Skip to content

Why GDPR Still Reigns: Navigating the Modern Data Privacy Landscape

Cast your mind back to May 2018. Remember that flurry of privacy policy updates hitting your inbox?

That was the grand entrance of the General Data Protection Regulation (GDPR). And if you thought it was just a fleeting trend, or something that would eventually fade like dial-up internet or fidget spinners, guess again!

Fast forward to today, and GDPR isn’t just sticking around – it’s stronger, more influential, and more vital than ever. Said another way: GDPR isn’t just a suggestion, it’s the law. If your business interacts with any personal data of individuals living in the European Union (EU) or the European Economic Area (EEA), you absolutely must comply. It’s the primary legal framework to ensure the millions of people living across the EU and EEA have fundamental rights over their digital footprints.

GDPR’s staying power is having an even wider impact on our global perspective of trust, privacy, compliance, and the commitments we make to one another about how we handle and process personal data. This article dives into that far-reaching impact, and showcases how GDPR’s success is an investment in trust.

Let’s dive in!

The Impact of GDPR Is Real (And Can Be Really Expensive)

GDPR is not a distant threat. Data Protection Authorities (DPAs) across Europe have demonstrated their willingness to levy hefty fines for noncompliance. Remember that eye-watering $1.3 billion fine Meta received in 2023 for data transfers to the US?

That wasn’t just a slap on the wrist; it was a loud, clear message.

Regulators are scrutinizing everything, from how transparent companies are about their data practices to whether they’re truly respecting individuals’ rights (like asking for your data back or requesting it be deleted). Enforcement is becoming more sophisticated and far-reaching, which means companies of all sizes need to be sure their systems and policies are compliant.

And while GDPR may directly apply to Europe, it’s far from a European idea. GDPR kicked off a wave of similar, robust data privacy laws across the globe. From California’s CCPA/CPRA to Brazil’s LGPD and South Africa’s POPIA, these regulations often share GDPR’s core principles and intent.

What does that mean for you?

If you’re doing a great job with GDPR compliance, you’re likely already building a fantastic foundation for meeting other international privacy requirements. If not, you’ll find that your efforts to improve your handling of private data will generally apply across the board.

AI’s New Frontier: GDPR’s Guiding Hand

The world may be buzzing about AI and Generative AI. But what is often lost in the conversation is that they bring a whole new set of questions about how our personal data is used, especially when it comes to training these powerful models.

The good news? GDPR’s foundational principles are incredibly robust and adaptable. They’re helping us navigate critical discussions around:

  • Lawful Basis: Is it okay to use my data to train an AI? What’s the legal reason?
  • Transparency: How do these AI models make decisions? Can I understand why an AI gave me a certain outcome?
  • Bias: Is the data used to train AI fair and unbiased?

And while the EU AI Act is on its way, it’s designed to work hand-in-glove with GDPR, not replace it. This shows just how forward-thinking and resilient GDPR’s framework truly is.

Ready to Be a GDPR Champion?

Becoming GDPR compliant (and staying that way!) is an ongoing journey, not a one-time checkbox. Here are some tips to get you on the path to being a GDPR pro:

Become a Data Detective: Time to map out all the personal data your company holds – from names and emails to IP addresses and even sensitive health info. Ask yourself:

  • Where does it live?
  • Who has access to it, both inside and outside your company?
  • Why are you collecting it in the first place?

Understanding “what you have” is step one!

Find Your “Why”: For every piece of personal data you process, you need a clear, legal reason (a “lawful basis”) under GDPR. Ask yourself:

  • Are you collecting it because someone consented?
  • Is it part of a contract?
  • Is it part of a legal obligation?

Pinpointing your “why” keeps you on the right side of the law.

Empower Your Users’ Rights: Make it easy for people to:

  • Know what data you’re collecting
  • Access their data
  • Correct any mistakes
  • Erase their data (“the right to be forgotten”)
  • And even move their data elsewhere (data portability)

Boost Your Security Game: You need strong defenses to protect personal data from unauthorized access, accidental loss, or anything that could compromise it.

Master the Breach Response: If a data breach occurs, you need a clear plan to detect, investigate, manage, and report it quickly – often within 72 hours! Being prepared is half the battle.

Bake Privacy In (By Design!): Data Protection by Design and by Default means thinking about privacy from the very beginning when you’re designing new systems, products, or services. And by default, ensure the strictest privacy settings are active and you only collect the data you truly need.

Mind Your Global Transfers: If you’re sending personal data across borders (especially outside the EU/EEA), make sure you’re doing it legally! There are specific mechanisms, like Standard Contractual Clauses, that help ensure data remains protected wherever it travels.

The Bottom Line: Invest in Trust

GDPR isn’t just a complex set of rules; it’s a fundamental pillar of global data privacy that’s built on trust.

Its influence continues to shape how businesses worldwide handle sensitive information. Ignoring GDPR doesn’t just invite hefty fines; it risks your reputation and the trust of your customers – something no organization can afford to lose in today’s digital age.

JumpCloud and GDPR

JumpCloud takes security and privacy seriously and complies with the EU privacy regulation GDPR to protect personal data. You can check out our JumpCloud GDPR Compliance online documentation for more information. Our safeguards for personal data include, but are not limited to:

  • Encrypting all data at rest and in transit
  • Training employees in security awareness and performing appropriate background checks
  • Maintaining access controls
  • Actively monitoring JumpCloud user logins and privileged commands
  • Monitoring logs

If you have questions about GDPR, or how JumpCloud can help you become GDPR-compliant, please contact us at sales@jumpcloud.com.

Prioritizing GDPR compliance isn’t just a cost; it’s a smart, critical investment in your company’s future and your relationship with your users. So, let’s embrace it and build a more privacy-conscious world together!

