Threat Lab

Girl Scouts and OpenText empower future leaders of tomorrow with cyber resilience

The transition to a digital-first world enables us to connect, work and live in a realm where information is available at our fingertips. The children of today will be working in an environment of tomorrow that is shaped by hyperconnectivity. Operating in this...

World Backup Day reminds us all just how precious our data is

Think of all the important files sitting on your computer right now. If your computer crashed tomorrow, would you be able to retrieve your important files? Would your business suffer as a result? As more and more of our daily activities incorporate digital and online...

3 Reasons We Forget Small & Midsized Businesses are Major Targets for Ransomware

The ransomware attacks that make headlines and steer conversations among cybersecurity professionals usually involve major ransoms, huge corporations and notorious hacking groups. Kia Motors, Accenture, Acer, JBS…these companies were some of the largest to be...

How Ransomware Sneaks In

Ransomware has officially made the mainstream. Dramatic headlines announce the latest attacks and news outlets highlight the staggeringly high ransoms businesses pay to retrieve their stolen data. And it’s no wonder why – ransomware attacks are on the rise and the...

An MSP and SMB guide to disaster preparation, recovery and remediation

Introduction It’s important for a business to be prepared with an exercised business continuity and disaster recovery (BC/DR) plan plan before its hit with ransomware so that it can resume operations as quickly as possible. Key steps and solutions should be followed...

Podcast: Cyber resilience in a remote work world

The global pandemic that began to send us packing from our offices in March of last year upended our established way of working overnight. We’re still feeling the effects. Many office workers have yet to return to the office in the volumes they worked in pre-pandemic....

5 Tips to get Better Efficacy out of Your IT Security Stack

If you’re an admin, service provider, security executive, or are otherwise affiliated with the world of IT solutions, then you know that one of the biggest challenges to overcome is efficacy. Especially in terms of cybersecurity, efficacy is something of an amorphous...

How Cryptocurrency and Cybercrime Trends Influence One Another

Typically, when cryptocurrency values change, one would expect to see changes in crypto-related cybercrime. In particular, trends in Bitcoin values tend to be the bellwether you can use to predict how other currencies’ values will shift, and there are usually...

Why your computer will thank you for choosing Webroot Essentials

Jul 29, 2025 | Home + Mobile, Threat Lab

Let’s be honest – nobody wants antivirus software that slows down their computer. You know the feeling: you install security software to protect yourself, but suddenly your laptop takes forever to start up, programs freeze, and you’re constantly waiting for things to load.

Well, we have some great news. A recent independent study by PassMark Software just proved what we’ve been saying all along: Webroot Essentials gives you top-notch protection without the performance headaches.

We actually came out on top

PassMark tested nine popular antivirus programs (including big names like McAfee, Norton, and Microsoft Defender) to see which one performs best on Windows 11. Webroot Essentials scored the highest overall – but here’s what really matters to you as a user.

The numbers that matter to your daily life

Instead of boring you with technical jargon, let’s talk about what these test results mean for your everyday computer use:

Getting set up

Webroot installs 6.7 times faster than other antivirus programs
Translation: You’ll be protected in under a minute, not sitting around waiting

Using your computer

Our software opens 3 times faster when you need to check something
Your computer stays snappy and responsive, just like it should

Your hard drive space

Webroot takes up 33 times less space than the average competitor
More room for your photos, music, and the stuff you actually care about

Your computer’s memory

We use 5 times less memory when just running in the background
Even during scans, we use 3.5 times less memory than others
Your other programs won’t slow down or crash

Security scans

Full system scans happen 6 times faster
No more hour-long scans that make your computer unusable

What this really means for you

Think about your typical day with your computer. Maybe you’re checking email, browsing the web, working on documents, or video chatting with family. You want protection running quietly in the background – not something that makes you want to throw your laptop out the window.

With Webroot Essentials, you get that peace of mind without any of the frustration. Your computer starts up fast, programs load quickly, and you’ve got plenty of storage space left for your files.

Details of the study

PassMark Software ran this independent test in June 2025, putting nine antivirus products through 15 different performance tests. Every product was tested exactly the same way on fresh Windows 11 computers with default settings – so it was a fair comparison across the board.

Download the full report here.

The bottom line

Here’s the thing: you shouldn’t have to choose between staying safe online and having a computer that actually works well. Webroot Essentials proves you can have both.

If you’re tired of antivirus software that feels like it’s working against you instead of for you, it might be time to make the switch. Your computer – and your patience – will thank you.

Learn more about Webroot Essentials

Strengthen your digital defenses on World Password Day

Apr 30, 2025 | Threat Lab

In today’s digital world, passwords have become a necessary part of life. But even though you use them for almost everything you do online, you probably don’t give them the thought they truly deserve. May 1, 2025, is World Password Day, a reminder that passwords are the unsung heroes of cybersecurity, the first line of defense for all your sensitive personal data. This annual event encourages you to level up your password game and strengthen your online defenses. World Password Day is more relevant than ever in today’s evolving threat landscape.

Data breaches are on the rise, and according to the 2024 Verizon Data Breach Investigations Report, a staggering 81% of them are linked to weak or compromised passwords. The bottom line? If you’re still relying on “Fluffy123”, you could be putting your personal information at risk. Let’s explore password-based attacks, and some steps you can take to lock down your logins, once and for all.

Threats to your passwords

Managing all your passwords can be a hassle. They’re easy to forget and hard to keep track of, so people tend to use and reuse simple passwords they can remember. But here’s the issue – cybercriminals are getting smarter and their attacks are only getting more sophisticated. If a scammer gains access to your personal details, they can create havoc with your finances and cause you stress for years to come. In the past, brute force attacks were the go-to method, which involved simply using trial and error to crack passwords. Today, hackers use much more complex methods – here are a few examples.

Password phishing: In a phishing attack, scammers will use emails, phone calls, or texts to pose as trusted businesses and service providers. They may send you a fake invoice to pay. They might offer you an amazing deal on an upgraded service. Sometimes they threaten to cut off a service if you don’t respond immediately. The goal is to trick you into giving up your username and password so they can access your data and steal your money.
Credential stuffing: Once hackers have your login details, they often try what’s called credential stuffing – using your stolen credentials (username and password combinations) to try and break into your other accounts. Why does this work so often? Because more than two in three people admit they reuse passwords across multiple accounts.
Malware: Infostealer malware can be used by hackers in the background to steal your personal information including your passwords. Once the malware is on your device it can search your web browsers, email clients, digital wallets, files, applications, etc. looking for sensitive information. They can even look for old forms you filled out with passwords, record your keyboard strokes, and take screenshots of your computer dashboard. The malware then sends this information back to hackers’ servers, sometimes within seconds. Hackers can use this type of malware for large attacks as seen by the targeted attack on Snowflake customers.

Password security checklist

Create strong passwords

Longer is stronger: Aim for passwords that are at least 16 characters long. Research shows this number of characters takes exponentially longer to crack.

Difficulty matters: “12345” may be an easy password to remember, but it isn’t going to keep the cybercriminals away. Create a unique mix of uppercase, lowercase, numbers, and symbols for each password.

