What is changing, what it means for your people, and what to do about it. Written in plain English for Kansas City nonprofits, churches, and small businesses.
A client of ours was asked by one of their partners to fill in a security questionnaire. One question asked whether they had a documented disaster recovery plan, with a named owner, tested every year. They did not, and neither do most organisations their size. Here is what those forms ask, and the answer that works better than pretending.
Read itWe looked at one office's Microsoft 365 account and found twenty-eight paid licences against eleven computers. Some of that was legitimate. Some of it was people who had left. Nobody had done anything wrong, and nobody was going to notice, because Microsoft does not send you a note when you are paying for the wrong thing. Nonprofits: the free Business Premium grant ended in July 2025.
Read itA critical flaw in ConnectWise ScreenConnect lets an attacker push files onto a computer and run them through a remote session nobody authorized, and a self-spreading campaign is already using it. The catch is that the fix lives on each computer, not on a server somewhere. Here is what we found when we checked every machine we manage, and what to do about yours.
Read itWhen an attacker gets into a mailbox, the first thing they do is usually not send anything. They create an inbox rule. Here is why that small, quiet change is the tell, what it is for, and why one showing up at 10:28 on a Monday night is worth more attention than most alerts you will ever get.
Read itThe six-digit code Microsoft texts your staff when they log in is being retired. The first change lands September 1st, about two weeks out, and the hard cutoff follows in early 2027. Here is what actually happens to your people, and what to do before it happens to them.
Read it