IoT Device Security: The Hidden Attack Surface in Your Small Business
Smart cameras, thermostats, and networked printers often run default passwords and years-old firmware. How these devices become an entry point and how to lock them down.
Read postNotes from the field
Plain-talk writing on cybersecurity, managed IT, and the things that actually break in small business networks. No corporate speak, no fearmongering, no fluff.
Latest
The three newest posts across every topic. Looking for something specific? Browse all posts in the file view.
Fileless Malware: The Attack That Leaves Nothing for Antivirus to Find
Fileless malware and living-off-the-land attacks run entirely in memory using tools already on your PC, so traditional antivirus never sees a file to scan. How it works and what stops it.
Read postVoIP Toll Fraud: How a Hacked Phone System Runs Up a Five-Figure Bill Overnight
A hacked business phone system can rack up thousands of dollars in international calls in a single weekend. How VoIP toll fraud works and how small businesses stop it.
Read postManaged IT in Salinas
Decision-making material for Salinas and Monterey County business owners evaluating managed IT, IT support, and providers. Start with the Salinas IT services hub for the broader picture.
Do I Need Managed IT Services? 7 Signs Your Small Business Has Outgrown Break-Fix
Seven clear signs you've outgrown calling someone only when things break, what managed IT actually changes, and the honest cases where you might not need it yet.
Read postBest IT Support in Monterey: How to Choose the Right Company (2026)
The criteria that matter, the questions to ask any provider, the red flags to avoid, and why local on-site coverage of the Monterey Peninsula counts.
Read postHow Much Does Managed IT Cost for a Small Business in Salinas in 2026?
Real numbers, what should be included at each price point, and the hidden costs to watch for. Per-user vs per-device vs flat-rate, and how to read an MSP quote.
Read postThe Best IT Support in Salinas: How to Evaluate Providers
What "good" actually looks like for Salinas IT support, the questions that separate serious providers from the rest, and how to compare them honestly.
Read postTop Managed IT Providers in Salinas and the Monterey Bay
A practical look at the Salinas-area MSP landscape and how to pick the right one for your business size, industry, and risk profile.
Read postSwitching IT Providers in Salinas / Monterey: The Checklist
What to ask, what to transfer, and what not to break when switching MSPs without disrupting your business operations.
Read postIT Support vs Managed IT Services: What's the Difference?
Where ad-hoc IT support stops paying off and managed IT starts. A plain-talk decision framework for small business owners.
Read postIT Help, Help Desk, and Tech Support for Small Business in Salinas
How help desk and tech support should actually work for a Salinas small business, what's included in flat-rate plans, and what to expect on the first ticket.
Read postCybersecurity for Small Business
How attacks actually work, what stops them, and the controls a real small business should have in place. See our cybersecurity services for the engineering approach.
IoT Device Security: The Hidden Attack Surface in Your Small Business
Smart cameras, thermostats, and networked printers often run default passwords and years-old firmware. How these devices become an entry point and how to lock them down.
Read postFileless Malware: The Attack That Leaves Nothing for Antivirus to Find
Fileless malware and living-off-the-land attacks run entirely in memory using tools already on your PC, so traditional antivirus never sees a file to scan. How it works and what stops it.
Read postVoIP Toll Fraud: How a Hacked Phone System Runs Up a Five-Figure Bill Overnight
A hacked business phone system can rack up thousands of dollars in international calls in a single weekend. How VoIP toll fraud works and how small businesses stop it.
Read postUSB Drop Attacks: How a "Lost" Flash Drive Becomes a Ransomware Foothold
A USB drive left in a parking lot or mailed to your office can hand an attacker a foothold before anyone clicks a link. How USB drop attacks work and how to stop them.
Read postMalvertising: How Fake Software Ads Are Infecting Small Businesses
Malicious search ads impersonate PuTTY, Zoom, and other everyday downloads to infect employees before they ever reach the real site. How malvertising works and how to stop it.
Read postClickFix: The Fake CAPTCHA Attack Tricking Employees Into Infecting Their Own PC
ClickFix pages pose as a CAPTCHA or a Zoom error and talk employees into pasting a command into Windows Run. How the attack bypasses antivirus and how to stop it in 2026.
Read postEvil Twin Wi-Fi: How Fake Hotspots Steal Data From Remote Workers
Evil twin Wi-Fi hotspots copy a real network's name to intercept logins and files from remote and traveling employees. How the attack works and how to stop it in 2026.
Read postSession Hijacking: How Stolen Cookies Let Attackers Skip Past MFA
Session hijacking steals the cookie that proves you're already logged in, so attackers walk past MFA without a password or a code. How it works and how to stop it in 2026.
