Certes blog

What Protects Your Data While You Prepare for PQC?

Certes Networks — Wed, 22 Jul 2026 13:45:25 GMT

Executive Liability Is Real: Why Data Protection Now Sits in the Boardroom

Certes Networks — Wed, 04 Feb 2026 16:05:06 GMT

For years, cybersecurity was seen as an IT problem. But not anymore. In the age of DORA, GDPR, and NIS2, data protection has become a board-level obligation. If your organization mishandles sensitive data, regulators will knock on the boardroom door – and you could be personally liable.

The uncomfortable truth is this: if your security strategy fails to protect data itself, your executives are exposed to legal, financial, and reputational fallout. And “we outsourced it” isn’t an excuse that will save them.

Accountability Has Shifted, and It’s Personal Now

The Risk Mitigation Imperative report from Certes and Freeform Dynamics lays it out plainly: executive liability for data protection is now written into law.

Under DORA and NIS2, board members in regulated industries can be held personally responsible for data protection failures.
GDPR enforcement has matured from warnings to nine-figure fines, including $618 million for TikTok’s unlawful data transfers.
In the US, frameworks like CJIS and HIPAA are following suit, tightening requirements and increasing penalties per violation.

This isn’t a theoretical risk. Uber’s former CSO was convicted for concealing a breach. At T-Mobile and Equifax, security failures triggered executive-level firings. In the UK, the Jaguar Land Rover breach resulted in an estimated $2.5 billion impact on revenue, reputation, and operations.

Why Cloud Delegation Doesn’t Protect You

Many executives believe that if data is hosted in the cloud, responsibility shifts to the service provider.

Wrong.

Regulators follow the data. If you collect it, process it, or store it, you’re accountable for protecting it, even if a vendor or partner handles the infrastructure. You can delegate the work, but not the liability.

Here’s how that plays out:

If your provider can see your data “in the clear,” they become a data processor, and you both share regulatory risk.
If the data remains encrypted end-to-end (unreadable even to the provider), your exposure drops dramatically. A security incident becomes just that, not a breach.

This is exactly why encryption must travel with the data, not stay confined to your infrastructure.

The Regulatory Bar Has Risen. Has Your Security Strategy?

Traditional security architectures still focus on keeping attackers out. But in 2026, that’s no longer enough.

Attackers don’t need to break in; they can just log in using stolen credentials. And once they’re inside, your most sensitive data often moves unprotected between systems.

The problem? Regulators don’t care how the breach happened. They care that it happened, and what data was exposed.

That’s why our whitepaper emphasizes the need for a data-centric security model, not just infrastructure defense. Because when the data is protected and unreadable without the right keys, you may not even need to report the breach at all.

No data exposure means:

No mandatory breach disclosure
No GDPR fines
No class-action lawsuits
No reputational wipeout

DPRM: The Executive Strategy for Limiting Breach Fallout

Data Protection and Risk Mitigation (DPRM) provides a security solution that’s also an executive risk control strategy. Here’s how it protects your business and its leadership:

Protects data in motion: Protects sensitive data across internal and third-party systems, not just in storage.
Keeps control of encryption keys: Ensures your organization, not a vendor, owns the keys, a key requirement under CJIS and other regulations.
Maintains visibility: Unlike traditional VPN tunnel DPRMs, doesn’t blind your monitoring tools. It encrypts the data, not the entire traffic flow.
Delivers audit-ready evidence: DPRM gives risk, legal, and compliance teams the proof they need to demonstrate control and avoid fines.

And crucially, it’s post-quantum ready. With attackers already harvesting encrypted data for future decryption, DPRM ensures that even data stolen today remains unusable tomorrow.

If You’re in the Boardroom, You’re in the Firing Line

This isn’t a scare tactic. It’s a reflection of today’s regulatory and threat reality.

Every business holds sensitive data, so you need to assume it’s a target. And if that data isn’t protected in motion, you’re not just exposed. You’re accountable.

Executives need to be asking tougher questions:

Can we prove our data is protected as it moves across systems?
Who controls our encryption keys?
Are we prepared for post-quantum threats?
What happens when we’re breached, not if?

If those answers aren’t clear, you and your business are at risk.

Get the Full Whitepaper: The Risk Mitigation Imperative

For a deeper dive into how liability is shifting, and what to do about it, download our exclusive whitepaper.

You’ll learn:

Why perimeter defenses are no longer enough
How data-centric protection lowers compliance risk
What steps to take to reduce breach fallout and protect executive leadership

It’s time to stop securing the castle and start protecting the crown jewels: your data.

Download the whitepaper

Why Your Cybersecurity Strategy Is Failing Where It Matters Most

Certes Networks — Wed, 04 Feb 2026 15:52:48 GMT

If your business still believes perimeter defenses will protect it from a breach, you’re already exposed.

You’ve invested in firewalls, VPNs, endpoint protection, and maybe even a Zero Trust framework. Your security stack looks impressive on paper. But here’s the problem: attackers aren’t breaking in, they’re logging in with stolen credentials. And once inside, they’re not after your infrastructure. They’re after your data. If that data isn’t protected in transit, it’s wide open to theft, extortion, and regulatory scrutiny.

Most cybersecurity strategies are focused on the wrong target, and it’s costing companies millions in fines, downtime, and lost trust.

Why Legacy Security Is Leaving Your Data Exposed

Traditional security tools were built to protect infrastructure. They defend access points, manage users, and create barriers around systems. But we all know data doesn’t stay inside those barriers.

Today, information moves constantly between internal apps, cloud platforms, remote users, and external partners. These data flows, inside and outside your organization, are increasing in volume and complexity. And when data moves, your perimeter doesn’t move with it.

This is the blind spot that attackers exploit. And it’s where most organizations fail.

According to The Risk Mitigation Imperative from Certes and Freeform Dynamics, many companies have quietly accepted that protecting data in motion is too hard to solve with legacy tools. So they do what they can and leave the rest to chance. But it doesn’t have to be this way.

Regulators Follow the Data, Not the Infrastructure

If you’re thinking, “But our cloud provider handles security”, you’re missing a critical detail. You can outsource the work, but you can’t outsource the liability.

