Skip to content

GREYCORTEX Mendel 5.0: A Smarter Way to Prioritise IT/OT Network Risk

Security teams rarely struggle to collect enough alerts. The harder job is deciding which device deserves attention first, understanding what it is communicating, and turning that evidence into an action that does not disrupt business operations.

That challenge gets more complicated in mixed IT and operational technology (OT) environments. Servers, workstations, cameras, printers, medical devices and industrial controllers do not all behave alike, and many cannot be treated like a standard employee laptop. Network visibility becomes an important part of the picture.

Start with the device that is becoming risky

GREYCORTEX Mendel 5.0 introduces a device risk score based on security events and how unusual a device’s behaviour is compared with other devices on the same network. The score is tracked over time, so analysts can see whether a host is becoming riskier rather than treating every alert as an isolated event.

That historical view can help a small security team prioritise investigation. A device whose score is climbing may deserve a closer look than a host that has generated the same low-level noise for weeks. It is still a triage signal, not an automatic incident verdict: teams should validate the score against asset criticality, maintenance windows and what the system is meant to do.

Follow the traffic to understand the context

Once a device looks unusual, the next question is what it is talking to. Mendel 5.0’s Traffic Flow Map puts a host and its significant communication partners into one view. Analysts can inspect connections using measures such as flows, packets, data volume, retransmissions and unreplied flows, then move from one device to another without leaving the map.

For an IT/OT environment, that context matters. A workstation suddenly communicating with an unfamiliar server is one kind of investigation; a controller exchanging traffic with an approved engineering station during a planned maintenance window is another. A visual path through the connections helps the analyst ask better questions before escalating or blocking traffic.

Use AI assistance to speed up the first pass

Mendel 5.0 also adds an AI Assistant that explains devices, IP addresses and security events in plain language. GREYCORTEX says it can identify likely device roles, assess external IP addresses, explain an event, estimate whether it may be a false positive and suggest investigation steps in priority order.

That can make technical findings easier to hand over to an operations colleague or manager who does not spend all day reading network telemetry. Treat the assistant as decision support, though. Confirm its interpretation with packet evidence, asset records and the people responsible for the affected process—especially before taking action on production OT equipment.

Why this is relevant to Singapore operators

Singapore’s Cyber Security Agency has been putting greater emphasis on visibility and readiness for critical infrastructure. In a July 2026 speech, Minister Josephine Teo described the priorities as “lock down, find first, and fix fast”, and highlighted the difficulty of seeing what is happening inside many OT environments. CSA’s updated Cybersecurity Code of Practice for Critical Information Infrastructure was issued on 29 July 2026.

For organisations that operate or support essential services, the practical takeaway is straightforward: do not assess network detection only by the number of alerts it generates. Ask whether it helps your team discover unfamiliar assets, understand communications between connected systems, investigate unusual behaviour and coordinate a safe response. The same discipline is useful for manufacturers, logistics operators, healthcare groups and other businesses with connected facilities, even when they are not designated CII owners.

A practical evaluation checklist

  • Coverage: Confirm which network segments, sites, VLANs and OT zones can be monitored, and identify any blind spots.
  • Asset context: Check how the platform identifies devices and how teams can correct or enrich asset details.
  • Prioritisation: Ask how risk scores are calculated, what changes them and how analysts can review score history.
  • Investigation: Test whether traffic maps help analysts trace a device’s communication path and distinguish normal operational traffic from suspicious activity.
  • Response: Agree who can approve containment or blocking actions, and how IT and OT teams will coordinate during an incident.
  • Deployment and data handling: GREYCORTEX says Mendel runs on-premises, including in fully air-gapped deployments; its AI processing runs within EU infrastructure and can be disabled. Singapore buyers should validate telemetry flows, data handling and AI settings against internal policy before deployment.

Make the investigation workflow the measure of success

A network detection platform should do more than add another console to the security stack. The useful test is whether it helps an analyst move from “something looks odd” to “this is the device, this is its communication path, this is why it matters, and this is the next safe step”.

Mendel 5.0’s risk scoring, Traffic Flow Map and AI Assistant are designed around that workflow. Singapore IT and OT teams evaluating the platform should test those capabilities with representative traffic and real operational scenarios, then measure investigation time, false-positive handling and the quality of evidence they can hand to incident responders.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Keepit’s 2026 Data Report: Why SaaS Recovery Testing Must Start with Identity

Most organisations have a plan for getting a deleted document or mailbox back. Fewer have rehearsed what happens when the identity service that controls access to those applications is the thing that fails.

That gap matters as Singapore businesses move more day-to-day work into Microsoft 365, Google Workspace, Salesforce and other SaaS platforms. A backup can contain the data, but recovery still depends on people being able to authenticate, reach administration tools and restore the right configuration in the right order.

Keepit’s Annual Data Report 2026 offers a useful prompt for reviewing that dependency. The report is based on aggregated, anonymised backup and restore activity from Keepit’s production environment between 1 January and 31 December 2025. It is operational data rather than a survey, but it reflects activity within Keepit’s own customer environment and should not be read as a universal industry benchmark.

