ITGuys Team

10/13/2026

Windows Server 2016 reaches end of support on January 12, 2027.

Your servers won't stop working that day. They just stop receiving security updates, so every newly discovered vulnerability stays open.

You have three realistic paths:
- Upgrade to Windows Server 2025
- Buy Extended Security Updates (ESU) as a bridge, available for up to three years through 2030 (on-premises servers need Software Assurance or an equivalent server subscription)
- Move the workload to the cloud

Our new guide compares all three, explains who qualifies for ESU, and lays out a six-step plan you can start this week.

Read it here: https://mynewitguys.com/windows-server-2016-end-of-support/

Not sure what is still running in your office? ITGuys can inventory your servers and help you choose a path before the deadline.

09/30/2026

On October 13, Microsoft stops issuing security updates for several products at once:

• Office 2021 and Office LTSC 2021 (no extension, no paid extended updates)
• Windows Server 2012 and 2012 R2 (final year of Extended Security Updates ends)
• Windows 11 24H2 Home and Pro

Everything will still open on October 14. It just stops being patched, and that is how most ransomware finds its way in.

Of the three, the servers are the highest risk, and they take the longest to migrate. If you have any 2012 servers, the time to start is now.

09/22/2026

Most ransomware attacks don't start with a hacker breaking through a firewall. They start with an invoice email that looks completely normal.

We built an interactive breakdown of a realistic small business ransomware attack — a fictional 32-person firm, a phishing email, and 9 days from click to crisis. Toggle the story between "Unprepared" and "Protected" and watch the same attack hit a wall at 7 different points.

If you want to see where your own business would stand in that timeline, this is worth 7 minutes.

https://mynewitguys.com/ransomware-attack-timeline-small-business/

09/18/2026

A Colorado town lost over $1 million a few years back because of one skipped phone call.

Someone filled out a form on the town's own website asking to change how a contractor got paid. Nothing about it looked unusual. Staff checked some of the details, but nobody picked up the phone to confirm it with the actual contractor. By the time the bank flagged it as fraud, the money was already gone.

No hacking. No malware. Just a normal-looking request that nobody verified.

That's still how most of these scams work, and it's a big part of why Colorado businesses lost over $355 million to internet crime last year. We pulled the FBI's latest Colorado numbers and broke down what small businesses here can actually do about it:

Colorado ranks 7th nationally per capita for cybercrime. See what the FBI's latest data means for local small businesses, plus the state's breach notification rules.

09/09/2026

Most business email compromise cases don't involve a hack. No malware, no breached network, no stolen password. Someone just forges the "From" field on an email and asks for something normal: an updated invoice, a routine banking change, a wire before end of day.

Email was built in the early 1980s with no way to verify who actually sent a message. That gap is still open at a lot of companies, and attackers know it. In 2025 alone, the FBI logged nearly $3.1 billion in reported BEC losses, most of it moved by wire before anyone caught it.

The fix isn't one thing. It's DNS-level authentication (SPF, DKIM, DMARC) closing the technical gap, paired with a simple habit: verify any payment change through a second channel before you act on it. Neither one alone is enough.

We wrote up how this plays out in practice, including a case where a spoofed vendor email cost a city government $6 million: https://mynewitguys.com/email-spoofing-business-email-compromise-guide/

09/03/2026

Try this experiment: open ChatGPT or Perplexity and ask it to recommend a business like yours. See if you actually get named.

For a lot of small businesses, the answer is no, even ones that rank well on Google. A recent benchmark study of 200+ U.S. service businesses found the average company scores just 30 out of 100 on AI visibility. Ranking on page one of Google only translates to a ChatGPT mention about 6 times out of 10.

Here's the part worth knowing before you spend a weekend "fixing" it: a rigorous 2026 study from Ahrefs tracked nearly 1,900 pages that added schema markup, the technical fix most commonly pitched as the AI citation shortcut, and found it produced no meaningful increase in AI citations on any platform. Google's own documentation backs this up, stating plainly that no special markup is required to appear in AI Overviews.

What actually seems to move the needle is less technical and more fundamental: stating your answer plainly and specifically near the top of the page, staying consistent across every listing of your business, and earning genuine third-party mentions instead of just describing yourself well on your own site.

We broke down what the current research actually shows, including a quick self-check to see where your own business stands. Further reading: https://mynewitguys.com/ai-search-visibility-small-business-guide/

08/26/2026

Quick gut check for business owners: could you list every piece of software your company currently pays for, right now, off the top of your head?

Most owners can't get past the tools they personally use. Marketing has its own subscriptions. Sales has its own. Ops has its own. Someone signed up for a free trial eight months ago that became load-bearing infrastructure and nobody ever told finance.

None of that happens because anyone is careless. It happens because buying software got so easy that it stopped feeling like a decision. A credit card and an email address is all it takes now, and that convenience is exactly what makes it invisible.

The part that actually costs businesses money and exposure isn't the sprawl itself, it's what the sprawl hides. Duplicate tools nobody remembers to cancel. Access nobody remembers to revoke when someone leaves. Vendor relationships nobody in the building could describe if asked.

The fix isn't a lockdown. It's a habit: know what you're running, know who owns each tool, and build offboarding around a real list instead of a memory exercise. That one habit closes more risk than most security spending does.

We put together a deeper look at where this goes wrong and how to get ahead of it: https://mynewitguys.com/blog/saas-sprawl-small-business-risks

08/17/2026

Most offboarding checklists cover the visible stuff: collect the laptop, disable the email account, done.

But access doesn't live in one place anymore. It's spread across a dozen SaaS logins, shared credentials, forwarding rules, and sessions that never got logged out. Unless someone kept a running inventory of every account a person was ever given, IT is stuck trying to reconstruct it from memory when that person leaves.

That's usually the actual failure point, not carelessness, just structure. Access gets granted incrementally over months or years. It should get revoked the same way, deliberately and all at once, not reassembled after the fact.

The fix isn't complicated: log access as it's granted, cut it off at the identity layer first (this is where single sign-on earns its keep), and do a short follow-up review a few weeks after someone leaves to catch what slipped through.

https://mynewitguys.com/employee-offboarding-security-checklist-small-business/

08/06/2026

A federal court voided a company's entire cyber insurance policy over one missing checkbox.

Not fraud. Not a lie. Someone answered "yes, we have MFA" without knowing it was only enabled on the firewall, not the servers, not remote access, not the system ransomware actually got through.

The insurer sued. The court sided with them. The policy was voided from day one, right when the business needed it most.

This is happening more as insurers dig deeper before paying claims. In our latest article, we break down:
→ The 6 controls insurers actually check (MFA, EDR, tested backups, IR plans, patching, training)
→ Why "we have MFA" and "we have MFA everywhere" are two different claims
→ What to verify before your next renewal

Read it here: https://mynewitguys.com/what-your-cyber-insurance-policy-actually-requires-and-why-so-many-claims-get-denied/

07/31/2026

Quick story from our week: someone tried to get us to wire $12,000 to a fake vendor using a two-part scam. First a normal-looking invoice, then a follow-up email made to look like it came from our own owner, telling us to pay it fast and skip the usual checks.

It didn't work, but it was close enough to good that we wanted to share it. If a payment request ever tells you to skip your normal process, that's not a reason to move faster. That's the reason to stop and make a phone call first.

We wrote up exactly how the scam was built and what to watch for. Check it out if you want your team ready for the next one.

https://mynewitguys.com/someone-tried-to-scam-us-out-of-12000-heres-exactly-how-it-worked/