Whether it’s customer data, financial records, or health information, you’re still responsible if that data is exposed, even if the breach occurred in a third-party environment. Under regulations like GDPR, DORA, and NIS2, executive liability is now personal. If data in motion isn’t properly protected, your organization could face penalties, lawsuits, and mandatory remediation orders. Your CISO or CEO could be held individually accountable.

The regulator’s position is clear: If you hold sensitive data, you’re responsible for protecting it everywhere it travels.

The Limits of Infrastructure-First Thinking

Security teams love to talk about “defense in depth,” but most of that defense is layered around the network, not the data. Solutions like Secure Access Service Edge (SASE) or Zero Trust sound promising, but in practice, they’re expensive, complex, and often incomplete.

Our report highlights what many CISOs already know: Zero Trust initiatives stall, SASE rollouts drag on, and the most sensitive data still moves unprotected between systems.

Even with all that investment, you’re still one compromised credential away from a breach.

Assume Breach. Protect Your Data.

The modern security mindset isn’t “keep the bad guys out.” It’s “assume breach and limit the blast radius.” That means accepting that attackers will get in and designing your protection to ensure they walk away empty-handed.

So how do you do that?

By making sure data is protected the entire time it’s in motion. From the point it leaves the source system to the moment it reaches its authorized destination, the data must remain unreadable. That way, even if it’s intercepted, stolen, or exfiltrated, it’s useless.

This is the foundation of Data Protection and Risk Mitigation (DPRM), a model that recognizes breaches will happen but ensures they don’t become catastrophes.

How DPRM Changes the Cybersecurity Game

DPRM shifts the conversation from breach prevention to breach impact reduction. It’s a pragmatic, data-centric approach built around a few core principles:

Protect data at the source.
Don’t wait until data hits the network. Protect it at the application or device level.
Keep data protection persistent.
Maintain protection across every network, cloud, and system. Don’t decrypt midstream.
Control your keys.
You (not your provider) hold the encryption keys. This limits risk and avoids third-party processor liability.
Apply policy consistently.
Define access at a central control point, and enforce it everywhere, internally and externally.
Be post-quantum ready.
Quantum computing is coming. DPRM with quantum-safe cryptography ensures data stolen today isn’t exposed tomorrow.

It’s Time to Rethink What Security Really Means

You don’t need more alerts. You need measurable, enforceable control over sensitive data, wherever it goes.

That’s why data-centric protection is now the standard for modern cybersecurity. It’s how you reduce risk, prove compliance, and safeguard your organization’s reputation.

Because when the breach happens (and it will), it won’t be your firewall that regulators care about. It will be your failure to protect the data.

Get the Full Report: The Risk Mitigation Imperative

Want to see how this shift is playing out across industries? Download the whitepaper to learn:

Why perimeter-first strategies are falling short
What regulators now expect from executive leadership
How DPRM protects data in motion, even when attackers get in

Stop defending the network. Start protecting what matters: the data.

Download the whitepaper now

Certes appoints Wavelink as distributor for Australia and New Zealand

Certes Networks — Wed, 17 Dec 2025 15:10:54 GMT

Sydney, Australia, 16th December, 2025 — Certes, a global leader in data-centric cybersecurity, data protection & risk mitigation (DPRM) and post-quantum cryptography (PQC), today announced it has appointed Wavelink as distributor across Australia and New Zealand (ANZ).

With organisations of all sizes facing the risk of huge financial, legal and reputational penalties in the wake of a critical data breach, Certes DPRM is a data-centric approach that delivers infrastructure- and application-agnostic data protection with PQC capabilities. Certes DPRM ensures that when a network is breached – which it will be – any data accessed is rendered totally useless in the hands of the attacker, thereby protecting the organisation from penalties (financial or judiciary) and ensuring customer trust.

The partnership expands Certes’ reach across the ANZ market, giving partners and customers local access to sales, enablement, and technical support. As part of this agreement, Certes is committing to a channel-only model in the region, ensuring all sales and support are delivered through its partner ecosystem.

“2025 seems to have been the year of the data breach with numerous high-profile cases hitting the headlines; these have led to billions of dollars in penalties, brand reputations being decimated and countless executives losing their jobs – all of which could have been avoided,” said Bill Fraser, Channel Sales Director – APAC at Certes.

“Certes DPRM is solely focused on protecting data, and ensuring that whatever happens to the network, data is rendered useless to attackers. With PQC capabilities, we are protecting tomorrow’s data today, and thanks to Wavelink’s track record in building successful channels and supporting mission-critical solutions, I am looking forward to being able to ensure that companies across ANZ won’t fall to the same fate as so many others across the globe.

Under the agreement, Wavelink will recruit and enable a focused partner network, deliver pre-sales and post-sales support, and provide first-line technical assistance for Certes’ DPRM offering. The collaboration is designed to accelerate the adoption of continuous security testing, help organisations meet compliance obligations, and reduce risk while lowering the cost of remediation.

“Wavelink is delighted to welcome Certes, into our channel ecosystem-as a global leader in data-centric cybersecurity, data protection & risk mitigation (DPRM), Wavelink continues to be committed to equipping our partners with industry-leading

cybersecurity solutions across ANZ.

The Certes DPRM compliments Wavelinks current vendor portfolio to provide compliance with continuous validation and reporting, said Nick Touzeau, Chief Operating Officer, Wavelink.

What the partnership delivers

Local availability of Certes DPRM through Wavelink’s national reseller network
Wavelink will provide advisory support on channel strategy as well as targeted partner recruitment, new partner activation and ongoing partner investment planning.
Technical support and services aligned to ANZ customer needs
Compliance outcomes supported by continuous validation and reporting

Availability

ANZ partners can engage with Wavelink immediately for pricing, partner onboarding, and customer opportunities.

