Author Archives: Megan Carnes

Ransomware has become a constant threat in today’s world of emerging technologies. Threat actors are increasingly using this attack method to cripple corporate infrastructures, extract large sums of money as payment, and damage their reputation.  

Thrive’s Cybersecurity Incident Response Team (CIRT) recently prevented a threat actor from accomplishing those goals. A client who had not invested in Endpoint Detection and Response (EDR) solutions, was attacked. Despite the lack of endpoint tooling and customer documentation, Thrive’ s CIRT quickly responded to the developing incident, gathered crucial forensic artifacts, and launched an in-depth investigation. Thanks to CIRT’s methodical investigation it was determined a threat actor had encrypted numerous files, appending the extension .solution247 to each file.  

Additionally, every file directory contained a file named how_to_back_files.html, which included an extortion message from the attackers, detailing their ransom demands and instructions for potentially recovering the encrypted data.

Further analysis revealed that Remote Desktop Protocol (RDP) connections to the impacted server came from VPN during the period of compromise. A review of the firewall logs indicated that the user account used to authenticate to the VPN was compromised through a distributed brute-force attack.  

Using the low privilege VPN credentials, the adversaries were able to gain access to a domain controller and file server. Once they obtained access to these systems, they quickly installed AnyDesk, a commercially available remote access tool, likely used to establish persistent access. Shortly after, they executed tools such as CredentialFileView, SoftPerfect Network Scanner, and Process Hacker. 

The SoftPerfect Network Scanner was found to have accessed a file at the following location: C:\Users\Redacted\Documents\anetscan (6)\anetscan (5)\anetscan (4)\automim\!logs\Passwords.txt. This file was part of an automated process for scanning and attempting authentication on other network resources. Evidence of access attempts to the NTDS.dit, a “crown jewel” asset for an attacker, was also discovered during this period. Subsequently, the threat actors successfully gained access to several administrator accounts

A file named Solution247.exe was downloaded to C:\Users\Redacted\Documents\.  Solution247.exe—was identified as the BabyLockerKZ ransomware variant—was extracted. Prior to the file encryption, there was evidence of exfiltration from the compromised server to an IP address associated with the internet service provider 59telecom.ru over port 21 (FTP). Upon execution, Solution247.exe added itself to the current user’s Run key to maintain persistence with the following command: 

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v sm /t REG_SZ /d “C:\Windows\System32\ Solution247.exe” /f 

The ransomware then forcefully terminated critical processes essential for system operation and security, including SQL Server, Windows Defender, user login processes, and print services: 

cmd.exe /c taskkill /F /IM sqlservr.exe /T 

taskkill /F /IM msmpeng.exe /T 

taskkill /F /IM winlogon.exe /T 

taskkill /F /IM spoolsv.exe /T
 

Next, Solution247.exe  disabled key services using net stop commands, disrupting crucial system operations, including antivirus and backup systems: 

net stop “Windows Defender Antivirus” 

net stop “SQL Server (MSSQLSERVER)” 

net stop “Windows Backup” 

After disabling these defenses, Solution247.exe began encrypting files across multiple drives using cipher.exe commands: 

cipher /e /s:C:\ 

cipher /e /s:D:\ 

To further hinder recovery efforts, it deleted volume shadow copies with.  

vssadmin delete shadows /all /quiet 

Despite the threat actors’ efforts to hinder recovery, the client had invested in Thrive’s Veeam backup solution. After receiving a detailed timeline of the intrusion, they were able to confidently restore their data and ensure the integrity of the impacted servers.  

Indicators of compromise:  

Would you like to learn more about the indicators of compromise we found? Reach out today and we will provide the full list to you. 

Today’s complex cyber threats require a multi-solution approach combined with advanced skill sets and real-time, 24/7 monitoring. Thrive’s leading security platform integrates best in breed technologies, analyzing attack data with AI and certified security analysts to prevent the impacts from threats allowing you to focus on critical business outcomes.

Our security team combines the power of automation for rapid response and remediation with the expertise of our staff to address complex issues intelligently. We are ready to help.

G. Modiano, one of Europe’s largest wool manufacturers, needed to modernise its IT systems without disrupting daily operations. To help tackle this, they partnered with Thrive. Thrive stepped in to secure and streamline its cybersecurity posture, ensuring G. Modiano stayed ahead in a rapidly changing digital world while keeping its global operations running smoothly.

