Portnox Cloud Recognized for Exceptional Innovation.

AUSTIN, TX – May 6, 2025 – Portnox announces that TMC has awarded Portnox Cloud a 2025 Product of the Year Award, presented by Cloud Computing Magazine. The Cloud Computing Product of the Year Awards honor vendors with the most innovative, useful, and beneficial cloud products and services available to deploy within the past year.

Network access control (NAC) and endpoint security solutions often receive mixed reviews due to their challenging deployment, management complexity, and high costs. However, Portnox Cloud stands out by offering an affordable, unified access control (UAC) solution that addresses these concerns. As a fully cloud-native platform, Portnox Cloud is designed to simplify security management while reducing costs and complexity.

“Being recognized as a Cloud Computing Product of the Year winner underscores the power and value of our cloud-native approach to access control,” said Denny LeCompte, CEO of Portnox. “Portnox Cloud was built from the ground up in the cloud to provide unparalleled ease of deployment, management, and scalability. This award fuels our passion to continue pushing the boundaries of what’s possible in unified access control.”

“Congratulations to Portnox on earning a Cloud Computing Product of the Year Award,” said Rich Tehrani, CEO of TMC. “Portnox Cloud stands out as a truly innovative solution helping to drive meaningful transformation. As the cloud landscape advances and unlocks new possibilities, we’re excited to watch their continued growth and impact.”

Read the full announcement of 2025 Cloud Computing Product of the Year Award winners here.

Portnox honored with a Global InfoSec Award for its Network Access Control solution.

AUSTIN, TX – April 29, 2025 – Portnox, a leading provider of cloud-native, zero trust access control solutions, today announced its Network Access Control (NAC) was named Best Solution for Network Access Control by Cyber Defense Magazine’s Global InfoSec Awards. The award was announced at the 2025 RSA Conference, taking place this week in San Francisco, CA.

In 2024, Portnox was named “Best Next Gen Network Access Control” in the Global InfoSec Awards and the winner of the Cutting Edge Network Access Control category in the InfoSec Innovator Awards.

“We are incredibly proud to receive this top honor for our Network Access Control solution,” said Denny LeCompte, CEO of Portnox. “This award further solidifies our position as the leader in cloud-native NAC, proving that organizations can achieve robust security without the complexities and burdens of traditional hardware-based solutions. The Portnox Cloud is truly revolutionizing how businesses secure their networks.”

Portnox’s cloud-native zero trust Network Access Control (NAC) solution boasts no on-site hardware, no on-going maintenance, and no management hassles. The platform is tailor-made for resource-constrained IT security teams operating across a highly distributed corporate network.

“We scoured the globe looking for cybersecurity innovators that could make a huge difference and potentially help turn the tide against the exponential growth in cyber-crime. Portnox is absolutely worthy of this coveted award and consideration for deployment in your environment,” said Yan Ross, Global Editor of Cyber Defense Magazine.

The complete list of 2025 Global InfoSec Awards winners is located here: http://www.cyberdefenseawards.com/.

The company was recognized by SC Awards Europe for the second consecutive year.

AUSTIN, TX – April 22, 2025 – Building on its continued innovation in authentication technology, Portnox today announced its shortlisting in the prestigious 2025 SC Awards Europe. For the second year running, the company has been recognized in the Best Authentication Technology category, further solidifying its position as a leader in providing robust and adaptive security solutions.

In today’s complex cybersecurity landscape, IT teams face the daunting task of securing an ever-expanding network of managed devices, BYOD, and IoT, all while adhering to stringent compliance requirements. Portnox addresses this challenge head-on, transforming the potential vulnerability of numerous enterprise applications into a securely managed access environment. The cloud-native platform offers a streamlined approach to implementing zero trust and transitioning to passwordless authentication. It provides organizations with an affordable and scalable solution to protect their networks, applications, and critical infrastructure.

The SC Awards Europe celebrates the industry’s top innovators, teams, and solutions. Organized by SC Media, a leading resource for cybersecurity professionals, the awards honor excellence across key areas like threat detection, cloud security, and leadership. Being part of the SC Awards Europe means gaining recognition for contributions to the evolving world of cyber defense.

