Skip to content

ESET launches integration with Wazuh

  • This integration provides seamless ingestion of ESET PROTECT, ESET Inspect, and ESET Cloud Office Security data into Wazuh’s security platform.
  • Wazuh’s open-source security platform is easy to deploy, and it offers cost-effective benefits, which the integration of ESET’s solutions boosts to further heights, benefiting our mutual customers.
  • The integration between ESET’s solutions and Wazuh helps SMBs and enterprises meet most of their security needs, irrespective of their maturity levels.
BRATISLAVA, Slovakia — April 14, 2025 — ESET, a global leader in cybersecurity solutions, is continuing to increase its number of integrations, this time, by connecting with Wazuh, a popular open-source security platform. Cybersecurity is becoming more complex and difficult. B2B organizations might find obstacles in adjusting to this new reality. Therefore, interoperability has become crucial, which is also why ESET has adopted an API-first approach. As a result, the provision of strong security is easier than ever, as those organizations that need to correlate vast amounts of data from multiple sources, across several vendors, can create more efficient security workflows. The ESET Endpoint Management Platform (ESET PROTECT), including its Detection and Response capabilities (ESET Inspect), as well as ESET Cloud Office Security, integrates seamlessly with Wazuh, enabling organizations to consolidate security alerts, telemetry, and incidents in a single pane of glass. The integration works by using API-based integration – ESET provides REST APIs, allowing Wazuh to query and pull relevant security events, incidents, and telemetry directly. Consequentially, this integration should empower any security-conscious organization or professional with cost-effective, open-source security monitoring and compliance solutions. For example, security analysts or incident responders can use Wazuh’s dashboards to correlate ESET’s endpoint detection events with other logs, perform threat hunting, and develop comprehensive incident response playbooks. In the same vein, IT administrators can utilize Wazuh to generate summary reports, do compliance checks, and monitor operational metrics across their entire security stacks, including ESET-supplied data. Effectively, with this integration, security teams can do more with fewer tools and less manual work. “ESET provides security solutions that can protect one’s tomorrow today. With our integrations, we aim to lessen security burdens, and empower security operators with tools that create natural efficiencies, relieving many of their workflows. With data from ESET PROTECT, ESET Inspect, and ESET Cloud Office Security in Wazuh, they can cover the needs of an entire business environment from a single pane of glass,” said Michal Hájovský, Global Sales Lead at ESET. Visit our ESET integrations page for more information. Find out more about Wazuh’s open-source security platform. Discover more about the power of comprehensive security on the ESET PROTECT Platform page.  

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Ports Behaving Badly: Uncovering Risky Protocols in Unexpected Places

What’s listening on port 80? Probably a web server… right? What about 443? Gotta be HTTPS. Not always. Sometimes it’s SSH. Or RDP. Or something way worse.

These aren’t hypotheticals. They’re real-world examples of protocol-port mismatches and risky services that security teams uncover with runZero.

In this post, we’re shining a light on the strange, surprising, and straight-up dangerous services hiding across your environment — and how you can use runZero to uncover them before attackers do.

Real-world examples of ports misbehaving #

Before we dive into how and why this happens, let’s take a look at common examples we’ve seen in the wild. These are the kinds of misconfigurations and protocol mismatches that pop up in real environments more often than you’d expect. And yes, they’re exactly the kinds of things attackers love to exploit.

SSH on Port 80 or 443 #

Why it’s risky: Ports 80 and 443 are traditionally used for HTTP and HTTPS. SSH running on these ports is often done intentionally to bypass firewall rules or evade detection. Many firewalls allow web traffic by default, so tunneling SSH through these ports is a tactic used by attackers or even well-meaning admins trying to work around strict network controls.

Real-world concern:

  • This setup could indicate unauthorized remote access or shadow IT — a developer or insider enabling SSH access for convenience.
  • It makes it harder for security tools to detect brute force attempts or unusual SSH usage, since those ports are usually not monitored for SSH behavior.
  • Malware and backdoors have been known to leverage SSH over port 443 to create encrypted tunnels that blend in with regular HTTPS traffic.

RDP on Port 8080 #

Why it’s risky: Port 8080 is typically used for web proxy traffic or alternate HTTP services, not remote desktop connections. If RDP is running here, it’s likely either a misconfiguration or an intentional evasion tactic. Security teams and firewall rules often focus on the default RDP port (3389), so attackers or rogue insiders may shift RDP to an alternate port like 8080 to bypass detection or gain persistent access.

Real-world concern:

  • Attackers actively scan for RDP on non-standard ports to find forgotten, exposed systems that aren’t being logged or monitored properly.
  • Tools like Shodan or Censys can easily uncover exposed RDP, even when it’s masked on uncommon ports.
  • RDP over 8080 may also go unnoticed in environments that whitelist web traffic, allowing brute force attacks, ransomware deployment, or lateral movement to go undetected.

Why do vulnerability scanners miss this stuff? #

Traditional vulnerability scanners only check for known vulnerabilities on known ports. When it comes to discovering services that are running on unexpected ports or unusual asset types, they often fall short. Here’s why:

  • Port-Based Assumptions: Most scanners only test services on their default ports (e.g., RDP on 3389 or SSH on 22). If a service is running on a non-standard or unexpected port, it often gets skipped or misidentified.
  • Shallow Inspection: They rely on banner grabs or lightweight probes that can be spoofed or fail to identify the actual protocol.
  • Credential Requirements: Vulnerability scanners often require credentials to detect deeper service context, which may not be available for all assets.
  • Blind Spots: Many scanners ignore unmanaged, shadow IT, IoT, or OT devices entirely if they don’t have credentials or agents installed.

The result? Assets with risky services go undetected. Attackers love these blind spots.

runZero helps you find them.

How runZero finds weird and risky protocols #

runZero’s purpose-built scan engine uses deep, multi-layer fingerprinting and unauthenticated discovery to:

  • Identify services running on non-standard ports
  • Detect protocols that don’t match the asset type
  • Highlight devices exposing risky or legacy services

To dive a little deeper, let’s see the platform in action — and how it helps you zero in on these risks quickly and with precision.

Ready to catch misbehaving ports in your environment? #

Sometimes the biggest risks aren’t CVEs. They’re misconfigurations hiding in plain sight. With runZero, you don’t just scan ports. You understand what’s really running, where it lives, and whether it belongs there — all from a single exposure management platform.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

10 best practices for successful service management

 

Service management: the importance

Service management is concerned with creating interfaces between a company’s products and its customers. It should focus on the customer. All contact points between the customer and the company must work well. These points should be checked often and improved.

Requirements and goals

You can see how well support services are doing by looking at customer satisfaction. Cases of persistent problems or major customer disappointment are a particular point of focus.

Service management is not just about offering customers services. Rather, it is about taking a comprehensive approach to providing the best possible experience for customers.  

Strategic aspects and processes

Companies must first identify the overarching purposes of service management and how these relate to the company’s goals.

The right processes and workflows are also needed to ensure that customers receive fast, reliable, comprehensive and helpful solutions. In IT, for example, this includes tried and tested processes for incident, problem and change management.

Software solutions and analytical aspects

The right software solution can also speed up service delivery, improve work management, and offer customers a quick result. An example of this is automating workflows or offering automated customer service to reduce waiting times and service costs.

Finally, data analysis is also a core area of focus. Companies can obtain and evaluate direct customer feedback as well as examine their own workflows. Data points out many ways to optimize workflows.

Whether service level agreements (SLAs) are being met is particularly important in IT Service Management (ITSM). Certain key performance indicators (KPIs) are also becoming increasingly important for companies. For example, first call resolution (FCR) defines the proportion of support inquiries resolved on the first contact.