Certes Strengthens Global Security Landscape Through Strategic Partnership with DeployPartners

Certes Networks — Thu, 27 Nov 2025 09:32:41 GMT

Certes is advancing its mission to deliver quantum-ready data protection by forming a strategic partnership with DeployPartners, a recognized leader in operations, security, and cloud optimization. This collaboration brings together two highly specialized organizations with complementary strengths, creating a new level of capability for enterprises seeking stronger, more resilient security architectures.

The partnership enables organizations to benefit from Certes’ advanced encryption and policy-based cybersecurity solutions alongside DeployPartners’ deep operational expertise. By combining these competencies, the two companies are positioned to help clients streamline security operations, reduce complexity, and prepare for emerging threats – including those driven by rapid advances in quantum computing.

Both organizations share a commitment to innovation and outcome-driven services. Through this joint effort, clients can expect enhanced integration support, improved operational efficiency, and security frameworks designed to evolve with the changing threat landscape.

“DeployPartners has built a reputation for helping enterprises simplify and strengthen security operations,” said Bill Fraser, Channel Sales Director – APAC. “Together, we’re enabling organisations to move from network-centric to data-centric protection -ensuring sensitive information stays secure, visible, and compliant wherever it travels.”

“Our clients need practical, deployable ways to protect data and maintain sovereignty across complex, connected systems,” said Greg Southam, Executive of Sales for DeployPartners. “Partnering with Certes brings advanced, quantum-safe encryption and segmentation technology to the heart of our cyber-resilience offering.”

As cyber risks grow more sophisticated, Certes’ collaboration with DeployPartners represents a meaningful step forward in providing organizations with the tools, guidance, and confidence they need to stay protected today while building a secure foundation for tomorrow.

It’s the Most Wonderful Time of the Year… Unless You’re Hit by Ransomware

Certes Networks — Mon, 24 Nov 2025 15:25:23 GMT

Every retailer knows the holiday season is the make-or-break moment of the year. It’s when revenue targets are hit, customer loyalty is built, and market share is won. But for cybercriminals, it’s also open season.

While your teams prepare for Black Friday and Christmas, cyber criminals are already rubbing their hands with glee. They know your systems will be stretched, staff potentially distracted, and downtime is more expensive than ever. For them, the festive period is all about taking. And they are counting on you being unprepared.

The Holiday Cybercrime Surge

You only have to look at previous years to understand the scale of the threat. Ramsonware continues to surge month by month, but the holiday season escalates dramatically. In 2024, phishing attacks during Black Friday week spiked by 692% relative to early November. December 2024 posted the highest monthly volume of global ransomware attacks ever recorded. And in the same year, a study of retail ransomware recovery found the average cost hit US$2.73 million.

But 2025 is different. The retail sector has already been targeted heavily during the year, with retailers like Marks and Spencer suffering devastating breaches. Online orders ground to a halt. Automated stock management collapsed. Fresh food had to be tracked manually, and entire fulfilment teams reverted to pen and paper. Over £300 million of losses in operational costs, stock write-offs, and reputational damage.

And they’re not alone. In recent months, Co-op, Adidas, Harrods, Pandora, and other high-profile names have confirmed breaches involving stolen credentials, payment data, and supplier compromise.

With peak trading just beginning, the question isn’t whether attackers will strike, it’s how bad the damage will be.

The Real Threat: Data in Transit

Most organizations still rely on perimeter-based defenses, like firewalls, intrusion detection, and endpoint protection, to stop attackers. But those controls assume the network itself is trustworthy. It isn’t. Once an attacker gets inside, whether through stolen credentials or a compromised third party, your data becomes theirs.

88% of breaches now involve credential misuse or phishing. That’s why traditional security architectures fail during periods of high activity. They protect the walls while leaving the data inside completely exposed.

The question isn’t if the perimeter will be breached; it’s how long your data will stay intact once it is.

Downtime Is the Real Cost

When ransomware hits, the first thing you lose is time. And especially in Q4, time is money.

Every minute offline is a missed transaction, an abandoned cart, or a delayed shipment.

IBM’s 2024 Cost of a Data Breach Report estimates the average recovery time at 277 days, with costs exceeding $4.88 million per incident. But that number balloons in retail’s golden quarter. When orders flood in and logistics are maxed out, a few hours of downtime can snowball into supply chain chaos.

No retailer wants headlines like: “Shoppers Left Empty-Handed After Cyberattack Cripples Retail Giant.”

And don’t forget the long-term impact too: customer trust lost in December rarely returns in January.

The Gift that Keeps on Giving: Protecting the Data Itself

Most breaches don’t happen because data is stored unsafely. They happen while it’s moving between systems, into the cloud, across suppliers.

That’s the gap attackers exploit.

Certes’ Data Protection and Risk Mitigation (DPRM) changes the game by protecting the data itself rather than the network it travels through. Unlike traditional encryption tied to network devices, DPRM protects every packet of data in transit, ensuring it remains unreadable, unaltered, and useless to anyone without authorization, even if the network is compromised.

This means your payment systems, customer transactions, and backup data remain protected from interception, tampering, and exfiltration. DPRM also enforces key ownership, ensuring compliance with regulations like CJIS that demand organizations retain full control over their cryptographic assets.

And it’s future-ready. With post-quantum protection already integrated, Certes safeguards data against the next wave of threats, ensuring what’s protected today remains secure tomorrow.

Don’t Let Cybercriminals Write Their Own Wish List

Right now, cyber attackers are preparing their own holiday hits. They’re counting on businesses being too busy, too distracted, or too reliant on outdated tools to stop them.

The ones who’ll survive the season aren’t the ones with the biggest cybersecurity budgets. They’re the ones protecting what matters: their data.

Certes gives your organization full control over your data, even when everything else is under pressure. That’s how you keep transactions flowing, customers loyal, and compliance intact, even when the worst-case scenario hits.

Ready to make your data untouchable this holiday season?

Talk to us about real ransomware resilience, compliance protection, and post-quantum readiness, before attackers make the first move.

NYDFS Expects End-to-End Control of Sensitive Data. Can You Prove It?

Certes Networks — Mon, 24 Nov 2025 15:13:28 GMT

Ask any NYDFS-regulated institution whether they meet the requirements and the answer is almost always the same: “Yes, we’ve got it covered.”

