Commstec

31/07/2026

MFA fatigue is one of the most common attacks on small businesses today, and most owners don't know it by name.

The attacker already has the password (bought from a leak or stolen from another site). They log in. The MFA push hits your employee's phone. They tap "Deny." The attacker tries again 10 seconds later. Then again at 2am. Then during lunch. Eventually someone taps "Approve" just to make it stop. The attacker is in.

Uber got hit this way in 2022. Cisco too. It still works on small businesses every week because passwords keep leaking and the push prompt looks identical to a real login.

Three things close the gap, and none of them are expensive. Switch your team from "tap to approve" to number matching, which both Microsoft Authenticator and Duo support out of the box and takes about 10 minutes to enable in your tenant.

Then turn on geo-blocking or impossible-travel rules in your identity platform so logins from countries you don't operate in get blocked before the push ever fires.

Last, give your team one rule: if you get an MFA prompt you didn't ask for, deny it AND report it. The report is what catches the attacker mid-attempt.

The attacker doesn't need a fancy hack. They just need someone tired enough to tap "Approve."

31/07/2026

Your team is using AI right now, whether you have a policy on it or not.

ChatGPT, Gemini, Copilot, Claude, and a dozen niche business tools are in the workflow of someone in your business this week. These tools learn from what you type, sometimes retain it for training, and live outside whatever data security setup you've built for the rest of the business.

Without a written policy, you have no way to know what client data is being pasted into prompts, which business decisions are being made with AI assistance, or how your insurance views any of it if something goes wrong.

An AI Acceptable Use Policy doesn't have to be 30 pages. A one-page version covers the essentials: which tools are approved, what data is forbidden as input, what disclosure rules apply to AI-generated work, and who reviews AI output before it goes to a client.

If you want a full AI Acceptable Use Policy template to implement in your business, comment below with "AI Policy" and we'll send it to you.

30/07/2026

Smishing is text message phishing, and it's now more effective at reaching people than email phishing.

The reason is mechanical. Most businesses spent the last decade hardening their email gateways and training people on suspicious links. Almost nobody applied the same effort to text messages. The result is a channel where employees still tap first and think later.

The patterns repeat: a "delivery failed" message with a link asking for login credentials, a "this is your CEO" text from a number nobody recognizes asking for gift cards or a wire, a fake account-lockout message that looks identical to a real bank alert, and a "hey, I'm in a meeting, can you help me with something quick?" text impersonating a senior person.

These work because texts feel personal in a way email doesn't. They land on the same screen where your spouse, your kids, and your coworkers reach you, which makes the brain default to trusting them. That's the entire attack.

The rules to give your team:

1. No business decision happens over text. That includes wire transfers, vendor changes, payroll changes, gift card requests, and password resets.
2. If a text claims to be from a coworker, verify through a different channel before responding. A 30-second Slack message or phone call kills most of these attacks.
3. Never click a login link inside a text. Open the app or website directly.
4. Forward suspected smishing to 7726 (which spells SPAM on a phone keypad). Carriers use it to block the source.

Smishing works when the response happens before the thinking. Train your team to slow down, and most of these attacks dead-end before the attacker has time to react.

29/07/2026

Microsoft's phishing report for the first quarter of 2026 shows how much phishing has changed in the past year.

In three months:

-8.3 billion phishing threats detected

-QR code phishing up 146% from last year, with a 336% spike in March 2026 alone for QR codes hidden inside emails

-Phishing pages hiding behind CAPTCHA puzzles jumped 125%. CAPTCHAs make the pages look real AND stop security scanners from checking them.

-10.7 million business email compromise attempts in one quarter

Hackers moved from text to images, codes, and CAPTCHAs because text-based filters can't read them. Even an expensive email gateway misses most of this.

If your phishing training still shows examples of misspelled emails from "Nigerian princes," you're teaching your team history, not security.

What to do this month:

-Update your phishing training. If it doesn't include QR code emails and fake CAPTCHA login pages, you're testing 2023 skills against 2026 attacks.

