Skip to content

Why AI ransomware is a new type of threat

Ransomware isn’t what it used to be

The origins of ransomware go back to the late 1990s, when the blueprint for an attack first took shape—using malicious software to block a user’s access to a computer system or encrypt their data, then demanding payment to restore it.

Over the years, ransomware attacks have become increasingly sophisticated. In the mid-2000s, cybercriminals relied on fake ads and deceptive websites to trick users into downloading ransomware-infused antivirus software. Later on, ransomware evolved into worm-like threats capable of spreading rapidly across organizational networks.

Fast forward to today, and we’re dealing with AI-powered ransomware. So, it’s no longer just about scrambling files—it’s about smart, targeted attacks that are harder to detect and even harder to stop.

What is AI-powered ransomware, exactly?

In short, AI-powered ransomware is about using AI or machine learning (ML) algorithms to automate, speed up, and improve every stage of a ransomware attack.

It starts with how AI-driven malware sneaks onto users’ devices. Not only can it quickly identify weaknesses in IT systems by exploring thousands of options at once, but it can also use advanced deepfake tactics to trick people into revealing sensitive information, like their business credentials.

Once inside, this type of ransomware can move through systems undetected, intelligently prioritizing which files to encrypt based on their value. The result is a smarter, faster, and far more effective form of ransomware compared to traditional attacks.

3 reasons why AI ransomware is so dangerous

By now, it’s probably clear that AI-powered ransomware is no joke—it’s a serious threat to both organizations and individuals. But if you’re still on the fence—or just want to understand the issue a bit better—let’s take a closer look at how AI ransomware works and what makes it so effective.

Automated attacks with high efficiency

Before AI, ransomware attacks had to be controlled manually from start to finish. But with AI, these attacks can now run on their own, working autonomously to reach their goal. They even use bots to contact victims, avoiding human-to-human communication altogether, which adds to the tension by forcing targets to interact only with a machine.

With the ability to analyze far more data than any living creature, AI can handle thousands of tasks at once, finding its way into systems and causing chaos, all without any human involvement. And let’s not forget that AI never gets tired, so these attacks can keep going as long as they need to. Unlike a human, artificial intelligence won’t get frustrated or lose motivation if things aren’t working right away.

Enhanced targeting and personalization

AI-driven ransomware attacks use machine learning to sift through public sources like social media and corporate websites, identifying valuable targets and learning more about them in the process. With this information, AI can later craft highly personalized phishing emails or ads, often using social engineering techniques to manipulate key staff into divulging sensitive data.

What’s even more concerning is the rise of deepfake technology. Attackers can now create convincing audio and video material, making it seem like a trusted family member or colleague is reaching out. This makes it easier for victims to divulge confidential details because they believe they’re communicating with someone they know.

Real-time adaptation

A target not on the hook? Not buying into the ransomware attack? Are they being extra cautious, trying not to slip up and expose their systems? It doesn’t matter to the AI behind the attack, which keeps watching and learning. With every interaction, it gets smarter and quickly figures out what it needs to do to get the victim to drop their guard.

An AI ransomware attack isn’t your average cyber threat. This malicious software can adjust to any situation on the go—all it needs is data to learn from, and then it can shift its tactics when needed. Where a human hacker might give up and move on to another target, AI never calls it quits.

 

Key strategies for mitigating AI-powered ransomware

Let none of what we’ve discussed so far make you feel powerless against AI-powered ransomware. There are smart, practical steps your business can take to stay protected and lower the risk of getting hit by an AI-powered attack. Here are a few to consider:

Run security checks regularly

This might seem like an obvious one, but we can’t stress enough how essential it is to objectively assess your company’s cybersecurity level on a regular basis. Think about it—your team is probably using a wide range of platforms and services to keep things running, and each one could be a potential entry point for cybercriminals if not properly secured. That’s why having strong monitoring and intrusion detection systems in place is so important.

You might also consider leveraging AI—after all, cybercriminals shouldn’t be the only ones using it, right?—to analyze your IT environment for unusual activity. This could help you identify threats like ransomware early, before they have a chance to do any damage.

Develop an incident response plan

Let’s be real—even with the best tools and real-time monitoring in place, there’s still a chance your company could face a cyberattack. Maybe an employee slips up, or someone forgets to secure a new piece of software. Whatever the reason, what matters most in that moment is having a clear plan of action.

