Customer case
K–8 district consolidates IT management to support secure remote learning
A district serving more than 5,800 students across nine schools coordinated computer management and IT support during the shift to remote instruction.
XCITIUM / Knowledge library
Experience. Research. Informed decisions.
Customer experiences, practical security guides and technical research. Find what you need by topic and material type.
195 materials
Customer case
Steel manufacturer sought to protect field teams and business records
A manufacturer with field staff sought simpler device management and protection for project and business records.
Customer case
State agency selected central management for a mixed OS fleet
A state technology-services agency established central policy and delegated administration across more than 25,000 Windows, Linux and Mac endpoints.
Customer case
FQHC healthcare organization sought remote IT support across multiple sites
The 16-site FQHC sought remote support; five information-security staff managed its Xcitium Advanced and Endpoint Manager deployments.
Guide and research
How to evaluate an endpoint protection platform
Evaluate endpoint protection against your environment: compatibility, unknown programs, management and pilot testing.
Guide and research
Guide to detecting and inspecting endpoint malware
The role of static and behavioural analysis, application control and EDR in detecting and investigating endpoint threats.
Guide and research
Detection engineering: model, test and maintain detection logic
Systematically design, test and maintain detection rules using a threat model and available telemetry.
Guide and research
Recognize and contain data exfiltration
Identify unauthorized data transfers through email, cloud services and removable media, and prepare a coordinated response.
White paper
Execution governance: beyond detection
Xcitium presents this paper for security leaders and teams assessing how to govern unknown code, document oversight and demonstrate that cyber controls are being enforced.
White paper
From containment to protection: the ZeroDwell approach
Xcitium discusses sandbox delays, kernel-level isolation for unknown files and ways to maintain user workflows during analysis.
White paper
Proving cyber control enforcement
Xcitium presents this paper around the shift from detection dashboards to runtime enforcement evidence, the principles behind execution governance and reporting for auditors, insurers and boards.
White paper
Unified Zero Trust platform: beyond detection
Xcitium presents a layered model that combines signature databases, behavioral monitoring and kernel-level isolation for unknown files.
Customer case
Amadeus unified airport IT operations with Microdium
Amadeus and Xcitium MSP partner Microdium combined ITSM and security for managing thousands of airport kiosks and computer systems.
Customer case
Evergreen Life Services simplified security across 130 locations
Evergreen Life Services, which supports people with disabilities, sought a simpler and more unified security approach to replace disconnected IT tools.
Customer case
Gem State Paper & Supply refreshed endpoint security after an encryption incident
Family-owned Gem State Paper & Supply sought EDR after an encryption incident and began monitoring its devices through the Xcitium portal.
Customer case
Global malt manufacturer chose unified protection after recurring infections
An unnamed Minnesota company producing malt and brewing supplies faced recurring weekly infections and a fragmented security stack.
Customer case
Grand Bend health centre combined remote helpdesk and endpoint protection
A nonprofit health centre in Ontario began with remote support tools and moved to Xcitium Advanced; it had more than 112 endpoints.
Customer case
Ransomware demonstration influenced a hospital’s endpoint protection choice
An unnamed hospital evaluated alternatives to Kaspersky, and a ransomware demonstration influenced its choice of approach.
Customer case
MSP owner shared the economics of MDR across 9,000 endpoints
An unnamed MSP founder described MDR costs and revenue across 9,000 endpoints; Xcitium used this historical account in an illustrative company valuation model.
Customer case
A nonprofit selected Xcitium after endpoint protection tests
Two IT staff selected protection for more than 350 endpoints and 30 servers across 14 locations holding financial and personal records.
Customer case
Arkansas nonprofit chose unified protection after recurring infections
An evangelistic nonprofit serving the motorcycling community replaced disparate antivirus tools with a central console to protect membership and donation records.
Customer case
Community school district chose central protection and support for student devices
A community school district adopted Xcitium Advanced and central management to address malware exposure on devices used by students for email and web access.
Customer case
Alliance for Audited Media chose security with responsive support and clear pricing
The media-industry association evaluated EDR, XDR, log analysis and provider support in one solution for roughly 150 endpoints.
Guide and research
Business email compromise: reducing payment fraud risk
BEC attacks exploit business trust to redirect payments, change payroll details and obtain sensitive data. Learn the common patterns and combine technical controls with financial verification.
Guide and research
EDR agents: monitoring, investigation and response
An EDR agent observes files, processes and network activity on endpoints to surface suspicious behavior. Understand how it differs from antivirus, what response actions it can support and what to assess before deployment.