G. Modiano is a major player in the wool manufacturing industry, with operations spanning multiple countries. As a company deeply rooted in industrial production, its IT infrastructure supports both corporate operations and factory machinery across jurisdictions. Over the past couple of years, Thrive has been an instrumental partner, ensuring G. Modiano’s security framework remains robust, scalable, and ready to meet the demands of modern business operations.

Why Thrive Was Chosen

When Perry Willis, IT Director of G. Modiano, joined the company seven years ago, he recognised the need to modernise the company’s IT infrastructure. While the existing systems were functional, they were fragmented and outdated. “The infrastructure wasn’t broken, but it hadn’t moved forward with the times,” Perry explained. The company needed a forward-looking cybersecurity approach that could integrate its systems while maintaining seamless operations.

After evaluating several providers, Perry selected Thrive for their ability to deliver reliable, repeatable security solutions with minimal complexity. Thrive’s reputation, strengthened by its acquisition of the UK-based ONI, and their proactive, customer-focused approach made them the clear choice for G. Modiano’s evolving needs.

Strategic Deployment of Advanced Security Measures

Thrive began its partnership with G. Modiano by conducting penetration testing to identify vulnerabilities within the company’s IT infrastructure. Unlike previous providers, Thrive’s approach stood out due to their transparent and straightforward project management. Perry appreciated the clear feedback, stating, “The project management was really good, very honest…refreshing, really.” Thrive delivered detailed reports with actionable insights, without the unnecessary complexity often seen in cybersecurity evaluations, providing G. Modiano with the tools to strengthen its security posture.

One of the key challenges G. Modiano faced was managing compliance across multiple jurisdictions, given its operations in Europe and beyond. With data centres in the UK and infrastructure spread globally, ensuring adherence to regional regulations was critical. Thrive played a pivotal role in navigating these complexities, helping G. Modiano maintain compliance with regulatory requirements while securing its diverse IT infrastructure. Thrive adapted and provided solutions that ensured both security and regulatory compliance across all operational areas.

Thrive’s Impact

Beyond technical results, Thrive’s people have played a crucial role in the partnership’s success. Its project management team, particularly the dedicated account manager, has gone above and beyond to ensure G. Modiano’s unique needs were met. Thrive’s combination of cutting-edge technology and personal commitment to customer success has reinforced G. Modiano’s trust in the partnership.

Thrive didn’t just offer a one-size-fits-all service; they actively listened, responded quickly, and ensured every detail was addressed. The team’s open communication and straightforward approach made G. Modiano feel supported at every stage of the partnership.

Thrive’s success with G. Modiano goes beyond just technical results—it’s the people behind the solutions that have truly made a difference. Despite G. Modiano being a smaller business in terms of its corporate headcount, Thrive understood the complexity of its IT infrastructure and handled it with precision. Thrive’s solutions allowed Perry and his team to focus on the core business without being bogged down by the technical intricacies. “Thrive delivered exactly what they promised, on time, and without any fluff,” Perry said. That straightforward reliability is what solidified G. Modiano’s trust in Thrive. Thrive team members didn’t just deliver technology—they provided peace of mind, making G. Modiano feel confident and secure about the future

“The business outcome with Thrive wasn’t just about security; it was about having a partner who delivered consistently, streamlined our processes, and gave us full transparency into every step. We’re confident in our infrastructure now, knowing it’s well-managed and future proofed.” ~ Perry Willis, IT Director, G. Modiano

About Thrive

Thrive delivers global technology outsourcing for cybersecurity, Cloud, networking, and other complex IT requirements. Thrive’s NextGen platform enables customers to increase business efficiencies through standardization, scalability, and automation, delivering oversized technology returns on investment (ROI). They accomplish this with advisory services, vCISO, vCIO, consulting, project implementation, solution architects, and a best-in-class subscription-based technology platform. Thrive delivers exceptional high-touch service through its POD approach of subject matter experts and global 24x7x365 SOC, NOC, and centralized services teams. Learn more at www.thrivenextgen.com or follow us on LinkedIn.

mhs homes, a leading housing association in the U.K., partnered with Thrive to upgrade from an on-premise telephony system to a Cloud-hosted SIP solution, seeking greater resilience, simpler management, and scalability. Thrive’s solution, featuring a Cisco Unified Communications Manager and an integrated contact center, ensured seamless continuity. Thrive’s responsiveness and understanding of mhs homes’ mission made the transition smooth and impactful.

mhs homes, managing over 10,000 affordable housing units in North Kent, needed to modernise its aging telephony system. Focused on providing housing solutions, they required a resilient, scalable system to meet growing needs. Thrive was chosen to implement a Cloud-hosted SIP solution to modernise communications while aligning with mhs homes’ mission of delivering value for money.

