Infected User Response Guide

WHITEPAPER

Infected User Response Guide

Take swift action on malware infections

Malware Infected User Guide

Many users are unknowingly using systems infected with malware that provides cybercriminals with access to their account passwords and full browser details. Information pilfered by these “botnets” is collected by bad actors, shared in small circles, and sometimes posted in hacking web forums, making it simple for cybercriminals to perpetrate account takeover, SIM swaps, blackmail and identity theft, and make fraudulent purchases.

Enterprises can mitigate the risks associated with malware infections by taking swift action to inform affected users and help them remediate.


Download our Infected User Response Guide to learn:

  • How infected users impact your organization, even if the affected systems fall outside of corporate control
  • What it means when employee or consumer information appears on a botnet log
  • How to contact users with an action plan (we provide an email template you can use right away)

Solution: Account Takeover Prevention

Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.

Learn More

Download the Guide

Infected User Response Guide

A few of our happy customers:

The SpyCloud Difference

SpyCloud provides the earliest detection of potentially compromised accounts – those using credentials that have appeared in a third-party breach or in a botnet log, and are therefore at risk of account takeover. And we automate the remediation of exposed passwords, enabling enterprises to lock down accounts quickly, before damage is done. 

Our goal is to help organizations to protect themselves from criminal activity and disrupt criminals’ ability to profit from stolen data.

SpyCloud human intelligence researchers have recovered billions of data breach assets, including stolen passwords and emails that can put enterprises at risk of account takeover

Check Your Exposure

See your real-time account takeover exposure details powered by SpyCloud data.

CISO’s Guide to Surviving a Data Breach

WHITEPAPER

CISO's Guide to Surviving a Data Breach

Surviving a Data Breach
“Remember, they hired you for the tough times. You survive by leading the best you can.”

If 2020 taught us anything, it’s the importance of preparedness. Large-scale data breaches are on the rise, costing an average $3.86 million. It’s time to get serious about your breach prevention and response plans.

Start by seeing how 3 seasoned CISOs survived data breaches that exposed customer data, and came out the other side with proven advice and lessons learned.

Download our guide for advice on:

  • Pre-breach fundamentals
  • Detecting breaches & finding stolen data on the dark web
  • Handling media relations & notifying customers
  • Navigating litigation
  • Long-term security investments & the question of ROI
It’s a rare peek into the full lifecycle of real-world data breaches that will help you be better prepared.
Insights relevant to all industries came from our interviews with:
  • Anthem’s Former CISO, Roy Mellinger
  • Landry’s Former CISO, Damian Taylor
  • CareFirst BlueCross BlueShield’s Former CIO, Harry D. Fox

Download the Guide

CISO’s Guide to Surviving a Data Breach

A few of our happy customers:

The SpyCloud Difference

SpyCloud provides the earliest detection of potentially compromised accounts – those using credentials that have appeared in a third-party breach and are therefore at risk of account takeover. And we automate the remediation of exposed passwords, enabling enterprises to lock down accounts quickly, before damage is done. 

Our goal is to help organizations to protect themselves from criminal activity and disrupt criminals’ ability to profit from stolen data.

SpyCloud human intelligence researchers have recovered billions of data breach assets, including stolen passwords and emails that can put enterprises at risk of account takeover

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

SpyCloud Named 2020 Gartner Cool Vendor in Identity Access Management and Fraud Detection

ANALYST REPORT

SpyCloud Named a 2020 Gartner Cool Vendor in Identity Access Management and Fraud Detection

SpyCloud Gartner Cool Vendor 2020
“Seek insight from specialist intelligence providers to understand where information compromise and loss can harm the enterprise.”1

SpyCloud is one of only three companies recognized in the Gartner 2020 Cool Vendors in IAM and Fraud Detection report.

Findings from the report:

  • New solutions are required to reduce risk at sensitive points in the customer journey, including authentication and enrollment.
  • As the COVID-19 crisis deepens, technology decisions increasingly focus on value for money and user experience. Solutions that can support new modes of work and enhance user trust and safety are finding traction.
  • Fraud detection continues to bolster identity corroboration capability and accuracy, with the focus of attention being persistent identity throughout the customer journey.
Download the full report today to learn more about Gartner’s analysis of the IAM and Fraud Detection market.