Guide and research
Risk services: preparing for assessments, scans and training
Learn how Xcitium’s risk services program organizes participants, scope and deliverables for gap assessments, vulnerability assessments, penetration tests and awareness services.
Guide and research
Zero Trust cybersecurity: verify every access request
Zero Trust does not treat network location as proof of trust. Rechecking identity, device posture and context for access requests helps limit permissions and constrain lateral movement.
Guide and research
Phishing simulations: how to run a useful, safe program
How to prepare a phishing exercise, assess staff responses and use the results to improve learning and work procedures.
Guide and research
Phishing tactics: how to assess suspicious work messages
Attackers may impersonate an executive, supplier, IT colleague or familiar service. Assess requests from email, text, QR codes and social platforms against their context and your organization’s normal approval process.
Guide and research
Endpoint protection and phishing response for remote work
How to inventory and update remote devices, limit access and prepare for phishing response. The role of EDR in monitoring activity and investigating incidents.
Guide and research
Social engineering attacks and the role of endpoint protection
Social engineering persuades a person to disclose information, transfer money or take an unsafe action. Learn how attacks are prepared, which techniques are common and where endpoint tools can help.
Guide and research
Phishing attacks: types, impact and layers of defense
Phishing uses email, messages and fake websites to exploit trust and obtain information, account access or money. Learn the main attack types and combine technical controls with operational procedures.
Guide and research
How to recognize and safely report phishing
A phishing message may look urgent and convincing while its sender, link or request does not fit the work context. This guide covers what to check before acting and what to do after an incident.
Guide and research
A practical checklist for securing an AWS environment
Security in AWS extends beyond choosing a service. It requires clear ownership and ongoing checks for accounts, permissions, data, workloads and monitoring.
Guide and research
Design cloud security architecture in layers
Cloud architecture should connect network, identity, application and data controls to the service owner’s actual responsibilities.
Guide and research
Cloud security assessment: an evidence-led review
An assessment reviews accounts, identity, data, workloads and recovery against risk, then assigns owners and deadlines to remediation.
Guide and research
What to check when choosing EDR for cloud environments
When selecting EDR, verify actual coverage and response capabilities for cloud-connected devices, virtual machines and managed workloads.
Guide and research
Cloud security foundations: from identity to recovery
Cloud security combines ongoing governance and technical controls to protect data, applications and infrastructure across customer and provider responsibilities.
Guide and research
What a CWPP does and what to check in cloud workloads
A Cloud Workload Protection Platform is a category of workload-level visibility and controls; verify actual coverage by asset type, runtime and responsibility boundary.
Guide and research
Hybrid cloud security: connect on-premises and cloud environments safely
In hybrid environments, risks arise as resources, identities and data cross multiple networks and management domains; map ownership and traffic flows.
Guide and research
Multicloud security: common control goals, provider-specific implementation
Reduce risk across multiple cloud providers with a common inventory and policy goals, while validating configuration and ownership for each service.
Guide and research
How to change a DNS server
Changing a DNS server changes how domain names are resolved to IP addresses. The setting can live on a device or on the router. Record the current configuration first, then review the new resolver’s privacy, filtering and availability policies.
Guide and research
What is a network gateway?
A gateway is a point that passes traffic between networks or protocols. Understanding its role and where router, switch and firewall functions begin helps teams design and protect a network.
Guide and research
How to restore website access safely
A site may fail to load because of a filter, DNS error, browser issue, regional restriction or service outage. Identify the cause first and choose a lawful fix that follows workplace or school network rules.
Guide and research
Choose cloud-managed endpoint protection
A cloud-managed endpoint tool can centralize policy and visibility, while coverage, agent behavior and response vary by product. Evaluate it against real devices and operating needs.
Guide and research
How to secure endpoint and VPN clients
A VPN can connect a remote user to a private network and route traffic through organizational controls. Access should be governed alongside device health, identity and authorization.
Guide and research
EDR and firewalls: differences and working together
A firewall applies connection policy by IP address, port and protocol; application and connection-state inspection depend on its capabilities. EDR helps investigate process and file activity on endpoints. Some suites include a host firewall, which does not automatically replace network-boundary control.
Guide and research
EDR and intrusion detection
An IDS looks for suspicious activity in network or host signals; EDR centers on endpoint telemetry and response. Their visibility and intervention options depend on the implementation.
Guide and research
Understand DDoS attacks and prepare
A DDoS attack attempts to disrupt service availability by sending a flood of traffic or requests from many sources. Preparation spans capacity, network providers, application behavior and incident response.