Why Thrive Was Chosen

mhs homes chose Thrive because of its ability to integrate the existing on-premise infrastructure with a new Cloud-hosted SIP solution. Thrive’s industry expertise, particularly through its acquisition of ONI, a previous partner of mhs homes, solidified the decision to continue the collaboration.

Amanda Hodge, IT Manager, explained, “Thrive stood out because of its understanding of our focus on value for money. They seamlessly combined our current technology with their Cloud solution, making the transition cost-effective and efficient.”

Strategic Deployment of Advanced Security Measures

Thrive implemented Cisco Unified Communications Manager, integrated call recording, and a contact center express to meet mhs homes’ communication needs. The redundancy allowed mhs homes to maintain full functionality, even during network outages or power disruptions.

“Moving to the Cloud relieved us of managing an on-premise infrastructure,” said Hodge. “We kept the handsets on-site, but everything else, from call management to reporting, was migrated to the Cloud. Thrive provided a resilient solution that ensured business continuity, even during challenges like the COVID-19 pandemic.”

Thrive’s Impact

The transition to a Cloud-hosted telephony solution profoundly impacted mhs homes, improving operational efficiency and system resilience.

“The biggest benefit for us has been the reduced management overhead,” Hodge shared. “With Thrive managing the system, we no longer have to worry about upgrades or outages. Even when we’ve experienced issues on our end, our telephony system has stayed up and running, allowing us to maintain communication with our tenants.”

Thrive’s ability to customise solutions and provide responsive support further strengthened the partnership, ensuring that mhs homes could focus on its core mission of providing housing to those in need.

“Thrive’s team has been great to work with. They understand our charitable goals and have tailored the solution to meet our unique requirements, ensuring we can deliver excellent service to our tenants,” Hodge concluded.

“Thrive provided us with a Cloud solution that not only modernised our telephony system but also gave us the resilience and flexibility we needed to keep serving our tenants without disruption. Their ability to customise the solution to our specific needs and mission has been invaluable.” ~ Amanda Hodge, IT Manager, mhs homes

About Thrive

Thrive delivers global technology outsourcing for cybersecurity, Cloud, networking, and other complex IT requirements. Thrive’s NextGen platform enables customers to increase business efficiencies through standardization, scalability, and automation, delivering oversized technology returns on investment (ROI). They accomplish this with advisory services, vCISO, vCIO, consulting, project implementation, solution architects, and a best-in-class subscription-based technology platform. Thrive delivers exceptional high-touch service through its POD approach of subject matter experts and global 24x7x365 SOC, NOC, and centralized services teams. Learn more at www.thrivenextgen.com or follow us on LinkedIn.

For mid-size British businesses, the cyber threat landscape has become a minefield in recent years. We have already reported on state-sponsored threats to private companies and public services. This year’s massive cyber attack on London National Health Service (NHS) hospitals by a Russian ransomware group has caused hundreds of operations to be cancelled, the need for emergency blood supplies to be found, and IT systems suspended, leading to the manual processing of patients because of a hack into the NHS supply chain.

While criminal hackers and financially motivated cybercrime groups have long plagued companies from known sources, a new and even more alarming threat has emerged: state-sponsored hacking operations backed by the Chinese government.

Recent developments have shed light on the sophisticated and persistent efforts by Chinese hackers to compromise systems, steal data, and even interfere with democratic processes across the UK and its allies. No business is immune, no matter its size or sector, so in this article, we’ll explain how you can protect your business from this imminent threat.

Investigated by the NCSC

In March 2024, the UK government took the bold step of publicly calling out China for two major cyber campaigns targeting British democratic institutions and Members of Parliament. As revealed by the National Cyber Security Centre (NCSC), a Chinese state-affiliated group gained widespread access to the systems of the Electoral Commission between 2021-2022, potentially exposing data on a whopping 40 million Britons on the electoral register. In a separate campaign in 2021, the same Chinese hacking group carried out reconnaissance against British members of parliament, particularly those outspokenly critical of Chinese government policies.