-Tell your team one rule: any QR code that arrives in an email is suspicious. No exceptions.

-Ask your email security vendor what they catch for image and QR phishing. Get the answer in writing.

Train your team for the phishing they'll actually see this year.

Microsoft noted a marked increase in QR-code attacks and CAPTCHA delivery methods.

29/07/2026

Your salesperson stops at a coffee shop between meetings. They set up at a table, open their laptop, order a drink, and walk back to the counter when their name is called. The laptop is unattended for 90 seconds. That's enough time for someone to ruin your business week.

The attacker doesn't need to be sophisticated. A $40 USB device called a "Rubber Ducky" plugs in and looks like a keyboard to the computer. It runs pre-loaded keystrokes faster than any human can type. In 90 seconds it can open a terminal, download a remote access tool, install it, and disable the screen lock notification, all without a click from your salesperson.

When your salesperson comes back to the table, the laptop looks the same as they left it. The next time they connect to your office network, the attacker has a path in.

This kind of attack has been demonstrated at every major security conference for the last 10 years. The hardware is cheaper now than it was then.

The defense is straightforward.

- Set every laptop to lock automatically after 30 seconds of inactivity, and train your team that any unattended laptop gets locked first.
- Disable USB device auto-execute across your fleet. On Windows, that's the "AutoPlay" setting plus USB device blocking in Group Policy or Intune.
- Use endpoint detection and response (EDR) software that flags new processes, persistence mechanisms, and suspicious network connections within seconds of installation.
- For people who travel often, give them USB data blockers (small adapters that allow charging but block data transfer) for airports and coffee shops.

Physical security still matters even though most of your defenses sit in software. Don't let the five steps from your laptop to the counter at the coffee shop be the weakest part.

28/07/2026

On May 19, 2026, Google Cloud's automated abuse-detection system incorrectly suspended Railway, one of its largest customers. The decision took Railway's entire platform offline for eight hours and pulled thousands of small businesses down with it.

Railway is a platform other businesses use to run their applications. Their production environment lives on Google Cloud, where Railway spends more than $10 million a year. That spend didn't matter when an automated system decided the account looked suspicious. The suspension happened instantly. Railway waited about an hour for a human at Google to respond, and the total outage ran around eight hours. For Railway's customers, that meant unreachable apps for a full workday with no warning and no path to escalate.

This matters to your business even if you've never heard of Railway. Your business depends on services you don't control and run on platforms you don't manage. Most of those platforms reserve the right to override their own SLAs when an automated system flags your account or your vendor's account. A cloud provider's automated decision can take you down as fast as a hacker can, and you have less recourse.

The work to do this month is in three pieces. Start with a dependency map. Each SaaS tool your business depends on (QuickBooks, HubSpot, payroll, CRM, file storage) runs on a cloud platform somewhere, and you need to know which.

With that map, identify which workflows have a manual fallback. Can you take orders without your CRM for a day? Can you process payments without your usual processor? The answer might be no, but knowing now is better than discovering it during an outage.

Last, read the SLA for the services you depend on. Most cloud SLAs include carve-outs for "automated abuse detection" and similar events. The recourse, even when the provider is at fault, is usually a service credit on your next bill, not the cost of your lost workday.

Cloud providers fail by accident and by their own systems making wrong calls. Your business should be able to function for at least a workday without any one of them.

This is the service we get when we spend $10m plus? asks automated code deployment outfit

27/07/2026

The ransom is usually the smallest cost of a ransomware attack on a small business.

A 25-person company often takes 3 to 6 weeks to fully recover from one. Most of that cost has nothing to do with the criminals.

What 3 to 6 weeks of downtime actually costs you:

-Payroll. 25 people getting paid for a month or more with almost no productive output. Easily £50K to £100K, depending on your industry.

-Lost revenue. Whatever your business normally pulls in over that window, gone.

-Lost customers. Public breaches drive customer churn, especially in industries built on trust. Different studies put the rate anywhere from 5% to 30% in the year after.

