2025 彙整 - 頁125，共137

Effective vulnerability and patch management: The key to strong organizational security in 2025

The gap between identifying vulnerabilities and applying patches continues to be a major bottleneck for organizations. In December 2024, the U.S. Treasury Department reported a breach attributed to a Chinese state-sponsored actor, who exploited two known vulnerabilities in BeyondTrust’s remote tech support software to gain unauthorized access^[1].

This incident makes us realize the importance of robust vulnerability and patch management strategies, especially now that we are entering the Year 2025. Both processes play crucial roles in securing IT systems, yet they serve distinct purposes and operate in tandem to safeguard organizational assets.

Let’s explore the fundamentals of vulnerability and patch management, their lifecycles, and how they complement each other to form the backbone of modern cybersecurity strategies. Read On-

Vulnerability vs. patch management: Understanding the basics

The first and most important thing to understand is that patch management is a process that comes within the broader scope of vulnerability management.

Vulnerability management is the process of identifying, assessing, categorizing, prioritizing, mitigating, and finally remediating vulnerabilities from an IT infrastructure. The aim here is to eliminate the security flaws, glitches, or weaknesses found in the system, which an attacker could exploit.

Conversely, patch management is the process of managing the action of patching the vulnerabilities. It identifies, prioritizes, tests, and deploys the patch to an operating system. Patching ensures that the devices run on the latest OS and app versions, addressing any kind of bug or vulnerability.

According to Jason Firch (CEO, PurpleSec), organizations can have vulnerability management without patch management, but they can’t have patch management without vulnerability management. One is dependent on the other^[2].

Learning the mechanics of vulnerability and patch management

To understand how vulnerability and patch management work we will need to understand their lifecycles.

Patch management lifecycle

1. Build an inventory of production systems such as IP addresses, OS, and applications.

2. Scan the system for missing patches.

3. Create the patching policies according to your organizational needs.

4. Prioritize patches based on their severity.

5. Stage and test patches in a controlled environment.

6. Deploy patches to required devices, servers, and operating systems.

7. Verify patch deployment to ensure that they are not only installed but also working as intended.

8. Create patch reports under the company’s IT security policies and procedures documentation.

Vulnerability management lifecycle

1. Find and identify vulnerabilities that require patching.

2. Assess vulnerabilities and their levels of risk to the organization.

3. Prioritize vulnerabilities by identifying which ones to patch first for a relevant impact on your organization.

4. Apply a patch to remediate the vulnerability.

5. Review and assess the patched vulnerabilities.

6. Continue monitoring and reporting vulnerabilities for a better patching process.

The interplay between patch and vulnerability management

Patch management and vulnerability management are complementary processes that form the cornerstone of an organization’s cybersecurity strategy.

While vulnerability management sets the stage by highlighting security gaps that need to be addressed, patch management complements vulnerability management by addressing the identified security flaws.

Patch management reduces the attack surface and reinforces the security framework by systematically addressing vulnerabilities. The synergy between vulnerability and patch management lies in their shared objective of minimizing risk.

Feedback loop: Vulnerability assessments inform patch management teams about critical vulnerabilities that require immediate action. Post-patch deployment, vulnerability scans confirm whether the issues have been resolved.
Prioritization alignment: Vulnerability management helps prioritize which patches to apply first based on the risk level, ensuring high-risk vulnerabilities are addressed promptly.
Proactive defense: Continuous monitoring by vulnerability management ensures that emerging threats are detected, while patch management provides the means to neutralize them effectively.

Patch vs vulnerability management: The odds and evens

Effective cybersecurity strategies hinge on patch and vulnerability management, as these processes address critical aspects of IT security. While they share similar goals—reducing risks and maintaining system integrity—they follow distinct methodologies and scopes.

Similarities

a. Focus on reducing risks

Both patch management and vulnerability management aim to minimize security risks by addressing potential threats. Patch management achieves this by applying software updates, while vulnerability management identifies and mitigates weaknesses in the system infrastructure.

b. Lifecycle phases

Both processes share similar lifecycle stages, such as identification, prioritization, remediation, and validation. These stages ensure vulnerabilities and patches are systematically addressed to enhance security.

c. Dependency on accurate assessment

Accurate assessment is critical for both processes. Patch management relies on understanding software versions and available updates, whereas vulnerability management depends on thorough scans to detect potential weaknesses.