 

About JumpCloud
At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

ESET Research uncovers variants of AsyncRAT, popular choice of cybercriminals

  • ESET Research has released insights into the landscape of AsyncRAT, a remote access tool (RAT), and its numerous variants.
  • The analysis uncovers their unique interconnections, and documents how these variants can be distinguished.
  • The widespread availability of frameworks such as AsyncRAT significantly lowers the barrier of entry for aspiring cybercriminals.

PRAGUE, BRATISLAVA — July 15, 2025 — ESET Research is releasing its analysis of AsyncRAT — a remote access tool (RAT) designed to remotely monitor and control other devices. Over the years, AsyncRAT has cemented its place as a cornerstone of modern malware and as a pervasive threat that has evolved into a sprawling network of its variants and forks (customized and improved versions of the original tool). The published analysis provides an overview of the most relevant forks of AsyncRAT, drawing connections between them and showing how they have evolved.

AsyncRAT, an open-source RAT, was released on GitHub in 2019 by a user going by the name of NYAN CAT. It offers a wide range of typical RAT functionalities, including keylogging, screen capturing, credential theft, and more. Its simplicity and open-source nature have made it a popular choice among cybercriminals, leading to its widespread use in various cyberattacks.

“AsyncRAT introduced significant improvements, particularly in its modular architecture and enhanced stealth features, making it more adaptable and harder to detect in modern threat environments. Its plug-in-based architecture and ease of modification have sparked the proliferation of many forks, pushing the boundaries even further,” says ESET researcher Nikola Knežević, author of the study.

Ever since it was released to the public, AsyncRAT has spawned a multitude of new forks that have built upon its foundation. Some of these new versions have expanded on the original framework, incorporating additional features and enhancements, while others are essentially the same version in different clothes. The most popular variants for the attackers, according to ESET telemetry, are DcRat, VenomRAT, and SilverRAT.

DcRat offers a notable improvement over AsyncRAT in terms of features and capabilities, while VenomRAT is packed with further additional features. However, not all RATs are serious in nature,  and this applies equally to AsyncRAT forks. Clones like SantaRAT or BoratRAT are meant to be jokes. Despite this, ESET has found instances of real-world malicious usage of these in the wild.

In its analysis, ESET Research has cherry-picked some lesser-known forks, too, as they enhance AsyncRAT’s functionality beyond the features included in the default versions. These exotic forks are often the work of one person or group, and they make up less than 1% of the volume of AsyncRAT samples.

“The widespread availability of frameworks such as AsyncRAT significantly lowers the barrier to entry for aspiring cybercriminals, enabling even novices to deploy sophisticated malware with minimal effort. This development further accelerates the creation and customization of malicious tools. This evolution underscores the importance of proactive detection strategies and deeper behavioral analyses to effectively address emerging threats,” concludes Knežević.

For a more detailed analysis and technical breakdown of various AsyncRAT variants and forks, check out the latest ESET Research blogpost, “Unmasking AsyncRAT: Navigating the labyrinth of forks,” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

BoratRAT promotional logo

 

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

The Rise of AI for MSPs: The Good, the Bad, and the Breach

How AI Has Shifted Traditional MSP Workflows

It seems like you can’t go anywhere without hearing the words AI, LLM, or MCP. But make no mistake about it, AI has changed the way MSPs operate. A smart prompt can essentially save you hours on ticketing resolution, assist with compliance documentation, and even auto-generate client performance reports in seconds, complete with pie charts and everything. 

A recent survey found that 66.7% of MSPs are already leveraging AI for IT monitoring, while 54.4% have automated ticketing and incident management. The same survey found that MSPs leveraging AI services have seen a 20-30% boost in service revenue YoY. 

Who wouldn’t want to increase operational efficiency while driving down the costs associated with hiring and training additional staff, unneeded service delivery delays, and seeing their profit margins climb? 

Sounds almost too good to be true. But there’s a catch. Threat actors have adopted it too. 

Attackers have added new chaos to the external threat surface, figuring out new ways to launch sophisticated phishing campaigns, automate business email compromise (BEC) attacks that mimic sentiment analysis of trusted senders, and deploy advanced malware at an unprecedented scale. Many new attack paths stemming from the use of LLMs, such as prompt injection and data poisoning, present new security challenges for MSPs. 

By the way, attacks on large language models (LLMs) take less than a minute to complete on average and leak sensitive data 90% of the time when successful. 42 seconds to be exact. 

So, how can MSPs enjoy the benefits of AI while avoiding the risks? Before we discuss how MSPs can prevent AI-generated phishing attempts, it’s important to understand the main attack vectors and security blind spots a threat actor can exploit. 

AI-Related Security Threats You Should Know About 

Advanced BEC Threats: Your inbox serves as a testing environment for attackers to launch advanced phishing campaigns and other related email threats. Research showed that 40% of BEC emails are AI-generated, and spam filters don’t always catch them. To the untrained eye, a phony invoice can appear to come from a trusted vendor, complete with a company logo and polished formatting. The bank transfer, however, leads to a fraudulent account controlled by the attacker. 

But that’s not all. AI adds a new layer of complexity by manipulating the context and tone of the message to make it more convincing. By the time the fraud is detected, the attacker has already changed their IP (again) and moved on to the next target. Without email security filters to detect and quarantine those suspicious emails, those inboxes remain vulnerable to BEC attacks and AI-generated phishing attempts. 

Conducting routine phishing simulations can help protect those inboxes by teaching employees how to recognize the red flags and build a culture of resilience from within. 

Exposed Cloud Data: Research from Tenable revealed that 70% of AI-enabled cloud workloads have critical vulnerabilities compared to only 50% of workloads without AI. Those workloads can contain sensitive information, such as training datasets, authentication credentials, and customer data. Exposure of these details can result in a serious breach, enabling attackers to gain further unauthorized access to broader cloud environments. 