Guide and research
Evaluate network security for a small business
Small business network security goes beyond choosing a firewall: consider devices, email, remote access, cloud accounts, backups and monitoring. Select a provider against verifiable needs and service terms.
Guide and research
What does a Web Application Firewall do?
A WAF can evaluate HTTP and HTTPS requests against application rules before they reach a web application. It does not replace secure coding, authentication or server patching.
Guide and research
What is an allowlist and how is it managed?
An allowlist permits only preapproved IP addresses, domains, email addresses or applications. Lists complement firewall and identity policies; they do not replace them.
Guide and research
SIEM and IDS: monitoring and detection roles
An IDS looks for intrusion indicators in selected network or host signals. A SIEM collects and correlates events from multiple systems; the categories complement each other.
Guide and research
A practical guide to securing Active Directory
Active Directory governs accounts, groups and computers, so its security depends on identity controls, privileged administration, domain controllers and recovery working together.
Guide and research
Find and reduce AWS misconfigurations
Public resources and excessive permissions can emerge in complex, changing AWS environments. Effective control needs an inventory, an owner, clear rules and verified remediation.
Guide and research
Combine enterprise EDR with identity controls
EDR helps investigate suspicious endpoint behavior, but it does not determine account ownership or required access. Defense should connect identity and device signals.
Guide and research
Build an identity and access management program
IAM governs identity creation, authentication, permissions and revocation. A sound program connects these steps to hiring, role changes, contractor access and departures.
Guide and research
Protect human and workload identities
Digital identity connects employees, administrators, applications and service accounts to systems. Identity security governs their permissions, authentication and activity monitoring.
Guide and research
Operate AD FS federation securely
AD FS can provide federated authentication between on-premises Active Directory and trusted applications. Security depends on server hardening, trust configuration and application dependency management.
Guide and research
Choose strong MFA for work accounts
Multifactor authentication reduces password-theft risk, but methods differ in phishing resistance and implementation quality. Match coverage and recovery to account risk.
Guide and research
Govern and monitor privileged accounts
PAM governs high-impact access for administrators, services and emergency accounts. An effective program combines policy, process and technical controls to reduce standing privilege.
Guide and research
Apply Zero Trust architecture around resources
Zero Trust does not treat network location or ownership as proof of trust. The architecture connects identity, device and resource decisions for each access request.
Guide and research
Build a Zero Trust program in manageable stages
Zero Trust is an approach to protecting resource access across remote work, cloud and shared infrastructure. Adoption requires staged changes shaped by organizational risk and architecture.
Guide and research
Evaluate managed IAM responsibly
A managed identity service can support an internal team with account and access operations. Customer and provider responsibilities, data access and escalation must be agreed in advance.
Guide and research
Connect identity management to daily operations
Identity management governs how users, devices and services access organizational resources. As remote work and cloud applications grow, consistent ownership, role assignment and deprovisioning matter.
Guide and research
Turn off BitLocker only when there is a clear need
Decrypting a drive removes a layer that protects data from someone with physical access to a lost or stolen device. Check the reason, recovery key and device policy first.
Guide and research
Choose data security controls for remote work
A remote-work security stack should connect endpoint response, application access, DLP, identity, backup and file sharing into one operating process.
Guide and research
Protect business data with encryption
Encryption turns readable data into a form that cannot be understood without a key. Apply it to the places where data is stored, transmitted and used.
Guide and research
Find and protect sensitive cloud data
When data spans SaaS, storage and backups, organizations need to find it, govern access and verify recovery.
Guide and research
Apply DLP across endpoints, network and cloud
DLP helps organizations see how sensitive data moves across endpoints, network traffic and cloud services, then respond to policy violations.
Guide and research
Protect cloud-managed endpoints
For cloud-managed employee endpoints, verify OS and agent coverage, telemetry, patching and response ownership.
Guide and research
Control sensitive file use on endpoints
Endpoint DLP can monitor sensitive-data use and transfer on supported managed endpoints; verify coverage by OS, application and action.
Guide and research
Segment access to sensitive resources by identity
Identity-based segmentation limits access to specific resources according to user, role, device and service identity.
Guide and research
Govern cloud data and keys together
Cloud encryption protects stored and transmitted data; the right approach depends on the service model, key control and recovery ownership.
Guide and research
Distinguish network, endpoint and cloud DLP
Network, endpoint and cloud DLP can observe different data states; actual coverage depends on channels and integrations.