Three findings worth taking seriously

Keepit highlights three patterns in the report:

  • Bulk recovery is being tested: nine in ten enterprises in the dataset had validated bulk recovery. That is an encouraging sign that many organisations are practising larger-scale recovery, not just assuming it will work.
  • Identity recovery gets less attention: identity systems were tested around four times less often than productivity systems. That is a significant gap when identity is the control plane for access to other SaaS applications.
  • Most restores are small and targeted: 90% of restores were single-file downloads. Everyday recovery is often about putting one item back quickly, rather than rebuilding an entire environment.

The takeaway is not that every business needs to run a full disaster-recovery exercise every week. It is that recovery testing should reflect the incidents teams are likely to face, while also covering the less frequent failures that could lock administrators out of everything else.

Why identity can become the recovery bottleneck

Identity platforms manage much more than usernames and passwords. They can control single sign-on, multifactor authentication methods, conditional access policies, group membership, privileged roles, application registrations and service principals used by integrations and automation.

If a user deletes a file, an administrator may be able to restore that file while the rest of the tenant keeps working. If a privileged identity is compromised, a conditional access policy is changed incorrectly, or a critical application registration disappears, the impact can spread across multiple services.

There is also a recovery dependency that is easy to miss: administrators may need the identity platform to sign in to the backup console, ticketing system, documentation repository or cloud management portal. If the identity service is unavailable or untrusted, a recovery plan that starts with “log in and restore” may not be usable.

That is why identity should be treated as part of the recovery sequence, not simply as another SaaS workload to protect.

Where Keepit’s product direction fits

Keepit’s product story is increasingly framed around protecting a trusted copy of business data that can be used for recovery and, over time, as a governed foundation for AI. In August 2026, the company announced AI Truth Cloud, organised around five pillars: Protect, Observe, Recover, Prove and Integrate.

Keepit described AI Connector Backup, its Model Context Protocol platform and AI Safe Room as core capabilities forming the immediate roadmap foundation. The announcement discusses protection for AI-related assets such as agent configurations, skills, projects and models, as well as ways to connect AI workflows to managed data. Buyers should confirm which of these capabilities are generally available, which are in development, and what is included in their specific subscription before treating them as deployable features.

Keepit also publishes protection services for business applications including Microsoft 365, Microsoft Entra ID, Salesforce, Google Workspace, Jira, Confluence and Okta. For a Singapore organisation, the practical question is whether the applications and data objects it relies on are covered at the level needed for a real recovery scenario.

A practical recovery checklist for Singapore IT teams

  1. Map the dependencies. List the SaaS services that support critical business processes, then map the identity provider, SSO configuration, DNS, administrator accounts and integrations each one depends on. Include the systems used to access backup and recovery tools.
  2. Test more than file restores. Keep granular tests for deleted files, messages and records, but add controlled exercises for bulk recovery and identity configuration. Include representative users, groups, privileged roles, authentication methods, conditional access policies and application registrations.
  3. Prove you can get in during an identity incident. Validate break-glass accounts, offline runbooks and emergency access to backup tooling. Use credentials and administration paths that do not rely entirely on the identity service being tested.
  4. Keep the recovery copy outside the production blast radius. Ask how backup data is isolated, whether it is immutable, who can administer or delete it, and whether production administrators can shorten retention or alter recovery points. Separate credentials and administrative control are as important as the storage location.
  5. Measure recovery against business needs. Set realistic recovery time and recovery point objectives for each application. During exercises, record how long it takes to locate the right restore point, recover the data, validate permissions and dependencies, and return the service to users.
  6. Review data location and handling. Ask where backup data is stored, who can access it for support, whether subprocessors are involved, how long data is retained, and how deletion and incident notification are handled. Singapore organisations should assess any overseas transfer of personal data against the PDPA’s Transfer Limitation Obligation, and ensure reasonable protection and appropriate retention practices. A backup product does not by itself make an organisation PDPA-compliant.
  7. Include AI-related data in the inventory. If teams use AI assistants or agents connected to SaaS applications, identify the configurations, prompts, project data, permissions and integration records that would be difficult to recreate. Ask vendors what is protected today and what remains on the roadmap.

Residency is not the same as recoverability

Keepit’s October 2026 writing on cloud sovereignty makes a useful distinction: knowing where data is stored and who controls the provider is not the same as knowing whether the organisation can restore data after an outage, compromise or accidental deletion. Its discussion of the proposed EU Cloud and AI Development Act is about a European policy proposal, not a Singapore legal requirement. The broader procurement lesson still applies here: evaluate both data control and the independence of the recovery path.

For Singapore buyers, that means asking not only where a backup resides, but also whether it is separately administered, protected from production credentials, recoverable if the primary identity service is down, and handled in line with the organisation’s own privacy and retention obligations.

Turn backup confidence into tested recovery

Keepit’s report points to a straightforward improvement: do not let identity recovery remain the part of the SaaS plan that nobody practises. Start with one critical workload, test a small set of identity objects in a controlled environment, and then run an exercise that follows the full sequence from emergency access through to application recovery.