Key Differences

Aspect	Patch management	Vulnerability management
Scope	Addresses software and application updates.	Covers weaknesses in networks, hardware, and software.
Approach	Reactive: Fixes known issues.	Proactive: Finds and assesses potential risks.
Tools	Patch deployment tools, and automated update systems.	Scanners, penetration testing, and risk analysis tools.
Outcome	Measured by patches applied and compliance.	Focuses on risk reduction and improved security posture.
Integration	IT asset and change management processes.	Risk management, compliance, and incident response.

a. Scope of management

Patch management: Focuses specifically on deploying updates to software and applications, addressing known vulnerabilities by fixing bugs or enhancing features.
Vulnerability management: Takes a broader approach, identifying, analyzing, and mitigating weaknesses across the entire IT environment, including network configurations, hardware, and software.

b. Proactive vs. reactive

Patch management: Often reactive, as it addresses vulnerabilities already identified and fixed by software vendors.
Vulnerability management: Proactive, involving continuous scanning and monitoring to uncover vulnerabilities that may not yet have a patch available.

c. Tools and techniques

Patch management: Relies on patch deployment tools and update management systems to automate and schedule updates.
Vulnerability management: Uses vulnerability scanners, penetration testing, and risk analysis tools to identify and assess system weaknesses.

d. Outcome and metrics

Patch Management: Success is measured by the number of systems patched and compliance with update schedules.
Vulnerability Management: Metrics focus on risk reduction, such as the number of vulnerabilities mitigated and the overall security posture improvement.

e. Integration with other processes

Patch management: Primarily integrates with IT asset management and change management processes.
Vulnerability management: Aligns more broadly with risk management, compliance, and incident response plans.

Best practices for implementing patch and vulnerability management

Effective patch and vulnerability management is essential to maintaining a strong security posture and protecting against emerging cyber threats. By adhering to best practices, organizations can reduce the risk of security breaches, improve system performance, and ensure compliance with regulatory standards. Following are some key best practices for implementing a patch and vulnerability management program:

1. Establish a comprehensive inventory

Begin by creating and maintaining an up-to-date inventory of all hardware and software assets. This includes operating systems, applications, and network devices. Knowing what needs to be patched or updated is the first step in managing vulnerabilities effectively. Regularly audit and update the inventory to ensure you aren’t missing any critical systems.

2. Prioritize patches based on risk

Not all vulnerabilities are created equal. Some may pose a more immediate threat to your organization than others. Prioritize patches based on risk levels, considering factors such as the severity of the vulnerability, the criticality of the system, and any known exploits. A risk-based approach ensures that you address the most critical threats first, minimizing potential damage.

3. Automate patch deployment

Manual patching can be time-consuming and error-prone. Automated patching allows for faster, more consistent updates across your environment. With automated solutions, patches can be tested, approved, and deployed to all systems efficiently, reducing the likelihood of human error and ensuring timely updates.

4. Test patches before deployment

While automation helps streamline the process, it’s crucial to test patches in a controlled environment before deploying them across your production systems. Testing patches ensure they don’t disrupt business operations or introduce new issues. A test environment will help identify any compatibility or performance issues, so you can address them before widespread implementation.

5. Maintain a patch management schedule

Consistency is key when managing patches. Implement a regular patch management schedule that includes daily, weekly, or monthly checks for new patches. Having a routine process in place ensures that patches are applied promptly and helps organizations stay on top of new security vulnerabilities as they emerge.

6. Monitor and report vulnerabilities

Regularly monitor for new vulnerabilities and threats affecting your systems. Implement vulnerability scanning tools to identify potential weaknesses and gaps in your security posture. Once a vulnerability is discovered, generate detailed reports to help track remediation efforts and assess the effectiveness of your patching strategy.

7. Establish incident response protocols

Even with a solid patch management strategy, incidents can still occur. Ensure that you have clear and well-documented incident response protocols in place. This should include steps to take if a vulnerability is exploited, such as isolating affected systems, analyzing the breach, and applying emergency patches if necessary.

Ensure consistent protection with Scalefusion’s automated patch management

If you want to upgrade to an advanced patch management solution for your Windows devices and third-party applications, look no further. With Scalefusion UEM’s automated patch management, you can schedule, delay, automate, and deploy patches on your device, keeping them updated and protected from vulnerabilities at all times.