 

Best practices for service management

How companies prepare their service teams can differ a lot. They may have different priorities and goals they want to reach.

Nevertheless, there are some best practices that can generally prove useful.

Best practice #1: Develop a sound strategic direction

If you don’t know the goal, you can’t find the right path. Therefore, the first step is to define a clear service management strategy. This should outlines high level service objectives and related these to business goals. Based on this, it is possible to make an informed judgment about how successfully the current services are working.

Areas in which there is potential for improvement require special dedication in the strategy. This is the case when there is a challenge from either the business or customer perspective.

For example, the support team may help customers with problems. However, they might not explain the product features well enough. As a result, customers have a limited perspective on what’s possible.

This means the company is not taking advantage of up-selling and cross-selling opportunities. It may even risk losing customers who aren’t getting enough value from the offering.

It is important for all key stakeholders to work together on the strategy. They should create sensible and realistic measures. These measures should combine the benefits for the company and the benefits for the customers.

Best practice #2: Set a clear customer focus

The customer should be the top priority for all services. A strategy that company representatives consider useful but does not clearly serve the customer is of little value.

In the best-case scenario, service management corresponds exactly to the needs that customers express. These needs are identified either through direct feedback or indirectly through problems they have experienced. For example, a well-developed knowledge management system can be extremely useful for solving problems.

Customers must also always receive immediate information about issues and maintenance times. Ideally, this transparency should encompass all aspects of customer communication. To ensure that the quality is also right, teams need regular training and access to new developments and trends. This ensures team member growth and awareness.

Best practice #3: Align with standard frameworks such as ITIL

ITIL®️ (Information Technology Infrastructure Library) and other ITSM frameworks provide valuable guidance when it comes to IT service management. Predefined processes, practices, and guidelines help us use our resources well. They also create a strong base for high service quality.

For example, ITSM processes such as service request, incident, problem and change management benefit greatly from applying standards. The ITIL principle of using a configuration management database (CMDB) helps with asset management in many service areas.

The CMDB manages data about hardware and software. It can also contain information on service contracts, customers or service level agreements (SLAs). Regular service reviews for process optimization also pay off.

Best practice #4: Introduce self-service

Self-service gives customers more flexibility and independence. Self-service means that companies offer their customers additional options that are geared towards the reality of their lives. Modern customers no longer want to be dependent on the working hours of the service desk.

An example of providing self-service is when a customer solves a simple application problem by interacting with chatbot from their sofa in the evening.

The self-service options include:

  • Knowledge databases
  • Frequently asked questions (FAQ) with short answers
  • (AI) chatbots
  • Community forums
  • Independent bookings and scheduling
  • Independent creation of product configurations

Best practice #5: Use AI and automation

Artificial intelligence (AI) holds immense potential for optimizing customer service. The main benefits of AI are greater efficiency, time savings and more accuracy. Machine learning (ML) and the handling of big data also enable detailed analyses and an optimized, personalized service.

Practical applications of AI may include:  

  • Summarizing ticket content,
  • Defining types of services or
  • Classify tickets.

Agents also benefit. They may:

  • Receive suggested answers to inquiries based on data on frequently asked questions,
  • Use sentiment analysis to understand the customer’s attitude and emotions or
  • Receive automatic translations.

Workflow automation is frequently used in ITSM too. It saves time, increases productivity and avoids errors. In some cases, process automation makes sense as well.

Best practice #6: Build a knowledge base

Knowledge is key to providing service that customers want. Creating a knowledge base and making it centrally accessible provides external customers with additional and better service options. It also helps internal employees with details about approvals, processes, solutions, and more.

It is important that companies regularly maintain, optimize and supplement knowledge bases. This is because content quickly becomes outdated. Customer requirements also change, especially with constant new developments.

It is also advisable to think about various forms of media. Knowledge content can be perfected and expanded using multimedia, such as videos, in order to maximize its benefits.

Best practice #7: Define KPIs and metrics

What companies want to achieve strategically with the service is an important factor, but it must be measurable. Well-defined KPIs and metrics are needed to measure the achievement of objectives. Doing so provides a baseline for optimizing services in a targeted manner and in line with corporate objectives.

Consider the following as an example:

Company goal: The customer retention rate (CRR) must be increased, i.e. customers should remain loyal to the company.

KPI: To increase customer satisfaction, problems should be solved as quickly as possible.

Metrics: First Call Resolution (FCR; percentage of problems resolved on first contact); Net Promoter Score (NPS) to measure customer satisfaction.

Best practice #8: Maintain continuous improvement

Those who do not improve will be overtaken. This explains why continuous improvement is so important. The principle is linked to a cyclical approach in which services are regularly examined, evaluated and optimized.

The Kaizen principle states that change for the better should take place. Those responsible do not have to strictly follow this principle, but it helps to implement improvements. These may be large or small improvements. They can be done on a regular basis in order to offer customers good, helpful and comprehensive service.

Best practice #9: Pay attention to security and compliance

Data security is an absolute necessity in service management. After all, confidential, personal and sensitive data and information must not be leaked. For example, it is important to comply with standards such as ISO 20000, ISO 27001 and the General Data Protection Regulation (GDPR).

A recovery plan should also be in place for IT emergencies. The best possible incident management can be achieved by using a cyber defense solution.

Regular security checks and precise access management are also a good ideas. These should be done on a day-to-day basis.

Best practice #10: Adapting trends and current developments

The world doesn’t stand still, and customer needs change. Similarly, service offerings shouldn’t always stay the same and should expand as much as possible. This could include new self-service options, AI features or a high degree of personalization.

Trends and current developments include the following:

  1. Use of AI features that expand the range of services and provide low-threshold answers.
  2. Distinctive omnichannel support so that customers can flexibly choose their preferred channels.
  3. Dynamic, multimedia self-service that can be used to solve problems.

 

Use cases that highlight ITSM best practices

In many cases, companies have succeeded in significantly improving management processes and reducing costs through the consistent implementation of best practices.

Using structured service management and best practices often leads to clear results. These results include shorter processing times, happier customers, and better transparency. For example:

  • By looking for and improving inefficient service processes, companies can speed up processing times.
  • By implementing ITSM tools, companies can enhance transparency regarding assets and save money on licensing.
  • By standardizing and organizing communication, companies offer consistency and efficiency to customers.

Here are a couple of specific customer use cases.

Example #1: SIEVERS-GROUP – standardize processes when supporting multiple departments

SIEVERS-GROUP, an IT system house, faced the challenge of making support more efficient. It wanted to offer its own customers higher quality and optimize service delivery. The aim was to use a central solution for seven different departments. As a prerequisite for this, relevant KPIs first had to be visible and measurable.

With OTRS, SIEVERS-GROUP now has uniform processes for ticket processing throughout the company. Customers experience significantly more transparency and optimized communication. Service quality is measured using the right KPIs.

Additionally, improvements can be quickly made when necessary. As a next step, SIEVERS-GROUP has plans to introduce a configuration management database (CMDB).

Find out more about the SIEVERS-GROUP use case.

Example #2: EMAPTA – incorporate more flexibility and compliance

EMAPTA, a personnel services company based in the Philippines, was frustrated by the lack of structured workflows for service provision. Compliance also needed to be improved in order to achieve ISO/IEC 2000 certification, among other things.

With OTRS as a service management system, EMAPTA now provides significantly higher workflow compliance, greater thoroughness. Customer needs are now better met.

Read more in the EMAPTA use case.

 

OTRS as a service management solution

OTRS was developed in alignment with these best practices. It can be used in a variety of ways for service management. Teams benefit from fewer errors, optimized service delivery, customizable interfaces and guaranteed security.

Users can use numerous features to optimize their workflows, provide better service and increase customer satisfaction.

