2025-07-14 - Version 2 Limited

Unlocking the AI Hybrid Era for MSP-Driven Cybersecurity in SMBs with Guardz

In cybersecurity, the old paradigm no longer applies to modern technologies and the modern landscape. When you combine human intelligence with artificial intelligence, the result isn’t simply additive, and it’s multiplicative. This is the core principle of the AI Hybrid Era.

The new paradigm is where humans and AI don’t work in isolation or competition but as a unified force that’s exponentially more effective than either alone. For MSPs defending SMBs, this isn’t a theoretical paradigm, it’s the practical security revolution needed to tackle today’s threat landscape.

The AI Hybrid Era: Beyond Automation, Into Amplification

The AI Hybrid Era isn’t just about throwing AI into the mix and hoping for the best. It fundamentally flips the outdated narrative of “AI replaces humans” into a far more powerful story: “AI empowers humans to become exponentially more effective.” This is the difference between automation and amplification.

At its core, this era hinges on the seamless integration of two distinct but complementary intelligences.

Human Intelligence

Contextual reasoning that understands the nuances behind anomalous activity, like why a login from an unusual geography might be benign or malicious based on business context. Ethical judgment guides when and how to act, balancing security with user productivity and privacy.

Intuition is honed through years of experience detecting subtle patterns no algorithm can yet fully grasp. Deep domain expertise in compliance, threat actor behaviors, and the complexities of hybrid IT environments. Strategic decision-making that anticipates attacker moves and designs defenses proactively.

Artificial Intelligence

Unmatched scale and speed, ingesting petabytes of telemetry every day from endpoints, identity services, cloud APIs, and network flows without breaking a sweat. Real-time correlation engines that stitch together seemingly unrelated events into coherent threat narratives within milliseconds.

Advanced anomaly detection models leveraging supervised, unsupervised, and reinforcement learning to spot novel attacks and low-signal malicious activity. Automated triage systems that enrich alerts with threat intelligence, risk scoring, and playbook recommendations, cutting through noise to spotlight what truly matters. Scalable response orchestration that can instantly contain infections, block compromised credentials, and remediate misconfigurations across distributed SMB environments.

Together, human and artificial intelligence form an intelligent feedback loop. AI accelerates the detection and response lifecycle by handling the scale and complexity that no human team could process alone. Meanwhile, humans continually train, tune, and contextualize AI models with their expertise, transforming raw algorithmic outputs into strategic security actions.

For MSPs serving SMBs, this synergy is a game changer. It means delivering enterprise-grade security capabilities that scale affordably and operate effectively in complex, heterogeneous environments without the burnout and gaps caused by alert fatigue and manual overload. It’s not about replacing analysts or security teams; it’s about amplifying their impact and extending their reach far beyond what was ever possible before.

This is the AI Hybrid Era: a new cybersecurity paradigm where humans and machines coexist, collaborate, innovate, and win together.

“AI won’t replace you, but a human who masters AI will.”

Why SMBs Can’t Afford to Rely on Purely Human or Purely AI Security

SMBs face a critical and complex challenge:

They generate enormous volumes of security data daily, spanning identity systems, endpoints, cloud workloads, and network traffic, but often lack dedicated SOC teams capable of effectively processing and responding to this influx.
This leads to overwhelming alert fatigue, with hundreds or thousands of daily alerts inundating limited security resources, the vast majority of which are false positives.
Adversaries exploit these vulnerabilities by deploying sophisticated, multi-stage attacks engineered to blend seamlessly into regular activity and evade detection.
Traditional SOC models, which rely solely on human analysts, are impractical for SMBs due to cost constraints and scalability issues. Meanwhile, standalone AI-driven tools fall short because they lack essential context and adaptability.

The AI Hybrid Era addresses this dilemma by fusing human expertise with AI’s processing power, delivering scalable, context-aware, and effective security tailored to SMB needs.

MSPs trying to protect SMBs can’t rely on traditional human-only SOC models due to cost and scale, nor on purely AI-driven tools that lack contextual nuance and adaptability. The AI Hybrid Era solves this by combining both.

The Art of the AI Hybrid Era

The phrase “1+1=3” captures the essence of the Hybrid MSP SOC Model, where the integration of human intelligence and artificial intelligence creates a force multiplier effect. This isn’t a simple sum, and it’s an artful fusion that defines the AI Hybrid Era.

In traditional SOCs, either humans or AI operate in silos, each with inherent limitations. Humans bring critical thinking, contextual understanding, and ethical judgment, but are constrained by scale and speed. AI offers unparalleled data processing, pattern recognition, and automation, but lacks the nuanced insight to independently interpret complex business contexts or evolving adversary tactics.

The art of the AI Hybrid Era lies in harmoniously orchestrating these strengths. AI manages massive telemetry ingestion, applies advanced machine learning for anomaly detection, and automates routine triage and response. Meanwhile, skilled human analysts inject context, validate AI findings, investigate sophisticated threats, and refine AI models through continuous feedback.

For MSPs serving SMBs, this hybrid synergy means delivering cybersecurity outcomes that far exceed what either AI or human teams could achieve independently. The art lies in balancing automation with human insight, enabling rapid and accurate detection and response while minimizing alert fatigue and operational overhead.

Mastering this art transforms MSP SOCs into adaptive, intelligent defense engines, where the whole is truly greater than the sum of its parts. It’s not just technology or people alone, it’s their deliberate, integrated collaboration that defines success in today’s complex threat landscape.