About Scalefusion
Scalefusion’s company DNA is built on the foundation of providing world-class customer service and making endpoint management simple and effortless for businesses globally. We prioritize the needs and feedback of our customers, making sure that they are at the forefront of all decision-making processes. We are dedicated to providing comprehensive customer support services, and place emphasis on customer-centric thinking throughout the organization.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

2025 Scalefusion

How to Build a Proactive Incident Management System (with Automation!)

Why is incident management crucial?

“Prevention is better than cure,” as the old saying goes, and it’s true. It also applies to the digital ecosystem in which we and our companies operate, especially when it comes to security.

In an increasingly complex digital environment, the number and variety of IT incidents are constantly growing. Consequently, organizations need advanced strategies to effectively manage these challenges.

Proactive incident management fits into this context with a very clear goal: to prevent and mitigate incidents before they can cause significant disruptions.

This approach not only reduces downtime but also enhances the resilience of the entire IT infrastructure.

But now, let’s take a step back to provide some context and see the differences between proactive and reactive incident management.

Proactive vs. Reactive Incident Management

The difference between proactive and reactive incident management is quite intuitive: reactive incident management focuses on responding to events after they have occurred, while proactive management involves identifying signals and patterns that may indicate a potential issue, allowing preventive actions to avoid or reduce the impact.

As mentioned earlier: prevention is better than cure… so the proactive approach is certainly the one to prefer.

However, be careful! These two types of management are not mutually exclusive—quite the opposite: they should both be implemented to get the most out of their integration.

Automation in Incident Management

The Role of AI and Automation in Reducing Incident Response Times

Automation is at the heart of the ongoing digital “revolution” and is also a crucial component in transforming incident management from a manual, reactive process to a proactive, automated one.

Advanced technologies like artificial intelligence (AI) can analyze data in real time, detect anomalies, and initiate corrective actions before incidents turn into crises.

In other words: response times are drastically reduced, and, at the same time, the effectiveness and precision of interventions are significantly improved.

This is why end-to-end incident resolution solutions are becoming more crucial every day: through automation, they speed up incident resolution, reduce human intervention (and consequently the workload on IT teams), and optimize operational efficiency—all at once.

Automated Ticketing and Alert Systems

Let’s get even more practical: automated ticketing systems can generate intervention requests at the first sign of anomaly, while alert systems immediately notify the responsible technicians.

What does all this mean? It means the ability to manage each incident in a timely manner, assigning the correct priority and the appropriate escalation path if needed.

The end result? An improvement in service quality, enhanced infrastructure security, and a reduced workload for IT teams.

Configuring a Proactive System

Key Features of a Proactive Incident Management System

A proactive incident management system must include several key features to ensure maximum effectiveness. There are many options and possibilities, but the essential aspects can be summarized in these points:

Continuous monitoring system.
Real-time data collection.
Workflow automation.
Integration with other ITSM tools.
Incident prediction capabilities via AI (a point we will return to shortly).
Centralized management of notifications and alerts.
Scalability, to adapt to a growing number of devices and services managed within the organization.
Advanced reporting and analytics, to trigger a continuous improvement process.

Steps to Implement Automation in Incident Management

Implementing a proactive system requires several steps that deserve careful attention. Ultimately, these steps largely depend on the key features mentioned above.

In short: defining objectives and requirements, selecting the right technologies, configuring monitoring systems, creating custom automated workflows, and tailoring analytics and reporting systems.

Last but not least, it’s also important to implement effective training for the teams that will use these tools.

Using AI for Incident Prediction and Prevention

Artificial intelligence is proving to be the engine of a significant technological breakthrough, which some compare to the introduction of the internet itself. The near future will tell if this is indeed the case.

In the present, however, we can already use artificial intelligence by implementing it in proactive incident management systems. With what aim? To analyze large amounts of data to identify patterns that could indicate an imminent problem. A predictive approach to security that allows for extremely efficient preventive measures in a very short time.

Best Practices for Proactive Incident Management

Automating Incident Categorization and Prioritization

Automating the classification and prioritization of incidents accelerates response mechanisms, ensuring that resources are allocated where necessary, only when necessary.

Thus, this approach optimizes the process, reduces resolution times, and improves overall service quality.

