Blog

Patch Tuesday Analysis
Blog

September 2025 Patch Tuesday Analysis

By Tyler Reguly on Tue, 09/09/2025
Today’s Patch Tuesday Alert addresses Microsoft’s September 2025 Security Updates. We are actively working on coverage for these vulnerabilities and expect to ship that coverage as soon as it is completed.In-The-Wild & Disclosed CVEsCVE-2025-55234From the advisory, “Microsoft is releasing this CVE to provide customers with audit capabilities to help them to assess...
Vulnerability Management
Blog

How to Automate Vulnerability Management: Benefits, Best Practices, and FAQs

Mon, 09/08/2025
What Is Vulnerability Management Automation? At its core, vulnerability management (VM) is the continuous process of scanning an organization’s digital environment for exploitable weaknesses that could serve as entry points for cyberattacks, reporting and evaluating the findings, and remediating systems to remove detected weaknesses. For vulnerability...
Vulnerability Management
What Is ESI Data? Understanding Electronically Stored Information
Blog

What Is ESI Data? Understanding Electronically Stored Information

Mon, 09/08/2025
Electronically Stored Information (ESI) refers to any data created, modified, communicated, or stored in digital form. This includes emails, documents, databases, instant messages, audio and video files, social media content, and more—essentially any information that resides in electronic systems. As digital communication and data storage have become the norm, ESI plays a pivotal role in legal...
Cloud Security
Data Classification
Data Retention & Archiving
How Data Protection Applies to Zero Trust
Blog

How Data Protection Applies to Zero Trust

Mon, 09/08/2025
Protecting data in the context of zero trust means moving beyond perimeter-based defenses to a model where no user, device, or application is inherently trustworthy. As a result, every access request is verified, continuously monitored, and limited to the minimum necessary permissions needed to perform a job function. This approach reduces the risk of insider threats, compromised credentials, and...
Compliance
Data Classification
Data Loss Prevention
the_critical_role_of_offensive_security_in_cyber_defense
Blog

Breaking the Chain - The Critical Role of Offensive Security in Cyber Defense

By Katrina Thompson on Mon, 09/08/2025
Offensive security practices—particularly penetration testing and red teaming—help organizations proactively disrupt the cyber attack chain. By simulating real-world attacks, offensive security identifies weak points across the kill chain stages (reconnaissance, weaponization, delivery, exploitation, installation, command & control, and actions on objectives) before threat actors can exploit them...
Beyond Red vs. Blue: Bring on the Purple Team
Blog

Beyond Red vs. Blue: Bring on the Purple Team

By Katrina Thompson on Fri, 09/05/2025
What Is a Purple Team?In cybersecurity, a purple team is a group that combines offensive red team capabilities with defensive blue team insights to provide a truly collaborative, well-balanced security posture. “Purple teaming” is more than a work group; it should be a philosophy.If you’re familiar with offensive security, red and blue team structures are well known. To review:Red Teams: Perform...
Red Teaming
Phantom Scam
Blog

FBI warns seniors are being targeted in three-phase Phantom Hacker scams

By Graham Cluley on Wed, 09/03/2025
The FBI’s Internet Crime Complaint Center (IC3) says that the elderly are more at risk from falling victim to online fraud and internet scammers than ever before. In fact, according to the IC3's latest published annual report, seniors suffered a staggering US $4.885 billion dollars worth of losses last year - a 43% increase from 2023. With an average...
Fortra Patch Priority Index
Blog

Fortra Patch Priority Index for August 2025

By Lane Thames on Wed, 09/03/2025
Fortra's August 2025 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft and Google.First on the list are patches for Chromium and Microsoft Edge (Chromium-based) that resolve use-after-free and inappropriate implementation vulnerabilities.Next on the list are patches for Microsoft Office, Word, Excel, PowerPoint, and Visio. These patches resolve 15 issues, including...
Vulnerability Management
machines_catch_yesterdays_scams_humans_stop_tomorrows
Blog

Machines Catch Yesterday’s Scams, Humans Stop Tomorrow’s

By Kirsten Doyle on Tue, 09/02/2025
Email is still the front door for attackers. And the door is wide open. Scammers now use the same tools defenders do. A bad actor with access to a large language model can generate flawless English, craft convincing requests, and sound exactly like a colleague or supplier. The result: emails that slip past traditional filters with ease. “By the time blocking rules and security have been built up...
Email Security & Anti-Phishing
credit_union_security_your_compliance_roadmap
Blog