Conclusion: Best practices make a decisive difference

Service management means not just offering customers support. It also means taking a holistic view of customer communication and optimizing it as far as possible. Overarching strategic aspects are important here. It is also important to consider how customers perceive the service and the extent to which their requirements are met.

Best practices for service management each deal with important sub-topics. These can also be linked together in a meaningful way. Ideally, this results in improving customer satisfaction.

In most cases it also makes sense to focus on individual practices within the company. Clear KPIs and associated metrics for services should be defined. The path to success often lies in fixed standards, structured workflows and continuous improvements.

In many cases, companies with the right best practices and the right software solution can make the decisive difference in providing sensible and successful service management.  

About OTRS

OTRS (originally Open-Source Ticket Request System) is a service management suite. The suite contains an agent portal, admin dashboard and customer portal. In the agent portal, teams process tickets and requests from customers (internal or external). There are various ways in which this information, as well as customer and related data can be viewed. As the name implies, the admin dashboard allows system administrators to manage the system: Options are many, but include roles and groups, process automation, channel integration, and CMDB/database options. The third component, the customer portal, is much like a customizable webpage where information can be shared with customers and requests can be tracked on the customer side.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Medical device cybersecurity: safeguarding patient safety in a digital age

 

Summary: Healthcare devices are targets for attacks that can disrupt care or expose data. Protect them with updates, strong access controls, and Zero Trust security.

As patient data becomes a prime target for data thieves, healthcare organizations are scrambling to counter numerous critical threats. Medical devices are now a cybersecurity frontier.

The medical devices we rely on to keep us healthy can fall victim to ransomware, identity theft, and DDoS botnets. Meanwhile, strict privacy regulations punish companies that don’t take data security seriously.

Healthcare providers, device manufacturers, insurers, and third-party service providers are all part of the healthcare cybersecurity challenge. This article will explore how to secure medical devices and safeguard patient safety in an increasingly dangerous environment.

Key takeaways

  • Proactive approaches are vital when securing medical devices. Companies must assess risks, monitor threats, and fix vulnerabilities before attacks occur.
  • Critical medical device risks include remote hacking, ransomware, data breaches, unpatched vulnerabilities, insider threats, and botnet attacks.
  • Regulatory compliance is essential. Device manufacturers must meet FDA standards, while users should comply with HIPAA and GDPR. NIST and ISO frameworks provide a roadmap to compliance.
  • Device security best practices include inventorying devices, segmentation, vendor collaboration, monitoring threats, and applying regular updates.
  • Medical device security is evolving. Expect advances in AI and machine learning to detect threats while 5G delivers speed and reliability improvements. New technology also enables the deployment of Zero Trust concepts to verify every device activity.

Why proactive cybersecurity is essential for patient safety

When we think about patient safety, medical competence, affordable care, and safe hospitals all come to mind. Cybersecurity risks aren’t always a top priority until data breaches expose private information to malicious actors.

However, Protected Health Information (PHI) breaches cause serious harm. Data thieves can use confidential details to steal identities or blackmail individuals. Data tampering can falsify records and lead to improper treatments, while information about health conditions can influence the decisions of employers or insurers.

The bottom line is that health data should always be secure. This includes data from medical devices like heart rate trackers, diabetes monitors, and wearable technology. These devices gather confidential data about the patient’s condition. They must also operate reliably – without downtime caused by cyberattacks.

Protecting medical devices demands a proactive cybersecurity approach. Security teams must assess each security risk and fix vulnerabilities before cyberattacks occur. Reactive security is too late. Healthcare providers need robust medical device cybersecurity systems that anticipate threats.

The cybersecurity risks medical devices face

Many people are not familiar with medical device cybersecurity risks. Let’s dive a bit deeper and explore how cyber criminals target consumer and professional healthcare devices.

6 cybersecurity risks for medical devices

Remote hacking

Many medical devices depend on network connectivity to transmit data, but these networks are not always secure. Hospital and home networks are vulnerable to remote hacking via unpatched software or weak passwords.

Criminals with unauthorized network access can theoretically control medical devices, adjusting dosages or pacemaker settings. That’s a terrifying prospect for professionals and patients.

Ransomware attacks

Medical devices, like all devices connected to the external internet, are vulnerable to ransomware infections. A quick exploration of the top ransomware attacks in 2024 shows that the infection risk is severe and growing.

These attacks deploy malicious software which encrypts devices and prevents legitimate access. This can have dangerous care implications if ransomware affects heart rate monitors or scanning equipment, although criminals usually relent when targets make crypto payments.

However, even if healthcare organizations make payments they may lose the data held by medical devices. Ransomware is a triple threat: affecting financial health, compromising critical systems, and exposing patient data.

Data breaches

Ransomware is not the only data breach risk linked to medical device cybersecurity. Cyber attackers may target monitoring tools and apps, gaining access to medical histories and current treatment programs.

Information about treatment is extremely valuable in the wrong hands. Criminals use it to launch insurance fraud scams, craft targeted phishing attacks, and even extract blackmail payments.

 

Exploits due to unpatched vulnerabilities

Medical device manufacturers may not update firmware or apps to address cybersecurity risks. This is a common issue with IoT technology that opens the door to exploit attacks leveraging outdated software.

Even worse, manufacturers often use proprietary software that is hard to update independently. And they sometimes delay patches due to complexity issues and concerns about compromising device functionality.

Healthcare providers often neglect updates in medical device cybersecurity strategies. However, when a single unpatched scanner can act as a network gateway, updating devices should be a priority.

Insider threats

Accidental errors and malicious employee activity can also compromise medical device security. For example, disgruntled staffers could use external drives to install malware on hospital systems or steal patient data for illegal purposes.

Negligent activity is equally damaging. Staff may ignore security protocols by sharing passwords, failing to encrypt laptops, or misusing physical access controls.

Botnet activity

Botnets pool large numbers of connected devices for criminal activities. For instance, bad actors could install malware on medical devices and use their computing power to mine cryptocurrency.

Lax medical device security also exposes healthcare organizations to DDoS attacks where attackers flood medical networks with traffic. These attacks take devices offline, disrupt care, and compromise security systems, opening the way to secondary attacks.

 

Medical device cybersecurity: What the regulations say

Governments have reacted to the growth in cyber threats against medical devices, passing many regulations to enforce data security. Organizations in the health sector must understand relevant regulations and use them to design security strategies.

Regulation or framework

Who must comply

Key requirements or recommendations

FDA

All medical device manufacturers in the US

Monitoring risks;
Ensuring device security and providing post-market patches

HIPAA

All healthcare providers in the US

Protection of patient data confidentiality, integrity, and availability

GPDR

All medical device companies operating in the EU

Protection of patient data and the need for a patient’s consent before using their data on medical devices

NIST

  • Not mandatory
  • Security guidelines for medical device manufacturers and patients

Suggests how to secure networks, manage cloud data risks, and ensure security measures meet healthcare professionals’ needs.

ISO/IEC 80001

Best practice for managing IT risks in medical devices

  • In the U.S., it’s not a legal requirement
  • In the EU, it aligns with MDR (Medical Device Regulation) requirements for risk management but is not explicitly required

It emphasizes risk management in medical IT networks to balance cybersecurity and patient data safety

FDA regulations for medical device manufacturers

Firstly, medical device manufacturers must comply with Food and Drug Administration (FDA) guidelines. The FDA regulates the safety of anything that “diagnoses, cures, mitigates, treats, or prevents [a] disease or condition.” In practice, FDA rules cover most medical devices.