Another consideration is who has access to your data? A third party might inadvertently enter sensitive company information into an LLM, which could then be exposed or even used to train future models, potentially leaking proprietary data outside your organization’s control without limit or oversight. It goes without question that you should restrict and prohibit the usage of shared data. Ensure you outline this in your SLA to clearly define what data can and cannot be processed through AI tools to protect client confidentiality.

Prompt Injection Attacks: LLMs are vulnerable to prompt injection attacks, where threat actors manipulate the model’s behavior by overriding instructions or embedding harmful commands. Chatbots can also be manipulated into disclosing sensitive information or delivering malicious links that can compromise unsecured endpoints with advanced ransomware. Prompt injections impact ticket resolutions as well. Automated ticket resolutions may be trained to close critical alerts and ignore key security events, allowing critical threats to go unnoticed. 

An MSP can’t properly triage security incidents if they don’t have context behind the threats or if the mitigation instructions are incorrect, resulting in a delayed response or no action at all. 

AI Bias: LLMs are prone to errors. ChatGPT clearly states that it can make mistakes. Those tedious tasks you automated may produce inaccurate or biased results altogether, which can hamper decision-making processes. LLMs and AI models are trained on many datasets that may contain inherent biases or outdated information. Separating fact from fiction might not be as clear-cut as it seems, especially when it comes to threat mitigation. 

AI models might prioritize certain types of security incidents based on historical data, potentially overlooking emerging threats that don’t fit established patterns. An unmitigated anomaly might escalate into a full-scale attack without a human expert to analyze the threat in a deeper context and initiate the proper containment measures.

MSPs must always validate AI-generated outputs to ensure accurate threat detection and effective response strategies.

That’s when an AI-powered, human-led MDR becomes essential. 

Prevent Advanced Threats with an AI-Powered, Human-Led MDR

AI plays a significant role in simplifying routine tasks, but when it comes to threat detection, you can’t take any chances or rely on LLMs exclusively. 

The Guardz MDR unifies SentinelOne capabilities and other platform detections into a single contextual system of normalized incidents, with an elite team of human-led security experts in the loop. Gain behavioral insights and integrated threat intelligence with automated response playbooks and reports. 

Reduce alert fatigue using AI to enrich data and make more informed mitigation decisions with the Guardz MDR platform. 


Get started today.

Start Free Trial

About Guardz
Guardz is on a mission to create a safer digital world by empowering Managed Service Providers (MSPs). Their goal is to proactively secure and insure Small and Medium Enterprises (SMEs) against ever-evolving threats while simultaneously creating new revenue streams, all on one unified platform.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Unlock Email Threat Visibility with Mimecast and Graylog

Email threats aren’t slowing down. From credential phishing to malware-laced attachments, email remains one of the most exploited entry points for attackers. If you’re already using Mimecast to help mitigate that risk, you’re ahead of the curve — but raw log data only gets you so far.

Starting with Graylog 6.2.3, you can pull logs directly from Mimecast using API v2.0 and view them immediately with built-in Illuminate Dashboards. This streamlines investigations, enhances visibility, enables cross-log correlation, and reduces time spent capturing critical information.

 

Why Integrate Mimecast with Graylog?

Mimecast logs contain a wealth of email security telemetry: blocked threats, quarantined messages, impersonation attempts, URL protections, DLP triggers — you name it. But your analysts are missing the bigger picture unless you’re pulling that data into your central logging and detection platform.

By integrating Mimecast with Graylog:

  • You centralize email security insights alongside endpoint, firewall, and identity logs.
  • You reduce pivoting between tools and improve incident response speed.
  • You leverage ready-made dashboards and content to cut through the noise.

 

Prerequisites

Mimecast Setup

Before getting started, make sure the following prerequisites are covered:

  • A valid Mimecast account
  • A configured Mimecast API application (see Mimecast documentation for setup steps)
  • API user with appropriate admin permissions based on log types

 

Graylog Input Configuration

To configure the Mimecast input in Graylog:

1. Go to Graylog > Inputs

2. Select the Mimecast input and click Launch new input

You’ll be prompted to configure the following:

      • Input Name
        A user-defined name (e.g., “Mimecast Email Logs”)
      • Client ID
        From your Mimecast API application
      • Client Secret
        Also from your API application
      • Log Types to Collect
        Select the types of logs you want to ingest (default: all). At least one is required.
      • Polling Interval
        How frequently Graylog polls Mimecast (minimum: every 5 minutes)
      • Enable Throttling
        When enabled, Graylog will pause new message intake from this input if the system is behind in processing

3. Enable the Graylog Illuminate Mimecast Processing Pack and Spotlight

That’s it — once saved, the input begins pulling in data and Illuminate goes to work.

mimecast input config

 

 

Illuminate Technology Pack

The content pack supports the following log types. Generic processing will be provided for log types not listed.

User Logged On
Unauthorized API Request
Case Action
Review Set Action
Discovery Case Adjustments
Logon Authentication Failed
Logon Requires Challenge
Completed Directory Sync
New Policy
Existing Policy Changed

Mimecast Support Login
Content Definition Adjustments
Existing Route Changed
New Delivery Route
Profile Group (Address) Log Entry
Account Updated
API Application Created
User Password Changed
User Settings Updated
User Locked

 

Illuminate Dashboards: Instant Insights from Day One

No need to build dashboards from scratch. With the Mimecast integration, Illuminate provides prebuilt dashboards that offer:

Email Threat Overview

See overall message volume, threat counts, and detection trends across time.

 

Saved Search

Quickly save searches for sharing to the team or creating an investigation using email parameters.