That kind of rehearsal gives IT leaders something more useful than a green backup dashboard: evidence that people, access paths and recovery procedures can work together when the business needs them most.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

JumpCloud Adds Continuous Compliance Controls for AI Agents: What IT Teams Should Know

AI agents are starting to do more than answer questions. They can trigger workflows, access SaaS applications, retrieve business data and carry out tasks on behalf of employees. That creates a new identity-management problem: the organisation needs to know which agents exist, what they can access, who is accountable for them and what they actually did.

On 28 October 2026, JumpCloud announced new capabilities intended to bring users, devices and AI agents into a more continuous compliance workflow. The update is relevant to Singapore IT teams that want to expand automation without losing control of access or audit evidence.

What JumpCloud announced

JumpCloud says the new capabilities combine several controls in its platform:

  • Workflows automation to automate identity and device lifecycle processes, offboarding and policy remediation.
  • Automated compliance reporting that generates real-time audit reports and continuous logs mapped to supported regulatory frameworks.
  • Agentic IAM for visibility and lifecycle tracking across AI agents and other non-human identities.
  • Risk detection to flag risky sign-ins, non-human behaviour and unapproved access changes.
  • Continuous audit trails that link human and non-human actions to a verified identity.
  • Device trust that can block unmanaged or unhealthy devices from accessing company data through supported Conditional Access Policies.

JumpCloud also says privileged access management for administrators and agents, using isolated identities and time-boxed credentials, is planned for December 2026. Treat that as a roadmap item rather than an available feature until the vendor confirms release.

Why agent identity needs the same discipline as employee identity

A departing employee is usually removed from the directory and their application access is reviewed. An AI agent may be less visible: it could have been created by a team for a narrow task, connected to an API or MCP server, and then left running after the original project has changed.

If that agent has no clear owner, broad permissions or a long-lived credential, the organisation can struggle to explain its activity or revoke access quickly. JumpCloud’s September 2026 Agentic IAM announcement describes treating agents as identities, associating them with human ownership, tracking their actions and applying privileged-access controls. The October update adds a stronger emphasis on continuous evidence and compliance workflows.

What Singapore IT buyers should check

  1. Build an identity inventory. Include employees, contractors, service accounts, automation identities and AI agents. Record the business purpose and accountable owner for each one.
  2. Set access boundaries. Give agents only the applications, data and actions required for their task. Separate read, write and administrative permissions wherever possible.
  3. Connect lifecycle changes. Test what happens when an employee changes role or leaves, a device becomes non-compliant, or an agent is retired. Access should not remain active simply because a workflow was forgotten.
  4. Keep evidence useful. Check whether audit records identify the human or agent, the device context, the action, the time and the affected resource. Confirm that reports can be exported and retained in line with your audit process.
  5. Protect personal data. Singapore’s PDPA Protection Obligation requires organisations to make reasonable security arrangements for personal data in their possession or control. Identity controls and audit trails can support that work, but they do not by themselves establish PDPA compliance.
  6. Keep a human checkpoint. Decide which actions—such as changing payment details, exporting sensitive records or modifying production systems—must be approved by a person rather than left to an autonomous agent.

Roll out in stages, not all at once

Start with a small set of high-value applications and the agents already interacting with them. Identify owners, review permissions, test offboarding and check whether the reporting gives your security and compliance teams evidence they can actually use. Then expand to more applications and departments.

During a proof of concept, include HR, IT operations, security, application owners and the data protection function. They will see different parts of the lifecycle, and the process will fail if agent creation is easy but ownership, review and retirement are nobody’s job.

The outcome to aim for

Continuous compliance is not simply a dashboard that says a control is enabled. It is the ability to show that access is appropriate today, that changes are handled consistently and that important actions can be traced to an accountable identity.

JumpCloud’s October update points towards a unified approach across people, devices and AI agents. Singapore organisations evaluating it should focus on the practical details: supported integrations, feature availability, audit-log depth, conditional-access coverage and how quickly an agent’s access can be restricted when something changes.

About JumpCloud
At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Graylog 7.2.2 Arrives with Security Fixes: An Upgrade Checklist for Teams

Logs are only useful when teams can trust the platform collecting, searching and routing them. A dropped output, a broken pipeline or an access-control weakness can turn a central view of the environment into a source of uncertainty just when an incident needs investigating.

Graylog’s 7.2.2 maintenance release, published on 4 November 2026, is a timely reason for Singapore IT and security teams to review their upgrade plans. The core release includes security hardening and a collection of fixes, while the matching Enterprise 7.2.2 update addresses several operational issues, including Kafka output handling and archive deletion.

What changed in Graylog 7.2.2

Graylog’s core changelog lists a mix of reliability fixes and security updates. The security items are particularly relevant to administrators:

  • Raw message parsing is more tightly permissioned. The endpoint now requires permission to create inputs or pipeline rules, helping prevent server-file probing through that endpoint.
  • Password-change handling has been hardened. This is a security-focused improvement to an important account-management path.
  • Dependencies have been updated. The release updates Jackson to 2.22.4 to address CVE-2026-110879, updates lz4-java to 1.12.1, and moves to OkHttp 5.5.1, which adds a TLS blocklist for eight compromised eMudhra intermediate CA certificates.