Scalable Data Processing with AI

AI systems ingest and normalize logs and telemetry data collected from endpoints, identity platforms, cloud workloads, and various applications. By applying both supervised and unsupervised machine learning techniques, these systems are capable of detecting a broad spectrum of threats.

This includes identifying low-and-slow lateral movement, credential abuse, anomalous cloud API activity, sophisticated phishing campaigns, mailbox manipulation, and many other advanced attack vectors. Such a comprehensive approach enables early and accurate detection of subtle and complex threats across heterogeneous environments.

Intelligent Alert Triage and Enrichment

One of the biggest challenges MSPs face when protecting SMBs is alert overload. Security tools across endpoints, identity platforms, cloud environments, and network sensors generate tens of thousands of raw alerts daily. Most of these are false positives, noise, or low-priority events that can obscure critical threats. Without effective triage, analysts are overwhelmed by this data, which delays responses and increases risk.

AI-powered intelligent, alert triage and enrichment solve this problem by transforming massive volumes of raw telemetry into actionable, high-fidelity security incidents. The process involves several key technical steps:

Data Ingestion and Normalization: Raw event data streams, including Sysmon logs, Azure AD sign-in events, and Office 365 audit logs, as well as endpoint detection alerts, are ingested in near real-time. The data is normalized into a standard schema, ensuring uniformity across heterogeneous sources and enabling cross-system correlation.
Event Correlation Across Domains: AI engines utilize graph-based analytics and multidimensional correlation to connect discrete events that, when viewed in isolation, appear benign or unrelated.
Attack Stage Tagging: Utilizing frameworks like MITRE ATT&CK, AI classifiers categorize correlated incidents by probable attack stages, including initial access, persistence, privilege escalation, lateral movement, data exfiltration, and others.
Automated Contextual Enrichment: AI automatically attaches relevant metadata to alerts, including user risk history, geolocation, past incident associations, vulnerability exposure, and known adversary TTP matches, transforming raw alerts into enriched narratives.

The outcome of this layered triage and enrichment process is a dramatic reduction in alert volume, often by 85-95%, distilling tens of thousands of raw events into a manageable few hundred actionable incidents daily.

This enables MSP analysts to focus their time and expertise on high-priority, contextualized threats rather than being overwhelmed by noise. It also significantly improves mean time to detect (MTTD) and mean time to respond (MTTR) by accelerating incident understanding and reducing investigation overhead.

Human Analyst Validation and Deep Investigation

Security analysts take AI-enriched incidents as a starting point and apply their tactical expertise and critical thinking to:

Confirm genuine threats: Distinguish true positives from false alarms by contextualizing AI findings with business knowledge, user behavior patterns, and environment specifics.
Uncover attacker intent and scope: Analyze the tactics, techniques, and procedures (TTPs) behind detected activities to determine adversary objectives, attack progression, and potential impact on critical assets.
Conduct a root cause analysis: Trace attack vectors back to the initial compromise points, identify exploited vulnerabilities or misconfigurations, and map lateral movement paths to fully understand the incident chain.
Refine detection capabilities: Utilize insights gained to tune and develop custom detection rules, build targeted threat-hunting queries, and enhance AI model accuracy tailored to the SMB’s unique environment and risk profile.

This human-driven validation and investigation layer adds indispensable nuance and strategic insight that AI alone cannot replicate, ensuring precision and depth in threat response.

Continuous Feedback Loop

The Continuous Feedback Loop is the heartbeat of the AI Hybrid Era, transforming static detection into a living, evolving defense mechanism. Every analyst action, whether confirming a threat or flagging a false positive, is more than just a checkbox; it’s a critical data point that fuels the refinement of AI models.

This feedback directly retrains and recalibrates machine learning algorithms, enabling them to:

Precisely tune detection thresholds to the SMB’s unique environment, minimizing false positives without sacrificing sensitivity.
Update behavioral baselines to reflect legitimate changes in user activity and infrastructure.
Adapt rapidly to emerging attacker techniques and evolving threat vectors specific to the client’s industry and technology stack.

Without this closed-loop learning process, AI models become stale, rigid, and prone to either alert fatigue or blind spots. By contrast, an MSP-powered hybrid SOC that incorporates continuous feedback enables dynamic, context-aware detection, which becomes smarter every day, transforming data into actionable intelligence and shifting security from a reactive to a proactive approach.

This continuous refinement is what elevates AI from a tool to an intelligent partner, making the human-AI collaboration truly greater than the sum of its parts. It’s not just feedback; it’s the fuel for relentless improvement in defending SMBs at scale.

Real-World Scenario: Alert Fatigue

Consider an SMB MSP deploying a hybrid AI-SOC platform like Guardz, designed to deliver enterprise-grade security at an SMB’s scale. The MSP faces a staggering 50,000+ raw alerts daily, originating from diverse telemetry sources, including endpoint detection systems, cloud identity logs, network intrusion detection sensors, and SaaS activity monitors.

The key focus is slashing alert fatigue by enabling the AI-SOC to cut through noise, reducing irrelevant alerts by more than 94%.

AI-Driven Correlation and Contextual Enrichment

At this volume, manual triage is impossible. The Guardz AI engine ingests and normalizes these heterogeneous alerts in real-time, applying:

Multi-source event correlation using graph analytics to link seemingly unrelated signals into cohesive attack campaigns.
Behavioral baselining and anomaly detection models trained on SMB-specific patterns.
Integration with threat intelligence feeds and MITRE ATT&CK mappings for automated threat classification.
Asset criticality and user context enrichment, correlating alerts to sensitive systems and privileged accounts.

