SecurityMetrics

Name: SecurityMetrics
Address: 1275 W. 1600 N, Lindon, UT, 84057, US
Telephone: (801) 724-9600
Price range: $$

Home
United States
Lindon, UT
SecurityMetrics

SecurityMetrics is a global leader in data security and compliance. Learn more about us here-->>http://bit.ly/UEOgL

SecurityMetrics is a global leader in data security that enables businesses of all sizes to comply with government, healthcare, and financial mandates. Since its founding date, the company has helped over 1 million organizations worldwide protect their network infrastructure and data communications from compromise. Among other services, SecurityMetrics offers PCI and HIPAA compliance services, pe*******on testing, security consulting, payment data discovery, and incident response. Founded in October 2000, SecurityMetrics is a privately held corporation headquartered in Orem, Utah.

10/30/2026

How do attackers go after an iFrame? Because an iframe is a window embedded in your page, attackers try to either cover the window or intercept what's typed into it:

- The pixel-perfect overlay: Malicious JavaScript detects the checkout page and draws an invisible layer directly on top of the real iframe. The customer thinks they're typing into your processor's secure form. They're actually typing into the attacker's layer sitting one pixel above it.

-The proxy attack: A more advanced move where the attacker rewrites your site's code so the iframe loads from a look-alike domain (say, "Stripe-Global-Security.com") instead of the real processor. The fake page captures the data, then quietly hands the customer back to the real checkout so nothing looks wrong.

- The double-entry trick: A fake "Error: please re-enter your card details" message appears. The first entry goes to the thief. The second goes to the real form and customers assume it was a glitch.

https://www.securitymetrics.com/blog/redirects-and-iframes-are-being-hacked-how-does-this-impact-saq-a

10/28/2026

Using a plug-in for coupons is incredibly common on e-commerce sites, but it can also be a common weakness that threat actors exploit.

10/26/2026

Not sure where to start with your Incident Response Plan?
An incident response plan should address a suspected data breach in a series of phases. The incident response phases are:

- Prepare: Establish policies, assign roles, and stock the tools and contacts (legal, forensic, PR) you'll need before an incident, not during one.
- Identify: Detect and confirm that an incident has actually occurred, and determine its initial scope.
- Contain: Limit the damage by isolating affected systems without destroying evidence.
- Eradicate: Remove the root cause, whether that's malware, an exposed credential, or an unpatched vulnerability.
- Recover: Restore systems and operations carefully, and confirm the threat is gone.
- Review: Conduct a post-incident review to capture lessons learned and update your plan and controls.

Test your plan with tabletop exercises at least annually, and after any significant change to your environment (new vendors, new payment channels, cloud migrations). A plan that's never been rehearsed tends to fall apart under real pressure. The middle of a breach is the worst time to discover your IRP doesn’t work.

Learn more:
https://www.securitymetrics.com/blog/forensic-faqs-yz754

10/22/2026

Keep an eye out for these five weaknesses on your e-commerce website!

10/21/2026

We're at the PCI SSC Europe Community Meeting! Visit booth 33 and talk to a member of the Cyber Assessment Team (CAT) for an inside scoop on:

- Preparing for a smoother PCI DSS audit
- Understanding e-commerce threats to your business
- Making the most out of your next Pe*******on Test

While you’re there, grab a t-shirt of your choosing! We have many fun designs in various sizes and colors.

10/05/2026

Catch the threats with SecurityMetrics from October 20-22 at the PCI SSC Europe Community Meeting. Go to booth 33 and talk to a member of the Cyber Assessment Team (CAT) for an inside scoop on:

- Preparing for a smoother PCI DSS audit
- Understanding e-commerce threats to your business
- Making the most out of your next Pe*******on Test

While you’re there, grab a t-shirt of your choosing! We have many fun designs in various sizes and colors.

https://calendly.com/securitymetrics/pci-ssc-europe-meeting

09/30/2026

With healthcare attacks and breaches on the rise, it's more important than ever to train yourself and your employee with the latest HIPAA knowledge.

We've compiled a list of our top five blog resources to help:
https://www.securitymetrics.com/blog/top-5-hipaa-resources-on-the-securitymetrics-blog

09/28/2026

What Agent-Based Solutions Get Wrong:

Many client-side security tools rely on browser agents or code embedded in the page itself to detect tampering.

The problem is that a full-redirect checkout, by design, sends the customer away from your site entirely.

An agent sitting on your webpage has nothing to monitor once the customer has left your domain for the processor's domain. This is exactly the blind spot that attackers exploit with link swaps and “man-in-the-middle” redirects.

Shopping Cart Monitor takes a different approach. It's an agentless solution so it doesn't require installing code on your site to function.

Instead, it monitors your checkout flow from the outside, which means it can catch redirect-based tampering (such as a hijacked "Pay Now" link that sends customers to a spoofed domain) that agent-based tools are structurally unable to detect, as well as iframe-based threats like overlays and proxy attacks.

Read more:
https://www.securitymetrics.com/blog/redirects-and-iframes-are-being-hacked-how-does-this-impact-saq-a

09/25/2026

To help you prioritize your security, here are common mistakes that small business owners make and how to fix them.

[Cybersecurity Mistake #1: Assuming you won’t get hacked]
Small businesses are a prime target for hackers because they often lack adequate security. The Verizon Data Breach Investigations Report showed that nearly 43% of cyberattacks are on small businesses. This is dangerous for small businesses because most of them do not have the resources to survive a security breach. IBM’s Cost of a Data Breach Report shows the average impact of a data breach on organizations with fewer than 500 employees is $3.31 million.

Instead of ignoring the threats to your business, be proactive in your security so that you reduce your risk of getting hacked.

[Cybersecurity Mistake #2: Neglecting Employee Training]
To date, employee error is still the largest threat to businesses with 95% of cybersecurity issues traced to human error. Social engineering tactics have continued to expand to over 10+ types of social engineering tactics and techniques including vishing, SMS phishing, and whaling.

Training your employees on password hygiene, social engineering, data protection, and other security topics is not only part of being compliant with the PCI DSS (Payment Card Industry Data Security Standard), but can significantly lower your risk of experiencing a data breach.

To learn about the five other common mistakes, read more:
https://www.securitymetrics.com/blog/the-7-most-common-mistakes-in-small-business-security

09/23/2026

How does a forensic investigation work?

These are the typical actions a forensic investigator would take:

(Step One: Preliminary Research) Forensic investigations begin with some research on the company. The PFI needs to "scope" the merchant's environment, identifying where critical data resides, the systems that connect to it, and how data flows in and out of the network.

(Step Two: Onsite Data Gathering) The forensics team then goes onsite and gathers data from identified devices.

(Step Three: Analysis) The investigation team brings the data back to headquarters and analyzes it thoroughly to confirm whether a data breach occurred, determine what data the attacker stole, and identify which vulnerabilities were exploited.

(Step Four: Report) About a week after the initial data acquisition, the investigator will issue a short preliminary report showing whether they've found any indicators of compromise or other overt evidence of a data compromise. After fully analyzing the forensic data, the investigator will submit a complete final report that explains how the attack happened, which vulnerabilities were exploited, and what data was at risk.

Read more common questions about forensic investigations here: https://www.securitymetrics.com/blog/forensic-faqs-yz754

Address

1275 W. 1600 N
Lindon, UT
84057

Telephone

(801) 724-9600

Website

https://www.securitymetrics.com/contact

Alerts

Be the first to know and let us send you an email when SecurityMetrics posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.