Fortra Publishes Its 2025 State Of Cybersecurity Survey Results

Posted in Commentary on February 4, 2025 by itnerd

Fortra has published the results from its 2025 State of Cybersecurity survey. The report looks at some surprising shifts in what security leaders see as their biggest threats, and what’s slipping off the radar.

Phishing remains the top concern, but interestingly, zero-day attacks have dropped off the list, with only 38% seeing them as a primary risk (down from 50% last year). At the same time, emerging technology threats—like genAI—jumped 15% year over year, hitting the top five for the first time.

Other trends worth noting:

  • Cloud security is no longer a top initiative. Are companies feeling more confident, or are they overlooking evolving risks?
  • A major spike in pentesting outsourcing, as companies push compliance-heavy security tasks to third parties.
  • Budgets are still the biggest blocker with more than half (59%) saying that funding constraints are their top challenge in executing security strategies.

You can view Fortra’s findings here.

Action1 Expands Its Free Offering to 200 Endpoints, Delivering Industry’s First Free Autonomous Endpoint Management Solution

Posted in Commentary with tags on February 4, 2025 by itnerd

Action1, a leading provider of autonomous endpoint management solutions, today announced a major expansion of its free tier, increasing the number of free endpoints from 100 to200. The first, foundational use case for Autonomous Endpoint Management (AEM) is autonomous patching that accelerates patch deployment and compliance and reduces IT overhead and degradation of Digital Employee Experience (DEX). Driven by a mission to make autonomous endpoint management easily and universally accessible, Action1 will now enable organizations and home users to deploy its cloud-native patching solution to secure the first 200 endpoints at no cost, forever, with no feature limits. 

Democratizing Autonomous Endpoint Management

Today’s cyber threat landscape presents unprecedented challenges, from sophisticated, Gen-AI-enabled ransomware attacks to complex compliance demands. Small and medium-sized businesses (SMBs) and nonprofits often lack the resources to address these issues effectively. 

According to Veeam, 85% of ransomware attacks target small businesses. Action1’s expanded free tier provides a lifeline to these targeted groups, providing: 

  • Enterprise-grade autonomous endpoint management FREE: Protecting up to 200 endpoints free forever, with simple scaling above 200, without hidden costs or complexity. 
  • 5-minute deployment, effortless management: Start managing endpoints immediately, minimize training and free up IT resources.  
  • Low bandwidth and hybrid workforce patching: Seamlessly deploy patches, remediation, and updates with bandwidth-efficient P2P distribution—no VPN required. Easily patch offline devices as soon as they reconnect online. 

Redefining “Free” in Autonomous Endpoint Management

Unlike misleading “free” software offers that often serve as bait for trials or data monetization schemes, Action1 provides a genuinely free solution with comprehensive autonomous endpoint management capabilities for the first 200 endpoints and transparent pricing for any additional usage. With no hidden fees or commercial handling of user information, Action1 empowers small businesses and non-profits to operate and grow securely. It also enables larger organizations to start using the platform’s capabilities on smaller environments at no cost, with no functional limits, before scaling up. 

Reinventing Patching with the Powerful, Cross-Platform Solution

Action1’s platform disrupts legacy patch management approaches, offering an all-in-one solution tailored for today’s hybrid work environments. Key benefits include: 

  • Unified, cross-OS and third-party patching: Automate the entire patching process, from identifying and deploying missing updates to real-time reporting. 
  • Ease of use: Start getting value in minutes. Patch software consistently without legacy technology, clunky integrations, or multiple consoles. 
  • Vulnerability discovery and remediation: Prevent security breaches and ransomware attacks. Detect vulnerabilities in OS and applications in real-time and enforce remediation. 