Be unpredictable: Avoid using obvious patterns and personal details that will be easy for hackers to figure out. This means no street addresses or phone numbers, and especially no personal details you might be sharing on social media.

Did you know? More than 50% of people admit to using familiar names for their passwords, such as their kid’s name or their pet’s name. 15% said they use their own first name in their passwords!
Change reused passwords
If you’re reusing the same password across accounts, it’s time for a refresh. All it takes is one compromised account for a hacker to potentially unlock dozens more. Start with your most sensitive accounts, such as banking, email, and healthcare and update those first.

Did you know? According to a study by Forbes Advisor, on average, people reuse the same password for at least four accounts.
Use multi-factor authentication
Even if a hacker obtains your password, you can still stop them in their tracks by adding a second layer of security to your login process. Multi-factor authentication (MFA) includes things like one-time codes sent to your phone or scans of biometric features, such as your face or fingerprints.
Did You Know? Using MFA can stop over 99% of account compromise attacks.
Consider using passphrases or passkeys
These are two alternatives to passwords that you might want to consider.
- A passphrase is a string of unrelated words that’s easy to recall and tough to crack. For example, something nonsensical like “FancyGoldEmuDancing “ will be hard for a hacker to guess, but it might be easier for you to memorize than a string of numbers and symbols.
- A passkey is an authentication method that uses biometric data, like facial recognition or a fingerprint. It can also use a swipe pattern (a three-by-three grid of dots) or a PIN. A passkey is used across all your devices, creating a password-free login.
  
  Did you know? Not only does signing in with a passkey make your data much more secure, it’s also three times faster than using a conventional
  password.
Use a password manager
Password managers are tools that make your life easier by doing the hard work for you. By automatically generating and storing your strong passwords, they reduce the risk of recycled or forgotten logins and provide secure access across all your devices. Webroot solutions include password managers and much more, including features like real-time phishing detection to prevent credential theft.

Did you know? Users who rely on password managers are less likely to experience identity theft or credential theft than those who don’t.
Protect your devices
Antivirus software scans detect and defend against any virus or malicious program like malware, trojans, adware and more that might cause damage to your devices. Webroot products offer robust antivirus protection that continuously scours the internet to identify and block the latest threats.

Did you know? Hackers are moving away from browser-based attacks and embedding malicious software into everyday files like documents, installers and media. More than 50% of all consumer malware now enters through downloads and desktop.

Never forget that your passwords are the very foundation of your digital defense strategy. With cyberattacks becoming more and more sophisticated, creating strong passwords is no longer optional – it’s essential. This World Password Day, take the time to check in on your password practices. Update those old logins, enable MFA, and let Webroot do the heavy lifting. Just a few simple steps today can save you a world of trouble tomorrow.

Looking for more information and solutions?

The danger of data breaches — what you really need to know

Apr 22, 2025 | Threat Lab

In today’s digital world, your personal data is like cold hard cash, and that’s why cyberthieves are always looking for ways to steal it. Whether it’s an email address, a credit card number, or even medical records, your personal information is incredibly valuable in the wrong hands.

For hackers, breaking into a company database is like hitting the mother lode, giving them access to millions of personal records. Why? Because whether you know it or not, many companies are collecting and storing your private data. Think about all the information you hand over when you order something online, like your full name, your credit card number, your home address, and maybe even your birthdate just to snag an extra discount. If a company you do business with becomes part of a data breach, cybercriminals may have full access to your confidential information.

Unfortunately, data breaches are on the rise and affecting more companies and consumers than ever. In 2024, more than 1.3 billion people received notices that their information was exposed in a data breach. Chances are you’ve received at least one of these letters, which means you have been put at risk for identity theft and major financial losses.

What are data breaches and how do they happen?

Data breaches occur when sensitive, protected, or confidential data is hacked or leaked from a company or organization. Sometimes businesses are targeted because they have outdated or weak security. While no industry is immune, some sectors are more likely to become victims of breaches because of the sensitive nature of the data they handle. Here are some of the most likely targets for access to consumer data:

Healthcare organizations: Healthcare companies are a prime target for cybercrime due to the large amounts of sensitive data they store, which includes personal information and medical records. In 2024, there were 14 data breaches involving 1 million or more healthcare records. The largest breach affected an estimated 190 million people and a ransom of 22 million dollars was collected by the hackers.
Financial services industry: Banks, insurance companies and other financial organizations offer a wealth of opportunity for hackers who can use stolen bank account and credit card information for their own financial gain. In 2024, mortgage lender LoanDepot was the victim of a cyberattack that compromised the information of more than 16 million individuals.
Retail and e-commerce: Retail and ecommerce businesses are vulnerable to breaches because they handle and store vast amounts of customer payment information, including addresses, credit card numbers and more. Many retailers operate both brick-and-mortar stores and ecommerce platforms and rely on a variety of mobile apps, PoS (point-of-sale) systems, and cloud-based platforms, which creates more entry points for hackers to exploit.
Tech companies: With access to user data, software systems and intellectual property, tech firms are frequent targets. Apple, Twitter and Meta have all reportedly been victims of cyberattacks.
Government agencies: Because government organizations store highly sensitive information, social security numbers, they are considered especially high-value targets for cyberattacks.

The most-wanted data

The type of information stolen in data breaches varies depending on the organization, but here’s a list of the kind of data cybercriminals are seeking:

Emails and passwords
Payment and credit card information
Medical records and health data
Social Security numbers
Driver’s license numbers
Banking details and account numbers

What hackers do with your data

Once data is exposed in a breach, cybercriminals will test your usernames and password combinations across thousands of sites, knowing that most people recycle their emails and passwords. Here are just some of the ways hackers exploit your stolen information:

Identity theft: Hackers use your personal info to impersonate you. They can open accounts in your name, apply for loans, and even file false tax returns.
Selling it on the dark web: Stolen data is frequently sold to the highest bidder on dark web marketplaces. This makes it accessible to a worldwide network of criminals.
Phishing and social engineering: Using your personal information, scammers can craft more convincing phishing emails or messages to trick you into giving up even more sensitive details, like passwords and PIN numbers.
Financial exploitation: When your credit card numbers or bank account details are compromised, cyber thieves can use that information to make financial transactions in your name. They can rack up charges on your credit cards and even drain your bank accounts.
Data reuse and repurposing: It’s important to remember that your stolen information can be used for fraud and theft even years after a data breach, so it’s crucial to stop using recycled usernames and passwords on both old and new accounts or systems.
Hijacking online accounts: If your login credentials (usernames and passwords) are leaked, all your online accounts are put at risk. Besides your financial accounts, cyber thieves can also access your social media accounts and other platforms, leading to a major loss of privacy in addition to monetary losses.

