22/04/2026
Seeing a lot of cybersecurity checklists from IT companies lately. Great lists, from great companies. But I think they're missing a few things that matter just as much.
Here's the ones I think matter most right now.
AI Security
We all love AI. But the speed at which businesses are giving AI tools access to sensitive systems without thinking about it is concerning.
Vibe coding with tools like Claude Code or running agents like OpenClaw? Use .env files and lock down your GitHub repos. The number of exposed API keys on public repos right now is staggering. One key is all someone needs.
These tools run locally but send everything to the cloud for processing. The app is local. The compute is not. Agents like OpenClaw can access your files, browser, email, and shell. Cisco already caught a third-party OpenClaw skill performing data exfiltration and prompt injection without the user knowing.
Sandboxing, API permissions, security groups. No controls on what your AI tools can access means you're handing out your business data for free.
MFA on Office 365
If you only do one thing on this list, do this one. Passwords get compromised. MFA means they still can't get in. No excuse in 2026.
Separate Admin Accounts
If your daily email account is also a Global Admin and it gets compromised, they own everything. Simple fix. So many businesses get it wrong.
EDR, Not Antivirus
Traditional antivirus isn't enough. EDR monitors for suspicious behaviour and isolates the device before malware spreads across your network. The difference between catching it early and finding out three months later.
Train Your People
All the tech in the world doesn't matter if someone clicks a dodgy link on a Tuesday morning. Quarterly phishing sims and a short training module make a real difference. No filter catches everything. Your people are your last line of defence.
Get Off Windows 10
Support ended October 2025. No more patches. ESU exists but starts around $105 AUD per device year one and pretty much doubles each year after. Three years max. It's a bridge, not a long term plan.
Back Up SharePoint and OneDrive
Device dies or gets hit with ransomware and those files are gone. Most businesses also store shared files in SharePoint or Teams. If someone deletes, modifies or encrypts them, you need to roll back. Proper third party backup is not optional.
Firewalls and Logs
You need proper firewall hardware. Not the box your ISP gave you.
Logs, you need logs, and ontop of that If nobody's reviewing them, you have zero idea what's happening in your environment. You could have someone sitting in your network right now and you wouldn't know. You can't protect what you can't see.
None of this is complicated. None of it is expensive. But most businesses aren't doing even half of it.
If you looked at this list and thought "yeah we should probably sort that out"... you probably should.