“We are thrilled to announce the official shortlist for the SC Awards Europe 2025! Congratulations to all those who made the shortlist for showcasing outstanding innovation and excellence in cybersecurity,” said Dan Raywood, Senior Editor, SC Media UK.

“Being shortlisted by the SC Awards Europe for Best Authentication is a testament to our focus on delivering real value to our customers in this critical region,” said Denny LeCompte, CEO of Portnox. “We believe our cloud-adaptive approach, coupled with our European data center, provides the robust and flexible security solutions they need.”

Portnox empowers organizations with a fully cloud-native, unified platform that simplifies the journey to zero trust and passwordless security. This comprehensive solution eliminates the complexities and costs associated with traditional on-prem security deployments, allowing businesses to achieve robust protection for their networks, applications, and infrastructure efficiently and at scale.

Find the complete 2025 shortlist on SC Media’s website. Winners will be announced in London at the SC Awards Europe 2025 ceremony on Tuesday, June 3, 2025.

The December 2013 Target hack remains one of the most infamous data breaches in cybersecurity history.  The hackers stole 40 million credit card numbers, got the PII (Personal Identifiable Information) of 70 million people, cost Target upwards of $200 million, and ruined Christmas for probably every single person working in Target’s IT department.  The breach not only tarnished Target’s reputation but also impacted several other sectors, highlighting the ripple effects of large-scale cyberattacks. Financial institutions faced increased costs for reissuing millions of compromised cards, while consumers dealt with heightened anxiety over identity theft and fraud. The breach also served as a wake-up call for retailers and businesses worldwide, prompting many to reevaluate their cybersecurity practices and adopt more robust systems to safeguard sensitive data. Ultimately, it underscored the critical importance of proactive cybersecurity measures in an increasingly interconnected world.

What the Hack Happened

The breach began when attackers targeted a third-party vendor that had legitimate access to Target’s network. The vendor, Fazio Mechanical Services, was a Pennsylvania-based HVAC (heating, ventilation, and air conditioning) company that provided maintenance services to Target.

Attackers sent a phishing email to Fazio employees, and one unfortunate soul fell for it. That’s a point that deserves some emphasis – it only takes one person, one click, in one unguarded moment, to give the bad actors a way in.  

The laptop was protected with the free version of Malwarebytes – an excellent tool that scans for and eliminates malware when initiated by the user.  The version you pay for – that actually gets appropriately licensed for corporate use – has a real-time scanner that probably would have caught the issue, because the malware installed, called Citadel, was pretty well-known.

Network Infiltration

Using the stolen credentials from Fazio Mechanical Services, the attackers got access to a Target-hosted web service dedicated to outside vendors.  They uploaded a file that allowed them to install a web shell to execute commands on the hosting server.  Some call this a vulnerability, but there are lots of legitimate reasons a web application would let you upload files – invoices, for example – and while it should ideally block executables, it’s easy enough to disguise them. 

 They used a Pass-the-Hash attack to get domain admin credentials, and then the network was their playground.  They went looking for database servers, and they found them – to the tune of 70 million records of PII (Personally Identifiable Information.)

But here’s a fun fact – know what those databases did not contain?  Credit card numbers!  Because Target’s data was PCI-DSS compliant, there was no financial info stored on their database servers.  

Deployment of Malware & Exfiltration of Data

Having been foiled in their scheme by Target’s PCI-DSS compliance, the hackers moved on to plan B (or what might have been plan A all along, we don’t really know) – infiltrate the PoS (Point-of-Sale) servers and capture credit card data in real-time.  They did this using malware called Kaptoxa, which would scrape the machine’s memory and store anything that looked like a credit card number in a file. Then, the malware would periodically transfer that file to another server, which would transfer it back to the hackers via FTP.  

If you’ve been following along so far, one thing that may have stuck out to you was how the attackers were able to wander through the network, accessing pretty much whatever they pleased.  This is why standard security procedures – like role-based access control and network segmentation, are so important.  

Note: There’s a very thorough deep-dive about the hack here, including all of the tools, protocols, and technology used if you want to geek out.