How to minimize the risks

Stay alert: Be on the lookout for any signs of fraud and use an identity protection plan to guard against suspicious activity. Webroot Total Protection monitors the dark web for you and sends alerts if your email or personal information has been found in a breach.
Use strong, unique passwords: Strong, unique passwords are a simple, yet powerful security tool. Webroot Essentials plans offer password managers that do the hard work for you, keeping all your passwords safe and encrypted while you remember just one password for a quick and seamless login on every site and app.
Enable two-factor authentication (2FA): Turn on two-factor identification wherever possible, especially for financial accounts and email. This adds an extra step to your login process and makes it much harder for hackers to gain access. Also, remember to update and reset your passwords on a regular basis and always delete any old, unused online accounts.
Keep your devices protected: Always keep your device software updated and use antivirus and internet security software. Webroot Premium protects your devices from malware, viruses and phishing attempts and provides identity protection so you’re immediately alerted if your information is leaked in a data breach or found on the dark web. If you do become a victim of identity theft, you’ll have 24/7 U.S.-based customer support and up to $1 million in expense reimbursement.
Update your identity protection plan: Remember to keep your identity protection plan updated, so your personal details like birthdate, Social Security number and driver’s license number are current. Make sure all your family members are onboarded, especially children and older relatives. Also, get real time fraud detection by setting up threshold alerts on your financial accounts so you’re notified of any suspicious transactions as soon as they occur.
Monitor constantly: It’s important to remember that even if your personal data was exposed years ago, it can still resurface and cause problems at any time. Especially when it comes to children and the elderly, suspicious financial activity can happen without their knowledge and go undetected. For example, it’s not uncommon for a young student to find out they have a poor credit score only when they to try to open their first credit card account. The student had no idea that a cybercriminal used their information for fraudulent purposes and is forced to go through a difficult and costly process to restore their good credit. Most identity protection plans include monitoring and remediation, even if the fraud happened years ago and is affecting you or your family today.

Data breaches are a fact of life in the digital world we live in, but you can protect yourself with some smart security measures. By using strong passwords, password managers, antivirus software, and identity protection plans, you can reduce your risk of becoming a victim of cybercrime, and even get help to restore your identity, your financial losses and your reputation.

It’s like putting a lock on your personal data. When it comes to your sensitive information, it’s always better to be safe than sorry.

Looking for more information and solutions?

Top cyberthreats of 2025

Keeping educational systems secure

How to keep your personal data safe

Protect yourself from identity theft

Safeguarding your devices from malware

World Backup Day: Pledge to protect your digital life

Mar 12, 2025 | Threat Lab

Our digital lives are filled with essential personal information, and it’s easy to forget how vulnerable all that data can be. But if your hard drive crashes, your laptop gets stolen, or you fall victim to cybercrime, the loss can be devastating. Your financial records, your work files, and even years of family photos can disappear in and instance. It’s a nightmare scenario that happens more often than you think. That’s why March 31st is World Backup Day, serving as a reminder that the right backup strategy can save you the frustration, cost, and the heartache of losing information that’s dear to you.

Backing up your data simply means creating copies of your important files and storing them in secure, encrypted locations. This ensures that even if something goes wrong and your data disappears, you’ll be able to recover it. Yet, many people don’t take these important steps to protect their digital lives. Despite all the risks, 20% of people rarely or never back up their data, leaving them vulnerable to irreversible loss.

Common causes of data loss

Human error: This is the number one cause of data loss, according to a report highlighted in PC World. Nobody’s perfect, and we all run the risk of accidents, from deleting files to spilling coffee on a laptop.
Hard drive failure: It happens! Hard drives are a great way to backup, but these devices can and do suffer data loss. Many hard drives fail in less than three years, and it’s been found that the newer drives have shorter lifespans than those manufactured before 2015.
Software corruption: When software or data is damaged, it can become unusable or unreadable. This can be caused by software bugs, hardware failures, viruses and malware, resulting in system crashes or data corruption.
Malware and ransomware attacks: Cybercriminals also deploy malware to lock, steal, or destroy your files. Ransomware is a type of malware that prevents you from accessing your files and demands a ransom for their return.
Natural disasters and theft: Threats like fires and floods, as well as burglaries and robberies, can lead to crippling data loss if all your information is stored in just one vulnerable place.

The 3-2-1 backup strategy

Avoiding common threats can be as easy as 1-2-3, or should we say 3-2-1? By using the 3-2-1 backup rule, you’ll give yourself comprehensive protection against the many forms of potential data loss.

3 Copies: always keep three copies of your data- your original plus two backups.
2 Different Media Types: Store your backups on two different types of media – for example, use an external hard drive and a cloud storage service, like Carbonite. Using encryption is also crucial for protecting against data loss because it transforms sensitive information into an unreadable format.
1 Offsite Backup: Keep at least one backup in a different physical location, like a separate worksite or a safety deposit box.

Backup options to consider

External hard drives
These are great for local backups, but can be vulnerable to theft, damage, and hardware failure.
Cloud backup services
Look for cloud-based solutions that offer encrypted, automatic, and unlimited backup to ensure files are always protected. Carbonite makes it easy to continuously and securely backup all your data with 128-byte protection. And because all backups are stored offsite, in the cloud, you can easily access them anytime, anyplace, and restore them with just a click.
Network-attached storage
A network attached storage (NAS) device is a dedicated file storage system connected to a network, which enables data sharing across various devices.

Why backing up is essential

Protects your important data from hardware failure, cyber-attacks, and accidental deletion.
Ensures that your valuable data is encrypted, secure, and accessible when you need it.
Saves you the time, money and stress associated with attempting to recover lost data.
Preserves your cherished personal memories, like photos and videos, from being lost forever.
Helps maintain business continuity by offering a quick recovery from data loss.
Offers businesses resiliency and compliance across their organization.

Backup action plan

✅ Test your backups regularly: Check that your files are retrievable on a regular basis.

✅ Set a backup schedule: Automate the frequency of your backups according to your needs.

✅ Create a backup strategy: Prioritize which documents, photos, and databases need protection first.

✅ Create a disaster recovery plan: Outline steps for restoring data in case of an emergency.

✅ Use antivirus protection: Secure your system with antivirus protection to prevent malware and ransomware attacks.

✅ Use an offsite, secure, and unlimited solution like Carbonite for cloud backup:

Offers options for individuals and businesses
Automatic and continuous backup: No need to manually backup files
End-to-end encryption: Keeps your data private and protected
Easy file recovery: Restores lost or deleted files with just a few clicks
Multiple device support: Protects desktops, laptops, and external drives

Take the World Backup Day pledge

There’s never been a better time to make backing up your data part of your routine. Make a promise to protect yourself today by taking this official pledge. “I solemnly swear to backup my important documents and precious memories on March 31st.” Then take a few simple steps to get started.

Create your first backup
Try the 3-2-1 backup strategy
Secure your digital life with Carbonite

Backing up your files isn’t just about security, it’s about peace of mind. This World Backup Day, start building your own good backup habits. Protect your files and photos and finances now, because if disaster strikes you may never see them again. Consider this your wakeup call to make data protection a priority. Your future self will surely thank you!

Looking for more information and solutions?

National Consumer Protection Week: Keeping your personal data safe in a digitally connected world

Mar 3, 2025 | Threat Lab

March is a time for leprechauns and four-leaf clovers, and as luck would have it, it’s also a time to learn how to protect your private data from cybercrime. Each year, the first week of March (March 2-8) is recognized as National Consumer Protection Week (NCPW). During this time, many government agencies and consumer protection organizations come together to help educate consumers on how to keep their personal and financial information secure.