How This Helps Analysts

It’s not just about pretty charts. Integrating Mimecast with Graylog improves the analyst experience in several key ways:

  • Centralized Investigation
    Email events are side-by-side with endpoint, DNS, firewall, and user activity logs
  • Less Manual Correlation
    No need to bounce between tools to get a full picture of an email incident
  • Faster Detection and Response
    Dashboards highlight high-risk activity, helping analysts focus on what matters
  • Operational Context
    Graylog’s enrichment and detection rules help connect Mimecast data to broader attack patterns

 

Ready to Try It?

If you’re already running Graylog Enterprise 6.2.3 or later, setting up Mimecast integration takes just a few minutes. With prebuilt dashboards and structured log inputs, you’ll go from raw data to actionable insights fast and finally get the email threat visibility your team needs.

 

About Graylog
At Graylog, our vision is a secure digital world where organizations of all sizes can effectively guard against cyber threats. We’re committed to turning this vision into reality by providing Threat Detection & Response that sets the standard for excellence. Our cloud-native architecture delivers SIEM, API Security, and Enterprise Log Management solutions that are not just efficient and effective—whether hosted by us, on-premises, or in your cloud—but also deliver a fantastic Analyst Experience at the lowest total cost of ownership. We aim to equip security analysts with the best tools for the job, empowering every organization to stand resilient in the ever-evolving cybersecurity landscape.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Features in OTRS: AI Use Cases and Benefits

Today’s service teams have high expectations. They must provide fast, personalized, and high-quality support. This support often needs to be across many channels, in different languages, and under pressure.

Even the most dedicated employees find it hard to keep up. They feel overwhelmed by repetitive tasks, slow ticket triage, and time-consuming research.

To ease this burden and provide noticeably better service, teams need new solutions. Artificial Intelligence (AI) applications accelerate responses, streamline workflows, and increase productivity. OTRS’ AI features automate repetitive tasks and enable fast, high-quality, and transparent ticket handling.

Why AI Is a Key Driver of Efficiency

AI features and applications automate tasks and increase efficiency, allowing companies to accomplish more with fewer employee resources. Every agent should have an AI assistant. This helps speed up ticket processing and gives accurate answers. It also frees teams from boring routine tasks.

In short: When agents work smarter, not harder, they get better results with less effort. This leads to more satisfaction overall.

This reduces pressure and improves customer relationships.

It supports key performance indicators (KPIs). It aims to maximize the return on investment (ROI) for AI solutions. It also focuses on improving important business metrics. These include Customer Retention Rate (CRR) and Net Promoter Score (NPS).

Additionally, it looks at employee satisfaction and productivity.AI-powered systems keep improving over time. They build on the base model and become more valuable with each interaction.

AI-enhanced systems significantly outperform traditional software, particularly in terms of efficiency and service quality.

AI Features in OTRS

As a ticketing system, OTRS doesn’t just provide AI tools—it gives users the power to work more efficiently.

AI applications are only as good as the time savings, quality improvements, and service enhancements they generate.

Here’s an overview of the AI services available in OTRS:

Ticket Classification and Service Description

This AI feature automatically analyzes and categorizes tickets. Not only does this save time, but it also ensures standardized, accurate ticket assignment. It can also trigger automated workflows such as escalation management.

This feature uses automated service descriptions. It creates consistent and meaningful summaries in seconds. These summaries include keywords and common request types. This significantly reduces manual documentation and forms the foundation for further AI use.

AI-Powered Response Generation

This service generates context-aware responses based on knowledge base entries. Agents review the natural language reply and send them directly. This greatly speeds up response times and helps solve problems better.

It also makes sure that answers are clear, helpful, and correct. This removes the need for long manual responses and searching through knowledge bases.

Sentiment Analysis

By using a large language model, OTRS AI features identify the emotional tone of incoming messages. They system determines how urgent or emotionally charged a request may be. Agents deal with cases differently based on a customer’s mood.

Sentiment analysis provides a quick overview and helps agents craft thoughtful, empathetic replies.

Real-Time Translation

This feature breaks down language barriers by instantly translating both incoming and outgoing messages. It enables seamless multilingual communication, allowing everyone to converse in their native language. This saves time for agents and enhances the customer experience.

Unified Knowledge Access

Responses need to be fast, accurate, and based on the latest information. This service integrates with both internal and external sources to ensure responses are current and consistent.

Accessing AI Services

AI features in OTRS are provided through credit packages that are tailored to specific needs. The features are microservices in OTRS. They are easy to set up and grow with your support operations. This also helps improve agent performance.


Pricing is simple and scalable: each AI action—such as ticket classification—costs one credit.

Ideal Use Cases for AI in OTRS

AI in a software solution like OTRS is useful in a wide range of scenarios. It’s especially beneficial when the goal is to save time, enhance the user experience, or increase precision. In these cases, automation, pattern recognition, and language processing pay off significantly.

Here are some ideal scenarios:

  • High ticket volumes: Service teams benefit from automation and easier scalability.

  • Multilingual environments: AI supports the setup of international, multilingual customer support.

  • Onboarding and productivity: AI shortens ramp-up time and boosts employee efficiency.

  • Improving customer experience: AI provides tools to better understand and serve unhappy customers.

  • Cost reduction: For cost-conscious businesses, AI helps reduce cost per ticket.

Benefits of Using AI

Using a dedicated ticketing system is already a big step forward for many organizations. Adding focused AI functionality takes productivity to the next level and helps evolve service management even further.

Here are five key benefits:

#1: Faster Resolutions

A key strength of generative AI is speeding up processes and reducing routine workloads. In ticketing systems, this means automatic ticket classification, priority assignment, forwarding, and response generation.

All of this speeds up the process, enabling quicker—and often better—resolutions. It eases the agents’ workload and, more importantly, increases customer satisfaction.

#2: Streamlined Workflows

One of the biggest challenges at work is the overload of routine tasks. These tasks prevent employees from focusing on strategic or creative work. AI frees them from these constraints, allowing for more value-driven tasks.

Sometimes, workflow management is less about perfecting processes and more about enabling employees to follow them without disruption.

