The Rnits Company

The Rnits Company Enterprise cybersecurity experts: cloud, endpoint, IAM, GRC, CI/CD AppSec—cut risk ensure compliance.

If you share SharePoint or OneDrive folders with clients, vendors or your outside accountant, some of those links are ab...
10/17/2026

If you share SharePoint or OneDrive folders with clients, vendors or your outside accountant, some of those links are about to stop working.

Microsoft is retiring the old SharePoint one-time passcode, the six-digit code outside people typed in to open a shared file. The retirement started rolling out in mid-October and should finish by the end of November. Anyone who opened an older "Specific people" link that way, and never got a guest account in your Microsoft 365, will get an "access denied" page on that same link.

The annoying part is who finds out first: your client, not you, usually right when they need last year's tax folder or a set of drawings.

The fix is easy. Re-share one file with that person and access comes back. We wrote up the 30-minute check to run now, plus the side effect nobody mentions: every outside person you share with now lives in your directory.

https://www.rnits.com/blog/sharepoint-one-time-passcode-retirement-external-sharing/

Microsoft is retiring SharePoint one-time passcodes through November 2026. Older links to clients and vendors will start failing. Here is the 30-minute fix.

For years, Microsoft's monthly security update fixed about 100 problems. On October 13 it fixed roughly 1,400.That's a r...
10/17/2026

For years, Microsoft's monthly security update fixed about 100 problems. On October 13 it fixed roughly 1,400.

That's a record, and it won't be the last one. Microsoft says AI is now finding bugs in Windows and Office faster than people ever could. July was about 570, September about 1,000, October about 1,400.

That's good news in the long run. Here's the catch for small businesses: you can't install only the important fixes. Windows updates arrive as one bundle, and one of October's fixes closes a hole attackers were already using. A laptop that hasn't rebooted in three weeks, or a PC someone paused updates on, is quietly missing all of it.

"Automatic updates are on" and "we're patched" aren't the same thing anymore. We wrote up what changed, what to ask whoever handles your IT, and the simple monthly process that actually keeps up:

https://www.rnits.com/blog/microsoft-patch-tuesday-1400-fixes-ai-small-business/

Microsoft fixed about 1,400 flaws in October, a record driven by AI bug hunting. What it means for small business patching and what to do first.

For $500 a month, a criminal could rent an AI that read a stolen Microsoft 365 inbox and told them who pays the invoices...
10/11/2026

For $500 a month, a criminal could rent an AI that read a stolen Microsoft 365 inbox and told them who pays the invoices.

The service was called EvilTokens. Microsoft took it down on September 22, but by then it had broken into more than 12,000 business inboxes. Construction, healthcare, financial and real estate firms were among the victims. It never needed anyone's password. It tricked people into approving a real Microsoft login, MFA included, and then its AI combed through the mail for wire transfers and pending invoices and wrote the fake "we changed banks" email for the crook.

Two things worth knowing. First, copycats already exist. Second, changing your password does NOT kick them out. The stolen sessions have to be revoked too.

We wrote up what happened, plus a one-hour checklist for your own Microsoft 365 tenant: https://www.rnits.com/blog/eviltokens-ai-phishing-microsoft-365-stolen-inboxes

Microsoft dismantled EvilTokens, a $500/month phishing service whose AI read 12,000 stolen M365 inboxes to plan invoice fraud. What it did and what to check now.

If you supply parts or engineering up the defense chain, you probably heard CMMC got suspended this summer — and you may...
09/26/2026

If you supply parts or engineering up the defense chain, you probably heard CMMC got suspended this summer — and you may have gotten a follow-up email telling you to book a certification assessment before the rush anyway. One of those is honest. The other is a sales pitch.

Here's the plain version: the Pentagon suspended the third-party CMMC audits in July, and in September started stripping them out of contracts. But NIST 800-171, the DFARS 7012 clause, and your SPRS score are all still fully required. The audit got paused. The homework did not.

So don't pay a consultant to prep you for an assessment that has no date and no final rules. Spend that budget getting genuinely compliant with 800-171 instead — it pays off no matter what the review decides.

We wrote the whole thing up for small MA/NH manufacturers and defense subs: https://www.rnits.com/blog/cmmc-phase-2-suspended-nist-800-171-still-required/

CMMC third-party assessments are suspended — but NIST 800-171, DFARS 7012, and your SPRS score still apply. What MA/NH defense subcontractors should do now.

A 30-person accounting firm turned on Microsoft Copilot and asked it a simple question: "Summarize our staff compensatio...
09/16/2026

A 30-person accounting firm turned on Microsoft Copilot and asked it a simple question: "Summarize our staff compensation structure." It answered in four seconds — names, numbers, all of it — from a payroll spreadsheet someone had shared with "Everyone" back in 2021 and forgotten.

Here's the thing: Copilot did nothing wrong. The person asking already had access to that file. Copilot didn't leak it. It just made a file nobody remembered existed instantly findable.

That's the whole "Copilot oversharing" problem. It's not a hole in Copilot — it's a spotlight on a decade of clicking "Share" to make life easier. The good news: it's a few hours of permissions cleanup, not a canceled rollout or six new tools on your IT bill.