-Outside costs. Incident response firm fees, breach lawyers, notification rules, credit monitoring for affected customers.

-Higher insurance. Cyber premiums often double or triple at your next renewal.

You might pay the ransom once. The downtime bills you for months.

Want a fair estimate of your real exposure? Take your monthly payroll, multiply by 1.5. Add your monthly revenue times 1.5. Add 20% on top for everything else.

That's the kind of number to put in front of your leadership team the next time someone asks why you're spending on security.

27/07/2026

When an employee leaves your business, the security gap is usually bigger than you'd guess.

A typical 25-person business has dozens of cloud accounts per employee.

Email, payroll, file storage, CRM, accounting, internal tools, and third-party SaaS subscriptions.

When the employee leaves, every one of those accounts should be disabled, but in most businesses only the obvious ones (email, computer login) get touched.

The rest sit dormant for months or years, still with the employee's credentials, still accessible if those credentials were ever leaked in a breach.

That's how a fired employee from 18 months ago becomes the entry point for next year's breach.

The fix is a written offboarding checklist that includes every account, not just the obvious ones.

- Day of departure: disable email, computer login, VPN, and any single-sign-on (SSO) accounts that gate everything else.
- Within 48 hours: revoke access on every SaaS tool by checking the actual admin panel of each.
- Within 7 days: change shared credentials the employee knew
- Within 30 days: do a "did we miss anything" review with someone who worked closely with the employee.

Without a checklist, "what did this person have access to?" is impossible to answer in a few months.

26/07/2026

On May 7, 2026, an Amazon Web Services data center overheated and took out an entire availability zone in US-East-1, AWS's most popular region. Several core AWS services went down, and any business application hosted in that zone was unreachable for hours.

Cloud outages happen to every major provider, not just AWS. Azure, Google Cloud, Cloudflare, Microsoft 365, Salesforce, and Slack have all gone down long enough to break a business day in the last three years.

If your business loses meaningful money during downtime, you need a "the cloud is down" plan. The plan has three parts.

A dependency map. Every critical workflow in your business should be mapped to the SaaS or cloud service it depends on. Your accountant uses QuickBooks Online, which runs on AWS. Your sales team uses HubSpot, which also runs on AWS. Your phones might be VoIP, which depends on a carrier you've never named. The map doesn't need to be pretty, but it does need to exist.

An out-of-band communications path. Phone numbers for your key vendors, your insurance broker, your IT provider, and a contact for every team lead. This list lives on paper or on a phone that doesn't depend on your office network. Use the same list from your incident response plan.

A decision tree for what stops and what continues. Some work has to keep happening even when systems are down (taking orders, handling client emergencies). Other work can wait. Pre-decide which is which, so that conversation isn't happening for the first time during an outage.

Test the plan once a year. Turn off access to one major SaaS tool for an afternoon and watch what your team does. Whatever you learn from the dry run is cheaper than learning it for real.

Overheating at a single data center has been identified as the cause of the AWS outage, which impacted customers such as Coinbase

25/07/2026

The quarterly review with your IT provider is one of the most useful meetings on your calendar, but it's easy to let it run on autopilot. Walk in with six real questions and you turn it from a status update into a strategic check-in.

Six to ask at your next review:

1. What changed in our security posture since last quarter? Not "what did you do." What CHANGED. The answer should reference specific risks reduced.
2. Which CISA Known Exploited Vulnerabilities are still unpatched in our environment, and why?
3. When did we last test our backup restore on a real workload, and what did the test show?
4. How many user accounts have privileged or admin access, and is that list smaller than it was last quarter?
5. What incidents (security events, near-misses, alerts) did we have this quarter that I didn't hear about, and why didn't I hear about them?
6. If we were hit by ransomware tonight, what's our realistic Recovery Time Objective for the most important systems?

If your IT provider can answer all six with specifics, they're operating at the standard you're paying for. Hedging or "let me get back to you" on more than one is information worth acting on.