#3: Improved Accuracy

The real power of AI lies in combining human and machine strengths. For example, as an agent builds a relationship with a customer, AI gives helpful case information. This information comes from internal or external sources in real time.

Agents can then filter what’s useful for the specific case—resulting in highly relevant, well-structured answers. Enhanced responses with rich detail are received by customers.

#4: Better Relationship Management

Empathy is a human strength. However, AI is very good at analyzing large amounts of data. This includes finding sentiment in text.

Sentiment analysis helps agents detect emotions quickly and prioritize tickets that may indicate frustration or urgency.

AI also supports personalization. It recommends actions based on historical data and understands each customer’s specific preferences and expectations. Summary generation helps employees quickly gain an overview—something that would otherwise require significant time and effort.

#5: Multilingual Support

Language barriers are one of the biggest obstacles to fully understanding issues and crafting appropriate solutions. Even when people share a language, fluency may not be enough to communicate complex details effectively.

Integrated translation eliminates this barrier. It enables multilingual support, regardless of the customer’s original language. Agents view requests in their chosen language. The system automatically translates their replies into the ticket’s original language.

Conclusion: Smart AI Usage Drives Business Forward

AI models are a game changer in ticketing systems—helping save time, improve visibility, and deliver more personalized service. When used effectively, customers clearly feel the benefits of AI.

A core rule of process automation is to first optimize workflows, then automate them. Similarly, AI should be implemented gradually in areas where it delivers high value.

OTRS’ AI credits provide a clear and flexible way to use AI features. This makes it easy to meet increasing support needs.

About OTRS

OTRS (originally Open-Source Ticket Request System) is a service management suite. The suite contains an agent portal, admin dashboard and customer portal. In the agent portal, teams process tickets and requests from customers (internal or external). There are various ways in which this information, as well as customer and related data can be viewed. As the name implies, the admin dashboard allows system administrators to manage the system: Options are many, but include roles and groups, process automation, channel integration, and CMDB/database options. The third component, the customer portal, is much like a customizable webpage where information can be shared with customers and requests can be tracked on the customer side.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Restore vs. recover: Are they the same thing in SaaS data protection? (Spoiler: it’s complicated)

Restore and recover are often used interchangeably, but they shouldn’t be. While they’re closely related (and for good reason), their meanings vary across industries and tech. For SaaS data protection, they can be used to describe different stages of getting your data — and your business — back to an operational state. Understanding the difference in a SaaS data context is useful to building effective backup, restoration, and disaster recovery .   

In this blog, we’ll look into how we can consider the terms and help frame them with some context — and why planning for both restoration and recovery is essential for true resilience. 

Let’s get into some definitions.  

Restore: Bringing back data or systems 

Data restoration is the act of retrieving data or systems from a backup and returning it to a previously known good state. 

You restore when: 

  • A file has been accidentally deleted. 
  • A system becomes corrupted and needs to be rolled back. 
  • A virtual machine or database needs to be reinstated from a snapshot. 

Restoration focuses on bringing back what was lost, damaged, or compromised — whether that’s a single file or an entire application. 

Restore = the process of putting data or systems back into place. 

For a deeper technical definition, see . 

Recover: Bringing back business operations  

Recovery is about achieving the state where systems, data, and operations are functional again — not just technically restored, but ready for use. 

You have recovered when: 

  • Systems and services are running smoothly. 
  • Users have full access to the resources they need. 
  • Operations can resume without disruption. 

Recovery often involves multiple steps — validation, reconfiguration, testing — to ensure that everything works as expected after a disruption. 

Recover = reaching full operational readiness. 

 

 

Jakob Østergaard is CTO at Keepit, a leading cloud backup and recovery solution. He has an M.Sc. in Computer Science and Applied Mathematics and has worked with software development since 1998. The early career started on massively parallel supercomputers but soon transitioned to more reasonably sized equipment.

He has played a key role in the design and implementation of several cross platform networked software systems and is the principal designer of the object storage system that underlies the Keepit business. Today he leads the development, operations, and security organizations of the company.

He still writes code. Find Jakob on .

TermFocusExample
RestoreAct of retrieving dataRestoring a deleted document or email
RecoverState of full functionalityResuming operations after a server crash or end user access to data

Restore vs. recover: Why the distinction matters 

Restoration is often one part of a larger recovery process — and as such restoring alone doesn’t guarantee recovery. But, sometimes it does (yes, this is part of why recover and restore are often used interchangeably. 

In the common data loss case involving small amounts of data or files, your entire recovery is completed when clicking “restore in place.” It’s super easy, that is, if you have a backup. If you don’t have backup, it’s suddenly not that easy. In fact, it’s not even possible in that situation. 

Let’s consider these larger recovery processes, such as disaster recovery (DR). For example, in a Microsoft 365 environment, restoring data like SharePoint documents or Exchange mailboxes isn’t enough if Microsoft Entra ID (identity and access management) hasn’t been restored first. That’s because without Entra ID operational, users won’t be able to authenticate and access the restored data — meaning that even though the information is back, business operations are still stuck. You’ve effectively restored, but not yet recovered. You have your data, but you don’t have your business operations. 

In large (or complicated) , restoration must happen in a well-calibrated fashion by restoring the right systems, in the right order, to achieve recovery. And by the definition above, recovery is the state of the business being “back.” 

Of course, to make matters complicated, sometimes a restore is “simultaneously” a recovery. Typically, these are small, simple data loss scenarios. Let’s say, for instance, there’s a data loss event involving a single employee overwriting a key budget spreadsheet. With certain third-party backup solutions, a shareable link can be sent to this employee, who can then restore the spreadsheet in place with a couple of clicks. In this moment, the data has been restored, and the “business is back” to how it was. That’s a recovery. The flow is: Back up -> restore -> recover. 

