SecurityMetrics

SecurityMetrics SecurityMetrics is a global leader in data security and compliance. Learn more about us here-->>http://bit.ly/UEOgL

SecurityMetrics is a global leader in data security that enables businesses of all sizes to comply with government, healthcare, and financial mandates. Since its founding date, the company has helped over 1 million organizations worldwide protect their network infrastructure and data communications from compromise. Among other services, SecurityMetrics offers PCI and HIPAA compliance services, pe*******on testing, security consulting, payment data discovery, and incident response. Founded in October 2000, SecurityMetrics is a privately held corporation headquartered in Orem, Utah.

Catch the threats with SecurityMetrics from October 20-22 at the PCI SSC Europe Community Meeting. Go to booth 33 and ta...
10/05/2026

Catch the threats with SecurityMetrics from October 20-22 at the PCI SSC Europe Community Meeting. Go to booth 33 and talk to a member of the Cyber Assessment Team (CAT) for an inside scoop on:

- Preparing for a smoother PCI DSS audit
- Understanding e-commerce threats to your business
- Making the most out of your next Pe*******on Test

While you’re there, grab a t-shirt of your choosing! We have many fun designs in various sizes and colors.

https://calendly.com/securitymetrics/pci-ssc-europe-meeting

What Agent-Based Solutions Get Wrong:Many client-side security tools rely on browser agents or code embedded in the page...
09/28/2026

What Agent-Based Solutions Get Wrong:

Many client-side security tools rely on browser agents or code embedded in the page itself to detect tampering.

The problem is that a full-redirect checkout, by design, sends the customer away from your site entirely.

An agent sitting on your webpage has nothing to monitor once the customer has left your domain for the processor's domain. This is exactly the blind spot that attackers exploit with link swaps and “man-in-the-middle” redirects.

Shopping Cart Monitor takes a different approach. It's an agentless solution so it doesn't require installing code on your site to function.

Instead, it monitors your checkout flow from the outside, which means it can catch redirect-based tampering (such as a hijacked "Pay Now" link that sends customers to a spoofed domain) that agent-based tools are structurally unable to detect, as well as iframe-based threats like overlays and proxy attacks.

Read more:
https://www.securitymetrics.com/blog/redirects-and-iframes-are-being-hacked-how-does-this-impact-saq-a

09/25/2026

To help you prioritize your security, here are common mistakes that small business owners make and how to fix them.

[Cybersecurity Mistake #1: Assuming you won’t get hacked]
Small businesses are a prime target for hackers because they often lack adequate security. The Verizon Data Breach Investigations Report showed that nearly 43% of cyberattacks are on small businesses. This is dangerous for small businesses because most of them do not have the resources to survive a security breach. IBM’s Cost of a Data Breach Report shows the average impact of a data breach on organizations with fewer than 500 employees is $3.31 million.

Instead of ignoring the threats to your business, be proactive in your security so that you reduce your risk of getting hacked.

[Cybersecurity Mistake #2: Neglecting Employee Training]
To date, employee error is still the largest threat to businesses with 95% of cybersecurity issues traced to human error. Social engineering tactics have continued to expand to over 10+ types of social engineering tactics and techniques including vishing, SMS phishing, and whaling.

Training your employees on password hygiene, social engineering, data protection, and other security topics is not only part of being compliant with the PCI DSS (Payment Card Industry Data Security Standard), but can significantly lower your risk of experiencing a data breach.

To learn about the five other common mistakes, read more:
https://www.securitymetrics.com/blog/the-7-most-common-mistakes-in-small-business-security

How does a forensic investigation work?These are the typical actions a forensic investigator would take:(Step One: Preli...
09/23/2026

How does a forensic investigation work?

These are the typical actions a forensic investigator would take:

(Step One: Preliminary Research) Forensic investigations begin with some research on the company. The PFI needs to "scope" the merchant's environment, identifying where critical data resides, the systems that connect to it, and how data flows in and out of the network.