The event is sponsored by the Federal Trade Commission (FTC), and other participating agencies include the Federal Deposit Insurance Corporation (FDIC), AARP, and the Better Business Bureau (BBB). This month, take advantage of all that NCPW offers, including access to free tools and information that can help you identify and prevent online scams, fraud, and identity theft.

The growing risks to your data

During the third quarter of 2024, data breaches exposed more than 422 million records worldwide. Millions of customers were put at risk when their social security numbers, phone numbers, and other sensitive personal information were leaked.
As of 2024, the average cost of a data breach in the United States amounted to $9.36 million. In comparison, the global average cost per data breach was $4.88 million.
The most common causes of leaks were operating system (OS) flaws and weaknesses on devices like computers and phones. For example, when a user forgets to log out before they leave their computer, it can open the door for cybercriminals to steal information. In fact, it’s estimated that careless users are responsible for about 70% of sensitive data loss.

Common attacks to consumer protection

Identity theft and fraud
Some common types of identity theft and fraud include account takeover fraud, when criminals use stolen personal information such as account numbers, usernames, or passwords to hijack bank accounts, credit cards, and even email and social media accounts.
Online shopping scams
An online shopping scam usually involves a fake online store or app, which appears legitimate and is promoted on social media or other authentic websites.
Financial fraud
With the advent of artificial intelligence (AI), financial fraud tactics are growing more sophisticated, and sadly, they often target older people. For example, grandparent scams happen when someone who sounds like a grandchild or other relative contacts an older person and asks them to send money via wire transfer to help get them out of trouble. Scammers use AI to clone voices, which helps them convince you that you’re sending money to a family member who desperately needs your help.
Medical identity theft
Medical identity theft happens when someone steals or uses your personal information like your name, Social Security number, or Medicare details, to get healthcare in your name. This kind of fraud can disrupt your medical care and cost a lot of money to resolve.
Social engineering attacks
Social engineering attacks occur when someone uses a fake persona to gain your trust. They deceive you into divulging confidential information so they can steal your money. Contact is usually made through social media, by phone or in person.

How to protect yourself and your data

Smart ways to secure your devices
- Strong passwords – Make them long, random, and unique.
- Password managers – Automatically generate and store strong passwords.
- Antivirus protection – Software that protects against viruses and malware.
- Solutions – Webroot Premium and Webroot Essentials offer ultimate protection and include password managers.
Best practices for financial diligence
- Credit monitoring services – Keep an eye on your credit for you.
- Fraud alerts and credit freezes – Protect you from identity theft.
- Secure payment methods – Ensure safe processing of financial transactions.
- Protect your identity – Webroot Premium provides identity protection for up to 10 identities, including financial account and credit monitoring, and dark web monitoring.
Beware before you share
- Phishing scams – Avoid clicking on malicious links in emails and social media.
- Unsolicited calls or emails – Be wary about sharing personal details with people you do not know.
- Make sure businesses and organizations are legitimate – Confirm you’re dealing with a trusted source.
- Webroot Essentials and Webroot Premium – Offer peace of mind with device, identity, and privacy protection.
Practice personal Information management
- Data minimization strategies – Provide the least number of private details necessary when filling out forms or answering questionnaires .
- Social media privacy – Avoid sharing personal information on social media.
- Document disposal – Shred sensitive documents.
- Backup solutions – Carbonite automatically backs up and protects your data.

It takes more than good luck to protect your private data and finances from cybercriminals, so be sure to grab this opportunity to learn more about staying safe from online fraud.

Looking for more information and solutions:

Digital life protection: How Webroot keeps you safe in a constantly changing world

Feb 21, 2025 | Threat Lab

Nearly every aspect of life is connected to the internet, so protecting your devices, identity, and privacy has never been more critical. Cyber threats are no longer just the occasional virus or suspicious email. Phishing scams, ransomware attacks, data breaches, and identity theft are part of a growing list of online dangers that are a daily reality.

For over 25 years, Webroot has been on the front lines of cybersecurity, protecting millions of people and businesses from evolving threats. What began as antivirus product has expanded into a comprehensive portfolio to secure your entire digital life. With our all-in-one solutions, we’ve created a new standard for digital security—because safeguarding your devices, data, and identity in an increasingly interconnected world is not optional, it’s essential.

Let’s explore how Webroot has evolved to become your one-stop shop for all things cybersecurity.

Introducing Webroot Total Protection: Comprehensive security for the modern world

When you think about cybersecurity, you probably think of antivirus protection—and rightly so. But as technology advances, so do the threats. Today, your personal information, online activities, financial data, and even your family’s privacy are targets for attack.

That’s why Webroot has gone beyond traditional antivirus solutions to create Webroot Total Protection, a powerful all-in-one security suite that provides everything you need to stay safe online.

What is Total Protection?

Total Protection is a robust, comprehensive solution that safeguards not just your devices but also your online identity, files, and privacy. It combines multiple security capabilities into one easy-to-use package that includes:

Antivirus protection
Detects and neutralizes viruses, malware, spyware, and ransomware.
Password Manager
Ensures your passwords are strong and secure, while also making them easy to access and manage.
Identity protection
Guards against identity theft by monitoring your personal information and alerting you to potential breaches.
VPN (Virtual Private Network)
Protects your privacy while browsing online, ensuring your data isn’t intercepted or tracked.
Secure backup
Keeps your critical files safe from data loss or ransomware attacks.
Parental controls
Helps you protect your family by limiting access to inappropriate or harmful content online.

With Total Protection, you can confidently navigate the digital world, knowing your devices, identity, family, and personal data are secure every step of the way.

What does Webroot Essentials include?

Webroot Essentials provides foundational protection against today’s most common cyber threats, including:

Antivirus and anti-malware
Detects and neutralizes viruses, malware, spyware, and ransomware.
Browser protection
Keeps you safe while you browse and shop online, surf the web, and connect on social media.
Anti-phishing protection
Shields you from phishing attempts.
Password Manager
Helps you securely store and manage your login credentials.

With Webroot Essentials, you get exactly what you need to protect yourself, your devices, and your personal information—all in a package that’s simple to use and designed for everyday security.

The benefits of Webroot Total Protection and Essentials

The internet has become an integral part of everyday life. From online shopping and banking to remote work and social media, most of us spend a significant portion of our lives connected. While this connectivity brings convenience, it also comes with risks. Cybercrime is increasing at an alarming rate, targeting individuals and families just as often as businesses. Some of the most common threats include:

Phishing involves fraudulent emails or websites designed to trick you into revealing sensitive information.
Identity theft happens when criminals steal your personal information to commit fraud or theft.
Ransomware encrypts your files and demands payment to release them.
Data breaches occur when hackers gain unauthorized access to and steal sensitive files and information.
Viruses and malware programs harm your devices or steal your data.

As these threats become more sophisticated, having robust, multi-layered protection is essential. That’s why Webroot is dedicated to constant innovation, delivering advanced solutions that stay ahead of cybercriminals and adapt to the ever-changing digital landscape to keep you safe.