But when we speak with banks, card issuers and financial platforms, a different picture often emerges: controls are strong in some places, but the data itself isn’t consistently protected everywhere it travels.

It’s a sign of how complex hybrid and multi-cloud environments have become, and how NYDFS now evaluates controls based on data-flow protection, not infrastructure alone.

Here are the four areas where organizations may be falling short of NYDFS regulations without realising it.

1. “We have visibility.”

Teams often assume they have good visibility because they monitor infrastructure, run SIEM tools and complete audit spreadsheets.

But NYDFS isn’t asking whether you can monitor infrastructure; regulators want you to demonstrate how nonpublic information travels, who can access it, and how each data flow is protected.

What we typically find:

Data moves between internal systems and cloud providers with little or no inspection.
Third-party connections (payment processors, analytics vendors, SaaS platforms) create blind spots.
Teams track assets, but not how sensitive information actually flows between them.

If you can’t map how NPI moves, you can’t prove it’s protected.

2. “Our controls are consistent.”

Often they’re not, especially in multi-cloud environments. This is the most common assumption we challenge.

Banks rely on a mix of AWS, Azure, Google Cloud, private cloud and on-prem systems. But if each one handles encryption, keys and segmentation differently, then consistency fails to hold up across your environments.

We often see:

One cloud provider encrypts traffic by default, another requires configuration, and legacy systems can’t do it at all.
Data segmentation stops at network boundaries rather than being applied to the data itself.
The same type of sensitive data is handled differently depending on where it flows.

NYDFS expects provable, uniform protection of NPI everywhere. So are your controls really consistent?

3. “We control the keys.”

In practice, many don’t; the cloud provider does. This is the most underestimated gap.

Institutions assume they control encryption keys because they “manage” them inside a cloud provider’s console. But in reality, control is only meaningful if third parties cannot access or influence the keys.

When we ask how keys are generated, stored and managed, here’s what usually emerges:

Cloud providers retain some form of influence or access.
Keys are tied to specific cloud environments and cannot be applied consistently across all of them.
Encryption policies vary depending on where the workload runs.

If a cloud provider holds the keys, you cannot demonstrate exclusive control, and NYDFS has made clear that responsibility for NPI does not shift to vendors.

How to tell quickly if your data in transit is exposed

We ask every NYDFS-regulated organization the same three questions:

Can you prove that all sensitive data is protected consistently across every cloud and vendor?
Can you show that you, not your cloud provider, control the encryption keys?
If an attacker gained valid credentials, could they still extract readable data?

If the answer to any of these is uncertain, your NYDFS compliance is at risk.

How DPRM closes the NYDFS readiness gap

Certes DPRM gives financial institutions a single control that secures data consistently, no matter where it travels. It applies protection at the data flow level, so sensitive information stays isolated, authenticated and encrypted across every cloud, network and vendor. Because DPRM separates protection from the underlying infrastructure, the same policies apply everywhere, even across legacy systems that can’t natively support strong controls.

Your team keeps full ownership of encryption keys and enforcement, removing dependency on cloud-provider key handling. And if a breach occurs, attackers cannot extract readable data, even with valid credentials. DPRM is also built with quantum-safe cryptography, so institutions avoid another rebuild once PQC standards take effect.

With DPRM in place, regulators see clear proof of how NPI is protected across the entire environment, not a patchwork of settings that only cover part of the environment.

Find the Gaps That Put Your NYDFS Compliance at Risk

Most institutions discover gaps only when regulators point them out, usually during an examination, enforcement inquiry or audit review. A readiness briefing exposes those gaps early, shows exactly where controls fall short, and gives teams a direct path to demonstrable protection.

A Certes NYDFS Readiness Briefing helps you:

See where data in transit is exposed across multi-cloud and third-party environments
Validate whether your encryption and key-management approach meets NYDFS expectations
Understand where your current controls break down across different clouds and systems
Learn how data-flow protection provides the proof regulators now expect

If you’re unsure whether your current approach would stand up to NYDFS scrutiny, this session will give you clarity fast and show how Certes DPRM can help you close the gap before it becomes an issue.

Book a free NYDFS readiness briefing now and walk away with an actionable roadmap.

The New NYDFS Standard: Prove Your Data Is Secure, or Face Penalties

Certes Networks — Mon, 24 Nov 2025 15:03:04 GMT

That era is over.

The New York Department of Financial Services (NYDFS) now expects firms to prove how they protect Nonpublic Information (NPI) across every system, cloud, and third-party connection. And regulators have shown they will pursue large penalties when firms cannot demonstrate that protection in practice.

This shift has caught many organizations off-guard. They invested in detection tools, audits, and dashboards, but far fewer invested in controls that actually secure data wherever it moves.

This blog breaks down why NYDFS has raised expectations, where organizations are failing, and why data-centric protection is now the control regulators look for.

NYDFS Is No Longer About “Reasonable Security”, It’s About Evidence

NYDFS supervisors have repeatedly stated that certification alone is no longer enough. Firms must be able to show how NPI is segmented, encrypted, and controlled across hybrid and multi-cloud networks.

Recent enforcement actions underline this change:

EyeMed Vision Care — $4.5M penalty

NYDFS found the organization failed to maintain effective access controls and left known security gaps unresolved. Sensitive customer data was exposed, and the regulator concluded the firm lacked proper oversight of systems handling NPI.

First American — $1M penalty

A vulnerability exposed hundreds of millions of documents containing personal and financial information. NYDFS determined the company had known about the issue for years yet did not remediate it or maintain adequate processes to protect NPI.

Both cases share a theme: NYDFS now investigates whether firms can prove their controls work, not whether they just exist on paper.

Why NYDFS-Regulated Firms Are Struggling

Most institutions can see their risk. They have dashboards, scanners, reports, and audits. But very few can control that risk across the places regulators now examine:

Multi-cloud estates (AWS, Azure, Google Cloud, private cloud)
A mix of modern and legacy applications
Third-party service providers and integrations
Data flows crossing internal and external boundaries

In practice, this results in:

Inconsistent protection across different clouds
Poor visibility of how NPI moves between systems
Over-reliance on cloud-native encryption, where the provider holds the keys
No way to demonstrate segmentation of sensitive data flows
Weak evidence when regulators ask: “Show us how this data is safeguarded.”

