#security

A practical path to require multifactor authentication in Microsoft 365 for a small business, without locking everyone out on Friday afternoon.

July 17, 20265 min read

Hugging Face's July 2026 incident: agentic attackers and defender blind spots

Hugging Face disclosed an AI-driven intrusion through its dataset pipeline. Lessons on hosted model guardrails, local forensics, and treating data processing as attack surface.

July 17, 20262 min read

What “good enough” endpoint security looks like for an SMB

A realistic endpoint baseline for small businesses: patching, MFA, EDR, backups, and least privilege, without pretending you need a Fortune 500 stack.

July 17, 20264 min read

WordPress Core CVE-2026-63030: patch 7.0.1 and older branches now

Critical unauthenticated RCE (wp2shell) hits WordPress 7.0.0–7.0.1 and 6.9.0–6.9.4. What the CVEs mean, which versions are fixed, and what SMBs should do today.

July 16, 20266 min read

OpenAI GPT-Red and what prompt injection means for your Copilot rollout

By Michael Narehood AI & ML

OpenAI's internal GPT-Red red-teaming model shows how automated prompt injection testing scales. Practical steps for businesses deploying Copilot, agents, and AI connectors.

July 15, 20265 min read

July 2026 Patch Tuesday: when AI discovery floods the CVE queue

Microsoft's record July 2026 release reflects AI-assisted vulnerability discovery. What MSPs and SMBs should change in triage without freezing from volume anxiety.

July 8, 20261 min read

Passkeys for business admins

Why phishing-resistant MFA belongs on privileged accounts first, and how to start small.

July 6, 20261 min readTutorial

Inventory your public websites before the next CVE

You cannot patch what you forgot existed. A quick method to find shadow WordPress and forgotten subdomains.

July 3, 20261 min read

How we triage critical CVEs for clients

A look at Qutzl’s patch priority process when a core product vulnerability hits the news.

July 1, 20261 min read

July security hygiene before vacation season

Out-of-office season is when delayed patching and standing admin rights get expensive. A pre-travel checklist.

June 29, 20261 min read

Web form spam and fake leads

Bot leads waste sales time and can hide phishing callbacks.

June 26, 20261 min read

Client data on personal phones

BYOD mail and Teams are convenient. Containerization and remote wipe need to be real.

June 24, 20261 min read

Firewall rule reviews that find surprises

Any-any rules and forgotten NAT entries accumulate. Schedule the cleanup.

June 22, 20261 min read

SaaS admin account hygiene

Separate admin identities and turn off unused seats before attackers find them.

June 19, 20261 min readTutorial

Incident first-hour checklist

What to do in the first sixty minutes of a suspected breach.

June 17, 20261 min read

Power Automate and OAuth app sprawl

By Michael Narehood Backups & Continuity

Citizen automation is great until a forgotten flow holds privileged consent.

June 15, 20261 min readTutorial

Tabletop incident exercise for five people

A one-hour script to practice ransomware or BEC response without breaking production.

June 10, 20261 min read

Detecting unusual sign-ins in Microsoft 365

Impossible travel, new countries, and legacy protocol spikes: signals worth a human look.

June 5, 20261 min read

Voicemail and Teams phone security basics

Toll fraud and voicemail hacks still happen. A short hardening list for modern phone systems.

June 3, 20261 min read

Website care: updates, plugins, and PHP versions

How small business sites get owned, and a maintenance rhythm that prevents most of it.

June 1, 20261 min read

Summer interns and joiner access done safely

Temporary staff need tools on day one, not permanent Global Admin on day ninety.

May 29, 20261 min readTutorial

Decommissioning old servers safely

Powering off is not decommissioning. Data remnants and DNS ghosts linger.

May 25, 20261 min read

Teams external access settings worth reviewing

Federation and guest access are powerful, and easy to leave too open.

May 22, 20261 min read

USB and removable media policy

Block-all vs allow-with-logging: picking a control that matches your risk.

May 18, 20261 min read

Microsoft Secure Score: what to prioritize (and ignore)

Secure Score is a guide, not a grade. Which recommendations move risk for small tenants.

May 13, 20261 min read

Calendar permissions: the oversharing nobody notices

Open calendars leak meetings, clients, and travel plans. Tighten defaults without killing scheduling.

May 8, 20261 min read

Printers on the network are still computers

Default passwords, ancient firmware, and flat VLANs turn MFPs into quiet pivot points.

May 6, 20261 min read

Secure remote support: what to expect from a good session

How remote assistance should work when you care about consent, audit trails, and least privilege.

May 4, 20261 min read

Endpoint detection vs antivirus: what SMBs actually need

Signature AV alone is not enough. How EDR changes outcomes without requiring a SOC theater budget.

April 27, 20261 min read

Time to rotate service account passwords

Service accounts with never-expiring passwords become permanent backdoors.

April 24, 20261 min read

Browser extension risk at work

Helpful toolbars are supply-chain risk. How to set a sane policy.

April 22, 20265 min read

Project Glasswing and the patch queue your business will feel anyway

Anthropic's April 2026 Project Glasswing put Claude Mythos Preview to work finding critical flaws with major vendors. What that means for downstream patching at ordinary SMBs.

April 22, 20261 min read

Wi‑Fi password rotation myths

Rotating the PSK every week is not a strategy. Segmentation and enterprise auth are.