Protection for your growing number of devices
With the growing number of devices in every household—laptops, smartphones, tablets, and more—it’s crucial to have security that can keep up. Webroot offers packages designed to cover multiple devices, so you can keep your entire household protected.
Dedicated to innovation
New threats emerge daily. Backed by a dedication to constant innovation, Webroot’s solutions leverage advanced technology to detect and neutralize threats in real time, ensuring you stay protected from cyber-attacks before they can do harm.
Peace of mind for families
Features like parental controls and identity protection give families an added layer of security, so parents can rest easy knowing their children are safe online.
Powerful data protection
With secure backup included in Total Protection, you don’t have to worry about losing important files to ransomware, malware, or accidental deletion.
Effective antivirus protection
In an era where cyber threats are constantly evolving, some people might wonder: Is antivirus protection still necessary? The answer is a resounding yes. Viruses and malware are still very real dangers, and strong protection remains the cornerstone of any good cybersecurity strategy. Webroot’s antivirus technology is constantly updated to protect against the latest threats, and it works seamlessly with our other security tools to provide comprehensive protection.
A trusted name in cybersecurity
Webroot has spent over two decades perfecting our products, earning the trust of millions of users around the world. Whether you’re a tech-savvy professional or a casual user, we’re here to make security simple and effective.

Protect Your digital life with Webroot

Webroot has spent 25 years adapting to the ever-changing cybersecurity needs, and we’re not stopping anytime soon. With our all-in-one solutions like Webroot Total Protection and Webroot Essentials, we’re proud to offer powerful, easy-to-use tools that meet the demands of your modern digital life.

Whether you’re looking to safeguard your devices, protect your family, or secure your online identity, Webroot has you covered. Because in a world where cyber threats never rest, neither do we.

Is your whole digital life protected? 4 ways to address common vulnerabilities

Feb 21, 2025 | Threat Lab

Cyber threats. Identity theft. Online profiling. Financial fraud. Social media misuse. The list just gets longer. As more aspects of our lives move online and digital devices proliferate, staying safe from threats has become more important than ever.

Consider all the connected devices you use for daily tasks—browsing, shopping, banking, gaming, and more. Then think about all the content that you share on these devices every day; much of it likely contains sensitive or critical information that, in the wrong hands, could lead to serious damage with long-lasting impact.

The solution? Comprehensive digital protection. Webroot Total Protection is the latest release in our Customer Digital Life Protection strategy that checks all the boxes. It’s a top-end, true all-in-one offering based on a new platform that combines antivirus, password manager, identity protection, VPN, backup, and parental controls.

1. Protect your devices from viruses

How confident are you that your digital music, photos, and important documents—as well as email and applications—are safe? Cybercriminals are constantly developing new malware, ransomware, and phishing attacks that can steal identities, encrypt memorable family photos and documents for ransom, and turn home computers into devices that criminals take over to send spam or steal data.

Effective security software shields you from worms, trojans, adware, and more. And it protects not just your PC and laptop, but also your tablets, smartphones, and other digital devices.

Comprehensive antivirus software is most effective when used in conjunction with security best practices. Here are a few:

Make sure your antivirus software performs scans regularly
Install the latest security patches for your operating systems
Keep your antivirus software up to date
Be careful when downloading new apps onto devices; only download from app stores you trust
Regularly backup important data

Color illustration showing how Webroot antivirus protects devices.

2. Protect your privacy in your online activities

Sharing information has become commonplace in our digital lives. From purchasing a plane ticket to opening a bank account and registering to vote, or simply doing your grocery shopping online, getting through the day without sharing at least some personal information online seems nearly impossible.

The flip side to this convenience, however, is that we risk losing control over who can access our personal information. Malicious actors are constantly seeking to collect personal data to commit fraud, steal identities, harass and threaten individuals, and more.

Protecting privacy is a top priority for families facing growing threats. Password managers generate strong, unique passwords and simplify their use, protecting you and saving time by automatically filling in credentials for website and app logins. Besides, using a VPN (Virtual Private Network) that establishes secure connections to public Wi-Fi hotspots by encrypting data transmission will keep you safe and anonymous when you’re away from home.

By paying attention to your device settings you can take steps to protect your privacy across your digital life:

Social media: Choose who can see your posts, photos, and personal information and review these settings regularly. Set your default sharing settings to “friends” or a more restricted group rather than “public.” Check which third-party apps have access to your account and remove those you no longer use.
Mobile devices: Disable location, camera, microphone, and contact list access for apps that don’t truly need them. Consider turning off location services when not needed and review which apps track your location in the background.
Web browsers: Clear your browsing history and cookies regularly, block third-party cookies, and enable “do not track” features. Review and manage which sites can send you notifications, access your location, or use your camera/microphone.
Smart home devices: Review privacy settings for voice assistants like Alexa or Google Home regularly. Check what data these devices collect and adjust accordingly.
Email services: Keep tabs on apps and services that have access to your email account. Adjust spam filter settings to your preferences.
Operating systems: Check your privacy settings to control app permissions, data access, and tracking features.

3. Safeguard your identity and private information

Once only seen in spy movies, identity theft today is very real, and poses serious financial, legal, and personal consequences. Bad actors can drain your bank accounts, open fraudulent credit cards, take out loans, file false tax returns, obtain medical services in your name, and more. The results range from damaged credit and mounting debt to inaccurate medical records and reputation damage.

Some steps you can take to protect your identity include:

Monitoring financial activity: Check bank and credit card statements each month for unauthorized charges. Set up alerts for unusual transactions and review your credit reports.
Securing personal information: Only share Social Security numbers, birth dates, or account numbers when absolutely necessary. Shred or securely dispose of documents containing sensitive information and keep important documents in a secure location.
Be wary of scams: You shouldn’t respond to unsolicited phone calls, emails, or texts requesting personal information—legitimate organizations typically won’t ask for sensitive details through these channels.
Consider additional protection: Identity theft protection services monitor your credit and personal information for suspicious activity and alert you to anomalies. Many will also reimburse up to $1 million for fraud expenses, stolen funds, and related costs such as lawyer and expert fees, lost wages, private investigator charges, and additional childcare or eldercare. They can also help you re-establish your identity—on average it takes 200 hours to restore an identity after fraud.

How does an identity protection plan work?

Usually such services include a secure online portal where you can register your personal data, like date of birth, driver’s license, SSN, account numbers, and more. Once you subscribe, make sure to take the time to create your profile and that of your family members, so you can start getting identity health reports and rapid alerts right away in case anything fraudulent is detected!

If identity theft does happen, freeze any accounts with fraudulent charges and establish a fraud alert with credit bureaus. You can file an official identity theft report with the Federal Trade Commission at IdentityTheft.gov. Contact relevant organizations, such as the Social Security Administration if your SSN was stolen. Close compromised accounts and open new ones with different account numbers, and new passwords and PINs.

If you think the process of restoring your identity after theft is daunting, rest assure that cybersecurity or insurance companies offer identity protection plans that include the help of a remediation expert, who can guide you through the process. These professionals have in-depth knowledge of identity theft laws, credit reporting procedures, fraud resolution practices, and how to interact with various institutions to resolve issues effectively.