NYDFS expects consistent protection across every environment where NPI travels, and many organizations simply don’t have a control that can meet that expectation.

Why the Shift to Data-Centric Protection Matters for NYDFS

The most common gap discovered during NYDFS enforcement is data in transit.

Many firms assume the network, the cloud provider, or TLS alone will cover them. Regulators no longer accept that. They expect organizations to enforce protection at the data-flow level, not at the perimeter or the device.

A modern NYDFS-aligned approach requires:

Protecting the data itself, not just the network it travels across
Ensuring encryption cannot be bypassed or weakened by misconfigurations
Owning the encryption keys rather than leaving them with AWS, Azure, or Google
Being able to prove which users, systems, or services can access specific data flows

This is the shift regulators want to see, and the shift most infrastructures were never designed for.

How Certes DPRM Helps Organizations Meet NYDFS Expectations

Certes DPRM (Data Protection & Risk Mitigation) gives financial institutions a single, consistent control they can point to when regulators ask how NPI is secured across their entire environment.

Instead of relying on a mix of cloud-native settings, network rules, and device-level protections, DPRM applies protection directly to each data flow. It keeps those flows isolated, authenticated, and encrypted, whether they move through private cloud, AWS, Azure, Google Cloud, or third-party networks.

Your organization maintains full ownership of encryption keys and policy enforcement, removing the dependency on cloud provider key management. And because DPRM records clear, auditable policies and logs, teams can show regulators exactly how NPI is segmented, governed, and protected.

DPRM is also built for crypto agility. Its quantum-safe design means firms can be ready for the PQC era, avoiding another costly and disruptive compliance cycle.

NYDFS Has Raised the Bar, Firms Need Controls That Can Keep Up

NYDFS is now focused on proof, not promises. If an organization can’t show how NPI is secured across end-to-end data flows, regulators see that as a material gap, no matter how strong the documentation looks.

Certes helps financial institutions replace partial coverage with data protection that works across every cloud, system, and connection. Instead of depending on the network or the provider, DPRM gives teams a straightforward, defensible answer when regulators ask how data is actually protected.

Book your free NYDFS Readiness Briefing and get a clear path to provable protection.

HIPAA Safeguards for Data in Motion: Securing Legacy Healthcare Networks

Certes Networks — Thu, 13 Nov 2025 15:34:10 GMT

Hospitals across the US rely on legacy infrastructure that was never built to meet today’s cybersecurity demands. MRI scanners, patient monitors, and lab systems often run on outdated operating systems. Replacing them is challenging and costly. Many of these machines are FDA-certified, and any software change can trigger a recertification process, leading to costly downtime.

But while the hardware stays stuck in the past, the regulations don’t. Protected Health Information (PHI) must still meet the security and privacy requirements laid out in HIPAA. That’s the challenge facing nearly every hospital IT team: how to meet modern data protection requirements using outdated, hard-to-replace systems.

The Financial Risk of Securing Data Using Legacy Equipment

Outdated equipment might slow down care delivery, but it also creates risk exposure.

HIPAA penalties now exceed $1.9 million per violation category, per year, based on 2025 federal updates.
The average healthcare breach costs more than $10 million – the highest across all sectors.
Patient trust is fragile. One incident can erode public confidence and invite scrutiny from regulators, auditors, and the media.

Modernizing every device might seem like the obvious fix, but for most hospitals, it’s not realistic. A full replacement effort could reach tens of millions of dollars and disrupt clinical operations. That’s why security teams are shifting focus to a more viable approach: protecting the data itself, especially while it’s in transit.

Why PHI in Transit Is the Hidden Vulnerability

Most healthcare security strategies focus on the perimeter: firewalls, segmentation, endpoint protection. These controls are necessary, but they don’t address the most frequently exploited gap: protecting data in motion.

Every imaging file, lab result, or EHR update moving across a network is a potential breach point. If data isn’t protected during transmission, perimeter security alone won’t stop attackers from capturing or altering it.

This is where Certes DPRM (Data Protection & Risk Mitigation) comes in.

How Certes DPRM Secures PHI Without Touching the Device

Certes solves this problem without forcing hospitals to change their infrastructure. DPRM protects PHI directly at the data-flow level. Instead of relying on firewalls or device security, DPRM applies security policies to each stream of data in transit.

Each data flow is individually protected using its own encryption key, policy, and rotation schedule. Even if these flows run across the same network, they remain fully isolated from one another. If one stream were somehow compromised, the attacker wouldn’t gain access to anything else.

This approach allows hospitals to maintain their FDA-certified systems and existing infrastructure while securing PHI to support HIPAA’s transmission safeguards.

Meeting HIPAA Safeguards with Crypto-Segmented Data Flows

The HIPAA Security Rule mandates protection against unauthorized access during transmission and requires healthcare organizations to ensure the integrity of PHI.

Certes supports these mandates by:

Securing data in transit across internal, cloud, and third-party networks.
Isolating each data flow using crypto-segmentation, making compromise of one stream irrelevant to the others.
Enabling centralized control over key rotation, policy enforcement, and auditability.

This means hospitals can enforce strong technical safeguards while avoiding major infrastructure overhauls or device replacement.

Quantum-Safe PHI Protection for Future-Proof Compliance

The risks don’t stop at traditional encryption vulnerabilities. Quantum computing is no longer a distant research topic. Cyber criminals are already stockpiling encrypted healthcare data, ready for the quantum era that will allow them to decrypt it.

Certes addresses this head-on. DPRM integrates post-quantum cryptography today. That means secured PHI now stays secure, even when quantum computers become commercially viable. This future-proofing is critical for any provider handling sensitive patient data, especially as regulatory frameworks begin to incorporate quantum readiness into their enforcement standards.

Extend System Life. Reduce Risk. Avoid the Breach.