Guide and research
Manage vulnerabilities as an operating program
A vulnerability management program makes discovery, prioritization, remediation and verification a repeatable process with accountable owners. Define its scope, decision rights and completion criteria.
Guide and research
Recognize zero-day exploitation and limit its impact
A zero-day attack exploits a previously unknown flaw. Distinguish the vulnerability, disclosure, fix availability and evidence of exploitation, and plan investigation of suspicious activity.
Guide and research
Define the scope of a managed security service
Define a managed security service’s contracted scope, decision rights and handoffs. Connect monitoring, investigation and remediation to verifiable evidence and clear responsibility.
Guide and research
Prioritize vulnerabilities by contextual risk
Do not rank findings by technical score alone. Combine exploitation evidence, actual reachability and business impact to set a priority an accountable owner can act on.
Guide and research
Connect security tools through an operating workflow
Connect a security signal to an analyst, an authorized decision and a verifiable action. Coordinate the distinct jobs of testing, incident response and monitoring tools through a shared workflow.
Guide and research
Separate a vulnerability from an attack technique
Distinguish a system weakness, an attack technique and malware. Record code, configuration and identity weaknesses separately from the actions that exploit them.
Guide and research
Operate the vulnerability management lifecycle
Operate vulnerability management as a repeatable practice with clear cross-team ownership, reassessment triggers and decision records. Preserve evidence from discovery through outcome verification.
Guide and research
Complete assessment with remediation and reporting
Track an individual finding from assessment through disposition and action to evidence-based closure. Use reassessment and reporting to inform the next cycle’s priorities.
Guide and research
An AI governance checklist for IT teams
As teams adopt assistants, agents and AI integrations, organizations need a record of what is in use, what data it can reach and who owns the decisions.
Guide and research
An operating cycle for cyber risk management
A cyber risk program connects assets and threats to business impact, assigns treatment owners and revisits decisions over time.
Guide and research
Vulnerability management from finding to verified fix
A scan only creates findings. A program covers assets, validates results, prioritizes with business context, tracks fixes and checks again.
Guide and research
Check endpoint readiness from user devices to IoT
Remote computers, mobile devices and IoT equipment differ in software and update options. A review makes assets, baseline requirements and exceptions visible.
Guide and research
Endpoint security compliance controls
Policies, technical controls and operational evidence must work together to protect endpoint data. Fit requirements to the organization’s actual scope.
Guide and research
Manage compliance controls in a cloud environment
A cloud provider’s attestation does not remove an organization’s responsibility for its own data, configurations and operations. Manage requirements, responsibility boundaries and reviewable evidence together.
Guide and research
Cloud governance: policy, ownership and control
Cloud governance clarifies who provisions, protects, monitors and retires resources. Connect security, cost and operational goals to accountable owners.
Guide and research
Build EDR coverage around visibility and response
EDR brings signals from remote and office devices together. Useful coverage depends on agent health, disconnected devices and a response process that works across them.
Guide and research
Protect endpoints with layered controls
Laptops, servers, phones and IoT devices connect in different ways. Endpoint security needs to join asset inventory, updates, access rules and detection into one operating practice.
Guide and research
How to evaluate endpoint protection in a pilot
An endpoint pilot should test coverage, detection and response operations on your devices and workflows, rather than simply demonstrate product features.
Guide and research
Review protection layers for Windows devices
Windows endpoint protection spans operating-system and application updates, host controls and endpoint detection. Check the actual configuration and coverage of each layer.
Guide and research
Security testing: authorization and agreed scope
Ethical hacking tests weaknesses in systems with the owner’s authorization. Written permission, clear scope, impact limits and an actionable report are core parts of the work.
Guide and research
Reduce exposure to exploit kits
Exploit kits can probe browser and plugin weaknesses to deliver malware. Delayed updates, risky web content and excessive user privileges can increase the impact of that chain.
Guide and research
Inventory and assess the external attack surface
Internet-facing domains, hosts, cloud services and remote access points change over time. External attack surface management helps find unknown assets, confirm ownership and route findings to remediation.
Guide and research
Plan a penetration test with clear scope
A penetration test validates the impact of weaknesses through agreed scenarios. Without a clear objective, scope and risk boundary, testing can be incomplete or disruptive.
Guide and research
Connect threat and vulnerability management
A list of vulnerabilities does not determine risk priority by itself. Combining asset value, internet exposure and exploitation signals turns threat information into remediation decisions.
Guide and research
Build a vulnerability management lifecycle
A continuous process discovers assets and weaknesses, prioritizes remediation and verifies outcomes. Reassessment catches new assets, changes and recurring problems.