April 20, 20261 min read

IoT cameras and NVRs on your LAN

Default passwords and UPnP still ship with many “security” cameras. Segment them before they segment you.

April 17, 20261 min read

Separating Wi‑Fi for POS and office

By Michael Narehood Backups & Continuity

Payment devices and office laptops should not share a flat network. A practical segmentation sketch.

April 13, 20261 min read

Cyber insurance questions before renewal

MFA, EDR, and backup proof: what underwriters ask and how to answer without scrambling.

April 10, 20261 min readTutorial

Vendor access offboarding checklist

Contractors and MSPs change. Make sure their VPN, admin, and SaaS access changes with them.

April 6, 20261 min read

Wi‑Fi guest networks done right

By Michael Narehood Backups & Continuity

Separate guests from production without making the lobby password a company secret.

April 3, 20261 min readTutorial

Ransomware-ready in ninety minutes

A focused working session to improve your odds before an incident, not a multi-month maturity model.

April 1, 20261 min read

Spring cleaning for Active Directory and Entra ID

Disable stale accounts, reclaim licenses, and shrink attack surface before summer projects start.

March 30, 20261 min read

VPN split tunneling tradeoffs

Full tunnel vs split tunnel is a security and performance comparison. Make it on purpose.

March 27, 20261 min read

Patching NAS devices

NAS firmware holes are quiet until ransomware finds the share.

March 25, 20261 min read

Malware, macros, and Office defaults

Block macros from the internet. Your 2014 workflow may need a redesign.

March 23, 20261 min read

Offboarding: same-day access cut

Why delayed disablement is a predictable incident.

March 16, 20261 min readTutorial

Quarterly access reviews without the enterprise bloat

A two-hour quarterly ritual that catches privilege creep before an audit or an attacker does.

March 13, 20261 min read

Secure document sharing with clients

Move past email attachments for sensitive files without making clients jump through hoops.

March 11, 20261 min read

When to replace that aging firewall

End-of-support appliances quietly become unpatchable internet doors. How to plan a refresh without drama.

March 9, 20261 min readTutorial

DNS and email authentication: SPF, DKIM, and DMARC

A plain-language tour of the three records that decide whether your mail looks legitimate.

March 6, 20261 min read

Microsoft 365 external sharing defaults that save headaches

SharePoint and OneDrive sharing settings that balance client collaboration with least privilege.

March 4, 20261 min read

Business email compromise: red flags worth a phone call

The phrases and patterns that should trigger a pause before anyone moves money.

March 2, 20261 min read

Tax season: protect the files accountants touch

CPAs and bookkeepers become high-value targets each spring. Harden the paths to returns and source docs.

February 27, 20261 min read

Legacy TLS and payment tools

Old TLS versions linger in niche payment and LOB software. Plan the break.

February 18, 20261 min read

Shadow IT and SaaS sprawl

Credit-card SaaS purchases create data and identity debt. How to see it without becoming the department of no.

February 16, 20261 min read

Line-of-business apps and unsupported Windows

When one ancient app pins you to an old OS, and exit ramps that are less painful than denial.

February 13, 20261 min read

Why SMS MFA is a stopgap

SIM swaps and SS7 abuse make text-message codes weaker than app-based or FIDO MFA.

February 11, 20261 min readTutorial

Laptop encryption checklist

BitLocker and FileVault basics so a stolen laptop is an inconvenience, not a breach notification.

February 9, 20261 min read

VPN vs zero trust for small firms

When a classic VPN is enough, when it becomes a liability, and what “zero trust” means without the buzzwords.

February 6, 20261 min read

Phishing simulations without shaming people

How to run awareness tests that improve reporting rates instead of breeding resentment.

February 2, 20261 min read

Why local admin rights still matter

Ransomware and commodity malware love over-privileged users. How to shrink admin without breaking work.

January 30, 20261 min read

Password managers for teams under twenty

A practical way to kill shared spreadsheets without enterprise IAM theater.

January 23, 20261 min read

MFA fatigue and how to stop push bombing

Attackers spam approve prompts until someone taps Yes. How number matching and better MFA choices help.

January 21, 20261 min read

New-year security habits that actually stick

Skip the resolutions theater. Five security habits SMBs can keep through February and beyond.

August 20, 20255 min read

Chrome zero-day patch habits for small offices

Emergency browser updates do not wait for Patch Tuesday. How SMBs should force Chrome updates, control extensions, and close the relaunch gap before attackers do.

November 2, 20242 min read

Windows Server 2025 Released

Microsoft’s Windows Server 2025 LTSC release brings hotpatching, stronger Active Directory and SMB security, hybrid cloud options, and a 180-day evaluation download.

October 3, 20241 min read

Apple Releases iOS 18.0.1

By Michael Narehood Apple

iOS 18.0.1 fixes iPhone 16 touchscreen and camera issues, Messages crashes, performance problems, and important security bugs in Messages and Passwords.

September 20, 20244 min read

macOS Sequoia for business Mac fleets

By Michael Narehood Apple

macOS 15 is GA with iPhone Mirroring, a Passwords app, and continuity changes IT should pilot before a broad upgrade.

September 12, 20243 min read

5 Must-Have Plugins for Every WordPress Installation