Protect the data, document and precious memories stored on your devices

Theft isn’t the only threat to data – consider the impact that hardware failures, coffee spills, and accidental deletions can have on favorite photos, digital memories, and other unreplaceable items. This is where data encryption and automated backups come in.

Data encryption protects data by translating it into a different, unreadable form using an encryption key. When it’s in that encrypted form, only someone with the unique decryption key or password can translate the data back into its readable state. Encryption is one of the most effective and widely used forms of data security available.

With automated backup you can create a backup schedule that you can set and forget. Back-up files are typically uploaded to the cloud so they are accessible from anywhere. Changes that you make on your files are reflected in the backup ones.

Data protection best practices include:

Follow the 3-2-1 backup rule: three copies of data, on two different types of media, with one copy off-site
Test restore procedures regularly
Keep encryption keys and passwords secure but accessible
Monitor backup logs and storage capacity
Regularly update backup software for security patches

You may already be protected in one or several of these areas,
but how could you make sure you truly have comprehensive protection?

Introducing Webroot Total Protection

With the mounting threats out there, it’s time to consider comprehensive digital protection so you can rest easy that your devices are safe and your content, identity, and privacy are protected. Webroot Total Protection empowers families to enjoy their digital life to the fullest by protecting connected devices, documents, best memories, online transactions, and identities in a way that’s flexible and affordable.
Learn more about what Webroot Total Protection can do for your digital life.

MSPs weigh in: Key SOAR benefits driving MDR success

Feb 19, 2025 | Threat Lab

OpenText recently surveyed 255 MSPs to uncover key trends shaping the future of Managed Detection and Response (MDR). One technology area it explored was security orchestration, automation, and response (SOAR)—the workhorse behind automating security workflows. The survey revealed several key benefits of SOAR in MDR, highlighting how it can help MSPs and SMBs improve incident response, reduce alert fatigue, and deliver round-the-clock security.

SOAR is a technology that enables security teams to automate and streamline their workflows—from threat detection to response. It integrates and coordinates security tools and processes, helping analysts handle and respond to incidents. By automating repetitive tasks, such as triaging alerts and executing response actions, SOAR reduces manual effort and speeds up incident resolution. This improves the overall effectiveness of security operations, making it a critical component of modern MDR solutions.

Real-world benefits of SOAR for MDR solutions

Automation of common tasks
In the survey, 30% of MSPs pointed to automation of common tasks as the most valuable benefit of SOAR within an MDR service—and it’s easy to see why. Automation allows MSPs to streamline repetitive tasks like alert triage and standard response workflows. By speeding up incident resolution and ensuring consistent, accurate responses, SOAR helps MSPs address threats swiftly and effectively. This not only reduces the burden on security teams but also enables them to outpace adversaries and deliver stronger protection for their customers.

Improved 24/7/365 protection and after-hours response
Cybercriminals know that timing is everything. They often strike outside of business hours—late at night, on weekends, or during holidays—because they count on reduced staffing and slower response times to give them the upper hand. However, with MDR services leveraging SOAR, cybercriminals lose their “after hours advantage.”

According to the survey, 27% of MSPs identified improved 24/7/365 protection and after-hours response as a top SOAR benefit as part of an MDR solution. By automating detection and response using customizable workflows, SOAR ensures security measures are always on, regardless of the time or day.

Reduced alert fatigue
Alert fatigue is one of the most pressing challenges for security teams today. When bombarded with an overwhelming number of alerts, it’s easy for critical threats to get lost in the noise. SOAR directly tackles this issue, helping MSPs streamline their processes and focus on what really matters. In fact, 24% of MSPs in the survey noted that SOAR’s ability to reduce alert fatigue thereby improving accuracy and confidence was a key benefit for an MDR solution.

SOAR works by automatically analyzing security alerts against predefined rules and context, escalating the most critical threats to the surface. This not only sharpens the accuracy of responses but also enables security teams to act quickly and decisively. Security teams can use SOAR to create workflows to remediate the high-priority incidents that truly need attention, ensuring that any financial and reputational damage is minimized

Centralized incident management with enriched alerts
When it comes to incident management, having a disjointed view can slow down response times and make it harder to pinpoint the right course of action. That’s why 19% of MSPs in the survey highlighted centralized incident management and enriched alerts as one of the top benefits of SOAR for an MDR solution.

Alerts are enriched with the latest threat intelligence, which provides security teams with vital context. This deeper layer of information helps analysts understand the full scope and severity of an alert, allowing them to make quicker, more informed decisions. With SOAR, all relevant data is centralized in one platform, giving security teams a unified view that enhances their ability to respond effectively and prioritize the most critical threats without missing crucial details.

MDR with SOAR helps MSPs differentiate their offering

For MSPs, leveraging SOAR capabilities in their MDR offerings is a strategic move that can significantly enhance their service delivery. By focusing on the key benefits of automation using workflows, 24/7 protection, reduced alert fatigue, and centralized incident management, MSPs can provide a superior level of security that meets the evolving needs of their SMB clients. This differentiation not only improves client outcomes but also positions MSPs as leaders in the competitive security services market.

Incorporating SOAR into MDR services enables MSPs to offer a more efficient, reliable, and comprehensive security solution. With SOAR automating routine tasks, improving after-hours response, reducing alert fatigue, and centralizing incident management, MSPs can ensure that their clients receive the best possible defense against cyber threats. This approach not only enhances the overall security posture of SMBs but also builds trust and confidence in the MSPs’ ability to safeguard their clients’ digital assets.

Final thoughts

When MSPs choose to partner with a vendor for MDR, it’s important to select one that integrates SOAR into their offering. By doing so, MSPs can deliver a modern, proactive MDR service that improves security posture and provides the best experience for their SMB customers. SOAR accelerates response actions to stop adversaries in their tracks at every turn, ensuring that MSPs can swiftly detect and respond to threats before they inflict damage. With SOAR at the core, MSPs can offer a superior MDR service that adapts to the rapidly changing threat landscape, keeping their customers secure, happy, and confident.

The rising role of cloud-based SIEM in MDR: What MSPs need to know

Feb 11, 2025 | Threat Lab

OpenText recently surveyed 255 MSPs to uncover key trends shaping the future of Managed Detection and Response (MDR). The findings reveal not only what cybersecurity professionals are prioritizing but also how MSPs can better meet the evolving demands of their small and midsize business (SMB) customers.

One key takeaway from the survey: 81% of respondents rated cloud-based SIEM (security information and event management) as important to include in their MDR solution.

Why is cloud-based SIEM such a big deal for an MDR? Because for MSPs delivering MDR services, it’s the backbone that makes scalability, visibility, central and efficient threat management possible.

Cloud-based SIEM is an essential MDR backbone

The modern attack surface is vast. Business customers are spread across hybrid infrastructures with data flowing through endpoints, networks, applications, and the cloud. Cloud-based SIEM-powered MDR services help MSPs stay on top of this complexity by serving as the single source of truth for detecting and responding to threats.