Guide and research
Malware and adware: types, signs and response
Learn how common malware families differ, how adware reaches devices and which changes deserve attention. Follow practical steps to investigate and clean a suspected infection safely.
Guide and research
Mobile malware: risks, prevention and response
Learn how fake apps, phishing links, excessive permissions and account theft can affect a phone. Follow practical steps to review app and privacy settings on Android and iPhone and respond to a suspected incident.
Guide and research
Trojan malware: disguises, warning signs and response
A Trojan may disguise itself as a trusted file or app. A user opening it is a common delivery path, but another malicious component can also start the payload. Learn how it differs from a virus or worm, how an attack unfolds, the major Trojan types, warning signs and response steps.
Guide and research
Cyber threats: categories, business impact and defenses
Map cyber threats by attack method and business impact. Match malware, phishing, service disruption, vulnerabilities, insider risk and cloud/API exposure with practical controls and response plans.
Guide and research
Access records and log management
Access records, operational logs and security events answer different questions. Choose the sources, keep records searchable and distinguish general log management from SIEM correlation.
Guide and research
SIEM fundamentals: from data to security events
SIEM brings security data together, normalizes it and helps teams investigate relationships among events. Learn how collection, normalization, correlation, alerting and reporting fit together.
Guide and research
SIEM, EDR and XDR: capabilities and selection criteria
SIEM, EDR and XDR cover different data sources and security tasks. Compare endpoint investigation, organization-wide correlation and coordinated response, then assess replacement against your own requirements.
Guide and research
How EDR detects malware
Learn how endpoint telemetry, behavior analysis and investigation tools can expose malicious activity. Evaluate visibility, privacy, response and operational readiness together when comparing EDR capabilities.
Guide and research
Ransomware: history, preparation and recovery
Trace ransomware’s evolution from file locking to extortion backed by threats to publish stolen data. Build practical plans for backups, access controls, updates and incident response.
Guide and research
What EDR can do against ransomware
Assess prevention, behavioral detection, hunting, isolation and investigation as separate EDR capabilities. Use practical questions to check detection of early attack signs, offline operation, automated actions and recovery limits.
Guide and research
Ransomware types and extortion methods
Distinguish file encryption, device locking and threats to expose stolen data. Learn why malware family, delivery method, criminal business model and extortion tactic describe different things.
White paper
Cybersecurity for schools
Incident response planning, data flow mapping and endpoint protection for school IT teams.
White paper
REvil: ransomware defenses
Five areas for reducing ransomware risk and preparing for recovery.
Guide and research
EDR capabilities and operating model
Endpoint Detection and Response (EDR) monitors endpoint activity and helps investigate suspicious behavior and respond to incidents. Learn its scope, telemetry, investigation and response capabilities, complementary role with SIEM, and selection criteria.
Guide and research
How to evaluate an EDR demo and pilot
Run an EDR demo as a test of your own workflow, not as a presentation. Evaluate event visibility, analyst investigation, response authority, device compatibility and operating effort against agreed criteria.
Guide and research
EDR deployment: coverage, compatibility and operational readiness
Roll out EDR in stages: confirm the device inventory, set telemetry and privacy boundaries, test operating systems, assign response ownership and introduce automation with control.
Guide and research
SOC functions, analyst work and operating model
A security operations center (SOC) brings together people, processes and technology to monitor, assess and respond to an organization’s security events. Learn its six core functions, business value, analyst responsibilities and incident workflow.
Guide and research
Endpoint protection: antivirus, EPP, EDR and firewalls
Compare the roles of antivirus, endpoint protection platforms (EPP), EDR and firewalls. Use practical questions to choose an architecture that fits your devices, team and incident readiness.
Guide and research
Agentless endpoint security: architecture and trade-offs
Compare agent, API, network and cloud-level monitoring. Use practical checks to choose a hybrid design that fits privacy, offline coverage, visibility and device-control needs.
Guide and research
Endpoint hardening for remote and mixed device fleets
Bring inventory, access, updates, network controls and incident readiness into one operating routine for remote staff, mobile devices, servers and IoT equipment.
Guide and research
Threat detection and proactive hunting
Learn how known indicators, behavior analysis, deception traps and analyst-led investigation fit together. Follow a hunt from hypothesis to response, review analytical methods and tool examples, and distinguish a compromise assessment from ongoing hunting.
Guide and research
How to choose a managed threat hunting service
Learn how an external hunting team can address resource and skills gaps, what work a service may include, and how to define collaboration with an internal SOC.