That’s where an incident response plan comes in. It’s essentially a set of rules that outlines exactly what your team should do if you’re hit with an AI-powered ransomware attack. According to the National Institute of Standards and Technology (NIST), a solid incident response plan should cover 4 key areas: preparation, detection, containment, and recovery. If you’ve got those bases covered, you’ll be in a much better position to minimize damage and prevent similar incidents from happening again.

Raise awareness by training your employees

Like we mentioned earlier, human error can still play a big role—even if you’ve got all the right cybersecurity tools in place. That’s why it’s so important to have open conversations with your team and run regular training sessions. These should cover how to spot AI-generated scam messages and other sneaky tactics that might be used in a ransomware attack.

Make those trainings relatable. Use real-life examples to show how these attacks can play out, then offer practical tips your team can actually use—so they feel confident, not paranoid, when using company systems. The goal isn’t to scare them, but to empower them to make smart, informed decisions that help keep everyone safe.

How NordPass can help

While not specifically an AI ransomware prevention tool, NordPass can significantly enhance your company’s cybersecurity and reduce the risk of threats like ransomware.

At its core, NordPass is a password manager that uses XChaCha20 encryption to keep your team’s logins, credit card details, and other sensitive information safe and easy to share internally. It also gives you greater control over who in your company has access to which resources and supports features like multi-factor authentication, so even if attackers somehow got hold of a password, they still can’t break in.

But NordPass isn’t just about password management. It offers additional features like Email Masking to hide your real email when signing up for services, and Data Breach Scanner that alerts you if your company’s data is found in a breach. It even allows you to ditch traditional passwords in favor of passkeys, a more secure, phishing-resistant login method. These tools help reduce your company’s digital footprint and limit the exposure that AI-driven threats could exploit in a ransomware attack.

For a quick assessment of your company’s data exposure, you can use NordPass’s free online tool to check if your data has been compromised. But for long-term protection, try the full NordPass version so your team can stay secure and make smart cybersecurity choices every day.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Network segmentation: what it is and how to implement it

What is network segmentation, exactly?

Network segmentation is the practice of dividing a computer network into smaller subnetworks (also called “segments,” hence the term “segmented network”), each of which can function as a separate unit.

By following this architectural approach, you can define how traffic will flow between different parts of the network. This can be achieved by establishing specific security controls and policies for each segment.

The purpose of all this is to improve network performance, simplify management, and contain potential threats within a specific part of the network, preventing them from spreading to other areas.

How does network segmentation work?

Dividing a network into smaller, manageable parts is no simple task, especially when the network itself is quite expansive—it takes careful planning, IT know-how, and the right resources. The idea is to have elements like the client database, email servers, company website, guest Wi-Fi, and internal applications as independent parts of the network.

Enterprise network segmentation starts with figuring out how to divide the network based on criteria like function, security needs, or business requirements. After that, you use a mix of hardware (routers, switches, and firewalls) and software (virtual LANs, cloud technologies) to break the network into segments and control how traffic flows between them.

Once you’ve got the segments set up, the next step is to monitor and manage each of them, which can be made easier with tools like security information and event management (SIEM) solutions.

Network segmentation and zero trust

Network segmentation is key to how companies manage access to their digital resources. Back in the day, companies used to follow the “assumed trust” principle—the idea that everyone in the company was a good guy, and therefore, could be trusted with access to all company data and services.

However, after thousands of human errors and security breaches caused by bad actors, companies have shifted to the zero-trust model. This approach assumes that no one should automatically have full access to the company’s network and virtual assets. Instead, they must be verified and granted access only to the resources they actually need.

To make this a reality, companies use a few different strategies, with network segmentation being one of them. How so? Zero-trust network segmentation refers to IT teams creating dedicated subnetworks for specific groups of users, ensuring they cannot move beyond their designated limits. This adds an extra layer of defense and aligns with the “never trust, always verify” motto of zero trust. Each subnetwork functions as a secure zone, with access protected by authorization protocols.

And if you combine all of this with identity and access management (IAM) solutions to securely manage user credentials, and network access control (NAC) tools that restrict access based on user or device authentication, you’ve got yourself a solid system for keeping the network running smoothly while minimizing risk.