Building a resilient strategy 

To build real resilience, you need to: 

  • Ensure you can restore individual files, systems, and services quickly.  
  • Design processes that lead to full recovery — not only data restoration.  
  • Test both restore procedures (for precision) and recovery plans (for complete readiness). 

Getting your data back is only part of the battle. Real recovery means regaining full operational strength — with systems restored, access reestablished, workflows intact, and confidence that your business can keep moving forward. 

Restoration and recovery work together 

In any data protection strategy, restoration and recovery are closely linked — but they aren’t the same thing. 

Restoring data is a necessary step, but true resilience is about fully recovering operations and services. Restoration brings the pieces back; recovery reconnects them, validates them, and ensures your business can move forward without missing a step. What good is having your data back if you can’t do anything with it? 

By planning for both, you strengthen your ability to bounce back from disruptions and keep your business running strong. 

 

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Best secure video conferencing tips

What is video conferencing software?

In simple terms, video conferencing software allows multiple users to hold live video and audio meetings online. This makes it feel like they’re having a face-to-face conversation, even though they’re not in the same room. It usually includes handy features like screen sharing, chat, and file sharing to ensure efficient, secure video conferencing. Video conferencing software is commonly used for work-related virtual meetings and online classes.

Cybersecurity risks in video conferencing

At the beginning of April, Zoom—one of the most popular video conferencing services—had a ton of security-related problems. Most of them revolved around poor encryption and data protection.

Zoom has always claimed to offer end-to-end encryption. However, this turned out to be far from the truth. The company only encrypts data in transit. To make matters worse, the developers have encryption keys that allow Zoom to decrypt its users’ data.

Another problem Zoom had to deal with was so prominent that it even had its own name: zoombombing. It’s a type of photobombing in which hackers and regular internet trolls infiltrate video conferences and post malicious links, pornographic images, or use obscene language.

A combination of weak encryption and bugs in some of Zoom’s apps led to the exposure of 500,000 users’ credentials, which ended up for sale on the dark web. It doesn’t help that Zoom is known to collect and sell users’ data to third parties without informing them.

Even though Zoom was quick to react and patch most of these vulnerabilities, new exploits will likely continue to arise in Zoom and other video chat services. Therefore, you should always keep tabs on the latest cybersecurity news. Otherwise, you risk your private conversations, passwords, and business secrets ending up online.

Secure video conferencing best practices

To ensure that your personal and business video calls are safeguarded, we suggest following these secure video conferencing tips:

  1. Make sure to install the latest version of the app the moment it’s available. Updates include security patches that are vital if you want to stay safe online.

  2. Never share the meeting link or ID publicly—send it only to the people participating in the video call. If your app allows it, set a password for your meeting to maintain access control. Need help with creating a strong password? Try our password generator.

  3. Take advantage of the other features offered by your video conference app. Some have a virtual waiting room where you can approve each person individually. Others allow you to disable participants’ cameras and microphones, or even kick them out. Learn about all the features of your secure video conferencing platform, as well as how to use them to stay safe.

  4. Never accept video conference invites from people you don’t know. They might be scams or attempts at catfishing, so it’s best to stay away from people you don’t know.

  5. Always be mindful of what you say and show during a video call. Remember, everything can be recorded, and you never know where it will end up. So, avoid sharing any information that’s too personal or sensitive. Look for safer methods to discuss business secrets.

  6. Even though many video conferencing apps offer encrypted video calls, you should still take additional safety measures and do your own research. Make sure that the apps don’t have any known vulnerabilities, the encryption protocols they use are bulletproof, and your own device is not infected with malware. If someone has control over your computer or phone, they can listen in on your calls, even if they are end-to-end encrypted. Scan your devices regularly to make sure they are safe to use.

  7. Be careful with apps you have never heard of. Only download them from official app stores, and always check whether the developer is trustworthy before installing. Hackers are known to create fake versions of popular, secure video conferencing platforms that infect your phone with malware.

  8. The usage of various video conferencing tools is skyrocketing, and cybercriminals have their eyes set on them. Therefore, never reuse passwords, change them regularly, and come up with strong, complex passwords for your most sensitive accounts. If you need help remembering them, use a password manager to safely store them all.

  9. Use a HIPAA-compliant video conferencing platform to ensure the safe handling of sensitive health information. Considering that sometimes employees need to share their health data with people in other departments (e.g., HR), you should create a safe virtual environment where they can do that without worrying about security.

  10. Use a HIPAA-compliant video conferencing platform to ensure the safe handling of sensitive health information. Considering that sometimes employees need to share their health data with people in other departments (e.g. HR), you should create a safe virtual environment where they can do that without worrying about security, complying with HIPAA requirements.

  11. Use only strong passwords—combinations of letters, numbers, and symbols that are complex and unique enough to prevent cybercriminals or malicious machines from identifying them. You should also implement two-factor authentication to increase the level of cybersecurity at your company. With two-factor authentication, employees must provide more than just their password to log in to your company applications or access company data. This means, for example, that they will be sent a verification code via email or SMS, or asked to confirm their identity using biometrics.

  12. Limit screen sharing to trusted people only, and be mindful about sharing individual web pages or applications rather than your entire screen to ensure that no sensitive information is shown.

CISA guide for securing video conferencing

The Cybersecurity and Infrastructure Security Agency (CISA), a US Department of Homeland Security agency, has released a guide on how to carry out video conferences in a secure way. In essence, CISA has come up with 4 tips that, when followed, can help you safely connect with others over a video chat. They are:

Make your network secure—set up your router to use the WPA2 or WPA3 wireless encryption standard, and create strong passwords for both the router and your Wi-Fi network.

Control access to your video conferencing software—create strict policies, processes, and procedures so that only the right people can use your video conferencing software.

