The first quarter of 2025 has ushered in a series of unprecedented geopolitical shifts. Long-standing allies are now entangled in escalating trade wars, with markets plummeting under increasing tariffs and businesses struggling to keep up with unpredictable US economic policy. At the same time, the European Union is embarking on a significant rearmament initiative, aiming to reduce its reliance on US military support. Meanwhile, the United States is aggressively pursuing an end to the Ukraine conflict, aligning its diplomacy more closely with Russia and threatening traditional alliances.

When identifying and prioritizing threats, cybersecurity teams have many options available. Plenty of platforms, frameworks, and techniques exist to help prioritize the constant stream of threats that companies face. The problem is that there are too many options available, and many are cost-prohibitive. Consequently, small and medium-sized enterprises (SMEs) can be rapidly overwhelmed by these options, making it difficult to identify easy-to-implement, cost-efficient, yet effective threat management approaches.

In cybersecurity, threat management refers to continuously identifying, analyzing, and mitigating cyber threats to protect an organization’s digital assets, networks, and systems. It is a critical part of cyber risk management and includes multiple security disciplines.

Running effective cybersecurity management reviews is hard. Executing them in a manner that gets leadership’s full attention while respecting everyone’s time is even harder. Management reviews are a crucial tool to bridge the gap between business and security leaders. Do them right and you have a fair shake at building a robust cybersecurity program. Mess them up and management will be having the wrong conversations about cybersecurity.

More importantly, management reviews can be one of the most impactful tools for security leaders. It is true that on a formal level, they are an unavoidable requirement of standards such as ISO 27001. However, on a softer level, they can be an effective tool to shine visibility on the activity of the security team, quantifying their impact.

Endpoint detection tooling is central to establishing a threat detection capability to protect enterprise networks. However, it is expensive and the cost is driven by the type of tooling purchased and the complexity of the corporate network.

Fortunately, we can use Sysmon to build a free endpoint detection solution that, if properly tuned, can broadly match the detection capabilities of paid tools.

As mentioned in part one, our lab is configured to deploy a special Sysmon configuration that collects log data based on known adversary behaviours, as documented within the open-source MITRE ATT&CK framework.