Not every hospital can afford to replace its equipment. But no healthcare provider can afford a breach. Certes offers a path forward that doesn’t force a decision between modernization and security.

DPRM allows hospitals to extend the life of their legacy systems while still aligning with HIPAA safeguards. It reduces breach risk without touching the device. And it protects patient data in transit, even if attackers breach the network.

The result is a security model that works with what hospitals have today, while preparing them for what’s next.

Ready to See It in Action?

If you’re leading cybersecurity for a healthcare organization, don’t wait for the next breach or audit. You don’t need to replace every system to protect your patients’ data.

Our latest whitepaper breaks down how Certes DPRM helps meet key HIPAA requirements while reducing operational risk and avoiding the need to replace critical infrastructure. Read it here.

Post-Quantum + Active Directory: A Perfect Storm for Attackers

Certes Networks — Fri, 07 Nov 2025 11:15:11 GMT

Now consider this: one of your IT assets many believe most critical, Active Directory, is likely vulnerable to the quantum threat. And if you’re still relying on outdated protections, you may be handing over the keys to your kingdom without even realising it.

The Quantum Threat Is Not Theoretical

Quantum computers are no longer a distant possibility. Nation-state actors are already harvesting encrypted traffic with the intent to decrypt it once quantum capabilities mature, a tactic known as “harvest now, decrypt later.” This makes every unprotected AD communication today a future breach in waiting.

LDAP, Kerberos, and DNS traffic between endpoints and domain controllers contain the keys to the kingdom. If harvested, that data could be decrypted later and weaponised to impersonate users, forge credentials, and bypass even the most advanced access controls. Once Active Directory is compromised, trust collapses, and that means your business can fail.

Unlike traditional malware campaigns, these are long-game strategies. Data stolen today will remain valuable for years. Access tokens, admin credentials, internal structures – all of it sits in transit inside AD communications, and all of it is up for grabs if left unprotected.

Active Directory Is the Ultimate Target

Attackers aren’t guessing passwords; they’re logging in. In 86% of breaches, stolen credentials are the root cause. And what validates those credentials? Active Directory. Once inside, attackers use tools like Mimikatz and BloodHound to enumerate AD, escalate privileges, and move laterally.

Here’s what’s at stake:

Identity hijack: Attackers can impersonate users and access any system.
Ransomware spread: Group policies can be weaponised to disable AV or push malicious payloads.
Operational shutdown: User lockouts, login failures, and policy tampering halt productivity.
Compliance collapse: A breach of AD is a breach of GDPR, DORA, HIPAA, and NIS2.

When AD goes down or is compromised, it’s more than an IT incident; it’s a business crisis. Your workforce is locked out, your customer data is at risk, and your compliance posture disintegrates.

We’ve seen this play out recently. In April 2025, Marks & Spencer was hit by a sophisticated ransomware attack that reportedly began with compromised credentials and culminated in the theft of their AD database. Despite strong internal controls, attackers exploited AD visibility to move laterally and deploy ransomware across the environment. The fallout included £300M loss in operating profit, a £1B drop in market value, and millions per week in lost sales, in addition to the overall disruption and huge reputational damage.

This wasn’t an isolated incident. Other UK retailers were also targeted in similar campaigns, with attackers leveraging AD access to exfiltrate data and paralyse operations. These attacks highlight just how quickly hackers pivot from access to impact, and how vulnerable unprotected AD traffic can be, even in well-defended environments.

Why Traditional Cyber Protections Fall Short

TLS and IPsec were never designed for post-quantum resilience. They also depend heavily on endpoint trust and can be bypassed by insider threats or compromised devices. VPNs and VLANs offer complexity, not security. And they provide no visibility or auditability.

Endpoint detection can’t stop traffic-level exploitation. MFA and Conditional Access can’t stop credential forgery. If your strategy ends at the login screen, you’re missing the bigger threat.

Certes takes a fundamentally different approach.

Certes DPRM: Quantum-Ready Active Directory Protection

Certes Data Protection and Risk Mitigation (DPRM) solution cloaks AD traffic in deterministic, zero-access protection. Unlike identity-centric controls, Certes enforces policy at the transport layer using cryptographic segmentation. Here’s how:

Post-Quantum Protection: Certes integrates post-quantum cryptography. This future-proofs your AD traffic against quantum decryption.
No Keys on Endpoints: Encryption keys are never stored on devices or transmitted on the wire. Even if a device is compromised, there’s nothing to steal.
Lateral Movement Prevention: Certes stops enumeration tools cold. Attackers can’t scan, interact with, or even see AD traffic unless they match policy.
Audit-Ready Visibility: Real-time policy telemetry shows who accessed what, when, and how, without decrypting content. Essential for regulatory audits.

This is protection that assumes compromise, and still holds. Even if a threat actor breaches the network perimeter, Certes ensures they cannot gain any useful insight or access from AD traffic.

Protect the Core Before It’s Too Late

Active Directory is the backbone of IT systems. But it’s also a glaring vulnerability if traffic isn’t cryptographically protected. The quantum threat makes delay unacceptable.

Security isn’t just about firewalls and access control, it’s about visibility, assurance, and resilience. When you protect AD at the traffic level with post-quantum enforcement, you mitigate risk by eliminating attack paths.

Certes DPRM is already post-quantum ready. It ensures your AD traffic is invisible and inaccessible to attackers, even those harvesting data today for use tomorrow.

Because protecting AD is essential to protect your data and thereby the trust that keeps your entire organisation running.

Your Active Directory is too valuable, and too vulnerable, to rely on outdated protections. Certes DPRM delivers quantum-safe, zero-access control over the traffic that keeps your business running.

Ready to see how it works? Book a meeting or request a callback and let’s make your AD invisible to attackers.

Certes Validated as “Nutanix Ready – AHV” with Quantum-Safe Options to Protect Data Everywhere

Certes Networks — Wed, 05 Nov 2025 09:23:28 GMT

Certes Validated as “Nutanix Ready – AHV” with Quantum-Safe Options to Protect Data Everywhere

Certes Networks — Fri, 31 Oct 2025 11:04:05 GMT

It’s all about the data.