The benefits of network segmentation

At this point, you’ve probably got a good idea of the advantages that come with dividing your company network into smaller segments. However, if you’re not sure you’ve caught all of them, here’s a rundown of the best examples of network segmentation benefits for you:

Enhanced cybersecurity

Network segmentation helps prevent cyberattacks from spreading across the entire company network. For example, if malware infiltrates a subnetwork, it cannot easily spread to other parts of the network, thereby reducing the potential damage and facilitating a quicker response. Similarly, if someone makes an error and accidentally puts systems at risk, the problem remains confined to the parts of the network they had access to. This makes it much easier to identify the issue and resolve it.

Improved compliance

Complying with policies and regulations like HIPAA and GDPR can feel like a lot of work, but network segmentation can make things easier. By breaking up the network into smaller, more secure sections, businesses can isolate sensitive data in specific virtual environments—only accessible to the right people. Plus, by controlling how data moves between these subnetworks, it becomes a lot easier to demonstrate that you’re meeting compliance requirements during audits.

Increased performance

By dividing the network into smaller segments, a company can avoid network congestion, which occurs when a network carries more data than it can handle. This can lead to slow internet speeds, buffering during streams, video call glitches, and difficulty accessing company resources when needed—ultimately affecting employee performance. Keeping network congestion low helps ensure smoother online operations and prevents downtime.

Facilitated incident response

When dealing with smaller segments of the network, it becomes much easier to spot where an incident is happening. From there, that specific area can be isolated to keep the issue from spreading. Since the rest of the network stays secure and there’s a smaller scope to investigate, IT security teams can focus on the affected area and get to the root of the problem much faster.

How to implement network segmentation in your organization

Before you start breaking your company network into smaller segments, it’s a good idea to get familiar with some network segmentation best practices. That way, you’ll head into the project with confidence and a solid game plan—setting yourself up for a smoother process and better results. Here are a few key things to keep in mind.

Don’t oversegment or undersegment your network

As you read this article, you might get the impression that the more you segment your network, the better. But that’s not quite true. If you go too far, your employees will end up dealing with too many access points, leading to user fatigue, slower workflows, and traffic bottlenecks.

On the other hand, if you don’t segment enough—say, only into 3 or 4 subnetworks—you won’t get the security benefits we talked about. This means your attack surface will still be pretty wide. So, the key here is finding the right balance. Effective network segmentation is about finding that sweet spot in how many parts your company network really needs.

Follow the zero–trust principle

Like we mentioned earlier, keeping your network segmentation secure means sticking to a strict zero-trust policy. In simple terms, no one gets an easy pass—regardless of their role or how long they’ve been with the company. Everyone needs to go through proper authentication before accessing any resources. It may sound tough, but it’s one of the best ways to protect your network segmentation operations and stay in control of who can access what.

Minimize third-party entry points

Chances are, your organization relies on at least a few third-party tools and services to keep things running smoothly. Since these platforms are part of your IT ecosystem, they can also become entry points for cybercriminals if compromised. That’s why it’s important to keep their access limited. Don’t give third-party solutions more reach than they really need. A good way to do this is by setting up dedicated access points that connect them only to specific segments of your network. That way, even if something goes wrong on their end, the issue will not spread easily into your company network.

Protect all endpoints

As an employer, you’re providing your team with devices, business accounts, and access to company data. With that comes the responsibility of making sure what you provide can’t be used against your company, and that each employee’s device and account are properly protected.

That includes giving employees access to the right subnetworks—but it doesn’t stop there. You also need to use antivirus software and monitoring tools to ensure only authorized devices get through—so that, much like in Homer’s Iliad, you’re not inviting in modern-day Trojan horses, which could bring chaos once inside.

Monitor all your subnetworks

Segmenting your network is just the beginning—the real work begins after that. You’ve got to manage and monitor all those subnetworks carefully, making sure you have a big-picture view of the whole network while also keeping an eye on how each part is doing individually. For that, it’s a good idea to use modern monitoring tools to spot any unusual user behavior or get alerted if there’s a data breach, so you can quickly figure out which part of the network needs to be shut off.