Get the Report

Gartner 2020 Cool Vendors in IAM and Fraud Detection

SpyCloud is on a mission to disrupt the cybercriminal economy to eliminate the loss of money, time, and reputation due to online fraud – and ultimately to make the internet a safer place for individuals and businesses.

We’re proud to offer IAM and fraud prevention teams solutions backed by the most current, relevant and truly actionable data recovered directly from the criminal underground within days of a breach occurring.

Discover why Gartner thinks we’re a Cool Vendor!

Download the Report

SpyCloud human intelligence researchers have recovered billions of data breach assets, including stolen passwords and emails that can put enterprises at risk of account takeover

Gartner Disclaimer:
1 Gartner, Cool Vendors in Identity Access Management and Fraud Detection, 5 October 2020, Jonathan Care, Akif Khan, Tricia Phillips, and Felix Gaehtgens.

The GARTNER COOL VENDOR badge is a trademark and service mark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s Research & Advisory organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

See how SpyCloud helps your enterprise proactively thwart fraud.

Best Practices for Notifying Consumers of a Third-Party Data Breach

WHITEPAPER

Best Practices for Notifying Consumers of a Third-Party Breach

Preview of the SpyCloud whitepaper, "Best Practices for Notifying Consumers of a Third-Party Data Breach"

It’s no longer a question of ‘if,’ but ‘when.’

Your consumers will reuse passwords, and those passwords will be exposed in a third-party data breach. 

As soon as reused passwords become available to cybercriminals, your consumers are at high risk of account takeover fraud, which can result in substantial losses for you and for your consumers.

By monitoring your consumers’ credentials and resetting exposed passwords, you can help prevent account takeover and reduce online fraud. However, the language you use to notify them that their passwords must be reset requires careful consideration. Informing affected users that their credentials have been exposed on the criminal underground can encourage them to choose strong, unique passwords and protect any other accounts that share the same login information. On the other hand, some consumers may wonder how you located their information on the ‘dark web’ in the first place and where it was exposed.

Download our best practices guide to learn:

  • How to prompt users to change compromised passwords without introducing friction 
  • Why you should take care to consider the right level of transparency for your organization
  • What an effective consumer notification looks like

Solution: Account Takeover Prevention

Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.

Learn More

Download the Whitepaper:

Best Practices for Notifying Consumers of a Third-Party Breach

A few of our happy customers:

Related Resources

Case Study

Top 10 Travel Booking Site

Preventing account takeover begins with monitoring the dark web, but without the ability to match user accounts with a database of exposed credentials, a top 10 travel booking site was vulnerable to attack.

Read More

The SpyCloud Difference

Current, Relevant, Truly Actionable Data

SpyCloud’s account takeover prevention and fraud investigation solutions are backed by the world’s most current and comprehensive repository of recovered stolen credentials and PII. More data, particularly plaintext passwords, means more matches and stronger account protection.

SpyCloud human intelligence researchers have recovered billions of data breach assets, including stolen passwords and emails that can put enterprises at risk of account takeover

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

2020 Report: Breach Exposure of the Fortune 1000

REPORT

2020 Report: Breach Exposure of the Fortune 1000

Preview of SpyCloud's 2020 Report: Breach Exposure of the Fortune 1000, which reveals the corporate credential exposure and ATO risks of major enterprises

Employees frequently reuse corporate credentials as personal logins, regardless of security guidelines that prohibit such behavior. When those third-party sites are subject to data breaches, reused employee logins provide easy entry points to corporate systems and networks. In addition to corporate credentials, data breaches expose a wealth of personal information that can enable cybercriminals to bypass security measures, take over accounts, and compromise enterprise networks.

To provide a snapshot of the breach exposure affecting major enterprises, we examined SpyCloud’s entire database to see what breach data we could tie to companies in the Fortune 1000. Across our data set, we were able to identify over 412 million breach assets tied to employees within the Fortune 1000.

Download the report to see:

  • How many Fortune 1000 employees and C-level executives have passwords available to cybercriminals
  • Top passwords of Fortune 1000 employees
  • Infographics showing credential exposure, password reuse rates, and more for all 21 Fortune 1000 sectors
  • Which sector is the worst offender (by far)

Solution: Account Takeover Prevention

Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.

