Plain-talk writing on cybersecurity, managed IT, and the things that actually break in small business networks. No corporate speak, no fearmongering, no fluff.
The three newest posts across every topic. Looking for something specific? Browse all posts in the file view.
A heavy month: 198 vulnerabilities and three zero-days, including a BitLocker bypass and an HTTP.sys server flaw. A plain-language breakdown of what's in it, what it means, and how a small business should protect itself this week, plus the Secure Boot deadline.
Read postMandiant and the FBI warn the Silent Ransom Group has escalated from phone calls to sending fake IT workers into offices to steal data in person. Why it's theft and not encryption, why backups won't save you, why it's not just law firms, and the verification habits that stop it.
Read postThree small DNS records keep your real mail out of spam and stop criminals forging your domain in invoice and wire-fraud scams. What each one does, why Google, Yahoo, and Microsoft now require them, and a safe phased rollout that won't block your own email.
Read postDecision-making material for Salinas and Monterey County business owners evaluating managed IT, IT support, and providers. Start with the Salinas IT services hub for the broader picture.
Real numbers, what should be included at each price point, and the hidden costs to watch for. Per-user vs per-device vs flat-rate, and how to read an MSP quote.
Read postWhat "good" actually looks like for Salinas IT support, the questions that separate serious providers from the rest, and how to compare them honestly.
Read postA practical look at the Salinas-area MSP landscape and how to pick the right one for your business size, industry, and risk profile.
Read postWhat to ask, what to transfer, and what not to break when switching MSPs without disrupting your business operations.
Read postWhere ad-hoc IT support stops paying off and managed IT starts. A plain-talk decision framework for small business owners.
Read postHow help desk and tech support should actually work for a Salinas small business, what's included in flat-rate plans, and what to expect on the first ticket.
Read postHow attacks actually work, what stops them, and the controls a real small business should have in place. See our cybersecurity services for the engineering approach.
A heavy month: 198 vulnerabilities and three zero-days, including a BitLocker bypass and an HTTP.sys server flaw. A plain-language breakdown of what's in it, what it means, and how a small business should protect itself this week, plus the Secure Boot deadline.
Read postMandiant and the FBI warn the Silent Ransom Group has escalated from phone calls to sending fake IT workers into offices to steal data in person. Why it's theft and not encryption, why backups won't save you, why it's not just law firms, and the verification habits that stop it.
Read postThree small DNS records keep your real mail out of spam and stop criminals forging your domain in invoice and wire-fraud scams. What each one does, why Google, Yahoo, and Microsoft now require them, and a safe phased rollout that won't block your own email.
Read postThe nine Microsoft 365 settings to enable first — MFA, admin protection, audit logging, anti-phishing, DKIM, external-sharing limits, retention and backup, self-service password reset, and app-consent controls. What each does and how to check yours.
Read postThe 10 controls that actually protect a small business in 2026, in priority order, what each one stops, and how to tell if yours is really in place. Owner-focused, no jargon, and the highest-impact ones are free.
Read postRunning an unsupported OS is a rising security and cyber-insurance risk. Windows 10 lost free updates in October 2025 and the consumer ESU bridge ends October 2026. Who upgrades to Windows 11 free, who replaces, what ESU costs, and how to plan it without panic.
Read postEmail-bomb the inbox, then message the employee on Teams posing as IT, talk them into Quick Assist remote access, and deploy ransomware. No vulnerability needed. How the Teams help-desk impersonation playbook works and the Microsoft 365 settings, training, and monitoring that stop it.
Read postSix unpatched Windows zero-days in six weeks, then a GitHub and GitLab ban. A plain-language rundown of BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma, what is patched, what is being exploited in the wild, and what a small business should do before the threatened July 14 sequel.
Read postSilent Ransom Group (Luna Moth) uses fake IT calls and remote-access tools to steal client data and extort law firms and professional-services SMBs. No malware, no encryption, so backups do not save you. The controls that do.
Read postPush-based MFA is being defeated by social engineering, not theft. How push bombing, adversary-in-the-middle phishing, and help-desk impersonation work, and the phishing-resistant MFA that actually stops them.
Read postThe five cybersecurity spending categories a Monterey small business should buy in priority order: identity, endpoint, monitoring, email, training. Industry-specific guidance for hospitality, real estate, healthcare, and professional services on the Peninsula.
Read postA six-layer IT checklist for trucking and logistics businesses in Salinas, Watsonville, and Gilroy. ELDs, dispatch, C-TPAT, the freight-fraud patterns hitting Central Coast carriers, and a realistic budget for a 5-truck operation.
Read postAll three live on top of SharePoint Online underneath. A plain-talk decision guide on which to use when, the five mistakes SMBs make, how Copilot interacts with permissions, and a reference org chart for a 25-person business.
Read postMost SMB backup plans look correct on paper and fall apart in a real incident. The 3-2-1-1-0 rule, immutable storage, ransomware-aware design, restore-test cadence, and what an SMB backup program should actually cost.