Integrating Incident Management with Monitoring Tools

Integrating monitoring tools like EV Observe helps quickly detect anomalies and automatically initiate incident management workflows. This integration forms a preliminary step to what we discussed earlier and promotes a holistic, coordinated approach to problem prevention.

Reducing the Incident Volume with Shift-Left Strategies

Adopting a “Shift-Left” approach means moving problem resolution to earlier stages of the IT service lifecycle, involving end users in self-managing minor issues. Practically speaking, this approach aims to prevent issues from escalating by addressing them early or providing easy-access tools for the individual user.

Shift-Left can be achieved through the implementation of self-service solutions, such as support portals with a knowledge base and guided troubleshooting tools, allowing users to independently solve common problems.

The result is a reduced workload for specialized technicians, enabling them to focus on more complex and strategic issues, thereby improving overall IT efficiency.

The Benefits of a Proactive Approach

A proactive incident management system offers numerous interlinked and reinforcing benefits, which we have already touched on in earlier parts of this article. Here, we briefly revisit three key aspects that seem most decisive.

Improved Incident Response Times
Automated processes and the use of predictive technologies reduce response times, minimizing the impact of incidents and increasing service availability.
Greater Service Availability and Uptime
By reducing the frequency and severity of incidents, organizations can ensure higher uptime and greater operational continuity, improving end-user satisfaction.
Cost and Resource Efficiency
Automation and process optimization lead to more efficient resource management, reducing operational costs and improving the overall productivity of the IT team.

Conclusion

Future Trends: AI-Driven Proactive Incident Management

The future is always uncertain, but if we look closely at the present, we can see its seeds. These seeds tell us that AI technologies will continue to evolve, providing increasingly sophisticated tools for predictive analysis and automated incident management. More experience will lead to greater effectiveness—just as it does for human intelligence.

How Automation is Shaping the Future of IT Incident Management

Automation is no longer an option but a necessity to address the growing complexity of IT environments. Incident management, supported by end-to-end solutions like those offered by EasyVista, will become increasingly proactive, ensuring greater resilience and uninterrupted operations.

Investing in a proactive system with these features today means preparing for tomorrow’s challenges.

About EasyVista
EasyVista is a leading IT software provider delivering comprehensive IT solutions, including service management, remote support, IT monitoring, and self-healing technologies. We empower companies to embrace a customer-focused, proactive, and predictive approach to IT service, support, and operations. EasyVista is dedicated to understanding and exceeding customer expectations, ensuring seamless and superior IT experiences. Today, EasyVista supports over 3,000 companies worldwide in accelerating digital transformation, enhancing employee productivity, reducing operating costs, and boosting satisfaction for both employees and customers across various industries, including financial services, healthcare, education, and manufacturing.

About Version 2 Digital

2025 EasyVista

New IoT Regulations and Your Incident Response Plan

Introduction to Changes in IoT Regulations

The rapid proliferation of IoT devices has revolutionized industries, driving innovation and efficiency. However, this surge also introduces significant security challenges that demand attention. Regulatory bodies worldwide are stepping up to address these risks, setting benchmarks for new IoT regulations to improve cybersecurity practices.

In Europe, the Cyber Resilience Act establishes a groundbreaking framework to bolster IoT security. Meanwhile, the UK is taking the lead with stringent security and privacy regulations designed to protect connected devices. Across the Atlantic, the United States is preparing to launch the Cyber Trust Mark, a labeling initiative aimed at helping consumers make informed purchasing decisions based on IoT product security standards.

These evolving IoT regulations highlight the urgent need for manufacturers to prioritize security throughout the product lifecycle. Integrating cybersecurity at every development stage is no longer optional—it’s a critical step for compliance and for mitigating emerging threats. For organizations and manufacturers, staying ahead of these regulatory developments isn’t just about avoiding penalties; it’s an opportunity to lead in safeguarding the future of IoT.

How The European Cyber Resilience Act is Shaping Connected Device Security

The European Cyber Resilience Act marks a significant leap forward in the regulatory framework for IoT devices, mandating end-to-end security measures throughout a product’s lifecycle. This landmark legislation is designed to enhance the digital security and privacy of connected devices, setting rigorous requirements that manufacturers must meet.

Central to the Act is the emphasis on secure-by-design principles, ensuring products are equipped to withstand evolving cybersecurity threats before they reach the market. For organizations operating in Europe, compliance with this Act demands a proactive approach to security, including continuous monitoring and adaptation to emerging risks.