This intelligent processing consolidates the alert storm into approximately 3,000 high-value actionable incidents. These incidents represent aggregated event clusters, significantly reducing noise while preserving attack fidelity.

Advanced Triage and Suppression

Next, the AI applies advanced filtering algorithms to suppress duplicate, benign, or low-risk events. It prioritizes incidents based on composite risk scores derived from:

Attack progression stages (e.g., initial access vs. exfiltration).
Historical alert accuracy and analyst feedback loops.
Real-time threat actor indicators and environmental context.

This triage reduces the workload to approximately 300 high-confidence alerts, allowing for focused analyst attention on the most credible threats.

Human Analyst Validation and Investigation

Security analysts then perform in-depth validation on this refined alert set, using enriched metadata, AI-provided incident narratives, and forensic tools. Their objectives include:

Confirming true positive (TP) incidents and dismissing residual false positives.
Mapping attacker TTPs to understand adversary intent and scope.
Executing root cause analysis to identify exploited vulnerabilities or compromised identities.
Adjusting detection rules and hunting queries tailored to the client environment.

Typically, analysts investigate fewer complex, high-impact alerts daily, dedicating their expertise to threats that demand nuanced understanding and strategic response.

Impact on MSP Operations and SMB Security

This tiered, hybrid approach yields:

Faster Detection: Automated correlation accelerates the identification of multi-stage attacks hidden within noisy data.
Accurate Prioritization: Risk-based triage surfaces true threats and suppresses distractions, improving analyst focus.
Efficient Resource Utilization: Analysts’ time is reserved for complex investigations, reducing burnout and enhancing job satisfaction.
Scalable Security Delivery: MSPs can confidently scale coverage across multiple SMB clients without proportional increases in headcount.

Why MSPs Serving SMBs Must Double Down on the Hybrid with Guardz

In today’s threat landscape, relying on AI alone leaves critical blind spots, especially in understanding the unique business contexts of SMBs. On the other hand, purely manual security can’t keep pace with the scale, speed, and complexity of attacks. Guardz’s hybrid model is the only way MSPs can truly deliver practical, scalable cybersecurity that SMBs desperately need.

Here’s why doubling down on the hybrid approach with Guardz is a game changer:

Sharper Threat Detection: AI’s relentless pattern recognition uncovers subtle indicators of compromise while expert human analysis filters false positives and interprets context, delivering unmatched detection accuracy.
Crushing Alert Fatigue: Guardz’s AI triage filters out noise and irrelevant alerts, freeing analysts to focus on what truly matters, complex and high-impact threats.
Lightning-Fast Response: Automated playbooks handle routine threats instantly, minimizing attacker dwell time while humans expertly tackle nuanced, high-risk incidents.
Enterprise-Grade Security, SMB-Friendly Costs: Guardz empowers MSPs to offer world-class protection that fits SMB budgets, making advanced cybersecurity accessible without sacrificing quality or scale.

For MSPs serious about protecting SMBs and scaling their security operations efficiently, the hybrid model with Guardz isn’t optional. It’s essential. It’s the competitive edge that turns limited resources into robust, proactive defense.

Conclusion: The Era of Hybrid AI Future Is Now!

For MSPs protecting SMBs, the AI Hybrid Era is no longer optional. It’s imperative. The fusion of human and artificial intelligence is the ‘1+1=3’ formula for a new approach to cybersecurity success. Embracing this synergy empowers MSPs to defend SMBs efficiently against evolving threats without overexerting resources or exceeding budgets. Mastering this hybrid balance is the competitive edge MSPs need to future-proof their security services and deliver true value in today’s hyper-connected world.

–

The webinar titled “AI and Human Insights Powering the Future of MSP Success” presents a detailed discussion on the evolving role of artificial intelligence (AI) in managed service providers (MSPs), particularly in cybersecurity and service management. The session features experts from Guards and SuperOps who collectively explore how AI, when combined with human intelligence (HI), addresses critical challenges faced by MSPs today, enabling them to operate more efficiently, scale profitably, and manage risks effectively.

About Guardz
Guardz is on a mission to create a safer digital world by empowering Managed Service Providers (MSPs). Their goal is to proactively secure and insure Small and Medium Enterprises (SMEs) against ever-evolving threats while simultaneously creating new revenue streams, all on one unified platform.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Guardz 2025

A Beginner’s Guide to Ransomware-as-a-Service (Raas)

Over the last few years, news reports around ransomware attacks have noted that the attacks are increasingly sophisticated. Simultaneously, they say that the attackers are less sophisticated than in the past. While these two statements appear to conflict with each other, they are both true when viewed through the lens of the current cybercriminals business models.

Ransomware-as-a-Service (RaaS) applies a subscription payment model to cybercriminal ransomware activities. The ransomware developers focus on evolving increasingly sophisticated attacks then sell these capabilities to less sophisticated cybercriminals. This ecosystem makes it easier for less technical criminals to deploy attacks while enabling the creators to make the ransomware more difficult to defend against.

With insight into how Ransomware-as-a-Service works, security teams can implement additional controls to mitigate risk.

What is Ransomware-as-a-Service (RaaS)?

Ransomware-as-a-Service (RaaS) is a cybercrime business model selling ransomware tools based on the legitimate Software-as-a-Service (SaaS) subscription model. With the RaaS model, developers build the malware then sell it to affiliates who carry out the attack. This process enables less-skilled cybercriminals to deploy sophisticated ransomware attacks.