Learn more about the difference Action1 can make for your IT operations with the first 200 endpoints free: https://www.action1.com/free-edition/

Contrast Security Releases Modern Heist Bank Report 2025 Which Revealing Critical Concern Over Zero-Day Attacks

Posted in Commentary on February 4, 2025 by itnerd

Contrast Security, the runtime security leader, today released Modern Heist Bank Report 2025, revealing that the financial sector faced a surge in attacks, with 64% of respondents reporting cybersecurity incidents in the past 12 months. Contrast Security’s annual report sheds light on the cybersecurity threats facing the financial sector, providing an eye-opening perspective on the changing behavior of cybercriminals and defensive shifts in today’s environment.

Contrast Security researchers found that 71% of respondents reported zero-day attacks as the key concern to safeguarding applications and APIs, followed by dwell time (43%) and lack of visibility into the application layer (38%). The overwhelming concern with zero-day attacks aligns with key industry research and trends showing significant increase in zero days being exploited year-over-year. The rise in zero days is largely due to heavy spending from nation states. China and Russia are increasing their efforts to discover and create zero days to infiltrate Western critical infrastructures. 

Financial institutions are further challenged by legacy technology, with 82% overrelying on web application firewalls (WAF) and 61% saying they considered their WAFs to be effective. However, reliance on WAFs alone is inadequate against zero-day exploits and modern application attacks. In light of all this, it’s no surprise that zero days were the top application-related security concern. In fact, fewer than 25% said they were confident that their current security controls could mitigate such an attack.

The report’s key findings include:

  • Two-thirds of financial institutions have experienced a cyber incident in the last 12 months
  • Respondents reported a 12.5% increase in destructive cyber attacks, which are launched punitively to destroy data and burn the evidence as part of a counter-incident response 
  • Over two-thirds experienced attacks focused on stealing non-public market information, with cybercriminals using it for insider trading, digital front running, and shorting stock before they dox the stolen, confidential data to the regulators
  • Over 71% said zero-day attacks were the biggest issue they faced in regard to safeguarding their applications and APIs
  • Over half experienced a supply chain attack
  • Top two attack vectors were APIs and cloud environments, followed by applications
  • 60% said their investments in XDR did not provide visibility into behavioral anomalies at the application layer

Offense must inform defense, and as zero days and API attacks surge, financial institutions need to implement ADR solutions purpose-built to provide ground truth at the application layer.  

ADR is the only real-time and always-on application and API security solution that prevents exploits in production and insecure programming during development. As a result, organizations are enabled to block attacks and easily scale to protect the entire software portfolio, including applications, APIs, and third-party applications.

To download the full report, visit https://www.contrastsecurity.com/modern-bank-heists-report-2025-adr.

Zoho Corporation Announces Zia Agents; AI Platform Supporting Autonomous Agents Across Organization’s Broad Portfolio

Posted in Commentary with tags on February 4, 2025 by itnerd

Zoho Corporation, a global technology company, today expands the scope of Zia with the announcement of Zia Agents, Agent Studio, and Agent Marketplace. Together, these solutions empower enterprises to access, build, and distribute intelligent, autonomous digital agents across their organizations. Beginning today, Zoho and ManageEngine will be previewing pre-built, task-specific Zia Agents, which will deploy across Zoho Corporation’s combined portfolio of 100+ products in the coming weeks. 

Zoho Corporation’s in-house AI has evolved over the past decade from proactive to prescriptive to generative to agentic: 

Zia: Launched in 2015, Zia is Zoho Corporation’s foundational AI, facilitating all intelligent and contextual actions across the company’s ecosystem of apps. Zia possesses a vast and diverse skillset. New skills are being implemented regularly to boost customer experience and drive productivity.

Ask Zia: Launched in 2018, Ask Zia has developed into a system-wide conversational assistant that helps employees work smarter and accomplish tasks more effectively. For example, an account manager can review a report of customers at risk of churn, summarize the outcomes of each customer’s recent interactions, filter and summarize helpdesk tickets, analyze trends in their industry, and reach out to that customer for a meeting based on the employee’s upcoming travel schedule, without leaving the Ask Zia interface. Ask Zia is powered by Zoho’s unified data platform and will be contextually embedded across all applications.