Regulators focus on it, cyber criminals want it, and CISOs and compliance officers are caught in the middle, worrying how to protect it in the wake of ever-increasing constraints on people and budgets.

Notwithstanding today’s risk and threats from bad actors, another challenge looming on the horizon is the threat posed by quantum computing, which is discussed at this link.

The problem gets worse because current security capabilities that build higher walls around enterprise networks only detect threat events that have already occurred. Stealthy cyber criminals still manage to get inside networks, where they perform reconnaissance, spread laterally and exfiltrate data with impunity.

Certes provides Quantum Safe Data Protection and Risk Mitigation (DPRM) capabilities to businesses, governments and other organisations that are concerned about protecting critical data. DPRM proactively safeguards before cybercriminals damage and exfiltrate data during backups, on servers and while in transit.

The term end-to-end encryption is frequently used in cybersecurity, but it can fall short of its promise. Many solutions only encrypt data between specific nodes or within segmented parts of the network, leaving points of exposure where data is briefly decrypted for inspection, routing or policy enforcement.

Certes takes a fundamentally different approach. Its architecture enforces persistent encryption so that data remains protected from its point of origin to its destination. Data is not exposed in plaintext, even during transit across internal networks or third-party infrastructure. This targets common vulnerabilities introduced by intermediate decryption and significantly reduces the attack surface.

This is more than encryption. It’s data-in-motion security as it was originally intended – continuous, verifiable and resistant to compromise.

The Certes model delivers:

▪ Quantum-Safe Protection – Post-quantum cryptography is built into the data layer, not bolted on later.

▪ Regulatory Readiness – Supports GDPR, DORA, NIS2, and CJIS compliance with enforced key ownership and audit-friendly controls.

▪ Zero Trust Enablement – No trust in the network, full trust in the data.

▪ Operational Longevity – Future-proofs sensitive data so it’s not exposed years from now when legacy encryption is forecast to collapse.

Certes Enforcement Points (CEP) implement the DPRM controls and can be deployed as bump-in-the-wire devices, virtual CEPs (vCEPs) and containers or in the cloud (cCEP). It all depends on how close a customer wants to put the protection to the applications.

As more organizations seek to implement workloads across datacenters, public cloud and edge compute facilities, they are naturally turning to vendors that offer seamless and comprehensive capabilities to manage across such environments.

Nutanix delivers hybrid and multicloud infrastructure that enables IT to run apps and data anywhere. The Nutanix Cloud Platform (NCP) solution natively converges silos of compute, storage, networking, and virtualization in a hyperconverged platform to run workloads at scale.

Through the Nutanix Prism hybrid multicloud management system, IT organizations can accelerate application infrastructure deployments and simplify operational management through one-click provisioning capabilities. Prism centralized management and orchestration automates configuration, provides essential analytics capabilities and does not require separate infrastructure.

The Nutanix AHV hypervisor extends advanced virtualization capabilities to modern hybrid and multicloud environments. Featuring a distributed systems core designed for the cloud, Nutanix AHV is designed to solve today’s complex enterprise IT challenges.

The Certes vCEP is validated by Nutanix to run on Nutanix AHV to power VMs and containers on-premises and in public clouds. The Nutanix Ready – AHV badge is awarded to products and solutions that have been tested and verified to work with Nutanix AHV. The Nutanix compatibility and interoperability matrix shows which version combinations have been validated.

By sitting on the Nutanix AHV hypervisor, the DPRM capabilities can be easily configured between the physical ports of a node and the VMs running there, which pushes data protection capabilities as close to the source of data as possible.

The benefits of this are:

1) Data is protected in VMs before leaving a physical port, making reconnaissance, lateral movement and exfiltration attempts by threat actors a fruitless endeavour.

2) Simplicity of deployment with control of the policy and keys kept in the hands of the data protection team. A vCEP is a bump in the wire that resides on the node, so network implementation and design processes need not be engaged.

3) Quantum safe protection for every VM mitigates the risks associated with legacy protocols, encryption capabilities and breaches due to exfiltration of data from VMs.

This allows organizations to rapidly and easily address the top-of-mind issues that CISOs are thinking about.

▪ Deploying a global quantum safe strategy.

▪ Protecting cyber vault backup and recovery systems to help ensure data integrity.

▪ Stopping the ransomware kill chain on Active Directory on Nutanix AHV by preventing the exfiltration of data by cyber criminals.

▪ Protecting critical AI data traffic and assets from poisoning, exfiltration and damage when building AI infrastructures.

Implementing Certes Quantum Safe DPRM vCEPs on Nutanix AHV gives organizations the ability to build scalable, simple and comprehensive data protection capabilities into their nodes to reduce the risks that CISOs, compliance officers and executives are concerned about.

Contact Certes to find out more.

Why Your Service Provider’s Breach Is Your Problem

Certes Networks — Mon, 20 Oct 2025 12:30:35 GMT

Too many CFOs and CISOs still believe their service providers have security under control. They don’t.

Every time your data leaves your environment unprotected, you hand over your reputation, revenue, and regulatory standing to someone else’s perimeter. And when that provider gets breached, and they will, you’re the one regulators and shareholders hold responsible. The data owner stays in the firing line.

Executives often treat outsourcing as risk reduction. In reality, it multiplies exposure. Managed service providers protect their perimeter, not your data. They secure networks and endpoints, but the moment information moves between your systems and theirs, it’s exposed. That’s where attackers strike, exploiting gaps in data-in-transit protection to intercept, alter, or weaponize your information.

Outsourcing services doesn’t outsource liability.

Regulatory Accountability: You Own the Risk

When your provider fails, the fallout lands on your balance sheet.

DORA, GDPR, and NIS2 are unambiguous: data owners are accountable for protecting sensitive information, regardless of who processes it. If your provider mishandles your data, your organization faces the fine, which could be up to 4% of global revenue, and your leadership carries personal liability.

Financial and Insurance Fallout

Insurers are tightening exclusions for third-party breaches. If your provider is compromised and you can’t prove you protected your data in transit, don’t expect a payout. The financial exposure doesn’t stop at fines, it extends to legal action, shareholder scrutiny, and long-term erosion of market trust.

