Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

How Kroll transformed its global Managed Detection and Response (MDR) service to Kroll Responder MDR by utilizing CrowdStrike Falcon to deliver faster onboarding, deeper expertise and proactive resilience on a global scale. In December 2025, Kroll and CrowdStrike announced a multiyear strategic partnership to elevate MDR services worldwide.

To read more on this story and the significance of Business Email Compromise (BEC), visit The Wall Street Journal where Dave Burg was interviewed (subscription required). A few months ago, scammers hijacked a routine infrastructure project in Surfside Beach, South Carolina, costing the small town $545,000. The scheme stemmed from a single spoofed email sent from a lookalike domain, instructing the town to switch payment from check to ACH.

Has your organization been exposed? How can you act on the exposures that matter most? What’s the best way to demonstrate measurable risk reduction?

The organizations that thrive in 2030 will be those that treat governance as the foundational architecture for innovations in autonomy.

Each month, our Cyber Threat Intelligence team compiles data from our engagements to determine key industry trends. We look at the initial access methods threat actors are using to gain entry into a network, types of incidents most commonly impacting organizations, which sectors are being more heavily targeted, and which threat groups are most prevalent.

A fully managed, end-to-end CrowdStrike deployment delivered at enterprise scale by Kroll A global quick-service restaurant brand needed to establish consistent, enterprise-grade protection and centralized visibility to quickly strengthen its security posture. It had to move fast without disrupting global operations or overburdening a lean IT team.

In a fast-moving threat landscape, finding the answers to complex security challenges can be fraught with unknowns. Asking the right questions can make all the difference, as Steven Escobar and Ben Habing know well through their work in the Assessments and Advisory practice within Cyber and Data Resilience at Kroll.

This article was authored by Cristhian Parrot from the Kroll Offensive Security Team. Kroll’s Offensive Security Team recently discovered a new vulnerability within Microsoft’s Azure Monitor Agent Metrics Extension, which demonstrates how subtle configuration issues can introduce significant security risks in widely deployed infrastructure components.

Kroll identified a cross-platform malware framework, dubbed GARUDA C2, that uses public code-hosting platforms like GitHub for staging, redundancy and command distribution across Windows, macOS and Linux. Analysis links the campaign to an India-based operator supported by Hindi-language development artifacts, build logs, infrastructure indicators and evidence suggesting use of a locally hosted large language model (LLM) to accelerate malware development.

The next phase of Threat Exposure Management by Gayathri Kunapuli.