Specifically, section 524B of the Federal Food, Drug, and Cosmetic Act requires medical device manufacturers to:

  • Create a plan to monitor and address medical device security risks (including exploits)
  • Ensure devices are “cybersecure” and provide post-market patches as appropriate
  • Submit a software bill of materials to the FDA detailing firmware and other components of medical device software

HIPAA and GDPR rules on safeguarding patient data

The Health Insurance Portability and Accountability Act (HIPAA) and the EU’s General Data Protection Regulation (GDPR) regulate how medical devices protect patient data.

HIPAA requires healthcare providers to protect data confidentiality, integrity, and availability. The law also suggests encrypting data on medical devices, controls on accessing patient data, and comprehensive audit logs.

GDPR protects patient privacy. It requires organizations to gain consent before using medical devices to gather data and the anonymization of patient data. Like HIPAA, GDPR’s “privacy-by-design” model encourages encryption and data minimization (only collecting essential medical data).

Both HIPAA and GDPR levy significant penalties for data breaches. Device security is a core aspect of both frameworks.

For instance, the University of Rochester Medical Center received a $3 million fine from the Department of Health and Human Services for losing a hard drive containing protected health data. In 2015, the Lahey Hospital and Medical Center was penalized for failing to secure a CT scanner workstation.

NIST cybersecurity frameworks

The National Institute of Science and Technology (NIST) offers cybersecurity guidelines for device manufacturers and users. While not enforceable by law, NIST’s cybersecurity framework explains how to:

  • Create secure and interoperable medical networks
  • Manage cybersecurity risks when storing medical data in the cloud
  • Apply quality control procedures in device manufacturing
  • Secure network communications within health settings
  • Ensure security measures meet the needs of healthcare professionals

ISO/IEC 80001: Managing device security risks

Similarly, ISO/IEC 80001 sets out an IT risk management framework for medical devices and is a valuable complement to NIST documents.

ISO recommends collaboration between device vendors and end users to assess and mitigate security risks. Device users should assess cybersecurity risks before deploying devices and apply continuous risk assessment throughout the product lifecycle. The risk management process includes proactively identifying and mitigating emerging data security threats.

The ISO approach works well because it balances cybersecurity standards with patient safety and performance. Systems should meet user needs while securing data and complying with relevant regulations.

Best practices for securing medical devices

The size of compliance penalties and the reputational harm caused by data breaches make cybersecurity solutions essential. But how should you secure medical devices against cybersecurity threats?

Best practices for securing medical devices

Security solutions vary between medical contexts. However, here are some general best practices for cybersecurity in medical devices:

Understand your device landscape

The number of medical devices used by a healthcare provider can rapidly grow, especially when patients take monitoring devices home. Every device is a potential endpoint and security risk. Each device needs security protection.

Start by creating a comprehensive device inventory. Create processes to update and audit the inventory, bringing all devices under your security umbrella.

Inventory software and hardware

Medical devices must be physically secure, with measures to prevent theft and unauthorized access. However, cybersecurity measures must also secure device firmware. Log current software versions and use automated tools to update medical device software as needed.

Check for end-of-life devices as well. Medical devices become obsolete as new technology appears. Older versions often create security risks and require prompt replacement.

Carry out a comprehensive risk assessment

When you have an accurate inventory, it’s vital to assess the risks posed by cyber threats. In this context, third-party risk assessment makes sense.

Cybersecurity experts with medical device experience understand the threats faced by healthcare organizations, how to prioritize risks, and suitable mitigation options.

Secure sensitive assets with network segmentation

Segmentation creates barriers between network assets. Placing sensitive data within protected segments ensures that attackers cannot access patient records if they gain access to devices.

Additionally, access controls and multi-factor authentication should protect patient information. Users should not be able to access protected information with just a username and password combination.

Work closely with vendors to understand device security

When sourcing medical devices, ask vendors to disclose security features and potential vulnerabilities. Consult vendors to execute a risk assessment for new devices and request a software bill of materials. This assists IT teams when securing device software and makes it easier to manage updates.

Monitor devices and detect threats

Apply intrusion detection systems (IDS) across all medical devices. Deploy continuous monitoring to detect malware or malicious user activity, and feed security alerts into a streamlined incident response plan.

The future of medical device cybersecurity

Medical device security is a dynamic field. Technology is evolving rapidly as medical internet-of-things (MIoT) devices proliferate, providing new ways to detect and counter cyber threats.

For instance, AI and machine learning can analyze network activity to track anomalies and identify attacks at an early stage. Speed increases offered by 5G connectivity supplement AI, enabling real-time activity tracking and reliable data transmission.

Our models for thinking about medical device security are also changing. Forward-thinking healthcare organizations now focus on Zero Trust concepts. Devices request verification for each user action and limit user capabilities according to least-privilege principles.

AI, 5G, and Zero Trust approaches are part of tomorrow’s cybersecurity toolkit. These technologies also reflect a trend toward enhanced collaboration between vendors, users, and regulators.

Work with NordLayer to secure your medical devices

Companies benefit from cloud-connected medical devices to learn about patients and deliver personalized treatment. But, as we’ve seen, medical devices bring security risks. Healthcare cybersecurity solutions are critical.

NordLayer can help you secure devices and serve patients securely and efficiently. Prevent unauthorized access with Identity and Access Management solutions and transfer data safely via Secure Remote Access. Conceal data in transit from attackers via AES 256 or ChaCha20 encryption, monitor 2FA adoption, and Share Gateway access in a centralized Control Panel dashboard.

Balance medical technology, ease of use, and cybersecurity. Contact the NordLayer team and solve your medical device security worries.

 

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Cyber Kill Chain: What Is It? Examples and Prevention

Organizations must predict and stop assaults before they become more severe in a time when cyber attacks are more advanced than ever. Developed by Lockheed Martin, the Cyber Kill Chain is still among the most often applied models for analyzing and reducing cyberattacks. By separating an attack into seven separate phases, this strategy gives cybersecurity professionals a methodical approach to identifying and countering attacks.

Following the Cyber Kill Chain model, cybercriminals keep improving their strategies in reaction to changing cybersecurity policies. From ransomware gangs to state-sponsored attackers, the approach is essentially the same. We will look at the seven phases of this approach and how businesses may protect against each level.

What is the Cyber Kill Chain?

The Cyber Kill Chain offers a methodical approach to studying cyberattacks. Breaking an attack into several phases helps security professionals identify weaknesses and stop hostile activity before it becomes more serious.

The methodology is especially successful against advanced persistent threats (APTs), in which cybercriminals or nation-state actors carry out prolonged, covert attacks to pilfer sensitive data or disturb operations.

The Seven Stages of the Cyber Kill Chain: How They Work

The seven steps that make up the Cyber Kill Chain each mark a crucial turning point in the development of an attack:

Step 1: Reconnaissance 

Attackers compile knowledge of their target in this phase. They find weak areas by scanning networks and examining publicly available data. Cybercriminals could employ methods including:

  • Open-source intelligence (OSINT) involves compiling from job ads, the internet, and social media.
  • Scanning tools for unpatched systems and obsolete software detection
  • Social engineering methods to gather login passwords from gullible staff members.

Prevention tips: To stop these attacks, companies should restrict public access to sensitive data, track network activity for reconnaissance efforts, and provide security awareness training.

Step 2: Weaponization 

Once the assailant has sufficient knowledge, they produce a hostile payload to exploit found weaknesses. This can encompass:

  • Development of malware—including ransomware, trojans, spyware.
  • Weaponized scripts or papers meant for attacking upon opening.
  • Modification of current malware to evade systems of detection.

Prevention tips: Security teams should routinely update software to fix vulnerabilities, apply robust email security solutions, and examine dubious data using sandboxing.