These were by no means isolated cases but rather represent, according to the Foreign Office, a “part of a large-scale espionage campaign” by China. These revelations were supported by allies like the United States, who announced criminal charges against Chinese hackers and partners across Europe and the Indo-Pacific, condemning Beijing’s malicious cyber activity.

Newly discovered malware

One particularly sly tactic Chinese threat groups use is exploiting the trusted relationships and supply chains of the targeted organisations. Crowdstrike’s Global Threat Report assessed that Chinese threat actors known as “Jackpot Panda” and “Cascade Panda” “consistently exploited trusted relationships through supply chain compromises and actor-on-the-side or actor-in-the-middle attacks.” These groups can quickly gain clandestine access and deploy malware inside a victim’s network by hijacking software updates or compromising close third-party vendors.

For example, Jackpot Panda was found to have “trojanised” installers for legitimate Chinese software to deploy their malware. Similarly, Cascade Panda intercepted update traffic from commonly used software utilities to install its WinDealer remote access tool on systems belonging to Chinese-speaking targets. Even little-known groups potentially linked to Beijing pulled off supply chain attacks, such as compromising an Indian (among other) critical infrastructures with a cybersecurity vendor, I-Soon, distributing malware via its software updates across multiple sectors, affecting users across the globe.

Three ways your company could find itself in the firing line

While the Chinese government’s motivations may usually be centred on gathering intelligence (mainly for monitoring dissidents), UK companies could easily get caught in the crosshairs. Firstly, they represent a treasure trove of intellectual property, research, customer data, and other sensitive information crucial to Beijing’s strategic interests and economic leverage. The Chinese military policy of “civil-military fusion” blurs any remaining lines between the private sector and state assets.

Secondly, British firms are deeply embedded in the same supply chains, software ecosystems, and trusted vendor relationships, actively being exploited as vectors for initial access by Chinese hackers. After all, a company’s cybersecurity posture is only as strong as its weakest link in such an interconnected business environment. Threat actors have demonstrated a keen ability to methodically map out these interdependencies and pounce when the opportunity presents itself.

Finally, UK businesses like yours should be prepared for the potential collateral damage and interruptions caused by Chinese cyber operations, even when not directly targeted against them. The data thieves’ campaigns highlighted above directly interfered with the IT systems of government bodies responsible for administering elections and democratic processes in Britain. So, any company’s operations could halt if its technologies or data flow intersects with compromised systems.

How can you shield your business?

In the face of this daunting threat from a competent nation-state adversary, mid-size UK businesses must boost their cyber defences and resilience. A proactive, comprehensive cybersecurity strategy centred around advanced threat detection capabilities is essential. Implementing strong access controls such as multiple-factor authentication, tight identity management, encryption, and vetting the cybersecurity practices of third-party vendors can all reduce risk exposure.

However, even the most robust technical controls have limits against skilled, determined, and infinitely meticulous nation-state attackers like China’s hacker groups. Businesses require professional cybersecurity monitoring services, threat-hunting experts, and incident response capabilities to identify and neutralise intrusion attempts quickly. For this reason, continuous security awareness training to educate employees on the latest tactics, like supply chain compromises, is also critical.

Take protective steps now

As the UK government has demonstrated with its recent actions, exposing and holding malicious Chinese cyber criminals accountable is a priority for preserving our national security and democratic values. Businesses must follow suit and implement comprehensive defences against this looming threat. Unfortunately, failing to do so risks surrendering your organisation’s most valuable data, suffering crippling interruptions, or unwittingly aiding and abetting Beijing’s authoritarian projects. Now is the time to get ahead of those jeopardising UK companies – before a rocky cyber stance becomes a devastating crisis for your company.

Don’t hesitate to contact Thrive today to learn more about nation-state threat detection and mitigation strategies tailored to mid-market UK businesses. Protecting your organisation from state-backed cyber campaigns demands the vigilance and expertise that our experienced team can provide you with every step of the way.