How NordPass can help

While it is not software dedicated strictly to network segmentation, NordPass is a tool that can help your organization control access to company resources and secure multiple endpoints to minimize the risk of a cyberattack.

NordPass is more than just an encrypted password manager that allows teams to securely store, manage, and share business credentials, credit card details, and sensitive information—it is also a cybersecurity solution for managing user access to company resources and monitoring data breaches to determine if they involve company data. If you run a large enterprise, you can use NordPass to see what was shared, with whom, and for what purpose, and revoke access with ease when necessary.

The best part is that you can try NordPass before making any commitments—just use the free 14-day trial to see how it can improve your company’s cybersecurity and performance. It would be a shame not to use this opportunity.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

What Is Internet of Things (IoT) Security?

What is IoT?

The Internet of Things (IoT) is what we call networks of physical objects that are packed with sensors, cameras, listening devices, and other technologies—like today’s smartphones, appliances, wearables, and cars. These devices are connected over the internet or a local network, so they can exchange data with each other. This allows them to work together as part of a smart system, enabling the automation of tasks and the creation of intelligent environments like smart homes or smart workplaces. Because of the way IoT devices operate, the Internet of Things and cybersecurity must go hand in hand to deliver smart experiences while ensuring safety and privacy for all users.

What is IoT security?

IoT security is all about protecting the interconnected smart devices and the networks they connect to. Since these devices can collect, store, and share data about users’ surroundings, this data must be handled with the utmost care and caution.

IoT devices aren’t just for personal use—more and more are making their way into workplaces. For example, businesses now install smart thermostats, blinds, and seating planners to optimize resources in their offices.

The benefit of these devices syncing and working together is that they regularly share and communicate data to improve functionality. However, since these devices are interconnected, gaining access to one could allow bad actors to exploit and breach your entire network. That’s why Internet of Things device security (as well as IoT network security) is essential to prevent vulnerabilities that could lead to cyberattacks.

Why is IoT security important?

The recent influx of IoT devices has provided another avenue for hackers to exploit in recent years. IoT devices can be particularly vulnerable to security breaches. At the end of 2021, a study concluded that up to 82% of healthcare organizations experienced an IoT cyberattack over 18 months. There are often security oversights regarding the IoT and its apps. For example, a German teenager hacked Tesla vehicles’ app component not that long ago. While he couldn’t access the driving functions like steering or brakes, he could still exploit other potentially dangerous features like unlocking doors, playing music at max volume, and flashing lights. The more IoT devices become common, the more widespread their security threats will become.

Which industries need IoT security?

Smart devices have made their way into almost every part of our lives. However, some industries rely more heavily on IoT technology than others and require additional security due to its strategic meaning for the nations’ and communities’ welfare.

  • Healthcare

Patient monitoring, advanced medical equipment, administering treatments and vaccines: Medical services increasingly rely on smart devices. Cynerio and Ponemon’s Study proves that healthcare is especially vulnerable to cyber attacks involving the Internet of Things devices as they constitute 88% of all hospital data breaches. More than half of hospitals in the US have experienced an attack on their smart devices between 2020 and 2022. The damage that cybercriminals can cause in healthcare is horrifying — the mortality rate increased in 24% of the attacked hospitals.

  • Energy and Utilities

Internet of Things devices are widely used in the energy and utilities sector for smart grid management, optimizing energy consumption, and remote monitoring of infrastructure. Monitoring devices such as smart meters, security cameras, and temperature/fire/chemical leak controls are prime targets for cybercriminals. Protecting energy infrastructure is essential to prevent disruptions to critical services, including electricity, heating, traffic control, or medical care.

  • Manufacturing

It’s hard to imagine a modern factory without Internet of Things solutions enabling process automation, supply chain management, and predictive maintenance. The endless possibilities that smart devices present to this sector can be overshadowed by the costs of cyberattacks, as hackers often target factories to demand ransom.

  • Logistics

IoT devices are entering the logistics industry through fleet, vessel, and traffic management systems. Self-driving vehicles are becoming commonplace in major cities. Also, the railway relies on Internet of Things devices for traffic planning and power supply management. Hacking an IoT-reliant logistics system could cause chaos on highways or railroads.