With the RaaS model, cybercriminals can expand their reach while making prevention and detection more difficult for security teams.

How does the RaaS model work?

With the RaaS model, threat actors operationalize ransomware attacks and provide cybercriminals with the same services that a legitimate SaaS product company would offer, including customer support services and a payment portal.

At a high level, the RaaS model consists of three types of adversaries:

Operators: Create and sell the malware, campaign infrastructure, and services
Initial access brokers (IABs): compromise networks and then sell the unauthorized access to other cybercriminals
Affiliates: purchase and deploy the ransomware

While the specifics are unique to each operation, the overall structures tend to fall into a few models.

Monthly subscription

In this model, affiliates pay a recurring fee for continued access to the latest ransomware tools and services. The affiliates avoid the upfront costs and technical knowledge necessary for creating the ransomware from scratch. The operators gain recurring revenue from the affiliates while remaining distanced from the actual attack, enabling them to evade law enforcement.

One-time fee

Under this model, the affiliates pay the cybercriminal version of a lifetime license for full access to the ransomware code. The affiliate retains access to the tools, enabling them to run ransomware operations without further financial obligations. For affiliates who want to manage multiple attacks over a long period of time, this might be a cost-effective option.

Affiliate programs

An affiliate program uses a profit sharing model where the affiliates and operators split the ransom as payment. While payment structures differ across ransomware groups, they often fall under three structures:

70% to affiliate, 30% to operators
80% to affiliate, 20% to operators, seen recently with LockBit
90% to affiliate, 10% to operators, seen recently with Ransom Hub or APT 73

These arrangements are often flexible, with an affiliate’s skill sets impacting commission. Affiliates who have teams, infrastructure, and tools often receive a higher percentage of the ransom than less sophisticated cybercriminals.

What are the different extortion categories?

In the early days of ransomware, attackers would encrypt an organization’s data, providing the decryption key only once the victim paid the ransom. In response, organizations implemented more sophisticated backup and restoration capabilities for improved business resilience.

Recently, cybercriminals have changed their methodologies. Today, ransomware includes data theft, holding the sensitive information hostage until victims pay the ransom. These extortion methods include:

Single extortion: stealing data then asking for money
Double extortion: publishing some sensitive data and threatening to put it on the dark web
Triple extortion: pressuring companies into paying ransom through other means, like exposing file listings or sending victims emails

What are real-life examples of RaaS groups?

Although the RaaS ecosystem has seen some changes recently due to law enforcement actions, some groups are well-known across the landscape.

DarkSide

Linked to the 2021 Colonial Pipeline attack, DarkSide is known for targeting large corporations and using double extortion tactics. In June 2021, law enforcement seized cryptocurrency valued at $2.3 million, representing the proceeds of this attack.

LockBit

First appearing in 2019, this group is commonly considered the most prolific ransomware group, linked to 2,000 victims and stealing more than $100 million. Its malware, LockBit 3.0 (LockBit Black), added double extortion tactics. In 2024, law enforcement seized control of the group’s infrastructure and its alleged administrators, securing convictions of several affiliates.

REvil

Also called Sodinokibi, this group was involved in several high-profile attacks, like ones against JBS Foods and Kaseya. In May 2024, one group member was sentenced to over thirteen years in prison for his role in attacks related to over $700 million in ransom payment.

Conti

Linked to attacks against over 900 global victims, this group notably attacked Ireland’s Health Service Executive (HSE), severely disrupting healthcare services. In 2023, law enforcement charged four Russian cybercriminals over their involvement with the group.

Best Practices for Mitigating Ransomware Risks

The RaaS model increases the volume of ransomware sophisticated attacks by lowering the barrier to entry. With these best practices, you can improve your security and reduce risk.

Improve credential hygiene

With IABs selling initial access, improving credential hygiene is a fundamental security control. Implementing multi-factor authentication (MFA) enables you to mitigate risks by providing challenge questions related to something people have (like a smartphone) or something people have (like a face ID).

Monitor for credential exposure

Monitoring data breach information can help you identify leaked credentials related to your employees. Often, people reuse the same password across personal and professional logins, so identifying employee credentials leaked in previous data breaches can improve your security.

Reduce the attack surface

Every network access point is a location where attackers can gain initial access. Some typical ways to reduce the attack surface include:

Limiting access according to the principle of least privilege
Reviewing firewall rulesets for outdated rules with excess permissions
Disabling unnecessary device and software functionalities
Blocking known malicious IP addresses

Regularly scan for vulnerabilities and apply security updates

IABs often target vulnerabilities as a way to gain initial system and network access. Scanning for vulnerabilities across software, hardware, and firmware on network-connected devices closes this security gap when combined with installing security patches as quickly as possible.

Incorporate threat intelligence

Threat intelligence provides real-time insight into operator, IAB, and affiliate attack methodologies. For example, threat intelligence can provide insight into the known vulnerabilities that these groups target, helping to prioritize vulnerability remediation actions.

Graylog Security: Contextual Risk Insights for Improved Security Operations

Graylog Security’s contextual risk scoring, powered by Adversary Campaign Intelligence, incorporates threat intelligence into our risk scoring to amplify real threats and reduce noise. With Graylog, security teams can prioritize activities based on asset criticality and connect the dots between alerts to reduce alert fatigue.

Graylog Security’s Illuminate bundles map Sigma rule detections to the MITRE ATT&CK framework so you can gain immediate value from your logs and improve your security alert capabilities.

To see how Graylog Security gives you the SIEM that never asks you to compromise, contact us today.