Michael Gray, CTO, Thrive: While the Securities and Exchange Commission’s (SEC) Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules went into effect toward the end of 2023, many organizations still have questions when it comes to filings and disclosures. Under these rules, organizations have to disclose significant cybersecurity incidents and provide annual updates on their cybersecurity posture. Being able to accurately share cybersecurity updates, sometimes within short time frames, requires teams to have a deep understanding of 8-K and 10-K filings, and to implement new processes that simplify compliance.

Bridging The Gap

At Thrive, we’ve been through an amazing journey with ServiceNow Service Bridge, an extremely powerful feature that’s part of the Thrive Platform. Thrive is one of the few Service Bridge-integrated providers, providing your organization with even greater access to the Thrive Platform and its NextGen capabilities. Currently, the Thrive Platform gives clients better access to service and more accurate environment insights, while also transforming how IT is consumed through self-service.

What is Service Bridge? 

Service Bridge is an application that allows businesses to connect two (or more) distinct ServiceNow instances to seamlessly collaborate and process requests while still working within your organization’s instance of ServiceNow.  As a business grows, and recognizes the need to scale their operations and outsource security or other IT functions, Service Bridge allows its ServiceNow instance and another provider’s instance to be directly connected. This allows the organization’s designated ServiceNow administrators to build assignment groups that reference the external instance and more important fulfiller groups from a third party, if needed.

Moving forward, if an incident is opened in an organization’s service portal, the record immediately replicates to the provider instance. As the provider’s resources update the incident, all the notes are sent back to the consumer instance in near real-time. Everything is seamless to the end user. The solution builds a team-like partnership without the need to change end user interactions.

Investing in ServiceNow can be costly to organizations – both in time and resources. With Service Bridge, organizations can maximize their investment. Many IT providers or IT management software require organizations to change their process in order to work together. Service Bridge dispenses with this requirement and highlights the value of robust software integration.

Service Bridge is licensed on the provider’s instance and is free to consumers. Thrive now offers Service Bridge integrated managed services, enabling your organization to seamlessly integrate with Thrive to reach your business goals and ensure business continuity and optimal customer service. If you are a ServiceNow customer and curious about Service Bridge’s offerings and capabilities, please see the following documentation.   

Contact Thrive today to learn more about ServiceNow and Service Bridge.

Monterone Partners LLP, a European equity-focused hedge fund in London, needed more support to manage its internal IT infrastructure and compliance. Over the past nine years, Thrive has been a steady and trusted partner and has reduced the firm’s costs associated with internal IT teams, equipment, and full-time employees needed to manage systems, data centres, hardware and more. 

Since 2015, Monterone, a small, London-based firm with only eight employees, has relied on Thrive to outsource its foundational IT infrastructure and security needs. Monterone benefits from Thrive’s comprehensive services, including its fully hosted IT infrastructure, managed zero trust, endpoint security, disaster recovery, and more. Thrive ensures Monterone’s operations remain resilient and compliant with SEC and FCA regulations. By removing the need for internal IT teams and reducing equipment costs, Thrive provides the critical foundation for Monterone’s growth and protection against cyber threats.

Why Thrive Was Chosen

Thrive, formerly known as Edge, stood out during Monterone’s search for a provider with deep expertise in alternative investments and hedge funds. Monterone recognised Thrive’s proven track record of delivering reliable solutions, which was crucial as the firm built its first infrastructure. The focus was on creating a system that was not only future-proof but also met stringent regulatory and resiliency requirements, particularly with the FCA and SEC providing oversight.

What truly sets Thrive apart is its ability to design and implement a solution tailored specifically to Monterone’s needs. Monterone relied heavily on Thrive’s expertise without an internal CTO to manage a smooth and disruption-free transition. This included everything from coordinating with providers to handling licensing and installation.

“Thrive’s expertise in alternative investments and hedge funds was invaluable. They also had experience with more complex firms, so they knew how to build a dependable system that could scale with us as we grew,” said Phillip Chapple, COO of Monterone Partners LLP.

Strategic Deployment of Advanced Security Measures

Monterone faced significant regulatory requirements and, without an internal CTO, needed a rock-solid and well-supported infrastructure, particularly with oversight from the FCA and SEC. The firm wasn’t seeking the latest technology but a reliable solution that could efficiently handle all their needs without complications.