Guide and research
Cyber threat intelligence: from data to action
Understand strategic, tactical, operational and technical intelligence, their audiences and how teams use each level. Apply practical criteria to choose sources, prioritize signals and evaluate a platform.
Guide and research
EDR and network detection tools: examples and selection
Compare product and service examples including Xcitium, Heimdal, Bitdefender, Snort, SentinelOne and CrowdStrike. Use practical criteria to evaluate EDR features, service scope and network IDS/IPS capabilities.
Guide and research
Evaluate XDR products by data sources and response
Check how endpoint, identity, email, network and cloud signals are correlated and which incident response actions are available. Neutral pilot criteria for Cisco XDR and Palo Alto Cortex XDR.
Guide and research
Incident response planning
An incident response plan defines roles, decision authority, escalation, communications and recovery steps in advance. See how current NIST guidance differs from older lifecycle models and how to tailor a plan to your assets, services and risks.
Guide and research
Digital forensics and incident response
DFIR combines incident response with the preservation and analysis of digital evidence. Learn about artifact types, chain of custody, a six-stage workflow, cloud and IoT constraints, anti-forensics countermeasures and team skills.
Guide and research
Managed detection and response (MDR)
MDR adds external security specialists and tools to an organization’s detection, investigation and response work. The service’s value depends on monitoring scope, human analysis, authority, escalation, response actions and follow-up reporting.
Guide and research
Malware analysis: from sample to evidence
Compare static inspection, isolated execution and reverse engineering. Turn file, memory and network evidence into detection and response actions.
Guide and research
Understand cloud services and shared responsibility
IaaS, PaaS and SaaS divide operational work differently. This guide explains infrastructure and deployment models, customer and provider security duties, and the roles of core AWS services.
Guide and research
Design VPC networks and govern cloud app access
A VPC provides controls for network segmentation, routing and access rules, but it does not secure resources by itself. Pair network design with cloud app visibility, data policies and suitable CASB capabilities.
Guide and research
Plan a cloud migration in deliberate stages
Plan a migration from inventory and dependencies through strategy, pilot, staged cutover and rollback. Compare tools and define how to validate security, application behavior and costs after the move.
Guide and research
IP addresses, subnets and DHCP: how a local network is organized
Routers, IP addresses, subnet masks and DHCP work together to help devices find each other on a local network and reach other networks. This guide connects the core concepts with safe diagnostic steps.
Guide and research
TCP, ping and TTL: understanding a network connection
TCP supports reliable delivery of a data stream, ICMP carries diagnostic messages, and IP TTL prevents packets from circulating indefinitely. This guide links those concepts to network topology and simple read-only checks.
Guide and research
Wi‑Fi, mobile and DSL: choosing and securing an access path
Wi‑Fi connects to a local network over radio; LTE and 5G use a mobile operator’s radio and core network; DSL uses a telephone line. Choose based on verified availability at your address and work needs, then secure the router and connected devices.
Guide and research
Design application logs that answer useful questions
An application log should show more than an error: it should record when it happened, which component was involved, its severity and its outcome. This guide covers event selection, levels, structured formats and sensitive data.
Guide and research
Collect, normalize and retain logs
Logs from many servers and applications become searchable when the path from source to archive is planned. This guide covers collection, parsing, normalization, search, alerts, retention and how to evaluate managed logging services.
Guide and research
Investigate Windows, IIS and web-server logs
Event Viewer exposes Windows events, while IIS and other web-server logs record HTTP requests and responses. This guide covers focused filtering, W3C fields, status codes and rotation settings with practical examples.
Guide and research
Understand application performance with monitoring and observability
Monitoring tracks selected indicators; observability connects logs, metrics and traces to help investigate unexpected behavior. This guide explains APM, DevOps feedback, distributed traces and real-user monitoring.
Guide and research
Monitor server, network and cloud health
Infrastructure monitoring connects server resources, network paths, cloud services and user-visible outcomes. This guide covers metric selection, SNMP/ICMP/traffic-analysis roles, capacity trends and the responsibility boundary with a cloud provider.
Guide and research
Recognize and defend against account attacks
Account attacks range from password guessing to reuse of stolen sign-in pairs. Distinguishing the methods helps teams choose suitable detection and response steps.
Guide and research
Understand Active Directory credential attacks
NTLM and Kerberos expose different attack paths in Active Directory environments. Defense depends on understanding protocol flows, compromise indicators and recovery actions.