About Graylog
At Graylog, our vision is a secure digital world where organizations of all sizes can effectively guard against cyber threats. We’re committed to turning this vision into reality by providing Threat Detection & Response that sets the standard for excellence. Our cloud-native architecture delivers SIEM, API Security, and Enterprise Log Management solutions that are not just efficient and effective—whether hosted by us, on-premises, or in your cloud—but also deliver a fantastic Analyst Experience at the lowest total cost of ownership. We aim to equip security analysts with the best tools for the job, empowering every organization to stand resilient in the ever-evolving cybersecurity landscape.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Graylog 2025

How to find Phoenix Contact devices on your network

Latest Phoenix Contact vulnerabilities #

In July 2025, Phoenix Contact disclosed vulnerabilities in certain models and versions of their AC charging controller and Programmable Logic Controller (PLC) firmware.

July 2025: AC charging controller vulnerabilities #

Nine vulnerabilities have been disclosed, across two advisories VDE-2025-019 and VDE-2025-014, in certain models and versions of Phoenix Contact CHARX SEC-3XXX series AC charging controller firmware.

An unauthenticated remote adversary can alter the device configuration in a way to achieve remote code execution as the root user with specific configurations. This vulnerability has been designated CVE-2025-25270 and has been rated critical with a CVSS score of 9.8.
An unauthenticated adjacent adversary can modify device configuration by sending specific requests to an API endpoint resulting in read and write access due to missing authentication. This vulnerability has been designated CVE-2025-25268 and has been rated high with a CVSS score of 8.8.
An unauthenticated adjacent adversary can configure a new OCPP backend due to insecure defaults for the configuration interface. This vulnerability has been designated CVE-2025-25271 and has been rated high with a CVSS score of 8.8.
An unauthenticated local adversary can inject a command that is subsequently executed as the root user, leading to a privilege escalation. This vulnerability has been designated CVE-2025-25269 and has been rated high with a CVSS score of 8.4.
An unauthenticated remote adversary can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service (DoS) for these stations. This vulnerability has been designated CVE-2025-24003 and has been rated high with a CVSS score of 8.2.
A local adversary with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation. This vulnerability has been designated CVE-2025-24005 and has been rated high with a CVSS score of 7.8.
A low-privileged local adversary can leverage insecure permissions via SSH on the affected devices to escalate privileges to root. This vulnerability has been designated CVE-2025-24006 and has been rated high with a CVSS score of 7.8.
An unauthenticated remote adversary can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service (DoS) for the stations until they are restarted by the watchdog service. This vulnerability has been designated CVE-2025-24002 and has been rated medium with a CVSS score of 5.3.
An adversary with physical access to the device can send a message to the device via the USB-C configuration interface which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service (DoS) for the stations until they are restarted by the watchdog service. This vulnerability has been designated CVE-2025-24004 and has been rated medium with a CVSS score of 5.3.

The following models and versions are affected

CHARX SEC-3000 firmware versions before 1.7.3
CHARX SEC-3050 firmware versions before 1.7.3
CHARX SEC-3100 firmware versions before 1.7.3
CHARX SEC-3150 firmware versions before 1.7.3
CHARX SEC-3000 firmware versions through 1.6.5
CHARX SEC-3050 firmware versions through 1.6.5
CHARX SEC-3100 firmware versions through 1.6.5
CHARX SEC-3150 firmware versions through 1.6.5

What is the impact? #

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable device, potentially leading to complete system compromise.

Are any updates or workarounds available? #

Phoenix Contact has released updates to fix most of these issues. Users are encouraged to update to the latest firmware version 1.7.3 as quickly as possible, which fixes all but three vulnerabilities (CVE-2025-24002, CVE-2025-24003 and CVE-2025-24004) related to the German Calibration Law (Eichrecht) functionality in firmware versions through 1.6.5. There is no vendor planned fix for these three issues.

CHARX SEC-3000 upgrade to firmware version 1.7.3 or later
CHARX SEC-3050 upgrade to firmware version 1.7.3 or later
CHARX SEC-3100 upgrade to firmware version 1.7.3 or later
CHARX SEC-3150 upgrade to firmware version 1.7.3 or later

How to find affected Phoenix Contact AC charging controllers with runZero #

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Phoenix Contact CHARX SEC-3000" OR hw:="Phoenix Contact CHARX SEC-3050" OR hw:="Phoenix Contact CHARX SEC-3100" OR hw:="Phoenix Contact CHARX SEC-3150"

July 2025: Programmable Logic Controller vulnerabilities #

Four vulnerabilities have been disclosed in certain models and versions of Phoenix Contact Programmable Logic Controller (PLC) PLCnext firmware.

A low-privileged remote adversary is able to trigger the watchdog service to reboot the device due to incorrect default permissions of a config file. The vulnerability may be used to perform denial-of-service (DoS) attacks against the device or to gain unauthorized access by triggering the vulnerabilities identified below. This vulnerability has been designated CVE-2025-41665 and has been rated medium with a CVSS score of 6.5.
A low-privileged remote adversary with file access is able to replace a critical file used by the watchdog service. Once the watchdog service has been initialized the adversary gains read, write and execute permissions to the whole file system on the device. This vulnerability has been designated CVE-2025-41666 and has been rated high with a CVSS score of 8.8.
A low-privileged remote adversary with file access is able to replace a critical file used by the arp-preinit script. Through replacing the critical file the adversary gains read, write and execute permissions to the whole file system on the device. This vulnerability has been designated CVE-2025-41667 and has been rated high with a CVSS score of 8.8.
A low-privileged remote adversary with file access is able to replace a critical file or directory used by the security-profile service. Through replacing the critical file or directory the adversary gains read, write and execute permissions to the whole file system on the device. This vulnerability has been designated CVE-2025-41668 and has been rated high with a CVSS score of 8.8.
In addition, multiple vulnerabilities exist in Linux components within the device firmware. Please refer to VDE-2025-053 for the extensive list.