Target’s Security Posture Before the Breach

You might think that Target had pretty poor security before the breach, but that was surprisingly (and alarmingly) not true.  They had a security team of over 300 employees and had just invested in the well-known security tool FireEye.  This tool actually did send out alerts about the malware, which the security team forwarded on to the operations team….but no one did anything about them.  Not only that, FireEye has a setting that can automatically remove Malware….and they turned it off. The thought was they wanted a human to make decisions about what to remove vs. automated software.  

Lessons Learned

So what are the lessons we can take away from Target?  Let’s review:

Lesson 1: Security can be expensive – but not nearly as expensive as a breach.

Lesson 2: Assume every device outside your organization is compromised, because eventually one will be.

Lesson 3: Regulatory compliance might be difficult, but it is often worth it.

Lesson 3: Pay attention to the security basics.  Role-based access control, least-privileged access and network segmentation are not new concepts, but they are invaluable to minimize damage.  

Lesson 4: Your security tools are essential; invest in them and tailor them to work for you.  Automation is there to make your life easier.  

We’re going on 12 years since this hack happened, and it still serves as a powerful reminder of the critical importance of cybersecurity in today’s digital age.  The Target breach underscored how even a single weak link in a company’s supply chain can have catastrophic consequences, impacting not only the business but also millions of customers. It also paved the way for stricter industry regulations and greater emphasis on safeguarding sensitive data. As cyber threats continue to evolve, the lessons from this breach remain especially relevant.  

While firewalls, endpoint detection, and security awareness training are essential, many enterprises overlook one of the most powerful tools for data leak prevention: Network Access Control (NAC).

NAC solutions serve as digital gatekeepers, ensuring that only authorized users and compliant devices can connect to the network. More importantly, NAC helps prevent data leaks by enforcing access policies, monitoring network behavior, and segmenting sensitive data zones. Let’s explore how NAC plays a critical role in safeguarding data and preventing costly leaks.

Understanding Data Leaks: The Growing Threat

A data leak occurs when sensitive information is unintentionally exposed, whether due to human error, insider threats, or cyberattacks. Unlike data breaches, which involve direct hacking, data leaks often stem from poor access controls, unsecured endpoints, or misconfigured cloud environments.

Some of the common causes of data leaks include:

• Unsecured endpoints (e.g., personal devices, unpatched systems, rogue IoT devices)
• Insider threats (e.g., disgruntled employees, accidental mishandling of data)
• Misconfigured access permissions (e.g., users with excessive privileges)
• Shadow IT and unmanaged devices (e.g., employees using unauthorized apps and personal devices)

With these risks in mind, how can NAC mitigate data leaks and strengthen an organization’s cybersecurity posture?

1. Enforcing Strong Access Controls

One of the primary ways NAC prevents data leaks is by ensuring that only authorized users and compliant devices gain access to critical systems and data.

• Role-Based Access Control (RBAC): NAC allows administrators to enforce strict access policies based on user roles. For example, HR personnel can access payroll databases, but marketing teams cannot.
• Device Compliance Enforcement: NAC checks devices for security posture (e.g., up-to-date antivirus, encryption, OS patches) before granting network access.
• Guest and BYOD Controls: NAC isolates guest users and unmanaged personal devices, preventing them from accessing sensitive corporate data.

By ensuring that only trusted users and devices connect to sensitive systems, NAC significantly reduces the risk of unauthorized data exposure.

2. Monitoring Network Behavior in Real-Time

Even with strong access policies, insider threats and compromised accounts pose a risk. NAC helps prevent data leaks by continuously monitoring network activity and identifying suspicious behavior.

• Detecting Unusual Data Transfers: If an employee suddenly starts transferring large volumes of files to an external storage drive, NAC can flag and block the activity.
• Identifying Anomalous Logins: NAC detects login attempts from unusual locations or devices, preventing potential credential misuse.
• Restricting High-Risk Applications: NAC can block unauthorized apps or cloud services (e.g., unsanctioned file-sharing platforms) that employees might use to move sensitive data.

By actively monitoring and controlling network behavior, NAC helps organizations spot and stop potential data leaks before they escalate.