Create a secure environment for file and screen sharing—establish secure rules regarding the types of files that can be shared during a video conference. Also, if you plan to record the meeting, notify all participants.

Use only the latest versions of your applications—enable automatic updates and follow a patch management policy to make sure your applications are up-to-date and as secure as they can be.

Most secure video conferencing software

Below, we have compiled a list of what we consider to be the best secure video conferencing tools available on the market today. They are:

  • ZoHo Meeting—a secure video conferencing platform that not only provides all the communication features needed to connect with other team members. It encrypts all audio, video, and screen sharing to make sure that all information—both personal and business—is safe and sound. Using ZoHo Meeting, you can easily record your meetings and share them with the people you trust. Plus, as a host, you can “lock” the meetings so that they are fully private. This gives you full control over who can join the meeting, and you can add/remove participants at any time.

  • Microsoft Teams—probably one of the most popular video conferencing tools available on the market, Microsoft Teams is a secure video conferencing service that comes with a wide range of features to help you easily set up and carry out video conferences. Not only does it allow you to connect with up to 10,000 people at once for a live event, but it also enables you to go from a group chat to a video conference with the press of just one button.

  • Pexip—a video conferencing tool that prioritizes security. With Pexip, you can set up PIN-protected virtual meeting rooms that allow you to keep communication private and control meeting access. As a host, you can see all participants taking part in the meeting and thus be sure that no eavesdropping is attempted. If you are looking for a secure video conferencing service, you should give Pexip a go.

  • Google Meet—developed by Google services, this secure video conferencing tool allows users to host and join virtual meetings. It offers features like screen sharing, real-time captions, and integration with Google Workspace tools, making it ideal for both personal and professional use. Users can engage in encrypted video conferencing through a web browser or mobile app without being required to install any additional software.

  • Zoom—another highly popular video conferencing platform that lets users set up virtual meetings, webinars, and online events. While it had its fair share of security issues in the past, it offers features like screen sharing, breakout rooms, and virtual backgrounds, providing functionality for both personal and professional needs. By allowing users to join meetings via a web browser, desktop application, or mobile app, Zoom makes video conferencing an enjoyable experience anywhere, anytime.

Bottom line

Follow the best practices outlined in this article to ensure secure video conferencing, both for private and business environments. Likewise, review all your options before choosing one of the secure video conferencing tools for yourself or your team. Lastly, use NordPass to store passwords for these platforms or generate them for meeting access with our password generator.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Guardz Wins 2025 MSP Today Product of the Year Award Celebrating Innovation and Impact for MSPs and SMB Security

We’re thrilled to announce that Guardz has been named a 2025 MSP Today Product of the Year Award winner for our AI-Powered Unified Detection and Response Platform. This marks the third consecutive year we’ve received this honor and it’s a powerful validation of our mission to empower Managed Service Providers (MSPs) in protecting the small and medium-sized businesses that keep our economy moving.

Why This Award Matters

Today’s MSPs face an overwhelming challenge managing up to 10 different cybersecurity tools while defending clients against an ever-growing wave of cyberattacks. This fragmented approach slows response times, increases costs, and leaves businesses exposed. At Guardz, we set out to change that by building a truly unified, AI-native platform that streamlines cybersecurity across identities, endpoints, email, cloud, and data all managed from a single engine designed for MSPs.

Winning the MSP Today Product of the Year Award isn’t just about recognition. It’s about the real-world impact we’re making together with our partners. This award celebrates solutions that reshape the managed services landscape and we believe Guardz is setting a new standard for innovation, performance, and measurable results.

How Guardz Helps MSPs Succeed

Our platform combines AI-driven automation with expert-led Managed Detection and Response (MDR), delivering 24/7 protection that connects the dots across every attack vector. From seamless SentinelOne EDR integration to real-time monitoring of Microsoft 365 and Google Workspace, Guardz gives MSPs the tools they need to detect threats faster, respond smarter, and reduce manual work.

By integrating identity threat detection and response (ITDR), email protection, and user awareness training, we empower MSPs to stop attacks early before they turn into costly breaches. Our goal is to make cybersecurity a growth engine for MSPs, unlocking new revenue opportunities while keeping SMBs safer than ever.

A Message from Our CEO

“As cyber threats grow more dynamic and damaging, we remain laser-focused on delivering unified, AI-powered solutions that meet MSPs’ evolving needs,” said Dor Eisner, CEO and Co-founder of Guardz. “This award is a testament to our team’s dedication and to the incredible work of our partners who are on the front lines defending SMBs every day.”

Thank You to the MSP Community

To all our MSP partners and customers, thank you for trusting us as your cybersecurity ally. Your feedback and collaboration fuel our innovation and keep us pushing the boundaries of what’s possible.

If you’re an MSP still relying on disconnected security tools we see you and we’re here to help you change the game. Let’s continue building the future of MSP security together.

Start Free Trial

About Guardz
Guardz is on a mission to create a safer digital world by empowering Managed Service Providers (MSPs). Their goal is to proactively secure and insure Small and Medium Enterprises (SMEs) against ever-evolving threats while simultaneously creating new revenue streams, all on one unified platform.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Cloudbric Surpasses 1,100 Global Enterprise Clients with AWS Security Solutions

Penta Security AWS Cloudbric Managed Rules

Penta Security’s Cloudbric Surpasses 1,100 Global Enterprise Customers on AWS Marketplace

Flagship ‘Managed Rules’ solution drives 156% year-over-year global revenue growth, validating worldwide demand for simplified, high-performance web security.

Penta Security today announced that its cloud security platform, Cloudbric, has surpassed 1,100 global enterprise customers, driven by the remarkable international success of its Cloudbric Managed Rules for AWS WAF. This milestone highlights the soaring demand for security solutions that simplify the complexity of cloud environments.