The following models and versions are affected:

AXC F 1152 firmware versions before 2025.0.2
AXC F 2152 firmware versions before 2025.0.2
AXC F 3152 firmware versions before 2025.0.2
BPC 9102S firmware versions before 2025.0.2
RFC 4072S firmware versions before 2025.0.2

What is the impact? #

Successful exploitation of CVE-2025-41665 would allow an adversary to perform denial-of-service (DoS) attacks against the device, but in combination with CVE-2025-41666, CVE-2025-41667 or CVE-2025-41668 an adversary may gain full control over the device.

Are any updates or workarounds available? #

Phoenix Contact has released updates to fix these issues. Users are encouraged to update to the latest firmware version as quickly as possible.

AXC F 1152 upgrade to firmware version 2025.0.2 or later
AXC F 2152 upgrade to firmware version 2025.0.2 or later
AXC F 3152 upgrade to firmware version 2025.0.2 or later
BPC 9102S upgrade to firmware version 2025.0.2 or later
RFC 4072S upgrade to firmware version 2025.0.2 or later

How to find affected Phoenix Contact PLC devices with runZero #

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Phoenix Contact AXC F 1152" OR hw:="Phoenix Contact AXC F 2152" OR hw:="Phoenix Contact AXC F 3152" OR hw:="Phoenix Contact BPC 9102S" OR hw:="Phoenix Contact RFC 4072S"

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

runZero 2025

What is Governance, Risk, and Compliance (GRC), exactly?

changes and business need

The integration of GRC components allows organizations of all sizes to make better decisions, improve their overall security strategy, and ensure they meet regulatory standards, setting a solid groundwork for operational efficiency and sustained growth. Let’s take an in-depth look at all things GRC.

The concept behind Governance, Risk, and Compliance (GRC)

GRC is a strategic framework developed by the Open Compliance and Ethics Group (OCEG) in 2002. Generally speaking, it is designed to help organizations align their IT operations with overall goals, effectively manage risks, and comply with local laws and regulations. You can think of GRC as a holistic approach that improves organizational efficiency, safeguards against financial losses, and even upholds brand image and integrity. Let’s break down GRC letter by letter.

Governance involves establishing policies, roles, responsibilities, and procedures to guide and control how an organization’s various departments work together toward achieving business objectives and operational excellence. It ensures that IT decisions are always in line with the organization’s strategic goals.
Risk management is about identifying, evaluating, mitigating, and monitoring risks that could affect the organization’s reputation, safety, security, and financial well-being. This includes taking a wide range of risks seriously, from cyber threats to compliance breaches, and implementing strategies to reduce their impact.
Compliance is the adherence to relevant laws and regulations affecting the organization’s operations. It includes everything from data protection regulations like GDPR to sector-specific rules, ensuring organizations meet their legal duties and preserve their integrity under external examination.

At its core, GRC aims to enable organizations to foresee and control risks associated with cybersecurity and other threats, operate within legal boundaries, and make strategic decisions promoting long-term success and resilience.

Why is the concept of Governance, Risk, and Compliance (GRC) important?

The significance of GRC for today’s business cannot be overstated because it helps organizations protect themselves and optimize their operations and strategy in a world of ever-evolving regulations, increasing cyber threats, and competitive pressures.

Here’s why the strategy of Governance, Risk, and Compliance is indispensable for modern businesses:

Helps ensure regulatory compliance: With the complexity and scope of regulations always expanding, GRC provides organizations with the structure needed to ensure they meet all legal requirements. This is vital for avoiding penalties and fines and maintaining trust with customers and stakeholders.
Mitigates risks: Integrating GRC risk management into every aspect of the business helps organizations identify, assess, and mitigate risks before they escalate into organization-wide issues.
Aligns IT with business goals: GRC helios organizations ensure that IT strategies and processes align with the organization’s business objectives. This alignment is critical for maximizing the efficiency and effectiveness of IT investments, supporting growth, and maintaining a competitive edge.
Promotes operational excellence: By establishing clear policies, procedures, and controls, GRC enhances operational processes, improves efficiency, and ensures that all organizational activities are aligned with the overall strategy and values.

Governance, Risk, and Compliance maturity is measured by the GRC maturity model developed by the OCEG . It helps companies gauge the level of GRC management within the organization and identify areas for improvement and growth.

In short, GRC is crucial for organizations seeking to navigate the complexities of the contemporary business world safely and successfully.

How to implement GRC in your business

Effectively and seamlessly integrating a Governance, Risk, and Compliance program across a business requires a thorough roadmap. Here are 7 main key steps, each designed to support a specific aspect of the journey:

Assess the benefits

Begin by evaluating what specific GRC framework benefits can bring to your organization, such as enhancing compliance, improving operational efficiency, and reducing risks. Such benefit assessment will help you to focus on strategic areas, provide a strong foundation for decision-making and community value to the stakeholders, and so not waste time in the process.