By integrating robust security measures into every stage of development, companies can safeguard consumer data, foster trust, and maintain a competitive advantage in an increasingly regulated IoT market. The Act’s sweeping implications highlight the need for businesses to stay ahead of regulatory shifts and embed comprehensive security frameworks into their operations.

Staying informed and prepared isn’t just about compliance—it’s about shaping a safer, more resilient future for connected technologies.

The UK Leads the Way in IoT Security Standards

In the United Kingdom, pioneering IoT security regulations have established the nation as a leader in device security standards. These rules mandate rigorous measures to protect user data and ensure device integrity.

Key requirements include enforcing unique passwords and transparent security practices, setting a high benchmark for IoT device security globally. This regulatory framework not only protects consumers but also drives innovation among manufacturers, compelling them to integrate advanced security features from the ground up.

As the UK’s approach gains international recognition, it serves as a model for other countries aiming to enhance their cybersecurity posture. The focus on transparency and robust security protocols reflects a commitment to safeguarding consumer data in an increasingly connected world.

IoT Regulation: What the U.S. Cyber Trust Mark Means for IoT Security

The United States is gearing up to launch the Cyber Trust Mark, a groundbreaking certification designed to provide consumers with vital information about the cybersecurity standards of IoT products. This initiative empowers consumers to make informed decisions by evaluating the security measures of the devices they purchase. In turn, it challenges manufacturers to prioritize cybersecurity in their product offerings to meet growing expectations.

As the rollout of the Cyber Trust Mark approaches, IoT device manufacturers face mounting pressure to integrate stringent security protocols throughout their development processes. This shift is crucial not only for building consumer trust but also for maintaining a competitive edge in a fast-evolving market.

The Cyber Trust Mark represents a pivotal step in the U.S. regulatory landscape, compelling companies to adopt robust security features from the earliest stages of product design. For manufacturers, embracing these standards is no longer optional—it’s a key to thriving in an increasingly security-conscious marketplace and demonstrating leadership in IoT innovation.

Incorporating Regulatory Compliance into Incident Response Strategies

To align incident response strategies with evolving IoT regulations, organizations must adopt proactive measures akin to GDPR readiness initiatives. Firms have spent over €1 million ($1.06 million) to meet GDPR requirements, illustrating the significant investment needed for regulatory compliance. As IoT regulations continue to evolve, effective coordination between security, legal, and operational teams is essential for developing incident response plans that meet these new standards. A collaborative environment where teams share insights and strategies is key to ensuring a comprehensive and well-rounded approach to security.

By leveraging the unique expertise of each department, organizations can design robust incident response protocols that not only achieve regulatory compliance but also strengthen their overall security posture. Regular training and ongoing updates on regulatory changes are critical to keeping all teams aligned and prepared to handle potential security incidents.

A unified and informed approach empowers organizations to respond swiftly and effectively to emerging threats, ensuring compliance with IoT regulation requirements while protecting valuable assets and maintaining consumer trust.

Strengthening Security Protocols for IoT Devices

IoT devices face increasing threats, underscoring the necessity for strengthened security protocols. Botnet-driven distributed denial-of-service (DDoS) attacks, for example, have surged fivefold in the past year, highlighting the need for fortified defenses. Conducting thorough security assessments and code audits is essential to identify vulnerabilities and mitigate risks. The growing IoT security market, valued at $3.35 billion in 2022, is projected to reach $13.36 billion by 2028, reflecting a compounded annual growth rate of 26.36%.

This growth underscores the increasing demand for robust security solutions in the IoT landscape. Adopting a proactive stance through continuous monitoring, automated security improvements, and staying updated on the latest attack vectors is vital. Leveraging advanced threat models and integrating security measures into the design phase can further bolster the resilience of IoT devices.

These strategies are critical for maintaining a secure, trustworthy, and competitive edge in today’s dynamic regulatory environment.

Readying for What Lies Ahead

Navigating the future of IoT security requires a proactive and forward-thinking approach to regulatory compliance and risk management. For cybersecurity leaders, it’s essential to continuously enhance security protocols while fostering a culture of vigilance within their organizations. This involves not only adhering to current IoT regulations but also anticipating future challenges and adapting strategies accordingly.