Step 3: Delivery 

During this phase, the attacker delivers the harmful payload to the target. Typical ways of delivery consist of:

  • Phishing emails loaded with dangerous attachments or links.
  • Drive-by downloads from either hostile or hacked websites.
  • USB devices or other external media corrupted with a virus.

Prevention tips: Email screening, online filtering, and staff training help businesses identify phishing efforts. Additionally, identifying and blocking corrupt files is an endpoint security solution.

Step 4: Exploitation 

Once the payload reaches the target, it uses system weaknesses to carry out destructive intent. One can experience exploitation via:

  • Software or operating system weaknesses.
  • Passwords, weak or recycled.
  • Human mistakes, including allowing macros in hostile papers.

Prevention tips: Strict access control policies, patch management, and frequent vulnerability analyses help to lower exploitation risk. Using multi-factor authentication (MFA) lends another degree of protection.

Step 5:  Installation 

The attacker installs malware at this point to stay on the hacked system. This could entail:

  • Putting trojans or backdoors for distant access.
  • Changing systems to stop detection.
  • Using rootkits to get thorough system access.

Prevention tips: Endpoint detection and response (EDR) systems help to spot and stop illegal installations. Organizations should also constantly monitor for unusual system behavior.

Step 6: Command and Control (C2) 

Through communication with the hacked system, the assailant enables orders, data theft, or network spread of malware. C2 servers streamline:

  • Remote control of compromised devices.
  • Lateral movement in the network.
  • Carrying out more hostile acts.

Prevention tips: Threat intelligence technologies, intrusion detection systems (IDS), and network segmentation can assist in identifying and stopping C2 communications. Additionally, blocking suspicious outbound traffic helps attackers to lose control.

Step 7: Actions on Objectives 

In this last phase, the assailant carries out their ultimate objective, maybe:

  • Data exfiltration—stealing private data for espionage or financial gain.
  • Encrypting files and requesting payment for decryption forms ransomware deployment.
  • System disturbance brought on by destructive attacks causes operational downtime.

Prevention tips: Strong encryption techniques, incident response strategies, and data loss prevention (DLP) solutions help reduce harm. Additionally, routine security audits help spot weaknesses before they are exploited.

🔐 Cyber Kill Chain – Cheat Sheet

StepWhat HappensExample
1. ReconnaissanceGather info on targetScanning for open ports or employee emails
2. WeaponizationCraft malware/exploit for specific vulnerabilitiesCreating a trojan-loaded PDF
3. DeliverySend malicious payload to targetPhishing email with malicious link
4. ExploitationActivate malware via a system vulnerabilityUser opens infected file
5. InstallationInstall backdoor or malware to maintain accessDropping a remote access trojan
6. Command & Control (C2)Connect back to attacker for remote controlMalware contacts attacker’s server
7. Actions on ObjectivesExecute mission (data theft, ransomware, etc.)Stealing data, encrypting files

Real-World Examples of Cyber Kill Chain Attacks

APT29, Russian State-sponsored Attack 

APT29, sometimes referred to as Cosy Bear, has been connected to cyber espionage efforts directed against businesses and government entities. This group uses the Cyber Kill Chain concept, which consists of:

  • Doing thorough target reconnaissance.
  • Delivering malware via emails sent under spear-phishing.
  • Keeping persistence and extracting data using cutting-edge methods.

WannaCry Ransomware Attack 

WannaCry sent ransomware all over using a weakness in Microsoft Windows. The attack followed the guidelines of the Cyber Kill Chain:

  • Reconnaissance: Looking for systems lacking SMB patches.
  • Distribution: Let self-replicating worms spread malware.
  • Exploitation: Encrypting important files and requesting a ransom payment marks exploitation.

These cases emphasize the need for proactive security policies to stop such assaults.

Preventive Techniques at Every Level 

Organizations should use a tiered security strategy to break the Cyber Kill Chain when disrupting every level of an attack:

  • Reconnaissance: Use threat intelligence tools and keep an eye on assets pointing outward.
  • Weaponization: Weaponizing tools from malware analysis help identify new dangers.
  • Delivery: Use cutting-edge email and web security systems.
  • Exploitation: Use regular software updates and strict access policies to prevent exploitation.
  • Installation: Install endpoint protection systems to find illegal programs.
  • Command and Control: Use network segmentation and anomaly detection under command and control to avoid correspondence in hostile servers.
  • Actions on Objectives: Real-time monitoring and data encryption will help stop system penetration and data theft.

Backup as a Response to Cyberattack

In the face of escalating cyber threats, robust backup and recovery solutions are essential for organizations to ensure data integrity and business continuity. Storware Backup and Recovery offers an enterprise-grade, agentless solution that caters to diverse environments, including virtual machines, containers, cloud instances, and applications. Its architecture emphasizes centralization and unification of backup management, providing a resilient defense against ransomware attacks and other cyber incidents.

Storware’s comprehensive feature set includes immutable backup storage, which prevents unauthorized modifications and enhances protection against ransomware. The solution supports snapshot management, enabling automated creation, retention, and recovery processes that reduce recovery time objectives (RTO) and recovery point objectives (RPO). Additionally, Storware offers policy-based automation for granular control over backup scheduling and retention policies, ensuring that organizations can tailor their data protection strategies to specific business needs.

By integrating advanced security features such as role-based access control (RBAC), audit logs, and data-at-rest encryption, Storware not only safeguards critical data but also aligns with regulatory compliance requirements. Its scalability and versatility make it suitable for organizations of all sizes, providing a reliable foundation for disaster recovery and operational resilience in the event of cyberattacks.

Final Thoughts

The Cyber Kill Chain is a useful structure for comprehending cyberattacks and improving defense plans. Knowing the several phases of an attack helps companies apply focused security protocols to prevent risks before they cause major damage.

Since hackers constantly modify their approach, organizations must be vigilant, aggressive, and adaptable in their cybersecurity activities. Modern security measures, constant personnel training, and comprehensive incident response plans are essential in the digital age.

About Storware
Storware is a backup software producer with over 10 years of experience in the backup world. Storware Backup and Recovery is an enterprise-grade, agent-less solution that caters to various data environments. It supports virtual machines, containers, storage providers, Microsoft 365, and applications running on-premises or in the cloud. Thanks to its small footprint, seamless integration into your existing IT infrastructure, storage, or enterprise backup providers is effortless.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

What Is Internet of Things (IoT) Security?

What is IoT?

The Internet of Things (IoT) is what we call networks of physical objects that are packed with sensors, cameras, listening devices, and other technologies—like today’s smartphones, appliances, wearables, and cars. These devices are connected over the internet or a local network, so they can exchange data with each other. This allows them to work together as part of a smart system, enabling the automation of tasks and the creation of intelligent environments like smart homes or smart workplaces. Because of the way IoT devices operate, the Internet of Things and cybersecurity must go hand in hand to deliver smart experiences while ensuring safety and privacy for all users.

What is IoT security?

IoT security is all about protecting the interconnected smart devices and the networks they connect to. Since these devices can collect, store, and share data about users’ surroundings, this data must be handled with the utmost care and caution.

IoT devices aren’t just for personal use—more and more are making their way into workplaces. For example, businesses now install smart thermostats, blinds, and seating planners to optimize resources in their offices.

The benefit of these devices syncing and working together is that they regularly share and communicate data to improve functionality. However, since these devices are interconnected, gaining access to one could allow bad actors to exploit and breach your entire network. That’s why Internet of Things device security (as well as IoT network security) is essential to prevent vulnerabilities that could lead to cyberattacks.

Why is IoT security important?