Read postCopilot Business is $18/user/month if locked in before June 30, 2026; $21 after. The buy-now math, ROI by role, tenant-readiness checklist, and an honest read on when Copilot pays back for a 15-100 person business.
Read postActive exploitation of a FunnelKit Funnel Builder flaw is injecting card-skimming JavaScript into WooCommerce checkouts. Step-by-step verification for SMB site owners, emergency response, and the defensive baseline every WordPress business site should run.
Read postOn-prem SharePoint RCE patched in May Patch Tuesday. No workaround, cumulative update is the only fix. PowerShell verification steps, web-shell hunting, and the on-prem-to-SharePoint-Online migration math.
Read postPublic PoC for a Windows Cloud Filter driver flaw (CVE-2020-17103) takes any standard user to SYSTEM on fully patched Windows 11. Microsoft's 2020 fix did not fully resolve it. Defensive controls that actually move the needle while we wait for a real patch.
Read postInitial-access-to-handoff has dropped from 8 hours to 22 seconds in three years. Human-paced IT cannot keep up. The realistic 2026 minimum: identity hardening, EDR, 24/7 MDR, and automated containment.
Read postThe controls a Central Coast underwriter is going to ask about, and how to be ready for the renewal questionnaire without scrambling at the last minute.
Read postActive exploitation of an OWA XSS zero-day in on-prem Exchange. Verification PowerShell, defensive layers, and why this is the post that should make you start planning the migration off on-prem Exchange.
Read post120 fixes, 17 critical. The two CVEs small businesses should patch first, plus what Microsoft's new MDASH scanner means for next month.
Read postFive identity controls that actually move the needle for a 5-to-25-person business on Microsoft 365: phishing-resistant MFA, separated admin accounts, Conditional Access, no persistent local admins, and legacy auth turned off.
Read postA plain-talk read on two publicly disclosed Windows bugs: a BitLocker bypass through WinRE and a CTFMON privilege-escalation primitive.
Read postAnthropic's Claude Mythos found 271 vulnerabilities in Firefox 150 in a single eval. Why patching is moving from quarterly to continuous, and what that means for small business in 2026.
Read postA plain-talk breakdown of the May 2026 Instructure Canvas breach by ShinyHunters: what was actually stolen, what was not, and the steps to take.
Read postHow ransomware actually gets into small business networks, what happens after the attackers get in, and the controls that actually stop them.
Read postAfter years of opening up small business networks for the first time, the same five gaps show up over and over. None of them are exotic. All of them are fixable in a week.
Read postIndustry-specific guidance for businesses operating in regulated or operationally sensitive sectors across the Central Coast.
Privileged client data and client money make a professional office a target that punches above its weight. Email and BEC defense, client confidentiality, Microsoft 365 hardening, the FTC Safeguards Rule and IRS WISP for tax and financial firms, the lawyer's confidentiality duty, and continuity for filing deadlines.
Read postThe Salad Bowl of the World runs on a perishable clock. Cold-chain and cooler monitoring, produce ERP and FSMA 204 traceability, food-safety audit IT for PrimusGFS and SQF, seasonal-account hygiene, and the harvest-timed ransomware and wire fraud aimed at produce.
Read postThe most-targeted ransomware sector, with the CMMC 2.0 clock already ticking. OT/IT segmentation and shop-floor security, ERP/MES/PLM and CAD-vault uptime, the legacy-CNC problem, and a realistic CMMC and NIST 800-171 readiness path for a Central Coast shop.
Read postCAD and BIM firms lose billable hours to slow files and carry real risk in an untested vault. Workstation and PDM/vault performance, the VPN large-file fix, IP protection, NCEES seals, ITAR and CMMC flow-down, and tested backup of a multi-terabyte vault.
Read postA plain-talk guide for firms and HOAs: Yardi and AppFolio uptime, tenant-data protection, resident-network segmentation, vendor-banking and wire-fraud defense, FTC Safeguards and Davis-Stirling compliance, and a realistic IT budget.
Read postWhat HIPAA-compliant IT actually looks like for a Monterey County medical or dental practice, beyond the marketing checkbox.
Read postHow to keep your business running through Public Safety Power Shutoffs without losing data, customers, or compliance posture.
Read postMoving to the cloud the right way — what to migrate, what to keep, and how to do it without surprise downtime or a surprise bill. See our cloud services for the full program.
The cloud is not all-or-nothing and not automatically cheaper. What to move first, what to keep on-prem, a phased migration playbook, the real cost math, and how cloud keeps you running through a PG&E shutoff.
Read postNotes on building real websites for small business — fast loading, accessible, well-ranked, and actually maintainable.
How to evaluate website design and development providers in Salinas and the Monterey Bay, and what to expect from a small business build.
Read postSpecific fixes for specific problems — the kind of writeup the engineer keeps in a notebook and reaches for again the next time.
The XPS Document Writer fix for QuickBooks Desktop's email error on Windows 11, including the trick most guides miss.
Read post