The rapid expansion of the IoT sector underscores the need for integrating advanced security measures at the earliest stages of product development. By prioritizing secure-by-design principles, organizations can better protect consumer data, mitigate risks, and establish lasting trust with their users.

To thrive in an increasingly interconnected and regulated world, organizations must embrace cross-functional collaboration and invest in ongoing education to ensure their teams are prepared to tackle emerging threats. Emphasizing the implementation of robust security frameworks and committing to continuous improvement will position companies as leaders in IoT security while safeguarding their future success.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

About Version 2 Digital

Network Portnox 2025

Parallels Desktop 20.2: another exciting update in the Parallels Desktop 20 series

I’m excited to unveil Parallels Desktop 20.2.0, the third major release in the Parallels Desktop 20 series—all delivered in just four months!

At Parallels, we’re committed to bringing you powerful, user-focused features designed to bring some value to your everyday work and play.

In this update, we’re introducing innovations for every type of user, whether you run Windows apps on your Mac, manage large-scale IT deployments, or dive deep into development and testing.

Let’s take a closer look at what’s new!

New improvements for Pro users (developers, testers, and tech enthusiasts)

A milestone: introducing the early technology preview of x86 emulation

I’m proud to share a significant milestone — starting with Parallels Desktop 20.2.0 you can use x86 emulation on Apple silicon Macs.

This functionality allows you to run some Intel-based (x86_64) virtual machines (VMs) on Apple silicon Macs via our proprietary emulation engine.

Since we first introduced Parallels Desktop 16.5 with support for Apple silicon Macs, the ability to run x86_64 virtual machines has been a limitation.

And today, after months of hard work, we’re releasing this early technology preview for tech enthusiasts who want to explore its potential.

What does this functionality allow you to do?

We listened to your feedback — it’s important to us!

Many users have reached out to us and requested the ability to run, develop, and test 32-bit Windows apps in a native environment.

Some of you also asked for the ability to run x86_64 Linux virtual machines as an alternative solution to running Linux virtual machines through Rosetta.

That is why you now can:

Run existing x86_64 Windows 10, Windows 11*, Windows Server 2019/2022, and some Linux distributives with UEFI BIOS via Parallels Emulator.

Create new Windows 10 21H2 and Windows Server 2022 virtual machines.

* Running x86_64 Windows 11 24H2 virtual machines through x86 emulation isn’t supported currently due to the absence of SSE (Streaming SIMD Extensions) 4.2 support.

Are there any limitations?

Since the functionality is in the early technology preview stage, it has some significant limitations:

Performance is slow—really slow. Windows boot time is about 2-7 minutes, depending on your hardware. Windows operating system responsiveness is also low.

Only 64-bit operating systems are supported. But you can run 32-bit apps. Since there are millions of apps in the world, we couldn’t test all of them. I invite you to give it a try and share your feedback with us.

There is no support for USB devices which means you won’t be able to connect external devices to your VM.

Parallels hypervisor can’t be used. All VMs will be booted via the Apple hypervisor. Nested virtualization is not supported either.

You can find more details about the functionality and its limitations in this article.

Please note that we’ve hidden the option to start a virtual machine in our UI to avoid false expectations for the majority of users who don’t actually need it.

I know it’s not a complete solution yet, but I wanted to give you a first look and invite you to share your feedback with us on our Forum or through Support.

It’s important for us to better understand your workflow and what we can do to enhance the feature for your needs.

Automatically sync time and time zone for macOS VMs on Apple silicon

We’re making it easier to manage macOS virtual machines on Apple silicon Macs with the introduction of automatic time and time zone sync.

Why is this important?

Previously, when creating a new macOS VM on Apple silicon, users had to manually set the time and time zone, adding extra steps to the setup process.

Starting with Parallels Desktop 20.2, this sync happens automatically once you install Parallels Tools.

Significant improvements for IT admins and managers

Hybrid licensing and SSO support for Parallels Desktop Enterprise Edition

We made a promise—and we kept it.

Parallels Desktop Enterprise Edition with the new Management Portal that was recently released, and with it we’re making license management smarter and more flexible.

Organizations that utilize a corporate identity provider (e.g., Microsoft Entra ID, Okta, etc.) can use it to automate license management of Parallels Desktop licenses and enable single sign-on (SSO) capabilities.