Credit Union Security: Your Compliance Roadmap

By Katrina Thompson on Mon, 09/01/2025
Cybersecurity for Credit UnionsCredit union cybersecurity compliance is the practice of adhering to a set of mandates and regulations that ensure the confidentiality and integrity of digitized member data.Last year (September 1, 2023 – August 31, 2024) the National Credit Union Administration (NCUA) reported 1,072 cyberattacks among the 4,411 federally registered credit unions in the U.S. That...
Cybersecurity Regulatory Landscape in Switzerland A Primer for Business
Blog

Cybersecurity Regulatory Landscape in Switzerland: A Primer for Business 

By Kirsten Doyle on Thu, 08/28/2025
Switzerland is famous for being neutral, discreet, and self-contained. And while that reputation holds in the digital world, too, in the immortal words of Bob Dylan, “the times they are a changin.” To stay in business, even Switzerland must meet data privacy standards set outside of its borders. Cyber threats are growing in volume and sophistication, and regulations need to adapt accordingly. For...
cephalus
Blog

Cephalus ransomware: What you need to know

By Graham Cluley on Wed, 08/27/2025
What is Cephalus?Cephalus is a relatively new ransomware operation that emerged in mid-2025, and has already been linked to a wave of high-profile data leaks. Like many other ransomware attacks, Cephalus not only encrypts but also steals sensitive data - with victims named-and-shamed on a dedicated leak site hosted on the dark web.Where does it get the name Cephalus from?Cephalus is a character...
The Impact of CMMC 3.0 on Government Contractors
Blog

The Impact of CMMC 3.0 on Government Contractors

By Katrina Thompson on Tue, 08/26/2025
With 55% of government contractors expecting their next job to include a CMMC requirement, adhering to the latest, most updated version of “CMMC 3.0" is imperative. According to a recent US Department of Defense (DoD) memo, such an update may be on the horizon.Here are the facts, and what they could mean for certification hopefuls.What is CMMC 3.0?First, let’s get a few things straight. The CMMC 2...
Preparing for a CMMC Audit: A Practical Guide for Success
Blog

Preparing for a CMMC Audit: A Practical Guide for Success

Mon, 08/25/2025
Discover what a CMMC audit involves, how it ensures compliance for defense contractors, and how it differs from other cybersecurity audits.
Compliance
Cybersecurity Maturity Model Certification (CMMC)
Data Classification
Security Automation
ransomware_pivot_from_hospital_to_high_street
Blog

Ransomware Pivot: From Hospitals to High Street

By Katrina Thompson on Mon, 08/25/2025
Last year, headline news of staggering ransomware attacks was inescapable. But according to new research by Comparitech, those numbers may be slowing down.By studying 211 ransomware attacks on the healthcare sector in H1 2025, the firm noted only a 4% increase year-over-year. While this still represents a modest improvement, figures for other “easier/more lucrative” industries were much higher,...
Cybersecurity Regulatory Landscape in Japan A Primer for Business
Blog

Cybersecurity Regulatory Landscape in Japan: A Primer for Business

By Kirsten Doyle on Fri, 08/22/2025
Cybersecurity in Japan has always had a cultural element, infused with precision, preparation, responsibility, and accountability. Today, it’s also a matter of national security and global trust. As threats intensify and alliances shift, Japan has responded with structured policy and determination. For companies operating in or with ties to Japan, cybersecurity compliance is part of the operating...
Compliance
Understanding the NIS2 Directive: What It Means for Business
Blog

Understanding the NIS2 Directive: What It Means for Business

By Katrina Thompson on Thu, 08/21/2025
What is the NIS2 Directive?The NIS2 (Network and Information Security 2) Directive is the European Union’s updated, overarching cybersecurity legislation governing cybersecurity in 18 critical sectors.NIS2 requires each EU Member State to adopt a national cybersecurity strategy, ensure the proper critical entities comply, and include risk management measures such as:Supply chain...
Compliance
warlock-ransomware
Blog

Warlock ransomware: What you need to know

By Graham Cluley on Wed, 08/20/2025
What is the Warlock?Warlock is a ransomware operation that emerged in 2025, combining the traditional "double extortion" tactics of encrypting victims' files so they cannot be accessed, and threatening to release data stolen from the company's network.Nasty, but sadly not that unusual.Unfortunately, that’s right. The Warlock ransomware group seems to have stepped up its attacks in recent months,...
Waiting to Patch
Blog

Waiting to Patch? Attackers Won’t Wait to Exploit.

By Cybersecurity Experts at Fortra on Wed, 08/20/2025
In the time it takes for some companies to determine which vulnerabilities to patch, attackers will have already launched their malicious strike.In cybersecurity, we see this all the time. A major company was breached through a vulnerability that had a patch available for over 6 months. The patch wasn’t applied due to internal process delays, competing priorities, and fear of system downtime....
Vulnerability Management