Zia Agents: Today, Zoho Corporation has previewed some of the several dozens of pre-built Zia Agents that will be rolled out in the coming months, including an Account Manager Agent, SDR Agent, HR Agent, Customer Support Agent, IT Help Desk Agent, and a SalesCoach Agent. For customers, partners, and developers looking to create their own agents, Zoho is launching Zia Agent Studio, allowing them to build and deploy customized agents with inherited skillsets, which can then be distributed through Zoho’s Agent Marketplace.

  • Zia Agent Studio: Offering no-code and low-code experiences, Zia Agent Studio enables users to build autonomous agents with skills relevant to their specific needs. Zia Agent Studio users can also access a wide range of pre-existing Zia Skills, tools from across the Zoho ecosystem, data from a unified data platform, and a range of language models. These can be agents within a function (like an SDR agent or email support agent) or natively cross-functional agents (like an RFP agent or loan approval agent). They can be deployed on any Zoho application and summoned using Ask Zia. Moving forward, Zia Agents will be deployable in any third-party application as well. Additionally, Zia Agents with complementary skillsets can be combined using Zia Agent Studio, creating a single agent capable of cross-functional work.
  • Agent Marketplace: Agents created using Zia Agent Studio can be published in the Agent Marketplace. Zoho Corporation will offer a pre-built roster of agents, while the company’s ecosystem of partners and developers can build and distribute specialized AI agents through the marketplace, which can be reused and instantly deployed by organizations. 

Organizational Differentiation

Today’s announcement follows record growth for Zoho Corporation, which onboarded 110,000 new customers globally in 2024. With over 850,000 customers globally in diverse industries, using a range of tools across Zoho and ManageEngine, Zoho Corporation’s AI solutions are informed by a vast range of functional data. This is a core differentiator for the company, putting it in a unique position to serve businesses with cutting-edge technology. 

Technological Differentiation

Zoho Corporation’s distinct technological breadth and depth is a fundamental differentiator, particularly in AI development and deployment. Leveraging its shared data model, owned and managed tech stack, including global data centers, and a broad application portfolio, Zoho Corporation’s highly secure, privacy-compliant, usable, capable, and deeply knowledgeable AI agents deliver superior technology at a high value to its growing customer base. 

Availability

These capabilities will begin to roll out to a limited set of customers, which will expand monthly. 

OWC Announces General Availability (GA) Launch of OWC Dock Ejector 2.0

Posted in Commentary with tags on February 4, 2025 by itnerd

 Other World Computing (OWC) today announced the general availability (GA) launch of the OWC Dock Ejector 2.0, the ultimate solution for efficiently and safely ejecting all connected devices, including SoftRAID and AppleRAID volumes. This updated version works with all docks, including non-OWC docks and hubs, expanding compatibility and drive protection to all Mac and PC users.

The newly enhanced OWC Dock Ejector takes the tedium and risk out of un-docking devices individually. By ensuring all data has been written before any disk is unmounted, you can safely eject your dock without worrying about losing or fragmenting files.

New in OWC Dock Ejector 2.0:

1.)  Streamlined install process (new for Mac) – OWC is the first to ship software that enables high-power Thunderbolt dock ports without requiring reduced macOS security settings.

  • OWC Dock Ejector 2.0 eliminates the need for Recovery Mode and simplifies the process compared to competing docks, which require users to boot into Recovery Mode, lower Mac security settings, reboot multiple times, and install system extensions. With OWC Dock Ejector 2.0, simply install the software, approve the system extension, and you’re done!

2.)  Enhanced Volume Mounting (new for Mac) – OWC Dock Ejector 2.0 simplifies volume management like never before. If you unmount a volume, you can easily remount it without the hassle of unplugging cables or using Apple’s Disk Utility application.

OWC Dock Ejector 2.0 Features and Benefits:

●     Data Security – Avoid data corruption by safely ejecting all connected drives with a single click.

●     Easy Connection Management – Optimized for seamless disconnection of storage devices and peripherals.

●     Security First – No need to compromise your macOS security settings.