Guide and research
Change an email password and restore access
Changing a password with the email provider and refreshing the sign-in saved on a phone are separate actions. Secure the provider account first, then reauthenticate in Apple Mail or another mail app.
Guide and research
How to review network policy before a change
Review topology, firewall rules and vulnerability data together to assess real reachability, possible attack paths and the effect of proposed changes.
Guide and research
Mouse jigglers: screen-lock and session security
USB devices and software that move a cursor can interfere with idle locking. Understand the risks and set proportionate rules for accessibility, kiosks and long-running tasks.
Guide and research
How to choose a cybersecurity assessment adviser
Agree on scope, method, evidence and deliverables in advance so the engagement leads to decisions and a remediation plan.
White paper
Building a Zero Trust architecture
A Zero Trust plan from data flows to continuous monitoring.
White paper
Five reasons to move from MSP to MSSP
Why an IT service provider might expand into managed security services.
White paper
MDR for US state and local government
Managed detection and response for US state and local government.
Guide and research
Define the scope of a managed IT service
Managed IT can cover anything from user support to infrastructure operations. This guide helps define responsibilities, access rules and service measures before an agreement is signed.
Guide and research
Evaluate security as a service
SECaaS delivers security technology and operations through a provider. This guide explains how to assess the actual service scope, retained duties and questions to ask before choosing a provider.
Guide and research
Automate security workflows with control
Security automation connects repetitive triage, notifications and approved response steps across tools. This guide breaks the work into measurable workflows with checks and human oversight.
Guide and research
Human-sourced threat intelligence in cybersecurity
Information from people can add context about intent that technical telemetry may not show. This guide explains how to use it in lawful, consent-based and verifiable intelligence work.
Guide and research
Understanding threat actors and APT campaigns
Distinguish threat actors by motive and capability, follow how long-running APT activity develops, and build defenses around observed behavior.
Guide and research
How malicious code affects systems
Understand malware objectives, bootkit and keylogger mechanisms, botnet structures and how malicious advertising can deliver a threat.
Guide and research
Legitimate tools, process manipulation and lateral movement
Distinguish misuse of existing tools (LOTL), process manipulation and movement between networked systems. Investigate suspicious Windows and Linux activity using process, account and network evidence.
Guide and research
OSINT, honeypots and the deep web
Make open-source research verifiable, compare honeypots with firewalls, and distinguish the deep web from the dark web.
Guide and research
Pretexting, vishing and personal information exposure
Recognize how fabricated scenarios and voice calls exploit trust, verify suspicious requests and plan what to do after doxing.
Guide and research
Manage the attack surface and shadow IT
Bring internet-facing assets, cloud resources and unapproved services into the inventory. Tie each finding to an owner, business impact and remediation step.
Guide and research
Data breach response and leadership coordination
Coordinate technical investigation, business decisions and communication with affected people through one response plan.
Guide and research
Plan a penetration test safely
Define the scope, method and reporting for an authorized test, then remediate findings and retest controls.
Guide and research
Build an information security program
Bring risk assessment, policies, technical controls and incident response into one management cycle.
Guide and research
Investigate insider threat indicators fairly
Validate behavioral and technical signals without treating them as proof, protect access and investigate with respect for privacy.
Guide and research
Monitor file integrity and backport security fixes
Compare changes to critical files against a trusted baseline and validate fixes for legacy software.
Guide and research
Data obfuscation: use cases and limits
Change visible data values for testing and analytics while recognizing that obfuscation does not replace encryption or access controls.
Guide and research
Plan data flows and controls for cloud analytics
Build ETL/ELT and change-capture flows, compare hybrid and federated analytics, and apply identity and quality controls to each source.
Guide and research
Troubleshoot HTTP 401 authentication errors
Distinguish 401 from 403, check browser, API and server causes, and monitor repeated failures as a security signal.
Guide and research
Recognize and verify digital fraud signals
Recognize payment deception, phishing, account takeover and fake online stores; protect transfers with independent verification and an incident response process.
Guide and research
Check TPM and Secure Boot
Check TPM 2.0 and Secure Boot on a Windows device, enter firmware settings carefully, and prepare the recovery key for an encrypted drive first.
Guide and research
Time-limit privileged access
Replace standing administrator rights with access scoped to a task, resource and time window; define request, approval, expiry and audit steps.
Guide and research
Secure remote healthcare services
Protect data, accounts, endpoints and integrations throughout remote care, from video consultations and patient portals to monitoring devices.