(Step Two: Onsite Data Gathering) The forensics team then goes onsite and gathers data from identified devices.

(Step Three: Analysis) The investigation team brings the data back to headquarters and analyzes it thoroughly to confirm whether a data breach occurred, determine what data the attacker stole, and identify which vulnerabilities were exploited.

(Step Four: Report) About a week after the initial data acquisition, the investigator will issue a short preliminary report showing whether they've found any indicators of compromise or other overt evidence of a data compromise. After fully analyzing the forensic data, the investigator will submit a complete final report that explains how the attack happened, which vulnerabilities were exploited, and what data was at risk.

Read more common questions about forensic investigations here: https://www.securitymetrics.com/blog/forensic-faqs-yz754

A lazy approach to PCI DSS compliance means letting security controls slide for the rest of the year and scrambling to m...
09/21/2026

A lazy approach to PCI DSS compliance means letting security controls slide for the rest of the year and scrambling to meet requirements just before an audit.

The Consequence:
Treating PCI casually or as only a once-a-year requirement creates a window of opportunity for attackers. In fact, one report found that companies that don’t maintain continuous compliance efforts face a 28% higher chance of experiencing a data breach.

The "one and done" approach also makes your next audit more difficult and costly, as you have to re-establish controls from scratch.

How to Avoid This Cyber-Sin:
- Embrace continuous effort. Treat PCI compliance as a year-round operational process, not just an annual event.

- Perform regular checks. This includes quarterly vulnerability scans, daily log monitoring, and an annual pe*******on test.

- Maintain situational awareness. Continuously monitor all systems in your Cardholder Data Environment (CDE) and ensure a robust change control process is in place. After any significant change, rescope your environment to ensure it remains accurate.

- Empower your team. The team responsible for PCI compliance needs ongoing support from senior management, regular training, and the resources to succeed. Make sure they document all PCI-related activities throughout the year to prove their continuous efforts.

Read about the six other deadly sins of cybersecurity here:
https://www.securitymetrics.com/blog/the-seven-deadly-cybersecurity-sins

Is AI Actually Making Cardholder Data Attacks Worse? "It's not that AI necessarily is creating different risks; it's acc...
09/18/2026

Is AI Actually Making Cardholder Data Attacks Worse?

"It's not that AI necessarily is creating different risks; it's accelerating the risks that exist. Because AI can do all of the current and previous threats faster," says Jen Stone.

Read more:
https://www.securitymetrics.com/blog/is-ai-changing-pci

We're at the PCI SSC NA Community Meeting! Swing by the booth ( #33) to get your custom, limited edition-shirt and talk ...
09/16/2026

We're at the PCI SSC NA Community Meeting! Swing by the booth ( #33) to get your custom, limited edition-shirt and talk to our Cybersecurity Assessment Team (CAT).

tech

We're participating in GEAR again at the PCI SSC NA Community Meeting! If you're attending, be sure to catch our tech ta...
09/14/2026

We're participating in GEAR again at the PCI SSC NA Community Meeting!

If you're attending, be sure to catch our tech talk, ‘6.4.3 and 11.6.1 Monitoring Lessons Learned,’ which will be held on Wednesday, Sept. 16, at 9:35 a.m. in the Ballroom Foyer. And stop by Booth #33 to learn about AI threat solutions through our Cybersecurity Assessment Team (CAT), discover PCI compliance solutions, and talk with Jeremy King, former Regional VP, EMEA of the PCI SSC.

Learn more here:
https://hackernoon.com/securitymetrics-contributes-to-gear-shares-ai-solutions-at-the-pci-ssc-na-2026-community-meeting


09/09/2026

When adopting AI tools, don't forget to consider the changes to your cybersecurity environment.

Address

1275 W. 1600 N
Lindon, UT
84057

Telephone

(801) 724-9600

Website

Alerts

Be the first to know and let us send you an email when SecurityMetrics posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to SecurityMetrics:

Shortcuts

Share

Category