IT admins no longer need to manually disable unused licenses.

If an end-user is inactive and doesn’t log in for a month, the license seat is automatically revoked from this user and made available for another user.

The same happens when a user leaves the organization.

The activation process is super simple. Your end users just need to enter their corporate email and voila—the product is activated.

You can also link groups in your identity provider to sublicenses in Parallels My Account to get more visibility over the license keys.

But that’s not everything I wanted to share.

With this update, IT admins and managers have greater flexibility in managing the license keys.

They can allow one group of users to sign in through SSO while enabling other groups to activate Parallels Desktop using a license key.

More details can be found in the Parallels Desktop Enterprise Edition Guide.

Simplified deployment: Introducing support for Configuration profiles

How is this support helpful for new deployments?

As of now, you can easily deploy the Parallels Desktop application from the MDM App Catalogs and deliver information about the Parallels Desktop activation experience with the help of configuration profiles.

Configuration profiles can be created right from the iMazing Profile Editor app.

Simply choose how end users will activate—with a license key or via SSO.

Once the profile is created, push it to the end users’ Macs and Parallels Desktop will apply this configuration the next time they start up.

Delivering Parallels Desktop settings can be done through the Parallels Desktop Management Portal (available in Parallels Desktop Enterprise Edition).

The option to deploy the Parallels Desktop application, virtual machines, licensing information, and the settings using the deployment package is still available.

How can it be helpful for existing installations?

In response to the request from IT administrators, the Parallels Team has implemented support for managing the activation experience on managed Macs.

Once the configuration profile is deployed to the target Macs, if an end user tries to activate the Mac using a different key, Parallels Desktop will automatically reactivate with the key defined in the configuration profile.

It will also prompt the user to sign in with SSO based on the selected activation method. As a result, IT admins can ensure the end users get the proper experience and don’t face any challenges with activating Parallels Desktop, even if the product is uninstalled and reinstalled later.

I’m excited to share that Parallels Desktop is the first end-point virtualization solution that offers this kind of functionality.

Improvements for Windows app users

Writing Tools for Windows apps: Enhanced usability

We’ve made it even easier to use Writing Tools powered by Apple Intelligence with your favorite Windows apps. Now you can access them directly from the context menu in:

Microsoft Outlook (classic)

Microsoft Word

Microsoft PowerPoint

This integration makes polishing your text smoother than ever, whether you’re editing emails, documents, or presentations.

The 20.2.0 update also includes a range of fixes to enhance the overall stability and reliability of Parallels Desktop.

We’ve addressed key issues reported by users to ensure a smoother and more seamless experience. Learn more here.

About Parallels
Parallels® is a global leader in cross-platform solutions, enabling businesses and individuals to access and use the applications and files they need on any device or operating system. Parallels helps customers leverage the best technology available, whether it’s Windows, Linux, macOS, iOS, Android or the cloud.

About Version 2 Digital

Parallels 2025

What is identity and access management (IAM)?

So, to be more precise, identity and access management is a cybersecurity framework that allows companies to assign specific access permissions to individual users within the organization to ensure they can access only the systems, networks, and services necessary for their role. This means that, instead of granting all employees equal access to all resources, businesses can control exactly who has access to their systems and data—and for what purpose.

How does IAM work, exactly?

IAM is just a strategy, so it doesn’t work on its own. Therefore, you need the right tools to be able to enforce it and put it into practice in your business. That’s where IAM systems come in.

By definition, the goal of IAM systems is to perform two core tasks: authentication and authorization. Both of these play a part in making sure that the right person will get access to the right resources for the right reasons. Here’s how it typically works:

First, the IAM system confirms the identity of a user by checking their credentials against a database that holds everyone’s identity and access permissions.
The IAM system grants the user access only to the resources they’ve been assigned.

As you might expect, an IAM system typically comes with a set of dedicated tools that operators can use to easily create, monitor, modify, and delete access privileges for all members of the organization.

The role IAM plays in security

If you’re still asking yourself the question “What is IAM in cybersecurity?”, we are here to tell you that IAM is considered a critical part of cybersecurity these days and that every organization should incorporate it into its cybersecurity strategy. Why? Because IAM security is concerned with reducing identity-related access risks, improving legal compliance, and improving business performance across the entire organization.