The recent influx of IoT devices has provided another avenue for hackers to exploit in recent years. IoT devices can be particularly vulnerable to security breaches. At the end of 2021, a study concluded that up to 82% of healthcare organizations experienced an IoT cyberattack over 18 months. There are often security oversights regarding the IoT and its apps. For example, a German teenager hacked Tesla vehicles’ app component not that long ago. While he couldn’t access the driving functions like steering or brakes, he could still exploit other potentially dangerous features like unlocking doors, playing music at max volume, and flashing lights. The more IoT devices become common, the more widespread their security threats will become.

Which industries need IoT security?

Smart devices have made their way into almost every part of our lives. However, some industries rely more heavily on IoT technology than others and require additional security due to its strategic meaning for the nations’ and communities’ welfare.

  • Healthcare

Patient monitoring, advanced medical equipment, administering treatments and vaccines: Medical services increasingly rely on smart devices. Cynerio and Ponemon’s Study proves that healthcare is especially vulnerable to cyber attacks involving the Internet of Things devices as they constitute 88% of all hospital data breaches. More than half of hospitals in the US have experienced an attack on their smart devices between 2020 and 2022. The damage that cybercriminals can cause in healthcare is horrifying — the mortality rate increased in 24% of the attacked hospitals.

  • Energy and Utilities

Internet of Things devices are widely used in the energy and utilities sector for smart grid management, optimizing energy consumption, and remote monitoring of infrastructure. Monitoring devices such as smart meters, security cameras, and temperature/fire/chemical leak controls are prime targets for cybercriminals. Protecting energy infrastructure is essential to prevent disruptions to critical services, including electricity, heating, traffic control, or medical care.

  • Manufacturing

It’s hard to imagine a modern factory without Internet of Things solutions enabling process automation, supply chain management, and predictive maintenance. The endless possibilities that smart devices present to this sector can be overshadowed by the costs of cyberattacks, as hackers often target factories to demand ransom.

  • Logistics

IoT devices are entering the logistics industry through fleet, vessel, and traffic management systems. Self-driving vehicles are becoming commonplace in major cities. Also, the railway relies on Internet of Things devices for traffic planning and power supply management. Hacking an IoT-reliant logistics system could cause chaos on highways or railroads.

  • Supply Chain

In the supply chain industry, connected devices are used for tracking, monitoring, and managing goods throughout transportation. The security risk created by IoT tools used in day-to-day operations grows with the number of vendors a company cooperates with. Supply chain attacks often target third-party partners or suppliers to access the company’s assets.

IoT security challenges

While smart devices introduce plenty of opportunities and convenience to our lives, they also open up the possibility of cyberattacks. Industries such as healthcare and manufacturing increasingly rely on IoT devices, exposing unprepared organizations to cyberattacks. Here are some of the threats IoT devices are susceptible to:

  • Malware: Because cybersecurity isn’t the primary concern of many smart devices, hackers don’t require advanced malicious software to attack. Rudimentary malware can steal data and cause damage to networks and devices. Mirai is used to infect security cameras, scan the network for the IP address of IoT devices, and connect. This allows hackers to launch significant DDoS attacks.

  • Credential-based attacks: Using stolen login IDs and passwords is a popular method for hackers because many people’s logins are already floating around online thanks to massive data leaks such as Collection #1. Once a business’s smart device’s application layer is breached, hackers can access any device connected to the network.

  • Data theft and exposure: Adding IoT devices to your home or office will introduce more potential entry points for hackers to access data. This increases the risk of personal information being stolen and exposed on the internet. A good example of this is when hackers used Amazon’s Alexa to issue self-commands allowing the attackers to control smart lights, buy items on Amazon, and tamper with calendars.

  • Incorrect device management and configuration: Similar to the above, the more devices and accounts you add, the greater the chance of reusing passwords and usernames. Companies often ship IoT devices with default logins that should be changed during their setup. However, a survey of CIOs and IT managers showed that almost 50% of them allowed IoT devices onto their corporate network without changing the default passwords.

  • Complex ecosystem and smart device diversity: An office’s IoT ecosystem can quickly become a juggernaut of interconnected devices. These devices have many moving parts that operate at different levels. Overseeing and managing your wide array of IoT devices will help you prevent IoT attacks.

  • Not following security by design: Cybersecurity is generally not the main focus of many IoT devices, often taking a backseat to its functionality. Your office’s IoT security could be at risk because specific devices may have cybersecurity weaknesses that need to receive software updates. There’s also the possibility that any security features may be obsolete if the product is discontinued and no longer supported by its developer.

Examples of IoT security threats

Jeep Grand Cherokee

Back in 2015, security researchers Charlie Miller and Chris Valasek set out to see if they could remotely hack into and take control of a new Jeep model—the Jeep Grand Cherokee. They ran a series of cybersecurity tests, and sure enough, they found a major backdoor in the Jeep’s built-in infotainment system, which handles things like navigation and entertainment.

Using this vulnerability, they were able to connect to the car’s other systems and take control of the car’s key mechanics like braking, engine control, air conditioning, and transmission. Basically, they turned that Jeep into one of the most expensive remote-controlled toy cars in the world! After this demonstration, Chrysler (the owner of Jeep) had no choice but to recall more than 1 million Grand Cherokees to fix the software vulnerability.

Mirai botnet

Probably the most famous—or infamous, actually—IoT security breach ever, the Mirai botnet was first identified in 2016 and has remained a persistent cyber threat ever since. It works by infecting vulnerable IoT devices—like AVTECH CCTV cameras and Four-Faith industrial routers—and using them to launch large-scale distributed denial-of-service (DDoS) attacks.

In 2018, a Mirai variant was used in a 1.35 Tbps DDoS attack against GitHub, briefly knocking the platform offline. In 2020, the FBI issued a warning that Mirai-based attacks could go beyond websites and target critical infrastructure, like power grids and industrial systems.

But here’s the real problem: the Mirai botnet is still out there. Its original creators released the source code online, and since then, cybercriminals worldwide have been modifying and weaponizing it. Even today, in 2025, Mirai-based botnets are still behind record-breaking cyberattacks, targeting everything from internet service providers to government networks.

ThroughTek

In 2021, security researchers uncovered a serious flaw in ThroughTek’s IoT software, which is used in millions of smart cameras, baby monitors, and security systems around the world. It turned out that hackers could use this vulnerability to remotely access live video and audio streams from the cameras, and in some cases, even take full control of these devices, exposing sensitive footage from homes and businesses in the process.

The vulnerability was so severe that the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning, rating it 9.1 out of 10 on the severity scale.

How to secure IoT devices

The good news is that maintaining an overall good cybersecurity policy for your company will help safeguard your IoT devices. Training your staff with cybersecurity best practices and appointing specific admin roles to deal with the security of IoT devices in your organization are all methods for securing your business from IoT threats.

  • Regularly updating and checking IoT devices for patches: By staying up to date with your IoT devices’ firmware, you’re better equipped to protect your workplace from ever-evolving cyber threats. While people regularly update their computers and phones, they may forget to update their IoT devices.

  • Monitoring device behavior: By knowing your device’s base behavior and aspects such as its performance or regular network activity, you can recognize irregular behavior and intervene if you notice any deviations to your device’s performance.

  • Using strong and unique passwords: Using a password manager for your organization helps secure your IoT data security. NordPass Business creates unique, complex passwords. Additionally, it regularly reminds you to update passwords if they’re old, reused, or weak.

  • Checking app permissions for IoT devices: If an IoT device comes with an app, it is better to review the permissions it’s requesting before allowing access to your device or network. You shouldn’t grant apps more permissions than are strictly necessary.

  • Applying network segmentation and network security: Your workplace should have a way to monitor network activity and any devices connected to it. Tracking this information will help you recognize irregular internet traffic and act as an additional layer of security. This means that if one device is affected by an attack, it won’t be passed on to your other devices.