Learn More

Download the Report

2020 Report: Breach Exposure of the Fortune 1000

A few of our happy customers:

Related Resources

Case Study

Top 10 Travel Booking Site

Preventing account takeover begins with monitoring the dark web, but without the ability to match user accounts with a database of exposed credentials, a top 10 travel booking site was vulnerable to attack.

Read More

The SpyCloud Difference

Current, Relevant, Truly Actionable Data

SpyCloud’s account takeover prevention and fraud investigation solutions are backed by the world’s most current and comprehensive repository of recovered stolen credentials and PII. More data, particularly plaintext passwords, means more matches and stronger account protection.

SpyCloud human intelligence researchers have recovered billions of data breach assets, including stolen passwords and emails that can put enterprises at risk of account takeover

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

Targeted vs. Automated Account Takeover Attacks

WHITEPAPER

Targeted vs. Automated
Account Takeover Attacks

Account takeover (ATO) occurs when criminals use stolen logins to access user accounts without permission–typically credentials that have been exposed in a third-party breach. Using victims’ accounts, criminals can make fraudulent purchases, drain accounts, steal sensitive data, or move laterally within a target organization.

The vast majority of account takeover attempts are automated credential-stuffing attacks. However, SpyCloud customers report that 80 percent of losses come from just 10 percent of ATO attempts, which are highly targeted and challenging to detect.

Read this whitepaper to learn:

  • The differences between targeted and automated account takeover attacks and why targeted attacks can cause so much damage
  • The five phases of an account takeover attack and the tactics, techniques, and procedures cybercriminals throughout the attack timeline
  • How early detection can help you prevent both targeted and automated account takeover

Solution: Account Takeover Prevention

Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.

Learn More

Download the Whitepaper

Targeted vs. Automated Account Takeover Attacks

A few of our happy customers:

Related Resources

Case Study

Top 10 Travel Booking Site

Preventing account takeover begins with monitoring the dark web, but without the ability to match user accounts with a database of exposed credentials, a top 10 travel booking site was vulnerable to attack.

Read More

The SpyCloud Difference

Current, Relevant, Truly Actionable Data

SpyCloud’s account takeover prevention and fraud investigation solutions are backed by the world’s most current and comprehensive repository of recovered stolen credentials and PII. More data, particularly plaintext passwords, means more matches and stronger account protection.

SpyCloud human intelligence researchers have recovered billions of data breach assets, including stolen passwords and emails that can put enterprises at risk of account takeover

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

2020 Annual Credential Exposure Report

REPORT

2020 Annual Credential Exposure Report

Every year, the SpyCloud Credential Exposure Report examines the data cybercriminals have been sharing over the last year and what it means for enterprises and consumers. Our 2020 report shows that password reuse continues to be a serious problem, leaving enterprises and their customers vulnerable to account takeover (ATO). 

SpyCloud researchers infiltrate criminal networks to identify and recover stolen data months or years before it reaches a broader criminal audience or goes public. As a result, the 9 billion breach records analyzed for this report provide insight into breaches that have been freshly released to criminal marketplaces over the last year.

Download the report to see:

  • Trends our researchers have observed within cybercriminal communities over the last 12 months
  • Password reuse patterns, including the most common transformations people use to “refresh” a reused password
  • Most popular 100 passwords collected over the last 12 months
  • Common password hashing algorithms used by breached organizations

Solution: Account Takeover Prevention

Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.

Learn More

Download the Report

2020 Annual Credential Exposure Report

A few of our happy customers:

Related Resources

Case Study

Top 10 Travel Booking Site

Preventing account takeover begins with monitoring the dark web, but without the ability to match user accounts with a database of exposed credentials, a top 10 travel booking site was vulnerable to attack.

Read More

The SpyCloud Difference

Current, Relevant, Truly Actionable Data

SpyCloud’s account takeover prevention and fraud investigation solutions are backed by the world’s most current and comprehensive repository of recovered stolen credentials and PII. More data, particularly plaintext passwords, means more matches and stronger account protection.

SpyCloud human intelligence researchers have recovered billions of data breach assets, including stolen passwords and emails that can put enterprises at risk of account takeover

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

Best Practices for Implementing NIST Password Guidelines

WHITEPAPER

Best Practices for Implementing NIST Password Guidelines

Weak Passwords?
NIST Can Help!

Controlling users’ bad password habits poses a major challenge. Aligning your enterprise’s password policy with the latest guidelines from NIST can help encourage better password habits and reduce the risk of account takeover.