  • Supply Chain

In the supply chain industry, connected devices are used for tracking, monitoring, and managing goods throughout transportation. The security risk created by IoT tools used in day-to-day operations grows with the number of vendors a company cooperates with. Supply chain attacks often target third-party partners or suppliers to access the company’s assets.

IoT security challenges

While smart devices introduce plenty of opportunities and convenience to our lives, they also open up the possibility of cyberattacks. Industries such as healthcare and manufacturing increasingly rely on IoT devices, exposing unprepared organizations to cyberattacks. Here are some of the threats IoT devices are susceptible to:

  • Malware: Because cybersecurity isn’t the primary concern of many smart devices, hackers don’t require advanced malicious software to attack. Rudimentary malware can steal data and cause damage to networks and devices. Mirai is used to infect security cameras, scan the network for the IP address of IoT devices, and connect. This allows hackers to launch significant DDoS attacks.

  • Credential-based attacks: Using stolen login IDs and passwords is a popular method for hackers because many people’s logins are already floating around online thanks to massive data leaks such as Collection #1. Once a business’s smart device’s application layer is breached, hackers can access any device connected to the network.

  • Data theft and exposure: Adding IoT devices to your home or office will introduce more potential entry points for hackers to access data. This increases the risk of personal information being stolen and exposed on the internet. A good example of this is when hackers used Amazon’s Alexa to issue self-commands allowing the attackers to control smart lights, buy items on Amazon, and tamper with calendars.

  • Incorrect device management and configuration: Similar to the above, the more devices and accounts you add, the greater the chance of reusing passwords and usernames. Companies often ship IoT devices with default logins that should be changed during their setup. However, a survey of CIOs and IT managers showed that almost 50% of them allowed IoT devices onto their corporate network without changing the default passwords.

  • Complex ecosystem and smart device diversity: An office’s IoT ecosystem can quickly become a juggernaut of interconnected devices. These devices have many moving parts that operate at different levels. Overseeing and managing your wide array of IoT devices will help you prevent IoT attacks.

  • Not following security by design: Cybersecurity is generally not the main focus of many IoT devices, often taking a backseat to its functionality. Your office’s IoT security could be at risk because specific devices may have cybersecurity weaknesses that need to receive software updates. There’s also the possibility that any security features may be obsolete if the product is discontinued and no longer supported by its developer.

Examples of IoT security threats

Jeep Grand Cherokee

Back in 2015, security researchers Charlie Miller and Chris Valasek set out to see if they could remotely hack into and take control of a new Jeep model—the Jeep Grand Cherokee. They ran a series of cybersecurity tests, and sure enough, they found a major backdoor in the Jeep’s built-in infotainment system, which handles things like navigation and entertainment.

Using this vulnerability, they were able to connect to the car’s other systems and take control of the car’s key mechanics like braking, engine control, air conditioning, and transmission. Basically, they turned that Jeep into one of the most expensive remote-controlled toy cars in the world! After this demonstration, Chrysler (the owner of Jeep) had no choice but to recall more than 1 million Grand Cherokees to fix the software vulnerability.

Mirai botnet

Probably the most famous—or infamous, actually—IoT security breach ever, the Mirai botnet was first identified in 2016 and has remained a persistent cyber threat ever since. It works by infecting vulnerable IoT devices—like AVTECH CCTV cameras and Four-Faith industrial routers—and using them to launch large-scale distributed denial-of-service (DDoS) attacks.

In 2018, a Mirai variant was used in a 1.35 Tbps DDoS attack against GitHub, briefly knocking the platform offline. In 2020, the FBI issued a warning that Mirai-based attacks could go beyond websites and target critical infrastructure, like power grids and industrial systems.

But here’s the real problem: the Mirai botnet is still out there. Its original creators released the source code online, and since then, cybercriminals worldwide have been modifying and weaponizing it. Even today, in 2025, Mirai-based botnets are still behind record-breaking cyberattacks, targeting everything from internet service providers to government networks.

ThroughTek

In 2021, security researchers uncovered a serious flaw in ThroughTek’s IoT software, which is used in millions of smart cameras, baby monitors, and security systems around the world. It turned out that hackers could use this vulnerability to remotely access live video and audio streams from the cameras, and in some cases, even take full control of these devices, exposing sensitive footage from homes and businesses in the process.