Guide and research
Export and import CSV files safely
Reduce formula-injection risk when user data enters a CSV, inspect files before import, and protect sensitive exports.
Guide and research
Recover or hand off a PC safely
Choose the right steps to recover Windows after a fault or suspicious activity, back up data, and prepare a device for a new owner.
Guide and research
Secure CRM data and integrations
Review a customer-data CRM across roles, exports, connected apps and partner accounts.
Guide and research
Secure industrial IT and OT together
Coordinate IT/OT inventory, network boundaries, vendor remote access and continuity planning in connected operations.
Guide and research
How AI models and algorithms work
An algorithm, a trained model and a model architecture are different things. This guide explains the distinction through prediction, language and security examples.
Guide and research
NLP and large language models
Text processing, word normalization and LLM response generation are different stages. Learn what each does and where security boundaries matter.
Guide and research
Analytics, bias and statistical variation
Use business and security examples to distinguish analytics questions, predictions, relationships, bias and statistical variation.
Guide and research
Data lakes and business intelligence
Distinguish raw data storage from prepared reporting. Understand the roles of a data lake, warehouse and BI workflow security controls.
Guide and research
How to build a security awareness programme
Course completion does not show how employees will respond to a real request. Build a continuing programme around role-specific lessons, phishing practice, a clear reporting route and behaviour measures.
Guide and research
AI adoption readiness: from shadow use to a governed pilot
Employees may bring tools into daily work before procurement is involved. Discover current use, define data and permission boundaries, create a fast approval path and choose a narrow pilot with a measurable outcome.
Guide and research
An AI-assisted MSP service desk workflow
Place an AI agent in an existing support channel: it answers routine questions from approved material and passes unresolved requests to a queue with the conversation context. Keep identity checks and human control for consequential changes.
Guide and research
Secure network protocols and remote administration
FTP, RDP, SNMP and TLS serve different purposes. Learn what they carry, which access paths they create and which settings reduce exposure.
Guide and research
Manage IoT, IP phones and BYOD devices
Sensors, cameras, IP phones and personal mobile devices add new capabilities to a network. Practical steps for safer procurement, inventory, segmentation, updates and separating work from personal data.
Guide and research
Reduce spoofing and man-in-the-middle risk
ARP poisoning, DNS redirection, rogue Wi-Fi and other MITM methods exploit network trust. This guide explains where attacks occur, what to look for and how segmentation limits impact.
Guide and research
Reduce email spoofing and business email compromise
Forged senders, compromised accounts, executive impersonation and malicious attachments have different signals. Combine SPF, DKIM, DMARC, email gateway controls and payment verification.
Guide and research
Plan SASE, UTM and service availability
SASE combines networking and cloud security in one architecture; UTM brings several security functions onto one platform. Learn how to evaluate them and prepare for attacks on service availability.
Guide and research
API endpoints: authentication, /health and /info
An API endpoint is an address a client uses to access a service resource or operation. Design it together with access rules, permissions, load limits and diagnostic data.
Guide and research
Application security: threat modelling, testing and runtime controls
Application security covers design, code, dependencies, configuration and runtime behavior. This guide connects early risk discovery with testing for SQL injection, RCE and configuration mistakes.
Guide and research
Secure software delivery with CI/CD and policy as code
CI automates frequent integration and checks; CD automates promotion of a validated artifact through environments. Combine early security checks and versioned policy with protection for the pipeline itself.
Guide and research
Virtual machines, containers and microservice architecture
Virtual machines and containers isolate resources at different layers. Microservices divide an application into independently released components; the choice depends on performance, compatibility, isolation and operational complexity.
Guide and research
Kubernetes and AKS: access, workload security and monitoring
Kubernetes schedules containers across a cluster and manages their desired state. AKS provides a managed control plane; teams still need to understand responsibility for workloads, nodes, identity, networking, data and monitoring configuration.
Guide and research
MDR, MSSP and MXDR service models
MDR, MSSP and MXDR proposals do not describe the same service. Separate monitoring, investigation, response and the responsibilities your organization retains.
Guide and research
EDR and DLP: attack detection and data protection
EDR helps investigate suspicious endpoint activity; DLP controls how sensitive data is used and transferred. Compare their goals, coverage and how they work together.
Guide and research
SecOps, SOC and TDR: roles and workflow
SecOps brings security, IT operations and development specialists together. A SOC is a monitoring and response team or service, while TDR means threat detection and response. Understand the roles and how work is handed over.
No matching material. Try a different search or filter.
Vendor resources
Explore case studies and documentation on Xcitium’s official sites.