Name GRC implementation areas

To ensure a focused and effective GRC program rollout, identify the areas of your organization that will benefit most from it. Begin by assessing the existing processes, departments, and other functions to evaluate where stronger compliance or risk management practices are needed. Such prioritization will help you to create a roadmap to start and ensure that the GRC framework is tailored to address your company’s unique challenges and requirements.

Choose the right GRC solutions

This might sound trivial, but actually choosing the right tool to implement a GRC program is critical as it simplifies the integration process and reduces potential challenges. When selecting the software for your company, evaluate features such as automation, reporting, and adaptability to various compliance requirements.

Create the implementation roadmap

Once all the preparations are done, you can now turn to creating the GRC implementation roadmap itself. It should be clear, step-by-step, and flexible enough to adapt to changes or challenges. Within it, define a timeline, key milestones, tasks, and responsibilities.

Ensure collaboration

For successful GRC implementation, continued close communication and cooperation between all stakeholders are vital. Stakeholders such as leadership, heads of departments, and IT and legal teams should be aligned on the objectives, scope, and benefits of the GRC initiative. Consider establishing regular meetings and communication channels so the stakeholders are always informed.

Implement the process

Now, all it has left is actually to undergo the implementation process. This mainly consists of deploying the selected GRC software, integrating with existing systems, and configuring workflows to align with the organization’s specific requirements and needs.

Monitor, improve, and streamline compliance

Continuous monitoring is crucial for the GRC framework to remain effective and adaptable. Such monitoring helps to indicate potential gaps and allows proactive action to ensure that your company’s GRC system is involved with regulatory changes and business needs.

Understanding the GRC Framework and its operation

This GRC framework not only supports an organization’s immediate operational needs but also its long-term strategic goals and ambitions.

Here’s how the GRC framework functions to achieve these aims:

Setting strategic goals and objectives: The first step in implementing a GRC framework includes defining the organization’s strategic goals and objectives. This ensures that all GRC efforts are directly aligned with the organizational aims.
Developing a governance structure: When building up a governance structure it is crucial to have a clear delineation of roles and responsibilities within the organization. This structure provides the foundation for making informed decisions, managing risks, and ensuring compliance.
Risk identification and assessment: A key component of the GRC framework is the systematic process of identifying and assessing potential risks that could impact the organization. This, usually, involves analyzing the likelihood of various risk scenarios and their potential impact on the organization’s objectives.
Implementing controls and procedures: Based on the risk assessment, the organization activates appropriate controls and procedures to manage and mitigate identified risks. This could include implementing new tools and technologies, revising operational processes, or obtaining various compliance certifications such as SOC 2 Type II Compliance, ISO 27701 Compliance, CPRA Compliance, or ISO 27001 Compliance.
Ongoing monitoring and enhancement: The final step in the GRC framework is the continuous monitoring of the framework’s effectiveness and making improvements where necessary, which means regularly reviewing and updating the governance structure, risk management practices, and compliance efforts to ensure they remain effective and aligned with the organization’s goals.

By systematically assessing organizational goals, establishing a governance structure, identifying and mitigating risks, and continuously monitoring and improving the framework, organizations can ensure that they are well-positioned to meet their objectives while maintaining compliance and a strong overall security posture.

Benefits of the GRC Framework

The GRC framework isn’t just a set of guidelines to keep regulators at bay; it’s a comprehensive approach that can streamline processes, safeguard assets, and drive efficiency. Here’s what it brings to the table.

Enhanced decision-making

At the heart of GRC lies the power to make informed decisions. By integrating GRC practices, organizations gain a 360-degree view of their risk perimeter and compliance status. With real-time insights and analytics, decision-makers can pivot precisely, ensuring that every move is aligned with internal goals and external regulations.

Improved efficiency and reduced costs

By GRC activities, companies can eliminate redundant processes and streamline operations. This boosts efficiency and significantly cuts down costs associated with managing risks and ensuring compliance separately.

Risk Mitigation

Today, risks come from every direction—cyber threats, regulatory changes, market volatility, you name it. The GRC framework helps businesses to better identify, assess, and mitigate risks before they escalate into full-brown breaches.

Strengthened regulatory compliance

Navigating the complex web of regulations can feel like walking through a minefield. GRC simplifies this by providing a structured approach to compliance. Whether it’s GDPR, CCPA, SOX, or any other regulatory acronym, GRC helps businesses stay on top of their obligations.

Competitive advantage

In a marketplace where trust and reliability are as valuable as the services or products offered, GRC can be a game-changer. Organizations that proactively manage governance, risk, and compliance project a strong image of reliability and responsibility.

Enhanced organizational reputation

Lastly, a robust GRC framework polishes your organization’s reputation. In an era where news travels faster than light, a single misstep can tarnish your brand. By ensuring that governance, risk management, and compliance are tightly woven into your corporate fabric, you minimize the chances of such mishaps.

Challenges of implementing GRC framework

There’s no doubt that implementation of the Governance, Risk, and Compliance program can bring lots of benefits to your company. Unfortunately, companies often face challenges before, after, and during the implementation. So knowing these possible challenges beforehand can help you to mitigate or overcome them:

Unwillingness to change

In order to successfully implement the GRC program, new processes, tools, and even cultural shifts are required from the employees and leadership. Unfortunately, this can be met with hesitation from them and to overcome it, you’ll need to invest in promotion of department collaboration, provide awareness and training programs. This will ease the transition and mitigate change resistance. Similarly, you should showcase any early successes to build trust and boost the engagement.

Expertise gaps

Lots of companies often struggle with the internal expertise needed to design and implement an effective GRC program. This cap can be addressed by consulting with external experts or providing internal training for your internal teams.

