vendors will be given the chance to redesign or provide patches before they become publicly known or exploited. While we will address this topic in a separate article, there is an important aspect to remember relative to Mythos … There are 15-30 major frontier models like Claude, 200-500 notable open source models, and thousands of Research & Experimental models in play. Mythos isn’t likely the only one out there that has this capability … and if it is it is only days, maybe weeks, and certainly not months and years before other engines and models can do this. Many of the participants in Project Glasswing are defensive cybersecurity vendors, several of which your organization may already use. Microsoft, CrowdStrike, and others are confirmed participants, which means these vendors can build patches into their security tools that block exploits Mythos may discover. While the full list of participants has not been released publicly, many could be security vendors you use along with hardware manufacturers, Operating System developers, and application platform vendors. If so, you will benefit from the intelligence and information these vendors gain from Project Glasswing and Mythos. Pondurance is also keeping a close eye on Mythos and the results of Project Glasswing. Since we already partner with the leaders in the cybersecurity space (Microsoft, CrowdStrike, SentinelOne, and others), we’ll benefit from the research, patching, and methodologies that the project creates. One of the main reasons we choose the partners we do is because we know that they’ll remain at the forefront of emergent technologies like Mythos. When new threat signals and intelligence are discovered, the managed detection and response tools we use will also be able to evolve. AI is accelerating threats. Your defenses need to keep pace. See how Pondurance delivers continuous monitoring, threat detection, and expert response to protect your organization. Explore the platform or request a demo . Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026

Learn the key differences between MSSP vs MDR vs SIEM, plus which solution is right for your organization in this blog. Read here. MDR, MSSP, and SIEM: Which Is Right for You? Pondurance March 3, 2022 Facebook X (Twitter) LinkedIn Copy link With the rise in cybercrime, companies are looking for the best solution to protect against cyber threats. Most companies choose from one of three different security solutions: managed security services provider (MSSP), SIEM, and managed detection and response (MDR). More and more often, they are choosing MDR as the preferred security solution to stay safe from cyberattacks. In fact, technological research and consulting firm Gartner predicts that one-half of all organizations will use MDR services to monitor, detect, and respond to threats by 2025. In Chapter 4 of our new eBook Managed Detection and Response (MDR) for Dummies , we compare these three security solutions to help you decide what’s best for your company. We explain the key differences between MDR vs. MSSP vs. SIEM, which activities you must manage with each service once implemented, and why MDR is gaining ground as a security solution. MSSP This entry-level security solution can tackle some of the specific tasks of your information security workload. For example, an MSSP service can secure your network and evaluate security controls on your devices or it can configure your firewalls, run vulnerability scans, and validate policies for your virtual private network. Such tasks are helpful, especially if your company doesn’t have a dedicated cybersecurity staff. But is an MSSP able to fully protect your company from a sophisticated data breach or cyberattack? We explain why it’s important to understand the limited visibility of an MSSP and know how that limitation can result in undetected activity in your cyber environment. SIEM The SIEM platform collects relevant data from multiple security systems and forwards the data to a centralized management and analysis system. One of the best features of SIEM is that it collects data from so many sources, providing broad rather than limited visibility. However, such broad visibility can cause problems when an abundance of data leads to an overload of alerts. We’ll explain the pros and cons of broad visibility, discuss what you need to know about alert fatigue and false positives, and tell how SIEM uses machine learning and artificial intelligence to analyze data. MDR Great cybersecurity protection requires advanced technology, such as machine learning and artificial intelligence, and experienced security professionals. That’s where MDR excels. MDR uses both tools and humans to capture, integrate, and analyze data from multiple sources. Security professionals perform full scope analysis to detect novel attack patterns and proactively respond to attackers. In this section, we discuss how MDR integrates security silos, explain how MDR expands the scope of analysis to networks, endpoints, logs, and cloud environments, and tell why you must have humans in the loop to defend your company from cyberattack. Conclusion Cybercrime is a serious threat. You need to know the best way to protect your company from data breaches and attacks. Learn about the three most common security solutions and discover which option is right for your business. Featured Posts READ MORE Recognizing Social Engineering in the Age of AI October 14, 2026 Pondurance Named Managed Security Innovation of the Year in 2026 CyberSecurity Breakthrough Awards October 12, 2026 Why Everyday Cybersecurity Habits Still Matter October 5, 2026