The same core release also fixes issues involving lookup-table default values, GeoIP database downloads across regions, event-definition pages, PDF report rendering and other parts of the administration experience. These are maintenance improvements rather than a headline new feature set.

For Enterprise users, the 7.2.2 changelog includes a fix intended to prevent Kafka output messages from being dropped when authentication, TLS or authorisation fails. It also changes archive deletion so that archives are removed through the backend on which they were written, addressing failures when archives span multiple backends. Other fixes cover OIDC login callbacks, report-generation warnings and log-view sorting.

Why this matters to Singapore IT teams

A logging or SIEM platform often sits across identity systems, endpoints, cloud services, firewalls, business applications and infrastructure. Its reliability affects more than the security team: infrastructure operations, audit preparation and incident response all depend on accurate, searchable records.

The Kafka fix is a useful example. If an output encounters an authentication or TLS problem, administrators need clear failure handling and confidence that messages are not silently lost. Likewise, archive operations need to behave predictably so that retained evidence can be managed and retrieved when required.

Logs may also contain usernames, email addresses, IP addresses, device identifiers and other information that can relate to individuals. Singapore organisations should treat that data with appropriate care. The PDPA includes protection and retention-limitation obligations, so access controls, retention schedules and any overseas processing or transfer arrangements should be part of the logging design.

A practical upgrade checklist

  1. Confirm exactly what you run. Record whether the environment uses Graylog Open, Enterprise or Security, the current server and Data Node versions, and the versions of inputs, collectors and integrations. Do not assume the core and Enterprise changelogs describe identical changes.
  2. Read the full release notes and upgrade guidance. Check the supported upgrade path, dependency requirements and any product-specific instructions before scheduling a change.
  3. Back up the right components. Confirm that configuration, metadata and required log data or archives can be restored. Test the recovery process rather than relying on a backup job that has never been validated.
  4. Test the critical paths in staging. Exercise authentication and SSO, inputs, pipelines, lookup tables, event definitions, dashboards, reports, Kafka outputs and archive workflows. Include failure tests for expired credentials, rejected TLS connections and unavailable destinations.
  5. Review permissions and secrets. Check who can create inputs and pipeline rules, who can administer accounts, and how service credentials and certificates are stored and rotated.
  6. Validate after the upgrade. Monitor input health, processing queues, output failures, Data Node and search-cluster health, index growth, archive jobs and alert delivery. Compare event volumes with the pre-upgrade baseline.

Keep log data useful — and proportionate

More data is not automatically better. Agree which systems must be logged, which fields are necessary for detection and investigations, who can search sensitive records, and how long each class of data should be kept. Where logs contain personal data, align retention with a defined operational or legal purpose instead of keeping everything indefinitely.

For teams operating across Singapore and other markets, also map where logs are stored, which support teams or service providers can access them, and whether cross-border transfers are involved. These are governance and architecture decisions for the organisation; upgrading Graylog does not settle them on its own.

Use the release as a maintenance checkpoint

Graylog 7.2.2 is best approached as a security and reliability maintenance update, not as a promise of a new capability. Review the fixes against your own deployment, test the integrations that matter most, and schedule the change with a rollback plan and clear owners.

That disciplined approach helps Singapore teams keep log management dependable while reducing avoidable risk in the systems that support monitoring, investigations and day-to-day IT operations.

About Graylog
At Graylog, our vision is a secure digital world where organizations of all sizes can effectively guard against cyber threats. We’re committed to turning this vision into reality by providing Threat Detection & Response that sets the standard for excellence. Our cloud-native architecture delivers SIEM, API Security, and Enterprise Log Management solutions that are not just efficient and effective—whether hosted by us, on-premises, or in your cloud—but also deliver a fantastic Analyst Experience at the lowest total cost of ownership. We aim to equip security analysts with the best tools for the job, empowering every organization to stand resilient in the ever-evolving cybersecurity landscape.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Guardz Brings Prisma Browser Protection to MSPs: What Buyers Should Check

For many employees, the browser is the real front door to work. It is where they open Microsoft 365, Google Workspace, finance systems, customer records and increasingly, generative AI tools. That makes browser sessions, extensions and file transfers an attractive target for attackers — even when endpoint and email controls are already in place.

Guardz’s latest move puts that risk in the spotlight. The company has announced an integration of Palo Alto Networks’ Prisma Browser for Business into its MSP-focused security platform. For Singapore service providers and IT leaders, the announcement is worth watching, but there is an important availability detail to check before planning a rollout.

What Guardz has announced

On 2 November 2026, Guardz announced that Prisma Browser for Business is joining its platform, connecting browser protection with email, identity, endpoint, data and user-risk signals. The aim is to help MSPs investigate related activity as one incident instead of treating a suspicious web page, email and endpoint alert as unrelated events.

The announced capabilities include:

  • Phishing and session-theft protection: inline machine-learning detection and Advanced URL Filtering to help block malicious pages, including fake sign-in pages and attempts to steal active session tokens.
  • File and extension controls: WildFire file analysis, scanning of browser uploads and downloads, and identification of risky extensions.
  • Connected investigations: browser events can be correlated with the original email, Microsoft 365 activity and endpoint telemetry to give analysts a wider view of activity around one identity.
  • AI usage controls: technicians can apply client-specific restrictions on copying, pasting, uploading and downloading content by website or category. A per-client AI usage report is also intended to show which tools are being used.