Read postTyposquatting: How Lookalike Domains Impersonate Your Business and Your Vendors
Typosquatting uses domains one letter off from the real thing to impersonate your business or your vendors for phishing and invoice fraud. How it works and how to stop it in 2026.
Read postSIM Swapping: How Attackers Hijack Your Phone Number to Get Into Business Accounts
SIM swapping hijacks your phone number to intercept SMS codes and reset passwords, with no phishing click required. How the attack works, the warning signs, and the fixes that stop it in 2026.
Read postCredential Stuffing: How Reused Passwords Let Attackers Into Your Business Accounts
Credential stuffing doesn't hack your business — it logs in with a password your employee reused somewhere else. How the attack works, the warning signs, and the fixes that actually stop it in 2026.
Read postMobile Device Management (MDM) for Small Business: When You Actually Need It
BYOD policies cover personal phones, but company-owned devices, regulated data, and field teams often outgrow that. What MDM actually does, the signs you need more than conditional access, and how to roll it out without over-buying.
Read postLegacyHive: Nightmare-Eclipse's New Windows Zero-Day, Explained
The threatened July 14 sequel dropped — a Windows privilege-escalation bug in the User Profile Service, with no CVE, no patch, and a deliberately incomplete exploit. What it does, how serious it really is, and what a small business should do this week.
Read postPasskeys for Small Business: Should You Ditch Passwords in 2026?
Passkeys now work across Microsoft 365, Google Workspace, and most banking apps, and they can't be phished. What a passkey actually is, where it beats passwords and MFA, and a realistic rollout plan for a small business.
Read postJuly 2026 Patch Tuesday: A Record 570 Fixes, 3 Zero-Days, and What an SMB Should Patch First
The biggest Patch Tuesday ever: 570 vulnerabilities, three zero-days — two already exploited in attacks — and AI-driven discovery behind the record. What's in it, why it's so large, and the order a small business should patch in this week.
Read postVishing: How Voice Phishing Calls Are Scamming Small Businesses in 2026
A phone call claiming to be your bank, the IRS, or your own IT department is one of the oldest scams in the book, and it still works. Why caller ID can't be trusted, and the verification habit that stops it.
Read postAI Agents at Work: The Non-Human Identity Risk Small Businesses Aren't Managing
AI agents can now send email, book meetings, and update your CRM on their own, using real credentials plugged into your systems. Why these non-human identities are a growing small-business risk, and the checklist that governs them.
Read postZero Trust Security for Small Business: What It Actually Means in 2026
Zero Trust gets thrown around as a marketing buzzword, but the actual model is simple: never trust, always verify. What it really means for a 10-person business, what it costs, and where to start.
Read postSmishing: How Text Message Phishing Is Hitting Small Businesses in 2026
Fake delivery texts, fake toll bills, fake payroll alerts — smishing skips your spam filter and lands directly on employee phones. How it works, why it's outrunning email phishing, and the controls that stop it.
Read postOAuth App Phishing: How Attackers Get Into Microsoft 365 Without Stealing a Password
A newer phishing email doesn't ask for a password, it asks an employee to click "Accept" on a fake app permission request. How OAuth consent phishing works, why it slips past MFA entirely, and the controls that shut it down.
Read postCalifornia Data Breach Notification Law: What Small Businesses Must Do After a Breach
California's breach notification law applies no matter how small your business is. What actually counts as a reportable breach, what a compliant notice must say, and why the real financial risk is a CPRA lawsuit, not a fine.
Read postBYOD for Small Business: Securing Personal Phones and Laptops Without Locking Down Everyone's Devices
Your team is already checking company email on personal phones, whether or not you have a policy for it. What a BYOD policy actually needs to cover, and how to secure personal devices without an enterprise MDM budget.
Read postThe Seasonal Worker IT Checklist: Onboarding and Offboarding Summer Staff Without Leaving Accounts Open
Harvest crews, tasting-room staff, and summer hospitality hires all need system access, and few businesses ever turn it back off. A simple onboarding and offboarding checklist for seasonal workers on the Central Coast.
Read postVendor & Third-Party Risk: What Happens When a Vendor You Trust Gets Breached
A breach at your payroll processor, CRM, or help desk vendor can expose your data even if your own network is never touched. How vendor risk actually works, and the checklist that manages it without a compliance team.
Read postDomain Name Security: How Small Businesses Lose Their Website and Email Without Getting Hacked
An expired renewal, a stolen registrar login, or one unauthorized DNS change can take down your website and email overnight, with no malware involved. How it happens, and the checklist that locks it down.
Read postSummer Travel & Remote Work Security: Protecting Company Data When Your Team Isn't in the Office
Public Wi-Fi, lost devices, and travel-season phishing expand your attack surface all summer. The risks that actually cause breaches when employees work from the road, and the checklist that closes them.