What is more, by helping companies manage digital identities and user access to company data, IAM tools make it very hard for non-authorized parties to hack into business networks and cause problems that could lead to big financial losses.

Enterprise identity and access management

As you can probably guess, “enterprise identity and access management” is a phrase that refers to all of the IAM policies, processes, and tools that large-scale businesses can use to manage access to their data and resources more securely and effectively.

Many of today’s enterprise-like organizations have massive IT infrastructures that consist of a vast range of servers, databases, applications, and cloud environments — to which dozens, if not hundreds or thousands, of their employees must have easy access. Enterprise IAM solutions are, therefore, a way for those big enterprises to make their resources available to a large number of employees without making any compromises in regard to cybersecurity.

So, even if your business is a global one — that is, you have thousands of employees and run multiple projects around the world — many of the IAM solutions available today are powerful and flexible enough to give you the ability to manage user permissions and prevent unauthorized access with ease.

What is the difference between identity management and access management?

The difference between identity management and access management essentially boils down to the part each of these two frameworks plays in the process of providing users with access to company resources.

Identity management is about (as its name suggests) user identities and the many ways they can be recognized and verified. Access management, on the other hand, deals with giving or withdrawing permissions and access privileges.

IAM regulatory compliance

Many of today’s lawmakers around the world are striving towards creating and introducing new policies that will help protect the digital lives of their citizens. As a result, many of today’s data privacy regulations (including HIPAA, SOC2, PCI DSS, FERPA, and GLBA) require businesses to follow strict IAM policies, which means they are obligated to manage access to data very carefully.

As you can expect, however, identity and access management solutions can be used to meet some of the compliance requirements (including, of course, IAM compliance)—which is also one of the reasons why enterprises are interested in making them part of their IT environments.

Let us provide you with an example. To comply with the already-mentioned information security standard called PCI DSS, a vendor is required to establish strict IAM policies (including rules that clearly define user identities, authentication, and authorization methods), and processes that restrict access to environments where cardholder data is stored. Only with such IAM policies in place can a vendor become fully compliant with the PCI DSS standard.

Identity and access management benefits

Implementing IAM solutions offers numerous benefits for businesses, regardless of their size or location. These include:

Enhanced cybersecurity – IAM solutions can help all businesses – no matter their size or location – prevent data breaches and protect themselves against malware, identity theft, and phishing attacks.
Simplified work for IT administrators — With the use of IAM tools, IT administrators can develop new, advanced security policies and processes and implement them across the entire organization in a blink of an eye.
Real-time monitoring of company data access — IAM solutions allow you to remain in control of who can access what at your organization.
Ensuring compliance with data privacy regulations — IAM systems are designed to help users comply with legal requirements such as HIPAA, SOC2, and PCI DSS.
Minimizing financial and reputational losses — By allowing you to prevent fraudulent activities and unauthorized use of company resources, IAM solutions can help you maintain business continuity and avoid costly downtime.

Enterprise identity and access management with NordPass

NordPass Enterprise, an encrypted password, and passkey management platform, can be used as an IAM tool to securely provide members of your organization with access to company data, systems, and applications. How so?

First of all, when you use the Business version of the NordPass platform, you can share an unlimited number of digital entry points that you can assign to different departments or teams. This means that you can fully control access to shared credentials, payment information, and other sensitive data across the entire organization. Moreover, thanks to features such as the Activity Log, you can easily monitor all company logins to know exactly who accessed what and when.

Second, NordPass uses multi-factor authentication (MFA), as well as the single sign-on (SSO) authentication method, to identify and verify each and every user once they try to access one of the company accounts. The platform is equipped with three MFA options — an authenticator app, a security key, and backup codes — so that you can provide your team members with a few options in regard to how they can gain access to company resources.

Third, NordPass can help you achieve regulatory compliance. As mentioned, some standards (e.g., HIPAA and NIST) require organizations to implement secure access management solutions. With NordPass, not only can you easily manage access privileges, but you can also establish rules, procedures, and policies that will allow your company to meet certain specifications.

Of course, the fact that NordPass is an encrypted password management solution also means that you and your team members can use it to securely and easily generate, store, manage, and share company credentials. This is something that IAM tools cannot do — just as they cannot run password health check-ups or scan for data breaches to see if any of the credentials, payment information, or emails have been compromised – but NordPass can.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Nord Security 2025 NordPass