The vulnerability was so severe that the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning, rating it 9.1 out of 10 on the severity scale.

How to secure IoT devices

The good news is that maintaining an overall good cybersecurity policy for your company will help safeguard your IoT devices. Training your staff with cybersecurity best practices and appointing specific admin roles to deal with the security of IoT devices in your organization are all methods for securing your business from IoT threats.

  • Regularly updating and checking IoT devices for patches: By staying up to date with your IoT devices’ firmware, you’re better equipped to protect your workplace from ever-evolving cyber threats. While people regularly update their computers and phones, they may forget to update their IoT devices.

  • Monitoring device behavior: By knowing your device’s base behavior and aspects such as its performance or regular network activity, you can recognize irregular behavior and intervene if you notice any deviations to your device’s performance.

  • Using strong and unique passwords: Using a password manager for your organization helps secure your IoT data security. NordPass Business creates unique, complex passwords. Additionally, it regularly reminds you to update passwords if they’re old, reused, or weak.

  • Checking app permissions for IoT devices: If an IoT device comes with an app, it is better to review the permissions it’s requesting before allowing access to your device or network. You shouldn’t grant apps more permissions than are strictly necessary.

  • Applying network segmentation and network security: Your workplace should have a way to monitor network activity and any devices connected to it. Tracking this information will help you recognize irregular internet traffic and act as an additional layer of security. This means that if one device is affected by an attack, it won’t be passed on to your other devices.

  • Considering additional security solutions and tools: To secure the app component of IoT devices, consider only accessing the app via a VPN. Doing so will encrypt the data transferred and give your network an extra layer of security.

  • Using multi-factor authentication (MFA): The more layers of security (authentication factors) smart devices used in your workplace have, the safer your company assets are. Incorporating additional factors to authenticate the user, such as biometric data or the user’s geolocation, makes your IoT devices less vulnerable to cyber attacks.

  • Applying Cloud IoT Security: Many IoT applications leverage cloud computing for storing, processing, and analyzing data. Therefore, it’s essential to implement security strategies, procedures, and tools that encompass cloud security if your organization utilizes smart devices.

How NordPass Business boosts your IoT security

The surge of IoT devices in private and professional settings provides more potential routes for hackers to steal valuable data and information. These devices and networks are more intertwined than ever, meaning cybersecurity for IoT shouldn’t be ignored. For companies working with large amounts of data, NordPass Enterprise is the cybersecurity solution you’re looking for. With NordPass, you can securely store and share login credentials for all your accounts and generate strong, unique logins in no time. NordPass allows you and your colleagues to quickly access important office notes (alarm PINs, WiFi passwords, and recovery codes) in one place.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Granular policy controls: a flexible way to manage company-wide settings

When you’re ensuring thorough organizational security, company-wide settings can be a tricky business. You need them to be strict enough that all employees must comply with the rules, but you also need just enough flexibility to ensure everyone accesses sensitive information on a need-to-know basis.

To help organizations manage their internal security with more flexibility, NordPass offers granular policy controls—an addition to company-wide settings that lets companies assign more precise access controls to employees based on their needs and responsibilities.

What are granular policy controls and why are they necessary?

Organizations often face the challenge of determining the appropriate security measures across teams and individual employees. While globally applied policies can seem like the optimal option, in reality, they may grant overextended access to employees who should otherwise be restricted from accessing certain rights or advanced tools. This lack of access restrictions on a privilege level can lead to mismanagement and open up the organization to security risks.

NordPass tackles this issue, allowing businesses to control their security practices and access management as they see fit. With this functionality, organizations can set specific security policies at the organizational, role, or individual user level. This ensures that all employees can work efficiently based on their duties, setting a higher security standard in the organization.

How do granular policy controls work?

Granular policy controls are available with the NordPass Business, Teams, and Enterprise plans. The granular adjustments are managed by organization Admins and Owners using the Admin Panel based on member scope and particular policies.

Granularity scope

Before the introduction of granularity, all policies in NordPass were set globally, meaning that all organization members received the same access privileges without exception. With granular controls, Admins and Owners can set more precise access rights for members based on three criteria: whole organization, roles, or individual users.