“We were building our first infrastructure at the time and needed something that would last. We were focused on future-proofing, meeting all the regulatory and resiliency requirements, and finding a reliable partner for the long haul. Switching providers is a big deal for a firm our size—it’s disruptive and costly—so we had to get it right from the start,” added Chapple

Thrive handled every aspect of Monterone’s infrastructure setup. They sourced and installed all the necessary hardware, including printers, firewalls, switches, and wiring, and configured the Wi-Fi and internal networks. Additionally, they set up Monterone’s private Cloud infrastructure—a decision influenced by the regulatory landscape at the time, when public Cloud solutions were still met with some hesitation. Thrive also managed the piping and point-to-point connections to the data centres, ensuring a comprehensive and seamless implementation.

Thrive’s Impact

Over the past nine years, Thrive has been instrumental in helping Monterone navigate the increasingly complex world of compliance, especially as regulatory demands have intensified, particularly during events like COVID. Thrive’s proactive approach has consistently impressed Monterone, providing timely advice and solutions without waiting for instructions. Their expertise in regulated industries has allowed Monterone to stay ahead of industry standards with products that evolve alongside the firm’s needs without requiring major overhauls.

Thrive’s support has been particularly vital under the scrutiny of SEC and FCA audits, ensuring Monterone can securely store and easily reconstitute communications compliant, all while maintaining cost efficiency. The firm’s exceptional reliability has been a standout feature, with only one significant downtime incident in nine years—an issue promptly addressed and turned into a learning opportunity. Thrive’s proactive and seamless service has been vital to Monterone’s resilience, especially in trading operations where downtime could be detrimental.

“Thrive has always been proactive. They notice potential issues and start triaging before we realise a problem. They’ve often already switched over to backups or failovers by the time we’re aware of the situation. Their service is critical to us and consistently delivers what we need,” stated Chapple

“What impressed me most was how Thrive designed and implemented exactly what we needed. As a smaller firm, we didn’t have the in-house expertise to nail down every detail ourselves. We needed someone who could guide us without overcomplicating things. Thrive delivered a solution that fit us perfectly, handled all the providers and licensing, and took care of the installation. It was a white-glove service—they took care of everything and ensured it all happened with minimal effort and disruption on our end.” ~ Phillip Chapple, COO of Monterone Partners LLP

About Thrive

Thrive delivers global technology outsourcing for cybersecurity, Cloud, networking, and other complex IT requirements. Thrive’s NextGen platform enables customers to increase business efficiencies through standardization, scalability, and automation, delivering oversized technology returns on investment (ROI). They accomplish this with advisory services, vCISO, vCIO, consulting, project implementation, solution architects, and a best-in-class subscription-based technology platform. Thrive delivers exceptional high-touch service through its POD approach of subject matter experts and global 24x7x365 SOC, NOC, and centralized services teams. Learn more at www.thrivenextgen.com or follow us on LinkedIn.

In 2023, there was a 72% increase in data breaches since 2021, which has previously held the all-time record. In response to this growing frequency of cyber threats, cybersecurity insurers have significantly revised their policies for businesses, making them more stringent and demanding in terms of risk mitigation and management. Insurers are now requiring businesses to demonstrate not just the presence of cybersecurity protocols, but also their effectiveness and ongoing maintenance. For example, organizations are expected to implement comprehensive security measures, including advanced threat detection, regular vulnerability assessments, and a robust incident response plan. Failure to meet these heightened standards could result in denied claims, leaving businesses exposed during a cyber event and costing them financially.

In February, hackers took Change Healthcare offline in one of the most high-profile and wide-reaching cyberattacks to date. Change Healthcare serves hundreds of thousands of providers in the U.S. and processes billions of transactions every year. With Change Healthcare’s systems compromised, cash stopped flowing for hospitals and physician offices everywhere. Providers couldn’t submit new claims, pharmacies couldn’t charge appropriately for prescriptions, and prior authorizations couldn’t go through for critical procedures.

The healthcare industry poses a unique set of challenges when it comes to its cybersecurity framework. Hospitals, doctors’ offices, and local clinics are all home to vast amounts of sensitive patient and employee data. Hospitals alone store about 50 petabytes of sensitive data every year. In order to operate seamlessly and provide the best care possible, these healthcare havens need to ensure that their IT stack is robust. Cyber threats are rampant and have the potential to jeopardize patient privacy and safety, while also disrupting healthcare services to those in need and compromising the organizational integrity of the healthcare facility.