3. Network Segmentation: Keeping Sensitive Data Isolated

Data leaks often occur when users or devices gain access to systems they shouldn’t. NAC enforces network segmentation to ensure that access to critical data is tightly controlled.

• Zero Trust Segmentation: Even if a device is authenticated, NAC ensures it only has access to the specific resources needed for its role—nothing more.
• IoT and Endpoint Isolation: Rogue IoT devices or infected endpoints can’t move laterally within the network, preventing data leaks caused by compromised devices.
• Guest and Contractor Networks: NAC places guests, contractors, and third-party vendors in isolated VLANs, preventing them from accessing sensitive corporate data.

By limiting who and what can communicate within the network, NAC minimizes the attack surface and reduces the likelihood of data leaks.

4. Responding to Policy Violations with Automated Remediation

Even the best security policies can fail if they aren’t actively enforced. NAC goes beyond passive monitoring by providing automated remediation for security violations.

• Quarantine and Block: If a device fails security posture checks (e.g., outdated antivirus, suspicious activity), NAC can automatically quarantine or disconnect it from the network.
• Adaptive Policy Enforcement: NAC integrates with security tools like SIEMs and firewalls, ensuring immediate action when a threat is detected.
• Change of Authorization (CoA): If a device violates security policies (e.g., an unpatched laptop attempting to access sensitive files), NAC can trigger a forced re-authentication or revoke access.

By proactively enforcing security compliance and responding to threats in real time, NAC ensures that security gaps leading to data leaks are swiftly closed.

5. Supporting Compliance and Regulatory Requirements

For industries governed by strict data protection regulations (e.g., GDPR, HIPAA, PCI-DSS), preventing data leaks isn’t just a security concern—it’s a legal necessity. NAC helps organizations meet compliance requirements by:

• Ensuring Least-Privilege Access: Enforcing user and device access controls to protect sensitive data.
• Maintaining Security Logs: Providing an audit trail of who accessed what and when.
• Enforcing Encryption and Security Policies: Ensuring that all devices accessing the network meet security requirements.

By aligning with regulatory mandates, NAC helps organizations avoid costly fines and legal repercussions associated with data leaks.

Conclusion

Data leaks are a persistent and costly threat to organizations, but NAC provides a proactive defense against unauthorized access, insider threats, and network vulnerabilities. By enforcing strict access controls, monitoring network behavior, segmenting sensitive data, automating security enforcement, and supporting compliance requirements, NAC plays a critical role in preventing data leaks.

In a world where data is currency, organizations can’t afford to take network security lightly. Implementing a cloud-native NAC solution can help businesses lock down their networks, safeguard sensitive data, and mitigate the risk of devastating leaks.

The beginning of 2025 has been wild so far, and there’s no sign of it slowing down. We’re back with more predictions for what 2025 will look like for MSPs, with an eye towards 2026 and beyond.

Whether it’s integrating cutting-edge technologies, adapting to regulatory shake-ups, or capitalizing on emerging markets, MSPs and IT leaders must stay ahead of the curve. That’s why ChannelPro turned to some of the sharpest minds in the channel and asked them to deliver an unfiltered forecast for the rest of 2025.

If you’re looking to enhance your service offerings or master shifting market dynamics, these predictions and insights will help you stay ahead in an unpredictable year.

Tarun Desikan

Desikan is executive vice president, cloud secure edge for SonicWall.

“In the Mission Impossible movie franchise, Tom Cruise and team make use of advanced techniques – latex 3D face masks, voice modulators, adaptive contact lenses and more – to impersonate people, enter restricted areas and save the world from destruction. In 2025, new AI capabilities will make what was only possible in the realm of movies available to the mainstream. And, as with all such new technologies, the bad guys will be amongst the first to take advantage. Unfortunately, the bad guys won’t be using impersonation to save the world; instead, they will launch more sophisticated spoofing and phishing techniques to launch cyberattacks against unsuspecting civilian organizations.”

Jim Elder

Elder is VP of global pathways at Blancco.