Policy scope

The scope also is flexible across different policies. For instance, if only your Legal and Sales teams need access to the Guest Sharing policy, you limit it so that only select employees or teams with the appropriate role can access it. You can also flexibly adjust the requirements individually; for instance, employees in more sensitive roles may be required to adhere to a stricter password policy than staff in other roles.

The NordPass granular policy controls apply to the following company-wide settings:

  • Password Policy: you can customize and enforce password rules for the organization or different roles.

  • Guest Sharing: you can allow or disallow the ability to share sensitive information with contacts outside the organization.

  • Exporting: you can allow or disallow members of the organization to export sensitive data.

  • Autolock: you can define different inactivity periods before NordPass is automatically locked for different roles and individuals.

  • Browser extension lock: you can control browser extension behavior and set whether it can remain unlocked based on the role or individual member needs.

  • Multi-factor authentication (MFA): you can enforce MFA to ensure a higher security level for the organization, specific roles, or selected employees.

  • Email Masking: you can allow or disallow the organization, select roles, or individual members to use decoy email domains to protect their work email accounts.

The benefits of granular policy controls

NordPass’ granular policy controls solve a massive issue for business security: companies are no longer forced to apply global policies. Each team can adapt to higher security standards as role-specific rules reduce the likelihood of miscommunication and accidental or malicious access to sensitive materials.

Organizations that handle sensitive information can impose stricter and more accurate data management practices. With granularity ranging from the individual to the full organization, it offers an easier way to delegate security-related roles and responsibilities, such as sharing data with external partners.

Establishing granular access controls can help companies embarking on compliance journeys to meet the necessary regulatory criteria. Administrators can easily decide which settings must have more restrictive access and which can be more lax. This can protect organizations from unnecessary internal risks or human error and ensure a smoother workflow across teams.

Granular policy controls can also take device security into account. For instance, customizing autolock time requirements allows the organization to provide safeguards for all accounts while simultaneously keeping the workflow uninterrupted for those employees who are not exposed to critical access and can have a longer autolock period. MFA helps provide safer access to sensitive data, especially for employees who may be working remotely or traveling to industry events.

Granular policy controls allow organizations to build a more comprehensive data security system and maintain a clear and flexible cybersecurity standard that takes employee productivity and designated roles into account.

Secure your business with NordPass

Granular policy controls join the long list of NordPass functions that help achieve a higher level of cybersecurity in your organization—here, by enhancing company-wide settings with more precise access controls. With NordPass, you can store sensitive company data in XChaCha20-encrypted storage and share it with colleagues without compromising it. NordPass helps you stay ahead of data breaches with features like the Data Breach Scanner and Password Health, alerting you if your domains or email addresses appear on the dark web and checking your saved credentials for compromised, outdated, reused, or weak passwords.

Put your organization’s cybersecurity first without putting your team’s productivity on the back burner. Find the right NordPass plan for your business and enhance your credential security today.

 

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

IT regulatory landscape in 2025: an interview with Prof. Dr. Kipker

Regulatory compliance is a constant yet necessary headache for businesses. Regulations are not set in stone—just because a business met the criteria of one framework or another two years ago does not mean it’ll be sufficient a year from now. In 2025, as we see new technologies like AI emerge, businesses must adapt and prepare to meet new regulatory standards.

So, what do businesses need to know as new regulations roll in and evolve? Prof. Dr. Dennis-Kenji Kipker, member of NordPass Advisory Board, answered some of the most pressing questions about the current cybersecurity landscape in the EU, what AI risks new regulations aim to prevent, and how businesses can prepare for compliance policies that will come into force in 2025.

Kipker is a Professor of IT Security Law at the University of Applied Sciences Bremen and the Scientific Director of the cyberintelligence.institute in Frankfurt. He’s one of the leading cybersecurity experts in the world, acting as an advisor to the European Commission and the German Federal Government. Kipker’s research focuses on cyberlaw, international IT law, and IT consumer protection.

New and updated regulations come into effect every year. What are the major EU regulations coming into force in 2025 that businesses should be aware of?

This year we’ll see several key regulations taking effect. These include the Digital Operational Resilience Act (DORA) for financial institutions, the AI Act, the European Accessibility Act (EAA), and the NIS2 Directive. All these regulations have varying requirements but altogether aim to enhance digital security, compliance, and ethical AI deployment in the EU.