Guardz says deployment can be managed through the platform and rolled out using RMM or MDM. The announcement describes an extension for existing Chrome and Edge profiles, with a standalone browser option for Linux and other situations where protection should not depend on the browser already installed.

Why the browser deserves its own security review

Traditional security tools still matter, but each sees a different part of the story. Email security may identify the lure. Identity monitoring may spot an unusual sign-in. Endpoint detection may see a process launch. None of those views automatically explains what happened inside the browser session that connected them.

That gap matters when an attacker steals a session token after a user completes MFA, abuses a malicious extension, or tricks someone into pasting a command from a web page. It also matters when employees move business information into unapproved AI services through normal browser actions.

For MSPs supporting several Singapore customers, the operational challenge is multiplied across tenants. A useful browser-security layer should make it easier to connect a web event to the user, device, application and data involved — without forcing technicians to jump between disconnected consoles for every investigation.

What Singapore MSPs should confirm first

Product availability: Guardz’s 2 November launch article says the browser-security offering is currently available to MSPs in the United States and directs organisations elsewhere to contact their local Guardz team. Singapore partners should therefore confirm local availability, licensing, support arrangements and any rollout prerequisites before quoting or promising the capability.

Coverage and compatibility: Ask which browsers, operating systems and device-management methods are supported in the relevant market. Confirm how unmanaged devices, personal profiles, remote workers and shared workstations are handled. A browser control that only covers part of the fleet can leave an awkward blind spot.

Policy detail: Check exactly what administrators can restrict — such as uploads, downloads, copy and paste, extension installation or access to selected AI sites. Understand whether policies can differ by customer, department, device and sensitivity level, and how exceptions are approved.

Investigation workflow: Ask to see a realistic demonstration that links a browser event with email, identity and endpoint evidence. Confirm what analysts can search, what gets retained, how incidents are escalated and which response actions are automated versus handled by a human analyst.

Privacy and data handling: Browser telemetry can reveal employee activity and may include customer or employee personal data. Singapore organisations should document the purpose of monitoring, restrict access to investigation data, set sensible retention periods and assess any overseas processing or transfers against their PDPA responsibilities. These are governance checks for the buyer, not a claim that any product by itself makes an organisation compliant.

Make it a layer, not a silver bullet

Browser protection should complement — not replace — endpoint detection, identity controls, email security, secure configuration and user awareness. A pilot is a sensible way to test whether the extra visibility improves detection and response without disrupting everyday work.

Start with a small group that uses business-critical SaaS applications and approved AI tools. Measure deployment effort, blocked threats, false positives, policy exceptions and the time needed to investigate a test scenario. Then decide whether the operational benefit justifies a wider rollout.

The direction is clear: as more business activity moves into browser sessions, security teams need visibility at that layer too. For Singapore MSPs, the next step is to validate regional availability and prove that browser signals genuinely improve the incident picture across each customer environment.

About Guardz
Guardz is on a mission to create a safer digital world by empowering Managed Service Providers (MSPs). Their goal is to proactively secure and insure Small and Medium Enterprises (SMEs) against ever-evolving threats while simultaneously creating new revenue streams, all on one unified platform.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Segura Adds Self-Service Vendor Access Portal for Safer Third-Party Privileged Access

Third-party access is one of those IT tasks that can quietly become a security headache. A supplier needs to troubleshoot a system, an MSP has to maintain infrastructure, or an auditor needs temporary access to review a configuration. If every request depends on an administrator manually creating an account and arranging a connection, the process can become slow and difficult to govern.

Segura’s Platform v4.2.15 adds a Vendor Access Portal to Domum Remote Access. The self-service portal lets vendors, managed service providers and auditors register, sign in and request time-limited access to resources that an organisation has chosen to publish. Administrators still control approval, access limits and session policies.

Let vendors request access without handing over control

Previously, third-party accounts depended on the customer’s team creating each account. With the Vendor Access Portal, an external user can register and submit an access request. The request includes a justification, a requested session duration within the resource’s configured limit and an optional IT service management ticket reference.

An administrator reviews the registration and request before releasing access. This changes the administrative workload without turning the portal into an open door: third parties only see resources published for their organisation, and access remains subject to the customer’s policies.

Authentication, network restrictions and controlled sessions

The portal supports passwordless sign-in using an email address and a one-time code. On first sign-in, the user receives a code through the configured channel and registers an authenticator app for subsequent sign-ins. This adds a verification step without requiring the organisation to issue a permanent password to every external user.

Administrators can apply portal-wide IP and geolocation allow-lists. They can also configure restrictions for each vendor organisation and define the days, hours and number of sessions when access is released. Sessions run through the Segura Web Proxy rather than connecting directly to the target resource, and they follow the same session policies as other Domum sessions.

Two portal roles help separate responsibilities. Portal Configuration users manage settings, access restrictions and published resources, while Portal Operators review registrations and access requests. This can help organisations avoid giving every person who processes vendor requests broad administrative rights.