  • Considering additional security solutions and tools: To secure the app component of IoT devices, consider only accessing the app via a VPN. Doing so will encrypt the data transferred and give your network an extra layer of security.

  • Using multi-factor authentication (MFA): The more layers of security (authentication factors) smart devices used in your workplace have, the safer your company assets are. Incorporating additional factors to authenticate the user, such as biometric data or the user’s geolocation, makes your IoT devices less vulnerable to cyber attacks.

  • Applying Cloud IoT Security: Many IoT applications leverage cloud computing for storing, processing, and analyzing data. Therefore, it’s essential to implement security strategies, procedures, and tools that encompass cloud security if your organization utilizes smart devices.

How NordPass Business boosts your IoT security

The surge of IoT devices in private and professional settings provides more potential routes for hackers to steal valuable data and information. These devices and networks are more intertwined than ever, meaning cybersecurity for IoT shouldn’t be ignored. For companies working with large amounts of data, NordPass Enterprise is the cybersecurity solution you’re looking for. With NordPass, you can securely store and share login credentials for all your accounts and generate strong, unique logins in no time. NordPass allows you and your colleagues to quickly access important office notes (alarm PINs, WiFi passwords, and recovery codes) in one place.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

36 Endpoint Security Statistics MSPs Should Know About in 2025

You can’t secure what you don’t know exists.

That’s only part of the challenge MSPs face when managing endpoint security.

Endpoint security becomes even more complex when you factor in the number of unmanaged devices continually added to the corporate network.

Do you know the number of unauthorized productivity SaaS applications being used by employees on their personal devices? Most likely not. But shadow IT is only part of the problem MSPs and IT managers encounter daily.

We’re not even talking about BYOD policies that aren’t deployed or followed protocol. How about former employees who still have company-issued laptops they haven’t returned yet? Each unsecured endpoint is a prime target for attackers to exploit.

Wait until you see what else the Guardz team discovered.

Here are 36 endpoint security statistics in 2025 that every MSP must be aware of.

Unsecured Connections: Endpoint Security Risks of BYOD

  • 92% of remote workers report using their personal tablets or smartphones for work tasks, with 46% of them having saved a work file onto those devices. – The State of Remote Work Security
  • 97% of executives access work accounts or applications via their personal devices. – 2023 Not (Cyber) Safe for Work Report
  • 80% of executives are likely to send work-related messages from their personal devices. – 2023 Not (Cyber) Safe for Work Report
  • Microsoft research found that 80-90% of successful ransomware attacks come from unmanaged devices. – Microsoft
  • 62% of cybersecurity professionals cite data loss and leaks as their top BYOD-related concerns. Menlo Security
  • 36% of employees who said they use a personal device for work purposes admitted to delaying applying security updates. – The HIPAA Journal
  • 71% of employees store sensitive work passwords on personal phones. – Security Magazine
  • 67% of enterprises use up to five separate vendors for management and security across all device types. Computerworld
  • Only 38% of companies have a policy prohibiting employees from storing plain-text access credentials on their devices. The Sensitive Data Report
  • Only 42% of companies surveyed have a solution to proactively locate sensitive data on an employee device. The Sensitive Data Report
  • 38% of employees admitted that their employer doesn’t have any BYOD policies, or the policy is sometimes or always ignored. – The HIPAA Journal

Endpoints Unknown: The Dangers of Shadow IT

  • Gartner found that shadow IT accounts for 30-40% of IT spending in large enterprises. Forbes
  • According to Cisco, 80% of company employees use shadow IT. IBM
  • 76% of SMBs report that shadow IT threatens security. LastPass
  • 58% of SMBs have experienced high-impact shadow IT efforts outside the knowledge of their official IT department. Capterra
  • While the average large enterprise believes it uses 37 apps, employees actually use 625 apps. – CIO
  • 30% of IT leaders claim that information security is the biggest obstacle to BYOD adoption. CloudSecureTech
  • Shadow IT usage has increased by 59% with remote work. Keepnet
  • 47% of companies allow employees to access their resources on unmanaged devices, authenticating via credentials alone. The Shadow IT Report
  • 70% of employees using ChatGPT at work hide it from their employers. Business Insider
  • Nearly 1/3 (32%) of remote and hybrid workers use apps or software not approved by IT.  Infosecurity Magazine
  • A study found that 59% of organizations have experienced data loss through cloud-based shadow IT. Ponemon Institute
  • ChatGPT is the top unauthorized app that is secretly used by workers. Fortune
  • “By 2027, 75% of employees will acquire, modify or create technology outside IT’s visibility — up from 41% in 2022.” Gartner

Employee-Related Endpoint Security Threats

  • Among HR workers who offboarded employees in the past year, 71% say at least one employee didn’t return company-owned equipment, like a laptop or smartphone. Capterra
  • 65% of employees said they often bypass their organization’s security policies to improve productivity and make their lives easier. The HIPAA Journal
  • Over 90% of security incidents involving lost or stolen devices result in an unauthorized data breach. Samsung Knox
  • 13% of employees admit to falling for phishing attacks while working at home. – Security Magazine
  • A study by Wing Security found that 63% of businesses may have former employees with access to organizational data. The Hacker News
  • 62% of employees surveyed reported moving company IP to non–company devices. USACI
  • An HR offboarding study found that 59% of stolen company-owned equipment contained sensitive information and that only 55% were able to completely lock out the employee from using the equipment. Capterra

Endpoint-Related Attacks

  • There was a 300% increase in endpoint malware detections in Q3 of 2024. Help Net Security
  • In 2024, a Twilio data breach exposed 33 million phone numbers from Authy accounts, which was traced back to an unauthenticated API endpoint. Security Week
  • A study found that 90% of successful cyberattacks and as many as 70% of successful data breaches originate at endpoint devices. Verizon Business 2023 Mobile Security Index
  • 54% of security professionals said that more than 20% of their overall endpoints were unmanaged. CSO Online
  • A survey found that 67% of MSPs experienced an attack from an AI-borne threat in the last 12 months and that AI attacks could soon become more of a threat than endpoint attacks. SC Media

Secure Your Endpoints with Guardz

Visibility is the key factor when it comes to endpoint security.

The Guardz platform includes native endpoint protection that integrates with SentinelOne EDR, delivering best-in-class endpoint security. This enables MSPs to scale 365-day coverage without added complexity or cost.

Start Free Trial

About Guardz
Guardz is on a mission to create a safer digital world by empowering Managed Service Providers (MSPs). Their goal is to proactively secure and insure Small and Medium Enterprises (SMEs) against ever-evolving threats while simultaneously creating new revenue streams, all on one unified platform.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

ESET Recognized as Finalist in SC Awards for Cutting-Edge Ransomware Remediation

SAN DIEGO, Calif. — April 11, 2025 — ESET, a global leader in cybersecurity, today announced that it has been named a finalist in the prestigious 2025 SC Awards. ESET Ransomware Remediation has been recognized in the Best Business Continuity, Disaster, Ransomware Recovery Solution category as a finalist, underscoring ESET’s commitment to excellence and leadership in the cybersecurity industry. The SC Awards, now in its 28th year, recognize the solutions, organizations, and individuals that have demonstrated outstanding achievement in advancing the security of information systems.

“SC Awards are recognized worldwide by the cybersecurity community, and we are honored to be a finalist in the Best Business Continuity, Disaster, Ransomware Recovery Solutions category,” said Ryan Grant, VP of Marketing and Sales at ESET North America. “ESET has a history of innovation in mitigating ransomware, and Ransomware Remediation was launched to deliver comprehensive defense from encryption, theft and data holding. This recognition speaks to our continued investment in the ESET PROTECT platform and our commitment to offering businesses peace of mind in the fight against ransomware.”