If we’re not clear enough, then here’s your reminder: you can’t insure against responsibility.

Operational Disruption: When Your Provider’s Breach Becomes Your Crisis

A single provider breach can halt operations overnight. Customer deliveries stall, systems freeze, and recovery costs skyrocket. The breach may have originated with a vendor, but your business takes the hit.

Between your systems and theirs, data flows unprotected, exposed to interception and manipulation. Attackers know it. Regulators know it. Do you?

Data in Motion Is Still Unprotected

Most providers claim strong “security controls,” but these often stop at the edge of their network. Data moving between environments remains vulnerable. That’s the weak link, data in motion, unprotected, unmonitored, and fully exposed to interception. Because legacy security systems like network and endpoint protection only delay attackers. Data protection stops them from getting anything useful.

Certes DPRM: Continuous Protection Beyond the Provider’s Perimeter

Protection must travel with the data. Certes Data Protection & Risk Mitigation (DPRM) ensures data remains protected, authenticated, and compliant wherever it moves. Even if a service provider’s perimeter is breached, your data stays secure, preserving integrity and meeting regulatory demands.

Regulators don’t accept excuses, and neither do attackers. Your provider’s breach is your problem unless your data is protected independently of their controls.

Your Next Step: Eliminate Service Provider Risk

CFOs and CISOs should be asking two questions today:

How is our data protected when it leaves our network?
Can our providers prove compliance with data-in-transit protection standards?

If the answer to either is unclear, your exposure is real.

Watch our short video to see how Certes DPRM solves the service provider risk challenge, then book a demo to see how you can protect your data everywhere it moves.

Boardroom Cybersecurity: Why Liability Has Shifted to Executives

Certes Networks — Mon, 20 Oct 2025 10:37:17 GMT

The Hidden Cost of Holding Customer Data: Why CFOs Should Rethink Their Risk Approach

Certes Networks — Fri, 12 Sep 2025 09:47:10 GMT

What’s the real cost of holding customer data?

Most organisations rightly treat data as an asset; a fuel for growth, personalisation, and service delivery. But how often do boards stop to ask: what if this “asset” is also the single biggest liability on our books? What if the customer information we’re holding today is the very thing that could bankrupt us tomorrow?

Because when you hold sensitive data, you also hold the financial liability if it’s compromised. And regulators don’t care whether the breach came from your tech, your people, or your third-party provider. If the data is exposed, everyone pays.

But what if there was a way to significantly reduce this liability, without impacting your service delivery?

Data is financial risk capital

Regulations have tightened up on data protection rules and litigation. Under GDPR, fines can reach 4% of global revenue per breach. In 2021, Amazon was fined €886 million for GDPR violations. DORA and NIS2 add strict accountability for boards and executives, while CJIS enforces mandatory encryption key ownership for law enforcement agencies.

The costs don’t end with fines. The average total cost of ransomware recovery for UK organisations rose to $2.58 million in 2025. Add in litigation, lost contracts, and reputational fallout, and the real number can be far higher.

For CFOs, each piece of sensitive data represents potential financial exposure that could impact the organisation if it’s compromised

The hidden reserves draining profitability

Behind the scenes, regulators expect that if you’re holding sensitive data, you’re financially capable of covering the fallout of a breach. That means CFOs need to plan for the potential financial impact of data breaches, including fines, litigation, and reputational costs. Organisations with larger data holdings may face proportionally higher exposure, which can strain profitability if not carefully managed

Shared liability: you can’t contract your way out

One of the most dangerous misconceptions in the boardroom is that liability can be outsourced. It can’t.

GDPR, DORA, and NIS2 make it clear: responsibility is shared across data processors. If your service provider, cloud partner, or contractor mishandles data, you’re still accountable. Regulators won’t stop at the weakest link; they’ll fine everyone in the chain.

This means one breach can multiply into several regulatory actions. And no contract clause will save you.

Why cybersecurity spending doesn’t fix the problem

Boards often assume that spending more on cybersecurity reduces financial liability. But that isn’t how regulators see it.

Attackers aren’t breaking in; they’re logging in with stolen credentials. Even the most sophisticated firewalls and monitoring can’t prevent exposure once access is gained. When data is compromised, regulators don’t care how many layers of defence you bought. They only care that you held it, and you lost it.

Cybersecurity tools can slow attackers down. They do nothing to shrink the liability of holding data. If you can see it, you can lose it. And if you can lose it, you’re financially exposed.

The alternative: eliminate liability at the source

The radical but logical answer is simple: don’t hold what you don’t need.

For decades, companies assumed that to deliver a service, they had to see and store customer data. That assumption is what created today’s liability trap. But technology has moved on. Data can now be protected in transit in a way that keeps it functional for the business while remaining inaccessible to the business itself.

If your systems can function without ever seeing or accessing sensitive data, you remove liability entirely. You can process, transmit, and deliver outcomes, but without the exposure that triggers regulatory fines.

No access means no exposure. And no exposure means no reserve required.

This shifts the equation for CFOs. Instead of carrying risk reserves that drain profitability, you can redesign operations so the liability is reduced in the first place.

Why the time to act is now

Regulatory penalties aren’t slowing down; they’re escalating. GDPR fines now run into the hundreds of millions. DORA and NIS2 explicitly make boards and executives personally accountable. And quantum computing threatens to break today’s protection methods, exposing encrypted data already stored today.

And here’s the part too many CFOs overlook: liability is shared. Under GDPR and related regulations, you cannot contract your way out of responsibility. If your third-party provider mishandles data, you’re still on the hook. One breach can mean multiple fines across the same data chain.

When you can access sensitive data, risk reserves balloon, margins erode, and profitability becomes hostage to regulators.

CFOs can’t afford to treat this as tomorrow’s problem. The question is whether boards act now to eliminate liability at the source or wait until the regulator, the attacker, or the market forces the issue.

Because the strongest companies in the next decade won’t be those with the biggest reserves. They’ll be the ones with the least to lose.