Why this matters to Singapore organisations

Singapore businesses often rely on external technology providers to support networks, servers, applications, cloud environments and business-critical systems. That support is necessary, but standing privileged accounts and informal remote-access arrangements can leave organisations with more access than they intended.

A structured request-and-approval process gives IT and security teams a clearer record of why access was needed, how long it was requested for and who approved its release. The optional ITSM ticket reference can also help connect a remote session to a change request or incident record.

For organisations handling customer information or operating regulated services, this workflow can support stronger access governance. It should sit alongside a broader privileged access management programme, including least-privilege permissions, named user accounts, session monitoring, credential rotation, periodic access reviews and documented offboarding procedures.

Implementation checklist for IT and security teams

  • Publish only necessary resources. Start with a small set of systems and define which vendor organisations can request each resource.
  • Set sensible access limits. Use time windows and maximum session durations that match the support task, rather than granting broad, long-lived access.
  • Configure network controls. Review approved IP ranges and locations, including how legitimate support teams connect when staff work remotely.
  • Assign clear portal roles. Separate portal configuration from day-to-day request handling and keep permissions scoped to each responsibility.
  • Connect requests to service workflows. Encourage vendors to include a change or incident ticket reference so approvals can be checked against business context.
  • Test the user journey. Validate registration, MFA enrolment, request approval, session release, proxy access and audit records with a pilot vendor before wider rollout.

Make third-party access easier to manage

The Vendor Access Portal in Segura Platform v4.2.15 aims to reduce manual account provisioning while keeping approval and session control with the organisation. For Singapore IT teams, it offers a more consistent way to handle supplier and MSP access without relying on permanent privileged accounts or ad hoc remote connections. Start with a defined vendor group, review the access policies and audit trail, and expand only after the process works smoothly for both administrators and external users.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Microsoft 365 EWS Retirement: What IT Teams Should Do Before April 2027

Microsoft’s retirement of Exchange Web Services (EWS) is no longer a distant roadmap item. Enforcement has started rolling out across Microsoft 365 tenants, and the service is scheduled to be switched off permanently on 1 April 2027. For organisations using CloudM Migrate for Microsoft 365 projects, that makes migration readiness a task to put on the calendar now.

CloudM’s support update of 30 October 2026 explains that some Microsoft 365 workloads in CloudM Migrate still use EWS. The company is moving those connectors to Microsoft Graph, but that work is not generally available yet. In the meantime, customers need to make sure the CloudM application is permitted to use EWS in each affected tenant.

What is changing with EWS?

Microsoft is moving Exchange Online integrations away from EWS and towards Microsoft Graph. The change is being enforced progressively rather than on one single date for every tenant. From October 2026, Microsoft began setting EWS to disabled in tenants where it had not been explicitly configured. It also introduced an application allow-list model, so simply setting EWS to enabled is no longer enough once enforcement reaches a tenant.

From 1 April 2027, EWS will be fully disabled in Exchange Online. No tenant setting or allow-list entry will keep it working after that date. If a migration project depends on an EWS-based workload, the team needs a tested plan well before the cut-off.

Which CloudM Migrate workloads could be affected?

CloudM says the change affects Microsoft 365 migrations involving mail, calendars, contacts, tasks and notes where the current connector uses EWS. The impact depends on the workloads in scope, the tenant’s EWS configuration and whether the CloudM application registration is already on the relevant allow list.

There is one important detail for IT teams: Microsoft may have created an allow list based on applications that used EWS in the previous 60 days. Apps that are used infrequently, or were created more recently, may not be included automatically. A migration that worked during an earlier test is not proof that every production tenant is ready.

What should Singapore IT teams do now?

  • Inventory active migration projects. Identify every Microsoft 365 tenant and workload that relies on CloudM Migrate, including mail, calendar, contact, task and note data.
  • Check the tenant’s EWS settings. Confirm whether Microsoft’s enforcement has reached the tenant and whether an application allow list is in place. Do not rely on the legacy EWS-enabled setting alone.
  • Allow-list the CloudM application. Follow CloudM’s current guidance to add its Migrate app registration to Microsoft’s EWS allow list for the affected tenant. Have the Microsoft 365 administrator verify the application ID and policy change.
  • Allow time for the change to take effect. CloudM advises allowing up to 24 hours after updating the allow list before testing the migration again.
  • Run a representative test. Validate each workload, check data counts and permissions, and confirm that the migration can complete within the planned change window.
  • Keep the Graph transition on the roadmap. Ask your migration partner to confirm when Microsoft Graph support for the required workloads becomes generally available and what version or configuration will be needed.

Plan migration windows around the deadline

For Singapore organisations, the risk is not just a failed connector. A migration can affect staff access, project deadlines and business operations, especially when email and collaboration data are being moved between tenants. Build the EWS check into the project plan, schedule a test before the production cutover, and make sure the Microsoft 365 owner and migration partner agree on who is responsible for the allow-list change.