Unlike solutions based on the Windows Volume Shadow Copy service, ESET Ransomware Remediation is a proprietary post-execution solution which works with and is enabled by ESET Ransomware Shield – monitoring for and blocking sophisticated attacks before they happen. Solving one of the most common failings of regular backups during a ransomware attack – the lack of isolation or segmentation of data — ESET Ransomware Remediation creates temporary encrypted backups of important data, all in a sequestered environment untouchable by untrustworthy apps and processes.

“From the rise of generative AI attacks to breaches exploiting third-party access and non-human credentials, the past year has reminded us that cybersecurity needs to be about innovations that help enterprises pivot, adapt, and thrive in a threat landscape that changes by the hour,” said Tom Spring, Senior Editorial Director, SC Media.

“Being named an SC Awards finalist is a recognition not only of technical innovation, but of a shared commitment to making the digital world safer,” Spring said. “It’s inspiring to see how this year’s community of finalists — across identity, cloud, data protection, and beyond—is pushing forward together, united by purpose.”

The 2025 SC Awards entries were evaluated across 33 specialty categories by a distinguished panel of judges, comprised of cybersecurity professionals, industry leaders, and members of the CyberRisk Alliance CISO community, representing sectors such as healthcare, financial services, education, and technology.

The 2025 winners will be announced on Tuesday, April 29, 2025, at RSAC ’25 in San Francisco at the SC Awards Reception. Find the full list of 2025 finalists on SC Media’s website here.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

How data governance fuels growth and compliance

Data governance is often framed as a costly technical obligation — a necessary framework for compliance, risk mitigation, and operational control. And while that’s true, it’s far from the whole picture.

For organizations looking to grow, governance is not just guardrails — it’s infrastructure. It’s the structure that enables companies to move faster without losing control, to scale without introducing chaos, and to unlock the full value of their data without compromising compliance. Governance isn’t just about doing things right; it’s about making sure the organization can do more — and with confidence.

This article is part four of our five-part series based on the Intelligent data governance report. In this installment, we explore how governance supports growth — not just by protecting data, but by making it more usable, more trusted, and more strategic.

Data governance unlocks confident decision-making

Every organization collects more data than it knows what to do with. But volume alone doesn’t create value — usability does. And usability depends on structure: Knowing where data lives, how critical it is, who owns it, and whether or not it can be trusted.

Without governance, teams often waste time second-guessing data sources, reconciling conflicting reports, or duplicating work because there’s no shared language or system of ownership. Decision-making slows down. Trust erodes. Innovation slips without confident footing.

Governance introduces the necessary consistency. Classification, access policies, and ownership models help turn raw data into something organizations can rely on. And when people trust the data, they use it — to make faster, more accurate decisions that drive the business forward.

Efficiency starts with visibility and control

Data governance also reduces friction. In organizations without clear governance, data sprawl becomes a silent cost: Duplicate records, orphaned datasets, and outdated systems create noise that slows operations and increases security risks and compliance complexity.

By implementing governance policies that enforce visibility and control, organizations can clean up that sprawl and reclaim focus. When data is managed centrally and transparently, it becomes easier to eliminate redundant systems, reduce unnecessary storage costs, and streamline internal processes.

This isn’t just a back-office win — it’s what creates the operational agility to pursue new initiatives, adopt emerging technologies, and respond quickly to changing cybersecurity and business demands, including evolving regulatory requirements.

Growth without compromising compliance

One of the most powerful aspects of governance is its ability to scale with the organization — particularly when it comes to compliance.

Growing businesses often face a familiar tension: The desire to innovate and expand goes up against increasing (and more demanding) regulatory requirements. Governance bridges that gap. It ensures that compliance is embedded into the day-to-day way data is handled, rather than being tacked on at the end of a project or rollout.

Retention policies, access controls, audit logging — these aren’t just technical settings; they’re part of a broader governance strategy that keeps organizations in alignment with regulations like GDPR, HIPAA, NIS2, and others, without blocking innovation.

With governance in place, compliance becomes something you prove by design, not by scramble.

Scalable structure for sustainable growth

As organizations scale, their data environments become more complex. New tools are introduced, teams expand, acquisitions happen — and without governance, that complexity can quickly turn into fragility and vulnerability.

Governance provides the foundation to absorb that complexity and build true resilience. It makes it easier to integrate new systems, manage access as roles change, and preserve institutional knowledge as people come and go. A well-governed environment gives growing companies the ability to maintain consistency and control, even as the pace of change accelerates.

This isn’t just operationally valuable — it signals maturity to customers, partners, and regulators. In many industries, demonstrating a strong governance posture has become a prerequisite for doing business at scale, as well as in insurability controls.

Conclusion: A strategic investment, not just a safeguard

Data governance isn’t just about staying compliant or minimizing risk — it’s about creating the conditions for smarter, faster, and more strategic decisions across your organization. When data is well-governed, teams work with confidence, leaders act on insight, and innovation has room to grow.

From classification to collaboration, governance connects the dots between operational control and business growth. And as organizations take on more data, more AI, and more regulatory pressure, a clear governance framework is no longer a nice-to-have — it’s a strategic asset.

Download the report to explore practical guidance, examples, and tools to help you build a data governance program that supports resilience and drives growth.

Intelligent data governance report

This article is part four of a five-part blog series inspired by our new report, Intelligent data governance: Why taking control of your data is key for operational continuity and innovation. You can find other articles in the series below.

Data governanceRegulatory complianceBusiness growthData strategy

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Portnox Honored as Finalist of the 2025 SC Awards

Company recognized in the Best Authentication Technology category for the second consecutive year.

 

AUSTIN, TX – April 10, 2025 – Portnox is proud to announce that it has been named a finalist in the prestigious 2025 SC Awards. Portnox has been recognized in the Best Authentication Technology category for the second consecutive year.

“Authentication methods continue to evolve, driven by the need for stronger, frictionless security. Finalists in this category highlight a clear industry trend toward user-friendly yet secure authentication methods, employing advanced technologies to strengthen security while minimizing disruption to user experience,” said SC Media in an article announcing the finalists in this category.

“To be named an SC Award finalist is a significant validation of the hard work and dedication of the entire Portnox team,” said Portnox CEO Denny LeCompte. “We are committed to providing IT security teams with the unified access control and zero trust security solutions they need to navigate today’s complex cyber threat landscape, and this merit-based recognition from such esteemed experts is something to celebrate.”

SC Media highlighted why it chose Portnox as one of five finalists in the Best Authentication category:

Securing application access requires intelligent, real-time decision-making, and Portnox’s Conditional Access for Applications delivers exactly that. The platform provides adaptive, risk-based authentication policies that assess device posture, user behavior, and contextual risk factors before granting access. With strong adoption in highly regulated industries, Portnox is empowering organizations to implement granular access controls without disrupting user experience. The company recently expanded its support for Microsoft Azure AD and identity federation, enabling businesses to enforce Zero Trust access across cloud and on-premises environments. As threat landscapes evolve, Portnox is continuously innovating to enhance adaptive authentication capabilities.

“Being named an SC Awards finalist is a recognition not only of technical innovation, but of a shared commitment to making the digital world safer,” said Tom Spring, Senior Editorial Director, SC Media. “This year we received hundreds of submissions across 33 categories, and the result is a finalist roster that reflects an evolving cybersecurity industry.”

The SC Awards, now in its 28th year, recognizes the solutions, organizations, and individuals that have demonstrated outstanding achievement in advancing the security of information systems. Find the complete list of 2025 finalists on SC Media’s website: www.scworld.com/sc-awards. New this year, all finalists are invited to the SC Awards Reception, where the 2025 winners will be announced on Tuesday, April 29, 2025, at RSAC ’25 in San Francisco.

 

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.