Let’s start with the Digital Operational Resilience Act (DORA). What can you tell us about its impact on financial institutions and IT service providers?

The DORA went into effect earlier this year, on January 17. Its aim is to strengthen the IT security of various financial entities and ensure they’re prepared for potential operational disruption. So, here we’re talking about banks, insurance companies, and the like.

More specifically, DORA requires financial entities to implement stronger cybersecurity frameworks, conduct regular risk assessments, and ensure third-party ICT providers meet security standards. It impacts the overall standards of financial cybersecurity in the EU.

The Network and Information Security Directive 2 (NIS2) entered into force in October 2024. Nevertheless, it’s still a relatively recent legislation for businesses. What have been the key changes stepping away from NIS1 and into NIS2?

Compared to the earlier framework, NIS2 expands the scope of cybersecurity obligations beyond critical infrastructure to include more sectors, such as healthcare, manufacturing, and cloud service providers. It also mandates a faster incident reporting timeframe—businesses must relay this information within 24 hours of an incident occurring.

The NIS2 also introduced stronger risk management policies and established that every EU member state must follow uniform criteria to enforce cybersecurity measures and determine which entities must adhere to them. If an organization fails to meet the NIS2 requirements, its managing bodies are held liable.

AI prevails as one of the most pressing topics, and the EU Artificial Intelligence Act is set to become one of the world’s first AI regulations. What does it aim to achieve?

The AI Act is really the first comprehensive regulation of this kind—it entered into force in August 2024, and its first requirements started to be applied in February. Firstly, it classifies AI systems based on their risk level: that means banning harmful AI, setting strict requirements for high-risk AI in fields like healthcare or law enforcement, and mandating transparency for AI-generated content—think deepfakes.

The first stage of application encompasses prohibitions and AI literacy obligations specifically, broader application is due in August this year. This will be the biggest implementation, covering governance, confidentiality, and penalties, among other requirements. The final applications will be enacted in August 2026 and August 2027.

What kinds of AI applications will be banned under the AI Act? How will companies deploying AI in the EU need to comply with the new rules?

The banned AI applications list includes AI systems that can manipulate human behavior, exploit vulnerabilities, and employ government-led social scoring.

As for companies that use AI in high-risk sectors, they’ll have to conduct risk assessments, maintain detailed documentation, ensure human oversight, and register their AI systems in an EU database.

The European Accessibility Act (EAA) is coming into effect in June this year. How will it impact tech companies? What are the penalties for companies that fail to comply with the new accessibility rules?

The EAA mandates that digital services, such as websites, apps, and e-commerce platforms, must be accessible to people with disabilities. For instance, businesses must redesign user interfaces and offer assistive technology support, like alt text for images. Overall, the EAA follows four key principles of accessibility:

  • Perceivability, meaning that all information of the service must be presented in a way that users can perceive regardless of their disability;

  • Operability, or how the user interacts with the interface and how accessible the navigation is;

  • Understandability, which requires all information to be easy to understand without unnecessary complexities;

  • Robustness, meaning all content must work on different devices and platforms, including assistive technology.

Companies that fail to comply will certainly face penalties which will vary in different EU countries. However, we know that financial fines will vary from €1,000—the lowest fine rate in Malta—to €500,000—the highest fine rate in Germany. Other penalties include legal action and bans on selling non-compliant products or services in the EU.

Finally, what’s your advice for businesses preparing for these upcoming regulations?

Firstly, companies should conduct compliance audits. Some frameworks issue official certifications of compliance. It’s important for businesses to be self-initiative in terms of compliance frameworks and analyze the requirements themselves. That said, working with external consultants can help answer some individual questions regarding compliance.

Updating risk management strategies is also essential. For instance, with the new NIS2 requirements, it’s essential for businesses to have a system in place to react to incidents in a timely manner.

Investing in cybersecurity and AI governance is another recommendation. As the next application stage for the EU AI Act is in August, it gives time for organizations to review what AI governance services they use now and what they plan to use in the future.

And, of course, employee training is always key. Ensuring employees are familiar with and understand the new regulatory requirements can help ensure that the right practices are upheld in an organization.

 

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Need help? Our team is just a message away