Here’s why it matters:

Seamless data ingestion
Cloud-based SIEMs ingest security telemetry from diverse sources—EDR solutions, applications, cloud infrastructure, network packet data, and more—to deliver a holistic view of a customer’s environment.
In-depth correlation and analysis
By correlating data across borderless infrastructures, SIEM provides security analysts with the context they need to identify, prioritize, and address the most impactful threats.
Scalability and accessibility
As businesses grow, so do their security needs. Cloud-based SIEM scales effortlessly, ensuring an MSP’s MDR services can handle large data volumes without compromising performance. Plus, analysts can access SIEM insights anywhere, anytime.

In short, a cloud-based SIEM ensures that no corner of the customer’s attack surface is left unseen—from endpoint to cloud. It provides comprehensive visibility, continuously collecting, correlating and analyzing data from every layer of the IT environment. This means the MDR service can detect threats wherever they may arise, whether on-premises, in the cloud, or across hybrid infrastructures, giving MSPs the ability to respond quickly and effectively to any potential risk.

How SIEM drives faster MDR outcomes

Cyberattacks move fast. MSPs delivering MDR services need tools and processes that can keep pace with today’s threats. A cloud-based SIEM is the essential technology that enables the MDR service to deliver rapid detection, triage and investigation. Here’s how SIEM supports faster outcomes across every stage:

Rapid detection: A cloud-based SIEM continuously ingests and correlates syslog data from all sources, reducing the time it takes to identify a threat after it emerges.
Time to triage: By consolidating telemetry into a centralized platform, SIEM enables security analysts to quickly assess and prioritize incidents—cutting through the noise to focus on the most critical threats.
Accelerated investigation: SIEM by leveraging threat intel provides the context analysts need to understand a threat, pinpoint its origin, and determine its potential impact—all without needing to manually stitch together insights.

Expert-led, SIEM-enabled

When MSPs choose an MDR partner solution with a cloud-based SIEM at its core, they unlock more than just a sophisticated tool. They gain the advantage of expert-led security teams that can leverage the full potential of the SIEM platform to deliver rapid, precise, and continuous threat detection.

The survey results highlight that MSPs see the distinct advantage of running an MDR service with a cloud-based SIEM, which enhances their ability to run a 24/7/365 security operations center (SOC). With SIEM as the central hub, security experts can quickly surface suspicious activity, centrally manage investigations and take swift action.

The value of expert-led, SIEM-enabled MDR becomes even clearer when you consider the following benefits:

Round-the-clock SOC with seamless investigations
The ability to monitor and respond to threats 24/7X365 is critical for an MDR service. By consolidating threat data into a centralized cloud SIEM, experts can detect malicious activity at any time of day or night. This continuous monitoring reduces the risk of attackers moving undetected, ensuring that threats are neutralized before they can cause harm.
Single, integrated tool for investigation
The MDR survey results highlight the value MSPs place on having a unified toolset for threat detection and investigation. A cloud-based SIEM with threat intel provides this central hub, enabling security teams to efficiently assess the scope of incidents, prioritize based on severity, and track the attack’s progress in real-time. The SIEM can correlate data across multiple environments—whether it’s endpoint data, network logs, or cloud infrastructure—ensuring nothing slips through the cracks.
Expert insight into threat context
The SIEM doesn’t just provide raw data; it enriches that data with valuable context from threat intel , helping the MDR security experts to identify the root cause of a threat, its potential impact, and the fastest path to resolution.

As cyber threats become more relentless and attack surfaces continue to expand, MSPs are in a unique position to help SMBs stay secure. OpenText’s MDR survey results highlight what’s clear: a cloud-based SIEM as part of an MSP’s MDR solution is a priority set up. It allows MSPs to deliver consistent, effective threat detection and response.

By combining the right technology with the right expertise, MSPs can navigate the complexity of today’s cybersecurity landscape and give their customers the confidence to focus on what matters most: growing their business.

Protect those you love from internet scams this Valentine’s Day

Feb 10, 2025 | Threat Lab

February is a great month to refresh your cyber awareness skills. February 11 marks Safer Internet Day, encouraging us to work together to make the internet a safer and better place. It’s the perfect time to learn more about cybersecurity risks and best practices for protecting yourself and your loved ones online.

And while February 14 usually means love is in the air, Valentine’s Day is also a popular day with internet scammers. In 2024, romance scams alone led to losses tallied to $3.8 billion according to the Nasdaq 2024 Global Financial Crime Report. Don’t be wooed by too-good-to-be-true offers, online dating scams, and fraudulent websites. Stay informed about common scams and take action to stay safe.

Common Valentine’s Day scams

Online dating scams
AI-powered phishing scams are on the rise, impersonating popular online dating platforms. Scammers send fake match emails with malicious links, pretending to be from legitimate dating websites.
📌 Tip: Look for misspellings in the dating website name or web address and check the “from field” to make sure it’s a real address.

Trust your instincts
If something feels off—like a relationship escalating too quickly or seeming too perfect—listen to your gut.
📌 Tip: Scammers often use rapid declarations of love to emotionally manipulate their victims.

Be cautious with platform switching
Think twice before moving a conversation off a dating app to a less secure platform.
📌 Tip: Scammers often push for this to avoid detection.

Phony gift and delivery services
Scammers often lure victims with heavily discounted flowers, gifts, or even romantic getaway deals on unknown websites. These fraudsters go to great lengths to create the appearance of being legitimate florist, gift basket retailer, or travel agent, setting up websites, placing ads on social media, and sending emails. You go to the website enter your information and credit card details only to receive nothing or something that is not what you ordered.
📌 Tip: Always verify websites by checking for HTTPS in the URL and reading online reviews before making a purchase.

E-card and gift card scams
While digital greeting cards and gift cards are a convenient way to spread love, they’re also a common tool for cybercriminals. Scammers send fake e-cards that contain malware or gift card phishing emails asking you to redeem them on fraudulent websites.
📌 Tip: Never open e-cards from unknown senders, and never purchase gift cards as payment for someone you haven’t met in person.

How to protect your heart, computer, and wallet from these scams

Do your research
Before opening email or clicking links make sure they are being sent to you by a reputable brand. Webroot Secure VPN + AntiVirus offer real-time protection for your connection and devices while you are browsing the internet.

Be cautious sharing personal information
Don’t share sensitive information like credit card details or home address with any website or person unless you are confident in their identity. Consider investing in identity protection security solutions that will monitor the web for unauthorized usage and credit report monitoring, such as Webroot Premium.

Secure your devices and backup your data
Ensure your devices have the latest security updates installed. Use Carbonite’s secure, automatic computer backup solution to protect important files from cyber threats.

Strengthen your passwords and use two-factor authentication
Make sure to use complex and unique passwords, incorporating letters, numbers and symbols. Consider enabling multi-factor authentication (MFA) for extra security—this helps verify your identity with a second step, like a text or email code. Solutions such as Webroot Premium and Webroot AntiVirus include passwords managers to making it easier to remember all your passwords.

Use an all-in-one device, privacy, and protection solution
For complete device, privacy, and identity protection, consider a solution like Webroot Premium and get the best of all worlds –threat detection, password manager, dark web monitoring, and real-time virus protection.

Let’s stay cyber resilient this February and keep Valentine’s Day scam-free! 💙

Looking for more information and solutions?

Passkeys: The future of secure and seamless authentication

Feb 5, 2025 | Threat Lab

What are passkeys?