●     Timesaving – Skip the tedious recovery mode process required by other docks.

●     User-Friendly – Designed for simplicity without sacrificing functionality.

OWC Dock Ejector 2.0 is now generally available (GA) and is FREE.

Visit https://www.owc.com/solutions/dock-ejector to learn more and start optimizing your workflow.

Tariffs And IT: Are They Disruptive To The Sector?

Posted in Commentary on February 3, 2025 by itnerd

President Donald Trump loves his tariffs. He sees them as an offensive weapon. Actual economists don’t see it that way. But they don’t run the US. The real question is, what effect will tariffs have? To answer that question, I got this comment from  Kevin Surace, CEO, Appvance the “Father of The Virtual Assistant” regarding the potential impacts of proposed tariffs on IT. Seeing as this is an IT focused blog:

“Tariffs will increase the cost of nearly all hardware since components are sourced from China and many products are assembled there as well. It’s a little late to mitigate! But moving sourcing out of China has been an obvious choice for a few years. Few did so. But now there is no choice but to scramble.

“In some cases where automation is possible, we will see more onshoring. In other cases nearshoring or sourcing from democracies. The days of dealing with communist countries for ultra low labor costs may be waning.

The IT industry both sources from and sells to China specifically. This will likely increase competition within China from local vendors and increase US vendors costs. It cannot have a positive effect on any customers.”

I have to admit that I am considering moving up some of my tech purchases to lessen the impact of tariffs. Because while I don’t know how long this will go on for, I do know that there will be no winners.

“Infrastructure Laundering” Exploits AWS and Azure to Launch Attacks

Posted in Commentary with tags on February 3, 2025 by itnerd

Researchers have identified a new cybercrime tactic they’ve dubbed “Infrastructure Laundering” exploiting mainstream Amazon Web Services and Microsoft Azure. Threat actors operating “hosting companies” rent IP addresses from mainstream hosting providers and map them to their criminal client websites. You can read the details of this new threat here:

 https://www.silentpush.com/blog/infrastructure-laundering/

Erich Kron, security awareness advocate at cybersecurity company KnowBe4, commented:

“It’s no secret that phishing and other scam websites don’t stay online very long, and this is a clever way to acquire the IP address needed to host credential stealing, malware spreading, or other scam websites with little or no risk and very low cost. By utilizing major providers, the bad actors make it much tougher for organizations to block IP ranges, because those major providers may also be providing legitimate IP addresses for important web services. This precludes the ability to block large chunks of addresses easily.

Because the bad actors are not likely to set up an account using their own information, they’re liable to rely on stolen accounts to acquire these new IP addresses. Because much of the account takeovers involve the use of stolen or cracked credentials, it makes the need for the use of a phishing resistant Multi-Factor Authentication (MFA) technology critical, especially on any accounts with elevated permissions.

Organizations should review the accounts with access, audit transactions, and educate people on how to spot potential malicious activity within their cloud accounts.”

I strongly suggest that you do read it as it is eye opening. Even for someone like yours truly who lives this stuff on a daily basis.

VPN Mentor Reports On Generative AI’s Impact on Cybersecurity

Posted in Commentary with tags on February 3, 2025 by itnerd

VPN Mentor just published an Q&A report in which they delve deeper into AI’s groundbreaking technology and its impact on cybersecurity. Cybersecurity expert Jeremiah Fowler sheds light on the critical role that generative AI plays in safeguarding digital environments against evolving threats. 

You’ll find the full report here: https://www.vpnmentor.com/news/genai-and-cybersecurity/

Bell Canada Seriously Needs To Fix Their Customer Service Issues

Posted in Commentary with tags on February 2, 2025 by itnerd

I’ve written about Bell’s customer service issues in the past. For example when I was a customer of their’s (technically I still am as my ISP of the moment is Distributel which is owned by Bell) I had this incident. Or this incident. But at the same time, this incident highlighted the fact that Bell is capable of stepping up and providing good customer service.