It is also worth checking how the migration handles data governance. Confirm where migration data is processed, who can access it, how temporary copies are protected and how exceptions are recorded. These questions matter for organisations handling personal data, confidential customer information or regulated business records under Singapore’s PDPA and internal security policies.

Do not leave the check until the final cut-off

CloudM’s guidance gives customers an interim way to keep affected migrations running while its Microsoft Graph work progresses. That is useful, but it should not become a reason to postpone planning. Tenant-by-tenant enforcement has already begun, and the April 2027 retirement date is fixed.

If your organisation is planning a Microsoft 365 migration, ask your IT team or CloudM partner to review the EWS dependency now. A short compatibility check, allow-list review and controlled test can help prevent a last-minute disruption when the migration window matters most.

About CloudM
CloudM is an award-winning SaaS company whose humble beginnings in Manchester have grown into a global business in just a few short years.

Our team of tech-driven innovators have designed a SaaS data management platform for you to get the most from your digital workspace. Whether it’s Microsoft 365, Google Workspace or other SaaS applications, CloudM drives your business through a simple, easy-to-use interface, helping you to work smarter, not harder.

By automating time-consuming tasks like IT admin, onboarding & offboarding, archiving and migrations, the CloudM platform takes care of the day-to-day, allowing you to focus on the big picture.

With over 35,000 customers including the likes of Spotify, Netflix and Uber, our all-in-one platform is putting office life on auto-pilot, saving you time, stress and money.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

SealPath’s 2026 Data Protection Report: Why Teams Need Persistent Document Control

Most organisations have got better at controlling who can open a file inside their own systems. The harder question is what happens after that file is shared with a supplier, customer, external adviser or an AI tool. SealPath’s 2026 State of Data Protection report highlights a gap between access policies and the ability to keep control of information once it leaves the organisation.

The report is based on a survey of 1,052 security and technology professionals, with fieldwork carried out in July and August 2026. Its findings are useful for Singapore businesses reviewing data protection, secure collaboration and the controls they need as employees make wider use of generative AI.

Access control is only part of the job

According to the report, 85% of respondents say they apply least-privilege access. However, only 36% can change a document’s permissions after it has been sent, and just 21% say they have persistent protection in place. That difference matters because a file can move beyond the original repository very quickly: it may be downloaded, forwarded, copied into a project workspace or shared with an external party.

Revoking access to a folder or user account does not always solve the problem if a copy of the document is already outside the organisation’s control. Security teams need to consider the file itself, not just the location where it was first stored.

AI use adds another route for sensitive information to travel

The report found that 48% of participants confirmed that sensitive information had been entered into AI tools, while another 20% suspected this had happened. Although 78% said their organisation had an AI usage policy, only 26% reported technical measures to block sensitive information from being uploaded to those tools.

This is a practical challenge, not simply a policy issue. Staff may paste contract clauses into an assistant to prepare a summary, upload engineering drawings for analysis or use internal reports to draft a presentation. The intention may be harmless, but the organisation still needs to know what information is being shared and whether the destination is approved.

Why persistent document protection is worth evaluating

SealPath’s information rights management approach applies protection to the document, rather than relying only on the repository around it. Its platform combines encryption with usage permissions and traceability, helping organisations control who can access a protected file and what they are allowed to do with it. Depending on the configuration, administrators can also track access and revoke permissions after a document has been shared.

That model can be useful for contracts, financial records, customer information, product designs and other documents that regularly move between internal teams and external partners. SealPath describes SaaS and on-premises deployment options, alongside integrations with common business applications and storage environments.

What the findings mean for Singapore buyers

Singapore organisations should assess these controls against the way information actually moves through the business. The report found that 72% of respondents share sensitive information with third parties at least occasionally, but only 46% said they could revoke access to shared information and 32% could audit third-party access. Those gaps are relevant to businesses working with regional suppliers, outsourced service providers, legal advisers and overseas subsidiaries.

The report also found that 83% of respondents consider data sovereignty important or mandatory, and 72% apply that consideration to AI tools that process sensitive information. For local buyers, this is a reminder to ask where data is stored and processed, which administrators can access it, how keys and permissions are managed, and what happens when a document crosses a national boundary.

These questions should sit alongside the organisation’s obligations under Singapore’s PDPA and its own contractual and industry requirements. A technology platform can support governance, but it does not replace the need for clear policies, staff training, supplier due diligence and legal review.

A practical checklist before choosing a solution

  • Identify high-value information. Start with documents that would create material risk if they were copied or shared without approval.
  • Protect the file after sharing. Check whether permissions remain enforceable when a document is downloaded or sent outside the original repository.
  • Test revocation and audit. Confirm that administrators can withdraw access and review who opened a document, including external users.
  • Check application fit. Validate support for the file types and tools your teams already use, especially Office documents, PDFs and engineering or CAD files where relevant.
  • Review deployment and data flows. Compare SaaS and on-premises options, hosting locations, integrations, identity controls and administrator access.
  • Pilot real workflows. Test with a small group that regularly shares sensitive files with customers or partners, and measure both security outcomes and user friction.

Move from policy statements to controls that travel with the data

The main lesson from the 2026 report is that a policy can say who should access information, but it cannot by itself protect every copy once a document starts moving. Singapore IT and security teams should review whether their current controls can follow sensitive information through collaboration, external sharing and approved AI use.