Read postEDR vs. Antivirus: Why Small Businesses Need More Than a Signature Scanner in 2026
Traditional antivirus catches malware it already recognizes. It misses fileless attacks and the human-operated ransomware crews actually hitting small businesses. What EDR adds, what it costs, and the 10-minute check to see what you already have.
Read postEmployee Offboarding IT Checklist: Closing the Security Gaps When Someone Leaves
Former employees keep access to email, cloud files, and business apps far longer than owners realize. The same-day IT offboarding checklist that closes the gap: accounts, devices, shared logins, and forwarding rules.
Read postDark Web Monitoring for Small Business: What It Finds, What It Misses, and Whether It's Worth It in 2026
Dark web monitoring scans criminal forums and stealer malware marketplaces for your employees' stolen credentials. Here is what it actually catches, what it misses, and the honest answer on when it pays off.
Read postPhishing Simulations for Small Business: Why Annual Security Training Isn't Enough, and What to Do Instead
Annual security awareness training is forgotten within 60 days. Phishing simulations catch employees at the moment of failure and teach something that sticks. How to run a quarterly program that cuts click rates from 25% down to under 5% in 12 months.
Read postIT Incident Response Plan for Small Business: What to Have Ready Before You Get Breached
The most expensive part of a cyberattack is the first two hours — when your team is panicking and making decisions they should have made in advance. What your IR plan must include, and the one-hour exercise that makes it real.
Read postThe Deepfake CEO Call: Why Voice Cloning Is the New Wire-Fraud Threat, and How to Stop It
AI can clone your boss's voice from seconds of audio and call an employee to authorize an urgent wire. Why caller ID and a confirmation email won't save you, and the out-of-band verification rule that stops deepfake CEO fraud cold.
Read postData-Theft Extortion: When Attackers Steal Your Cloud Data Instead of Encrypting It
The fastest-growing extortion of 2026 doesn't encrypt anything. Attackers log into your cloud apps, steal the data, and threaten to leak it, using calls that impersonate IT and abused app connections. How the no-ransomware breach works and how a small business stops it.
Read postQuishing: Why QR Code Phishing Slips Past Your Filters, and How to Stop It
QR code phishing is at its highest level yet in 2026, because a QR code hides the malicious link from email filters and jumps the attack onto a personal phone. How it works, the physical-sticker version, and how a small business defends against it.
Read postHow Much Does Cybersecurity Cost for a Small Business in 2026?
A straight answer: real per-user monthly ranges, what drives the price, what's actually included, which high-impact basics are free, and why protection is a fraction of what a single incident costs.
Read postYour VPN Is the Front Door: This Week's Actively-Exploited Check Point and Ivanti Flaws, and What to Do
CISA flagged actively-exploited flaws in Check Point VPN and Ivanti Sentry this week, plus a Chrome bug. Edge devices are the ransomware front door and attackers move within days. Why they're the real prize, the "patch this first" list, and the steps an SMB should take now.
Read postShadow AI: Your Team Is Already Pasting Company Data Into ChatGPT — Here's How to Handle It
Your employees are already using AI tools at work, often with sensitive client data. The real risk is data leaving your control. Why banning backfires, what should never be pasted into a public AI tool, and how a small business governs AI safely without killing the productivity.
Read postJune 2026 Patch Tuesday: 198 Fixes, 3 Zero-Days, and What an SMB Should Patch First
A heavy month: 198 vulnerabilities and three zero-days, including a BitLocker bypass and an HTTP.sys server flaw. A plain-language breakdown of what's in it, what it means, and how a small business should protect itself this week, plus the Secure Boot deadline.
Read postFake IT Workers Are Now Showing Up in Person: The Silent Ransom Group Escalation and How to Stop It
Mandiant and the FBI warn the Silent Ransom Group has escalated from phone calls to sending fake IT workers into offices to steal data in person. Why it's theft and not encryption, why backups won't save you, why it's not just law firms, and the verification habits that stop it.
Read postSPF, DKIM, and DMARC for Small Business: Stop Spoofing and Land in the Inbox
Three small DNS records keep your real mail out of spam and stop criminals forging your domain in invoice and wire-fraud scams. What each one does, why Google, Yahoo, and Microsoft now require them, and a safe phased rollout that won't block your own email.
Read postMicrosoft 365 for Small Business: The 9 Settings to Turn On First
The nine Microsoft 365 settings to enable first — MFA, admin protection, audit logging, anti-phishing, DKIM, external-sharing limits, retention and backup, self-service password reset, and app-consent controls. What each does and how to check yours.