Today I’m going to tell you about a client of mine who is on the negative side of this. It stated last week when she phoned me to ask me to visit her home to troubleshoot a TV issue. This client has Bell for home phone, Internet, TV and cellular, and she couldn’t watch TV. When I arrived I quickly determined that the Bell TV box wasn’t connecting to her Gigahub, which is Bell’s name for their modem that connects you with their fibre optic service known as Fibe. Taking a look at the Gigahub, it appeared to be frozen. No problem I thought. I will reboot it and all should be right with the universe. Except unplugging it and plugging it back in resulted in a reboot loop. As it it would constantly reboot. That implied that the Gigahub was faulty. So since this client is a senior, she asked to help her talk to Bell to get this fixed. So she dialled them, verified her identity using her PIN along with a bunch of other information and then let me take control of the call to troubleshoot this with Bell. Long story short, it was determined that the Gigahub was faulty. The person on the other end of the line claimed that a new one would be sent out by FedEx or Purolator Courier preconfigured and would arrive the next day.

Now my Spidey Sense went off as I have never heard of Bell shipping replacement modems of any kind that quickly. But I dismissed that as I thought that maybe Bell had stepped up their game. I then asked the client to call or email me when the modem arrived, I would do the modem swap and drop off the old modem with whatever courier company Bell used to ship it to her.

The next day the modem didn’t arrive as Bell promised. I honestly wasn’t surprised by that. And when the client checked in with Bell to see what the problem was…. I’ll let her tell you in her own words via the email that she sent me:

So no delivery of a Bell box…. Such a nuisance!

What’s the next step?

I asked her to phone Bell. And she did. This was the next email that I got:

So…. Eventually it turns out that the order is in for a new modem but that it takes 2-3 business days… 

So we’ll see…

Cheers 

Now this sounds like the Bell that I am used to dealing with. It also meant that the guy that we spoke to together lied.

Sidebar: In my opinion, companies who provide customer facing support as part of their product offering need to aggressively monitor every employee they have to ensure that any bad actors are found and eliminated. And conversely any excellent employees are found, praised, and rewarded for the good work. That way you create a culture where providing excellent customer service is the only behaviour that is acceptable. I suspect Bell doesn’t do this at all, or as aggressively as they should because if this guy is on their payroll or part of an company that they outsource to and is able to lie to customers, it’s highly likely that other people exist within Bell or whatever company they outsource to who also do the same thing as they think that their odds of getting caught are low.

Unfortunately, things only get worse from here. I followed up with her a couple of days later when I didn’t hear from her and got this response:

So the saga continues…. No orders were put in.. I tried Sat and this am.

So I’m trying to dismantle the modem in order to return it to a Bell store (50 Bloor)

I can’t dislodge the cable.

Could you possibly swing by to do that?

The cable that she was referring to was the fibre optic cable. I was working with another client at the time and didn’t see this email until a couple of hours had passed, and by that point she got her son to come over to remove the cable. Hopefully not breaking it as fibre optic cables are fragile. But now we’ve moved from a situation where the new modem which the Bell rep said would arrive the next day, to one where the modem would arrive in two or three days, to one where an order for a new modem was never put in which forces a senior to take the old modem to a Bell store in hopes of getting a replacement.

Now the story does get better. Sort of. She did return the modem to the store after removing the cable. And then three days later a new modem did arrive and her son was able to help her to set it up. But the whole experience left her frustrated and upset and reconsidering if she should continue her relationship with Bell.

The thing is, negative experiences with Bell seem to be a common thing these days. Besides this report from the CCTS where complaints about Bell are not only up massively, but are second only to Rogers as well. And a browse of the Bell SubReddit seems to validate that Bell isn’t in a good place when it comes to customer service. Take this example, or this example, or this example. Now to be fair to Bell, these are a handful of examples that I found in five minutes of browsing on Reddit. But my counter argument to that is that if you accept that only a handful of people complain about service in public, there are many others who complain in places other than Reddit. And if you’re Bell, you should be very, very concerned.