Luckily, you can enforce many of these guidelines through the built-in settings provided by most directory services, including Microsoft Active Directory.

Download this best practices guide to get:

  • A plain-english overview of required, recommended and desirable NIST password guidelines
  • Detailed instructions to help you use directory services like Active Directory to enforce password guidelines
  • Advice for how to keep your password policy human-friendly and help your users help themselves
  • Questions to ask potential solution providers

Even if you don’t use Microsoft Active Directory, this is still a helpful guide to NIST’s latest password recommendations.

Solution: Active Directory Guardian

Automatically detect and reset exposed Windows accounts.

Learn More

Download the Whitepaper:

Best Practices for Implementing NIST Password Guidelines

A few of our happy customers:

Related Resources

The SpyCloud Difference

Current, Relevant, Truly Actionable Data

SpyCloud’s account takeover prevention and fraud investigation solutions are backed by the world’s most current and comprehensive repository of recovered stolen credentials and PII. More data, particularly plaintext passwords, means more matches and stronger account protection.

SpyCloud human intelligence researchers have recovered billions of data breach assets, including stolen passwords and emails that can put enterprises at risk of account takeover

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

GDPR & ATO Prevention Solutions

WHITEPAPER

GDPR & ATO Prevention Solutions

Everything You Ever Wanted to Know About GDPR in (Relatively) Plain English

With information for companies evaluating SpyCloud

In 2018, the General Data Protection Regulation went into effect with the goal to ensure the protection of data for all EU citizens. The law pertains to businesses throughout the world that process data belonging to EU citizens.

We worked with our legal team to develop this whitepaper, which breaks down the GDPR into plain English, and provides insights on what it means for you — in particular as you evaluate account takeover prevention solutions that rely on personal data.

Download this whitepaper for:

  • A brief history of EU data protection law
  • A summary of the major changes introduced by the GDPR
  • What the changes mean for your company if you process EU citizens’ data
  • How you can use SpyCloud and stay within the law

Solution: Account Takeover Prevention

Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.

Learn More

Download the Whitepaper:

GDPR & ATO Prevention Solutions

A few of our happy customers:

Related Resources

The SpyCloud Difference

Current, Relevant, Truly Actionable Data

SpyCloud’s account takeover prevention and fraud investigation solutions are backed by the world’s most current and comprehensive repository of recovered stolen credentials and PII. More data, particularly plaintext passwords, means more matches and stronger account protection.

SpyCloud human intelligence researchers have recovered billions of data breach assets, including stolen passwords and emails that can put enterprises at risk of account takeover

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.

Understanding the Latest NIST Password Guidelines

WHITEPAPER

Understanding the Latest NIST Password Guidelines

Security Meets Usability

Over the years, security professionals have learned surprising lessons about how password policies affect user behavior. Faced with complicated password requirements and hundreds of online accounts to keep track of, people often take dangerous shortcuts—and criminals benefit.

To help organizations mitigate the risk posed by users’ bad password habits, the National Institute of Standards and Technology (NIST) designed a set of password guidelines that balance security and usability. The updated guidance abandons the long-held philosophy that passwords must be long and complex. In contrast, the new guidelines recommend that passwords should be “easy to remember” but “hard to guess.” According to NIST, usability and security go hand-in-hand.

Read this white paper to understand what NIST’s guidance means for your organization, including:

  • Why NIST has abandoned popular password complexity requirements
  • What’s special about new authenticator guidelines
  • How NIST approaches biometrics (hint: they’re not enough on their own)
  • What organizations can do to mitigate the risk caused by users’ bad habits

Solution: NIST Password Screening

Align with the latest password security guidelines from the National Institute of Standards and Technology (NIST).

Learn More

Download the Whitepaper:

Understanding the Latest NIST Password Guidelines

A few of our happy customers:

Related Resources

The SpyCloud Difference

Current, Relevant, Truly Actionable Data

SpyCloud’s account takeover prevention and fraud investigation solutions are backed by the world’s most current and comprehensive repository of recovered stolen credentials and PII. More data, particularly plaintext passwords, means more matches and stronger account protection.

SpyCloud human intelligence researchers have recovered billions of data breach assets, including stolen passwords and emails that can put enterprises at risk of account takeover

Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.