Integrating siloed operations

More often than not, organizations are held back from achieving the integrated approach for a centralized GRC program because of the fragmented systems and processes. Hence, it’s crucial to foster cross-functional communication and collaboration, use all-in-one GRC tools to consolidate data and processes, and align departmental goals with a broader GRC strategy. This can successfully break down existing operational silos.

Resource limitations

Resources, such as personnel, budget, and time, aren’t unlimited. So, it’s critical to prioritize GRC areas that will deliver the most significant impact and measurable results. Then, you can use these successes to advocate for additional support and resources.

GRC software and tools

GRC software is a suite of applications that enable businesses to align IT processes and strategies with business goals while managing the vast spectrum of risks and complying with legal and regulatory obligations. The beauty of these tools lies in their ability to provide a bird’s-eye view of GRC-related activities in real-time.

At their core, GRC solutions are about integration. They break down silos between departments, ensuring that information flows seamlessly across the organization. This integrated approach ensures that everyone is on the same page, making it easier to identify, evaluate, and manage risks across all levels of the organization.

As we mentioned earlier, one of the key benefits of leveraging GRC software is the enhanced efficiency it brings to the table. Automating repetitive and manual tasks frees up valuable resources, allowing teams to focus on strategic objectives. Additionally, these tools come equipped with advanced analytics and reporting capabilities, providing actionable insights that can help and mitigate risks before they escalate.

Yet, choosing the right GRC software is not a one-size-fits-all affair. It requires a deep understanding of your organization’s specific needs and its regulatory landscape. Factors such as scalability, customization, user-friendliness, and integration capabilities with

As the regulatory and risk environment becomes more complex, the role of GRC solutions in ensuring resilience, compliance, and strategic alignment becomes ever more critical.

The key AI technologies in GRC

In a world that’s racing to adapt AI technologies as quickly as possible, GRC software is no stranger. Even more, it’s actually becoming the key element in effective risk management strategies.

AI-powered GRC systems can help companies effectively automate, enhance reporting capabilities, and streamline processes in increasingly complex regulatory requirement environments and cybersecurity challenges. This means that organizations that adopt AI GRC software can more efficiently manage risks, reduce operational costs, improve data-driven decision-making, and strengthen regulatory compliance.

Let’s now look closer at AI technologies that are changing the Governance, Risk, and Compliance landscape:

Robotic Process Automation (RPA): RPA and artificial intelligence are related but distinct things. Most importantly, RPA is process-driven, which means it follows the process defined by a user. However, AI is data-driven and uses machine learning to recognize patterns in data to learn over time. So, RPA-driven GRC tools will help automate specific tasks like data collection, report generation, and compliance checks. This reduces manual work and minimizes human error.
Machine learning (ML): ML is a branch of AI that allows computers to learn from data patterns and improve their performance on specific tasks without being explicitly programmed. Within Governance, Risk, and Compliance, machine learning can analyze extensive amounts of historical data to predict possible risks and compliance issues, empowering organizations to tackle them proactively.
Natural language processing (NLP): NLP is a branch of artificial intelligence that uses machine learning to enable machines to learn, read, and interpret human language. It’s useful for simplifying complex legal texts, compliance regulations and documentation to extract relevant data.

How NordPass helps organizations in their GRC efforts

NordPass stands as a great solution for businesses striving to improve their enterprise Governance, Risk, and Compliance frameworks, with a particular focus on securing and managing information access.

The key to NordPass’s utility is its advanced security features, such as end-to-end encryption and zero-knowledge architecture. These ensure that sensitive information remains accessible only to those with proper authorization, drastically reducing the risk of unauthorized access.

NordPass also improves organizational governance by facilitating controlled access to sensitive data. By implementing IT password management, user groups, and shared folders, businesses can enforce access controls that reflect their internal structures and governance policies, promoting accountability and transparency.

Furthermore, NordPass improves operational efficiency by simplifying login management. This efficiency allows employees to focus more on their primary tasks which is essential for companies looking to streamline their processes and ensure their governance frameworks effectively support their goals.

The IT Governance, Risk, and Compliance landscape is continually evolving, presenting new challenges and regulatory requirements. NordPass’s commitment to ongoing security innovation ensures that businesses can rely on a solution that remains at the forefront of security and compliance standards.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Nord Security NordPass 2025

EasyVista | Market Leading ITSM & ITOM Solutions

Simplify Complexity with Data Governance

We empower IT teams to drive efficiency, security, and innovation. With seamless automation and global scalability, our platform enables organizations to navigate the AI revolution with confidence and agility. Simplify complexity and deliver value at every step of your IT journey to take your organization to the next level.

Turning IT Pain Points into Progress

EasyVista tackles your most pressing IT challenges with a platform designed to simplify, empower, and transform. See how we address your needs:

Eliminate IT silos

From a dedicated Customer Experience Manager to C-level care, we ensure your IT journey is seamless and supported long after implementation.

Built for your needs today and tomorrow

Our platform prioritizes practical, scalable capabilities over trendy features, aligning IT solutions with your business goals while reducing complexity.

Faster, easier, and more affordable

With no-code implementation, flexible licensing, and a unified platform, EasyVista reduces TCO by more than 50% and accelerates adoption for immediate value.

The Power of a Unified Platform

Revolutionize IT service delivery with the EasyVista platform. Harness the power of AI—featuring LLM-based automation, intelligent insights, and conversational capabilities—to enhance productivity, improve service reliability, and simplify IT management. Explore our end-to-end solutions.