Now Bell hasn’t posted its quarterly numbers yet. But last quarter it lost money which is absolutely mind blowing to me as Bell as long as I have been alive has just made money simply by existing. One factor in them losing money was this:

BCE added 33,111 net postpaid mobile phone subscribers, down 76.8 per cent from the same period last year, which was the company’s second-best performance on the metric since 2010.

It said the drop was driven by higher customer churn — a measure of subscribers who cancelled their service — amid greater competition and promotional offers. BCE’s monthly churn rate for the category was 1.28 per cent, up from 1.1 per cent during its previous third quarter.

“I’m not happy with where churn is. I don’t think anyone would be given the numbers,” said Bibic, adding the company is coping with “what’s arguably been the most competitively intense market we’ve seen.”

“It is a marketplace reality that consumers are continuing to shop for deals given the sustained, aggressive promotional offers that are in the marketplace. So because of that, you’re going to see a lot of switching activity.”

BCE also saw 11.6 per cent fewer gross subscriber activations. Bell’s wireless mobile phone average revenue per user (ARPU) was $58.26, down 3.4 per cent from $60.28 in the third quarter of the prior year.

This isn’t a good situation for Bell. But you fix a situation like this by having a good product at a fair price with good customer service to back it up. If Bell is going to improve their fortunes, they need to improve on all these fronts. Especially customer service. Because without that, the first two don’t matter.

Let’s see if they’re able to do that over the near term. I don’t think they can, but as always, I am free to be surprised.

LimaCharlie Free Cybersecurity Workshop On 2/12/25 In Plano, TX

Posted in Commentary with tags on February 2, 2025 by itnerd

Join LimaCharlie at Legacy Food Hall in Plano, TX for an intensive, hands-on cybersecurity workshop tailored specifically for MSSPs, MDR providers, and incident response teams.

In this technical deep-dive, industry veterans Ken Westin and Matt Bromiley will guide you through practical implementations that directly address your operational challenges. 

Learn how to streamline your Okta security monitoring through purple team exercises, and master automated incident response workflows to dramatically improve your team’s efficiency. Discover how to leverage infrastructure as code and automation to scale your security operations while maintaining the high standards your clients expect.

These free workshops provide innovative ways to enhance your service capabilities and include a post-event happy hour for networking with your peers. Space is limited – reserve your spot today.

  • What: Free cybersecurity workshops featuring hands-on training with LimaCharlie and open-source adversary emulation tools 
  • When: February 12, 2025
  • Session 1: 1:00 PM – 3:00 PM – Purple Team Okta Security with Ken Westin – Identity Security Posture Management (ISPM) is a critical component to any organization’s security program, particularly in a highly distributed environment. In this hands-on workshop we will show attendees how to onboard Okta logs to the LimaCharlie Security Operations Platform, write detections for key events, and test detections using open source adversary emulation tools. The workshop will be run in an individual lab we will build using a combination of free and open source tools. A basic understanding of YAML and writing detections is helpful but not required.
  • Session 2: 3:00 PM – 5:00 PM – IR Automation with Matt Bromiley – Incident response is an art that requires speed and precision, oftentimes racing against adversaries and their actions. In this workshop, we will look at how to utilize LimaCharlie to automate incident response workflows from end-to-end. Attendees will learn how to utilize infrastructure as code to rapidly deploy IR-focused tenants, easily ingest various telemetry types, and deploy detections to automate the classification and prioritization of a client environment. Designed for incident responders, this hands-on session will highlight how LimaCharlie can streamline incident response efforts, giving your team the advantage it needs to quickly thwart attackers.
  • Happy Hour: 5:00 PM – 7:00 PM
  • Who: Security professionals, especially those from MSSP, MDR, and IR teams 
  • Why: To provide practical, hands-on experience with cutting-edge cybersecurity tools and techniques 

These workshops offer a unique opportunity for DFW-area security teams to enhance their skills in Okta security and incident response automation. Participants will work with real tools, including LimaCharlie, under the guidance of industry experts Ken Westin and Matt Bromiley.