“The proliferation of AI will continue to increase demand for greater processing speeds and more scalable data operations in 2025. Hyperscalers will forge ahead with their buildout and focus on facilitating AI applications and supporting AI initiatives at large and medium enterprises. Meanwhile, the cloud migration “gold rush” will continue to cool off and balance out, leading CIOs to shift budget into their own enterprise data center operations. This will further increase spend and demand for partner services that include helping enterprises optimize their cloud environments.”

Tim Erlin

Erlin is VP of product at Wallarm.

“In 2025, Managed IT will be all about reducing the burden for customers. As security incidents continue to gain more visibility with businesses and their boards, I predict that the dividing line between MSPs and MSSPs will blur. MSPs who are looking to expand their ability to help customers are likely to expand into security.

Also, a backup is only as good as the business’ ability to recover. So, the opportunity isn’t around “SaaS backups,” but around SaaS recovery.

MSPs looking to expand their “data loss” offerings in 2025 should focus more on business continuity. The real value to customers is gained by examining the threats that might disrupt their operations, including their SaaS tools, and providing a fast, reliable path to recovery.”

Terry Hedden

Hedden is the CEO of Marketopia.

“I believe the Managed IT Industry will continue the transformation it began in 2024. Security risks are becoming more complex. MSPs will elevate the services they offer far beyond user support to become both providers of very robust security.  I also see increased regulation and industry requirements that MSPs will be required to provide. The market opportunity for businesses in general is great in 2025. That means a very bright future for MSPs that are able to demonstrate value and increase income and profit as a result.”

J.J. Kardwell

Kardwellis the CEO of Vultr.

“In 2025, agentic AI will leap from imaginary to necessary, quickly redefining enterprise automation. Self-directed AI applications will allow organizations to make real-time, data-driven decisions, particularly in sectors already making use of sovereign and private clouds. Expect early enterprise-level adopters to crop up in places where CapEx isn’t an issue, deploying high-performance GPU and CPU clusters for mission-critical applications. Simultaneously, lighter agentic AI solutions will flourish through alternative cloud providers, enabling serverless inference at the edge, slashing costs and complexity.

By outsourcing infrastructure management, businesses will be able to focus on optimizing the AI application layer, unlocking unparalleled productivity and customer engagement. To support the massive scale of AI inference required, organizations will increasingly deploy specialized models paired with vector databases and RAG at edge locations. This edge-focused architecture will deliver the ultra-low latency needed for AI agents to effectively support the volume of AI interactions needed for agentic AI at scale.”

Denny LeCompte

LeCompte is the CEO of Portnox Security.

“There will be an even greater financial opportunity for MSPs to offer SaaS data backups in 2025. As organizations increasingly migrate to cloud-native solutions, the need for comprehensive data protection has never been higher. MSPs can capitalize on this demand by providing reliable SaaS backup services, thereby expanding their service portfolio and generating new revenue streams. By addressing a critical need, MSPs can enhance their value proposition and strengthen customer relationships.”

Dror Liwer

Liwer is the co-founder of Coro.

“In 2025, AI can either be a powerful ally or an unseen double agent. On one hand, it will help MSPs and their clients boost productivity; on the other, it introduces significant risks. In the rush to improve efficiency, security often takes a back seat, and sharing sensitive data with AI tools can result in severe consequences.

In addition, expect more AI-driven attacks as hackers further experiment with the technology and become more clever in their social engineering. For example, phishing emails are getting alarmingly good at mimicking people’s tone and even referencing past conversations. The usual security training is not cutting it anymore and MSPs will need to lean on advanced tooling like email address cross checking and behavioral tracking to plug those gaps. For SMBs, having an MSP who can stay ahead of these attacks will be a game-changer.”

Gary Pica

Pica is the president of TruMethods, a Kaseya company.

“Managed service providers (MSPs) are taking a more strategic role with their small to medium-sized business (SMB) customers as they invest more in technology and security. Lowering costs, adding value, and becoming more efficient is the top priority of every MSP. Automation and AI will play a critical role in this phase of the MSPs’ journey.

SMB decision-makers are now more educated about what a comprehensive IT and security offering looks like. For this reason, a more complete, automated solution will be more important than ever, and MSPs will need to be ready to offer it to their customers.”