Cloudbric Managed Rules removes the need for advanced cybersecurity knowledge and dedicated staff to manually configure AWS Web Application Firewall (WAF) rules. Instead, enterprises can subscribe to pre-configured, high-performance rule groups directly from the AWS Marketplace, achieving robust web protection with minimal effort.

This approach has resonated globally, with 98% of Cloudbric Managed Rules customers based outside of Korea. The solution’s effectiveness is further validated by the Tolly Group, a renowned IT benchmarking firm, which found its detection accuracy to be up to 40 percentage points higher than competing solutions.

“Since launching Cloudbric as Korea’s first Security-as-a-Service (SECaaS) platform in 2015, our goal has always been to make enterprise-grade security accessible,” said a spokesperson for Penta Security. “Surpassing 1,100 global clients for our AWS solution proves that businesses worldwide are looking for effective, easy-to-deploy security. We are proud to deliver that.”

As an official AWS Partner, Penta Security is committed to providing borderless, trusted SaaS security that scales across markets and industries.

About Penta Security
Penta Security takes a holistic approach to cover all the bases for information security. The company has worked and is constantly working to ensure the safety of its customers behind the scenes through the wide range of IT-security offerings. As a result, with its headquarters in Korea, the company has expanded globally as a market share leader in the Asia-Pacific region.

As one of the first to make headway into information security in Korea, Penta Security has developed a wide range of fundamental technologies. Linking science, engineering, and management together to expand our technological capacity, we then make our critical decisions from a technological standpoint.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Cracking the Tunnel: How to Detect and Defend Against DNS Tunneling in 2025

Given the threat posed by DNS tunneling, organizations should implement measures to detect and block such channels. Detection usually involves looking for anomalies in DNS traffic patterns: unusually long domain names, often a giveaway of encoded data, high volumes of DNS queries to domains that aren’t commonly accessed, a lot of TXT record requests, or consistent DNS traffic to an external domain with no associated web traffic. Security teams can use specialized tools or DNS logs to spot these indicators. For example, if a single internal host is making thousands of DNS queries to an obscure domain every hour, that’s a red flag. Some intrusion detection systems and DNS security solutions apply machine learning to identify the statistical footprints of DNS tunneling. Additionally, threat intelligence can help, known domains or signatures of popular tunneling tools can be blacklisted.

Indicators of DNS Tunneling. Behavioral Red Flags

To detect tunneling, look for anomalies that deviate from legitimate DNS usage patterns:
– Excessively Long Domain Names. Encoded data results in very long subdomains suspicious if consistently >100 characters.
– High Query Volume. Thousands of queries per hour from a single host, especially to uncommon domains.
– Frequent TXT Record Lookups. Abnormal reliance on TXT or NULL records often indicates tunneling protocols.
– Repetitive Requests to a Single Domain. Persistent communication to a domain with no corresponding HTTP/S activity.
– Unusual Query Timing. Regular, evenly spaced DNS traffic (e.g., every 3 seconds) may signal automation.

A specific solution in this space is SafeDNS. SafeDNS can act as an organization’s DNS resolver with built-in intelligence to detect malicious usage. For instance, SafeDNS can intercept all DNS queries made by clients and block disallowed or suspicious queries. Essentially, SafeDNS can recognize when DNS is being used as a tunnel and prevent those queries from reaching the attacker’s server. This is performed through a combination of methods: recognizing domain names generated by tools, payload signatures, or unusual query behavior indicative of tunneling.

Detection Techniques

1. DNS Log Analysis
Tools like SIEM or SafeDNS can analyze logs for tunneling patterns. Look for:
– Entropy in subdomain strings
– Uniform query sizes
– Irregular TLD usage
– Persistent use of rare record types

2. Machine Learning & Behavioral Analytics
Advanced DNS firewalls like SafeDNS use ML models to flag tunneling based on:
– Frequency analysis
– Markov chain models for domain randomness
– User/device behavior correlation

3. Threat Intelligence Correlation
Compare against updated threat feeds for:
– Known tunneling domains
– IPs of public C2 servers
– DNS signatures from tools like Sliver, dnstt, or Chisel

It’s worth noting that as of this writing, SafeDNS’s detection capabilities cover many, but not all, known DNS tunneling tools. Our solution currently is able to detect and block 3 out of the 7 common tools we listed earlier, for example, it may successfully catch Iodine, dnscat2, and DNS2TCP traffic based on known patterns. The remaining tools use techniques that evade basic detection or simply haven’t had signatures created yet. However, SafeDNS is actively improving its coverage, full coverage of all 7 listed tools is planned by August. This means our team is developing updates to our filtering algorithms such that by August, it should be able to identify traffic from Iodine, DNSStager, dnscat2, Sliver, dnstt, Heyoka, and Chisel and similar programs. With this enhanced coverage, organizations using SafeDNS will have an extra layer of defense: even if an attacker tries different DNS tunneling utilities, the DNS security service will flag and block those queries, cutting off the channel.

Of course, no single solution is foolproof. Attackers constantly modify their tactics to avoid detection. Some may implement custom tunneling that doesn’t match known signatures, or they may tunnel very slowly to fly under statistical anomaly thresholds. Therefore, a defense-in-depth approach is recommended. Combine DNS-specific protections, like SafeDNS, with network monitoring, endpoint security, and user behavior analytics. Regularly auditing DNS logs can also uncover a dormant tunnel. 

In closing, awareness is key. Many organizations are now waking up to DNS-based threats and are starting to treat DNS traffic with the same vigilance as they treat web or email traffic. Solutions like SafeDNS make it practical to apply that vigilance in real time, shutting down DNS tunnels before they cause harm. By August, with SafeDNS achieving full coverage of known tunneling tools, companies employing it will significantly harden their networks against DNS tunneling attacks. Until then, it’s imperative to use the strategies discussed, monitor DNS, restrict it, and use intelligent DNS security services to keep this covert threat in check.




About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.