{"id":119140,"date":"2025-02-19T16:29:53","date_gmt":"2025-02-19T14:29:53","guid":{"rendered":"https:\/\/www.catonetworks.com\/blog\/highlights-aus-dem-cato-ctrl-sase-threat-report-fur-q3-2024\/"},"modified":"2026-08-31T10:17:15","modified_gmt":"2026-08-31T07:17:15","slug":"highlights-from-q3-2024-cato-ctrl-sase-threat-report","status":"publish","type":"post","link":"https:\/\/www.catonetworks.com\/de\/blog\/highlights-from-q3-2024-cato-ctrl-sase-threat-report\/","title":{"rendered":"Highlights aus dem Cato CTRL SASE Threat Report f\u00fcr Q3 2024\u00a0"},"content":{"rendered":"\n

Introduction\u00a0<\/strong>\u00a0<\/h2>\n\n

Today, we published the Q3 2024 Cato CTRL SASE Threat Report<\/a>, which summarizes findings from Cato CTRL\u2019s analysis of 1.46 trillion network flows across more than 2,500 customers globally between July and September 2024.\u00a0\u00a0<\/p>\n\n

Key Findings<\/strong>\u00a0<\/h2>\n\n

Threat actors recruiting pen testers for ransomware affiliate programs\u00a0<\/strong>\u00a0<\/h3>\n\n

In closely monitoring discussions on the RAMP forum, Cato CTRL has observed threat actors seeking pen testers to join various ransomware affiliate programs including Apos, Lynx and Rabbit Hole.\u00a0\u00a0\u00a0<\/p>\n\n

Any good developer knows that software needs to be tested before deploying in production environments. This is also true for ransomware gangs. They want to ensure that their ransomware can be deployed successfully against organizations.\u00a0\u00a0\u00a0<\/p>\n\n

Shadow AI lurks in the background for organizations\u00a0<\/strong>\u00a0<\/h3>\n\n

Shadow AI refers to the unauthorized or unsanctioned use of AI applications and tools within an organization without the knowledge or approval of IT departments or security teams. This phenomenon typically involves employees or departments adopting AI solutions independently and bypassing formal vetting processes and governance controls.\u00a0\u00a0<\/p>\n\n

Out of the hundreds of AI applications that Cato CTRL monitors, Cato CTRL tracked 10 AI applications used by organizations (Bodygram, Craiyon, Otter.ai, Writesonic, Poe, HIX.AI, Fireflies.ai, PeekYou, Character.AI and Luma AI) and observed various security risks. The top concern is data privacy.\u00a0\u00a0\u00a0<\/p>\n\nQ3 2024 Cato CTRL SASE Threat Report | Download the report <\/span><\/a>\n\n

TLS attack attempts reveal TLS inspection not utilized enough<\/strong>\u00a0<\/h3>\n\n

TLS inspection allows organizations to decrypt, inspect and re-encrypt traffic. However, TLS inspection can break applications and access to some domains. As such, many organizations choose to forgo TLS inspection entirely or bypass inspection for a large portion of their traffic.\u00a0 \u00a0<\/p>\n\n

Cato CTRL found that only 45% of participating organizations enable TLS inspection. Even then, only 3% of organizations inspected all relevant TLS-encrypted sessions. This leaves the door open for threat actors to utilize TLS traffic and remain undetected. Organizations must inspect TLS sessions to protect themselves. In Q3 2024, Cato CTRL found that 60% of attempts to exploit CVEs were blocked in TLS traffic. CVEs included Log4j, SolarWinds and ConnectWise.\u00a0\u00a0 \u00a0<\/p>\n\n

When TLS inspection is enabled, organizations are better protected. In Q3 2024, Cato CTRL found that organizations who enabled TLS inspection blocked 52% more malicious traffic than organizations without TLS inspection.\u00a0<\/p>\n\n

Security Best Practices<\/strong>\u00a0<\/h2>\n\n

Based on our key findings, Cato CTRL recommends that organizations take the following actions:\u00a0<\/p>\n\n