Persistent document protection is one option to assess as part of that wider programme. The right starting point is a focused pilot using the documents and sharing scenarios that matter most to the business, with clear success measures for usability, access control, auditability and data governance.

About SealPath
SealPath is the European leader in Data-Centric Security and Enterprise Digital Rights Management, working with significant companies in more than 25 countries. SealPath has been helping organizations from different business verticals such as Manufacturing, Oil and Gas, Retail, Finance, Health, and Public Administration, to protect their data for over a decade. SealPath’s client portfolio includes organizations within the Fortune 500 and Eurostoxx 50 indices. SealPath facilitates the prevention of costly mistakes, reducing the risk of data leakage, ensuring the security of confidential information, and protecting data assets.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Actiphy ImageServer: Centralising Backup Operations for Businesses

For many IT teams, getting a backup job to complete is only the first step. The real work starts afterwards: checking that the image is healthy, moving copies to the right places, consolidating older recovery points and proving that a system can actually boot when it is needed. As backup estates grow across servers, virtual machines and remote offices, those follow-up tasks can become a workload of their own.

Actiphy’s latest announcement is aimed at that operational gap. On 26 October 2026, the company introduced Actiphy ImageServer, a platform that brings backup-image management and secure storage together, while moving several post-backup tasks away from the protected servers and workstations.

One place to manage the work after backup

ImageServer combines the image-management capabilities of Actiphy ImageCenter with the storage capabilities of Actiphy StorageServer. Instead of leaving every protected machine to handle the follow-up processing, administrators can use a dedicated server to run verification, replication, consolidation and BootCheck tasks.

That separation can be useful when backup activity competes with production workloads. A busy file server or application host should not have to carry unnecessary processing overhead just because the backup estate needs routine housekeeping. Centralising those jobs also gives administrators a clearer view of what has run, what is waiting and what needs attention.

What stands out in Actiphy ImageServer

  • Inter-file deduplication: ImageServer can identify common data blocks across backup images in the same bucket and reuse existing blocks. Actiphy reports reductions of about 71% for uncompressed backups and about 54% for backups using ActiveImage Protector’s IDDC in its own testing. Treat those figures as vendor test results, not a guaranteed saving for every environment.
  • Automated workflows: Administrators can automate verification, replication, consolidation and BootCheck, and define the order and time windows for those jobs.
  • Flexible replication targets: Supported destinations include network shares, FTP/FTPS, SFTP, WebDAV, Amazon S3 and compatible storage services such as Wasabi and Microsoft Azure.
  • Centralised monitoring: A web console provides visibility into storage use, connected clients, transfer speeds, task status, events and history. Image Browser also supports file-level recovery.
  • Security controls: The product supports HTTPS, user authentication, TOTP-based two-factor authentication, event notifications and scheduled summary reports.

Why Singapore businesses may want to look at it

For organisations operating from several Singapore offices, retail outlets, clinics, warehouses or regional sites, backup administration can become fragmented. Different teams may be responsible for different servers, and copies may be sent to a mix of local storage and cloud destinations. A central management point can make it easier to standardise how backups are checked and replicated, without adding the same post-processing load to every protected machine.

It is also worth thinking about recovery rather than storage alone. A backup that has never been tested is an assumption, not a recovery plan. Routine verification and BootCheck help teams build evidence that backup images are usable. File-level recovery can also be handy when the request is simply to retrieve one deleted document rather than restore an entire system.

Questions to ask before deployment

Start with the basics: which ActiveImage Protector versions and image types are in scope, how many backup generations need to be retained, and how much data is expected to move during each replication window? Actiphy lists a four-core CPU recommendation, 16GB of memory as a minimum and 32GB or more as a recommendation for some workloads. A separate storage destination is also required for backup images, so include that capacity in the design.

Next, decide where each copy should live. Singapore organisations should check the location of cloud storage, cross-border transfer arrangements, retention rules and any contractual or regulatory requirements that apply to the data. Consider network bandwidth and egress costs too, especially if large image files are replicated outside Singapore.

Finally, run a realistic recovery exercise. Measure how long it takes to find the right image, restore a file and bring a representative server back online. Confirm who can administer the console, enable two-factor authentication and document the recovery steps. If deduplication is part of the business case, test it against your own data rather than relying only on headline percentages.

A practical next step

If your organisation already uses ActiveImage Protector, ImageServer is worth evaluating as a way to bring backup storage, verification and replication workflows under more consistent control. The strongest case will come from mapping it to your current backup volumes, storage destinations and recovery objectives, then testing the workflow with a representative workload before rolling it out more widely.

About Actiphy
Actiphy founded in 2007, focuses on developing and offering innovative backup and disaster recovery solutions for complete protection of all your systems and data. ActiveImage Protector backs up Windows, Linux machines on physical and virtual environments and restore systems and data fast for you to be up and running with minimal downtime and data loss. Today Actiphy hold 20% of the image backup market in Japan and are expanding our services in the Asia/Pacific and North American regions, as well as in Europe, the Middle East and Africa.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.