You may have seen the term “passkeys” appearing more frequently in tech news, app updates, and security discussions. Major companies like Apple, Google, and Microsoft are rolling out passkeys as a replacement for passwords, promising both enhanced security and a smoother user experience. But what exactly are passkeys, and why are they considered the future of authentication?

With Password Day coming up this Saturday, it’s the perfect time to discuss the future of authentication. Passwords have long been the foundation of online security, but they come with significant downsides: they can be stolen, guessed, or reused across multiple sites. Enter passkeys, a next-generation authentication technology designed to replace passwords entirely with a more secure and user-friendly alternative.

Passkeys leverage public-key cryptography to authenticate users without requiring them to remember or type in a password. Instead, passkeys are stored on a trusted device (like your phone, laptop, or tablet) and are accessed using biometrics (Face ID, fingerprint), a PIN, or other device authentication methods. This means no more passwords to remember, reset, or leak in data breaches.

Check out our recent webinar where we discuss passkeys

How do passkeys work?

Passkeys function using a public and private key pair:

The public key is stored on the website or service you’re signing into.
The private key stays securely on your device and is never shared.

When you log in, the website asks your device to prove that it holds the correct private key. Your device then uses biometric authentication (like Face ID or a fingerprint) to confirm your identity, and the cryptographic exchange verifies you without transmitting a password over the internet. This makes passkeys resistant to phishing, credential stuffing, and brute-force attacks.

Illustration: Google Ask a Techspert

Pros of passkeys

1. Enhanced security

No passwords mean no risk of phishing attacks, password leaks, or brute-force attacks.
Passkeys are unique for every website, preventing credential reuse across multiple accounts.
Resistant to man-in-the-middle (MitM) attacks because private keys are never shared.

2. Seamless user experience

No need to remember or type passwords—simply authenticate with Face ID, a fingerprint, or a PIN.
Logging in is faster and easier, especially on mobile devices.
Syncs automatically across devices when backed up in Apple iCloud Keychain, Google Password Manager, or Microsoft Account.

3. Built-in multifactor authentication (MFA)

Traditional MFA often requires entering a one-time passcode (OTP), which can be intercepted.
Passkeys combine possession (your device) and biometric authentication, making them more secure than passwords + SMS codes.

4. No centralized password database to hack

Unlike traditional login systems that store passwords in a database (which hackers can breach), passkeys store only public keys on websites, reducing the risk of massive data breaches.

5. Reduced risk of social engineering

Attackers can’t trick users into revealing passkeys like they do with passwords.
Since passkeys are bound to specific websites, even if a hacker creates a fake login page, they won’t be able to use the stolen passkey elsewhere.

Cons of passkeys

1. Device dependency

Passkeys are tied to your device, meaning if you lose access to your phone or laptop, you could have trouble logging in.
Solution: Enable cloud backups through iCloud Keychain (Apple), Google Password Manager (Android/Chrome), or Microsoft Account.

2. Not all websites support passkeys yet

While adoption is growing, not every website or service currently supports passkeys.
Workaround: You may still need to use passwords for some sites while passkey adoption expands.

3. Migration challenges

Users switching between ecosystems (Apple to Android or vice versa) may need to manually transfer passkeys.
Solution: Some platforms allow exporting and importing passkeys, but it’s not always seamless.

4. Learning curve for some users

Users unfamiliar with biometrics, password managers, or cryptographic authentication might find passkeys confusing at first.
Solution: Tech companies are working on better onboarding experiences to help ease the transition.Users unfamiliar with biometrics, password managers, or cryptographic authentication might find passkeys confusing at first.
Solution: Tech companies are working on better onboarding experiences to help ease the transition.

What happens if you lose your phone?

Losing your device when using passkeys can be a concern, but here’s how to handle it:

1. Use a backup device

If you’ve set up passkeys on multiple devices (e.g., phone, tablet, laptop), you can log in using another device.

2. Restore from cloud backup

Apple, Google, and Microsoft automatically sync passkeys across devices using their respective cloud services.
When setting up a new phone, simply log into your cloud account to restore access.

3. Account recovery options

Many services still offer fallback authentication methods, such as email recovery, SMS codes, or backup keys.
Some sites allow you to generate a recovery passkey during setup—store this in a safe place!

4. Remote device management

If your phone is lost or stolen, use Find My Device (Apple, Google) to remotely wipe or lock it to prevent unauthorized access.

Why you should consider switching to passkeys

Stronger security than passwords—no phishing, leaks, or brute-force attacks.
Faster logins—just use your fingerprint or face instead of typing passwords.
No password resets—forget the frustration of forgetting your credentials.
Growing adoption—major companies like Apple, Google, Microsoft, and banks are pushing for passkey implementation.

Passkeys represent a significant shift in authentication, making online accounts more secure and easier to use. While challenges like device loss and adoption gaps still exist, the benefits far outweigh the drawbacks.

If you haven’t tried passkeys yet, consider setting them up on a supported website. As more services move toward this passwordless future, early adopters will enjoy enhanced security and convenience while leaving the hassles of passwords behind.

OpenText Secure Cloud: Streamline workflows with integrations

Feb 5, 2025 | Threat Lab

Simplifying security management is an important step toward better protection without sacrificing operational efficiency. With the added capability of automating processes by integrating with popular tools, security management can also deliver streamlined workflows.

OpenText™ Secure Cloud provides billing reconciliation by integrating with popular tools such as HaloPSA, ConnectWise PSA, AutoTask, and Kaseya BMS so you can automate many of the processes that would typically require manual input. These integrations help boost efficiency and reduce human error.

HaloPSA integration delivers:

Automatic invoice retrieval—The platform retrieves the monthly invoice from AppRiver, listing all recurring services purchased during the previous period.

Effortless invoice comparison—At the touch of a button, you can compare and update any differences directly within HaloPSA.

Simple setup—Link customers, recurring invoices, and products once and the system will remember your settings for next time.

ConnectWise PSA integration delivers:

Seamless invoice management—Similar to HaloPSA, the AppRiver invoice is automatically loaded into the platform, saving you time and effort.

Easy linking—The first time you use the integration you can link companies, agreements, and products, ensuring that future invoice retrieval is smooth and fast.

Customizable—If any agreements or products are missing in ConnectWise you can add them directly from within the platform.

AutoTask integration delivers:

Efficient invoice updates—The integration allows you to load and check AppRiver invoices quickly.

One-time setup—Link your customers, contracts, and services once and the system will remember your settings for next time.

Quick additions—If a contract or service is missing, it’s easy to create it within the platform, reducing downtime.

Kaseya BMS integration delivers:

Invoice and contract validation—AppRiver invoices are automatically retrieved and validated against your Kaseya BMS contracts, offering updates where needed.

Efficiency—If service quantities don’t match, you can update them directly within the system.

Simple linking—Set up by linking customers, contracts, and services once and future updates will be swift and hassle-free.

These integrations with OpenText Secure Cloud help you manage recurring services, validate invoices, and update your systems effortlessly. They save you time, reduce errors, and enable a smoother, more connected workflow across multiple platforms.

To learn more, get in touch with us here.