We wrote up the exact pre-Copilot cleanup checklist for NH and MA small businesses: https://www.rnits.com/blog/copilot-oversharing-sharepoint-permissions-smb/

Copilot creates no new access. It just makes everything a user can already reach instantly searchable. The oversharing was there for years — Copilot is the flashlight.

If your practice turned on an AI scribe this year, here is a question nobody in the building may have asked: did anyone ...
08/11/2026

If your practice turned on an AI scribe this year, here is a question nobody in the building may have asked: did anyone ask the patient?

HIPAA covers what happens to the health information in that recording. It says almost nothing about whether you were allowed to record in the first place. That is state wiretap law, and it carries criminal penalties HIPAA does not.

Most articles about AI scribes lump Massachusetts and New Hampshire together as "all-party consent" states. That is wrong about one of them. Massachusetts prohibits secret recording, where actual knowledge is the test rather than permission. New Hampshire requires consent from everyone. New Hampshire is the stricter of the two, which surprises most people.

In April, patients filed a class action against two health systems over exactly this. The AI vendor was not named as a defendant. The providers were.

We wrote up what compliance actually looks like, including the consent sentence to say out loud and why the "mandatory 2026 HIPAA requirements" you are being sold are not law yet.

https://www.rnits.com/blog/hipaa-compliant-ai-medical-practice-scribes-consent/

HIPAA is only half the problem when AI listens to a patient visit. Massachusetts and New Hampshire recording law is the other half, and the rules differ.

A client got their customer's annual vendor security questionnaire last month. Same packet as always, except it was four...
08/07/2026

A client got their customer's annual vendor security questionnaire last month. Same packet as always, except it was four pages longer, and the new pages were all about AI.

His first instinct was to write "we don't use AI." He knew that was false while he was thinking it. His office manager had been drafting proposals in ChatGPT since March, and his bookkeeper was using Copilot in Excel because it came with a license they already paid for.

Here's the part almost nobody gets right. If you bought an enterprise AI plan with a HIPAA BAA, you are probably not as covered as you think. Anthropic publishes exactly which parts of Claude the BAA covers, and the excluded list includes connectors, enterprise search, and the browser extension. In other words, the integrations that make the tool useful in the first place. "We have a BAA" is not an answer. Which surfaces you turned on is the answer.

We wrote up what those questionnaires actually ask now, and the four things you need in place before you can answer honestly. None of them require buying anything new.

https://www.rnits.com/blog/ai-security-questionnaire-guardrails-smb

Vendor security questionnaires now have an AI section. Here is what it asks, why "we have a BAA" fails it, and the four things you need in place first.

Last month we wrote about the five kinds of work that eat a small business week — proposals, repetitive forms, email, in...
08/01/2026

Last month we wrote about the five kinds of work that eat a small business week — proposals, repetitive forms, email, intake, and the marketing that quietly stopped happening. The follow-up question everybody asked was the same: fine, but where do I start?

The answer depends entirely on what business you're in, so we wrote it out industry by industry. Contractors, medical and dental practices, law firms, accounting firms, machine shops, property managers. What the paperwork actually is in each one, what the credible data says (and which numbers came from companies selling the fix), and the single workflow we'd build first.

Here's the part that surprises people: in every one of these, the first workflow is not the famous one. We would not start a medical practice on prior authorization, even though that's a 13-hour-a-week problem. We would not start a law firm on document drafting. The right first project is high-volume, low-judgment, and cheap to check — because that's the one that earns enough trust to make the second one possible.

Read it here: https://www.rnits.com/blog/ai-automation-by-industry-where-to-start/

Contractors, medical practices, law firms, accountants, manufacturers, property managers. Six industries, six different piles of paperwork, and where each one should actually begin.

Somebody in your office is retyping the same fifteen fields into a portal they've used four hundred times. Somebody else...
07/31/2026

Somebody in your office is retyping the same fifteen fields into a portal they've used four hundred times. Somebody else is rebuilding a quote from a price list and a phone call, the way they did on Tuesday and will again on Friday. A third person has 180 unread emails and no real method for deciding which twelve matter today.

That's a normal week at a normal small business, and none of it is a technology problem. The tools got cheap and capable this year. What's missing is that nobody has sat down and looked at how work actually moves through your office.

Our new post walks through the five places automation pays in almost any business: proposals and bids, the same form filled out over and over, email triage, requests arriving through five different doors, and the marketing upkeep that quietly stopped. Plus the part most people skip and regret, which is mapping the process before you automate it. Gartner expects more than 40% of agentic AI projects to be cancelled by the end of 2027, and the failures are almost never the technology.

https://www.rnits.com/blog/ai-business-process-automation-small-business/

Proposals, intake forms, email triage, ticket routing, website upkeep. The work eating your week is a process nobody wrote down — not a technology problem.

Address

404 Middlesex Road, Suite 9
Tyngsboro, MA
01879

Website

Alerts

Be the first to know and let us send you an email when The Rnits Company posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category