Read postHow to Protect Your Small Business From a Cyberattack: The 10 Essentials
The 10 controls that actually protect a small business in 2026, in priority order, what each one stops, and how to tell if yours is really in place. Owner-focused, no jargon, and the highest-impact ones are free.
Read postStill on Windows 10 in Mid-2026? Here Is What a Small Business Should Do Now
Running an unsupported OS is a rising security and cyber-insurance risk. Windows 10 lost free updates in October 2025 and the consumer ESU bridge ends October 2026. Who upgrades to Windows 11 free, who replaces, what ESU costs, and how to plan it without panic.
Read postThe Microsoft Teams "IT Help Desk" That Isn't: How a Fake Support Chat Ends in Ransomware
Email-bomb the inbox, then message the employee on Teams posing as IT, talk them into Quick Assist remote access, and deploy ransomware. No vulnerability needed. How the Teams help-desk impersonation playbook works and the Microsoft 365 settings, training, and monitoring that stop it.
Read postNightmare-Eclipse: The Six Windows Zero-Days From the Researcher GitHub Banned
Six unpatched Windows zero-days in six weeks, then a GitHub and GitLab ban. A plain-language rundown of BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma, what is patched, what is being exploited in the wild, and what a small business should do before the threatened July 14 sequel.
Read postFBI Warns: Silent Ransom Group Is Targeting Law Firms. Here's What to Do
Silent Ransom Group (Luna Moth) uses fake IT calls and remote-access tools to steal client data and extort law firms and professional-services SMBs. No malware, no encryption, so backups do not save you. The controls that do.
Read postMFA Fatigue: When the Attacker Just Asks Your Team for the Code
Push-based MFA is being defeated by social engineering, not theft. How push bombing, adversary-in-the-middle phishing, and help-desk impersonation work, and the phishing-resistant MFA that actually stops them.
Read postCybersecurity Services in Monterey: What Your Small Business Should Actually Buy in 2026
The five cybersecurity spending categories a Monterey small business should buy in priority order: identity, endpoint, monitoring, email, training. Industry-specific guidance for hospitality, real estate, healthcare, and professional services on the Peninsula.
Read postTrucking and Logistics IT in Salinas: What Owner-Operators and Small Fleets Should Have in Place
A six-layer IT checklist for trucking and logistics businesses in Salinas, Watsonville, and Gilroy. ELDs, dispatch, C-TPAT, the freight-fraud patterns hitting Central Coast carriers, and a realistic budget for a 5-truck operation.
Read postOneDrive vs SharePoint vs Teams Files: Which Should Your Small Business Use?
All three live on top of SharePoint Online underneath. A plain-talk decision guide on which to use when, the five mistakes SMBs make, how Copilot interacts with permissions, and a reference org chart for a 25-person business.
Read postBackup and Disaster Recovery for a Small Business: What Actually Works in 2026
Most SMB backup plans look correct on paper and fall apart in a real incident. The 3-2-1-1-0 rule, immutable storage, ransomware-aware design, restore-test cadence, and what an SMB backup program should actually cost.
Read postMicrosoft 365 Copilot Business: Lock In $18 Before July 1, 2026
Copilot Business is $18/user/month if locked in before June 30, 2026; $21 after. The buy-now math, ROI by role, tenant-readiness checklist, and an honest read on when Copilot pays back for a 15-100 person business.
Read postWordPress Funnel Builder Compromise: What Every SMB With a Website Should Check
Active exploitation of a FunnelKit Funnel Builder flaw is injecting card-skimming JavaScript into WooCommerce checkouts. Step-by-step verification for SMB site owners, emergency response, and the defensive baseline every WordPress business site should run.
Read postSharePoint Server RCE CVE-2026-33112: What an SMB Should Do This Week
On-prem SharePoint RCE patched in May Patch Tuesday. No workaround, cumulative update is the only fix. PowerShell verification steps, web-shell hunting, and the on-prem-to-SharePoint-Online migration math.
Read postWindows MiniPlasma SYSTEM Privilege Escalation: No Patch, Public PoC
Public PoC for a Windows Cloud Filter driver flaw (CVE-2020-17103) takes any standard user to SYSTEM on fully patched Windows 11. Microsoft's 2020 fix did not fully resolve it. Defensive controls that actually move the needle while we wait for a real patch.
Read postAI Has Cut Attacker Handoff to 22 Seconds: What an SMB Should Do
Initial-access-to-handoff has dropped from 8 hours to 22 seconds in three years. Human-paced IT cannot keep up. The realistic 2026 minimum: identity hardening, EDR, 24/7 MDR, and automated containment.
Read postCyber-Insurance Renewal Checklist for Central Coast Small Business
The controls a Central Coast underwriter is going to ask about, and how to be ready for the renewal questionnaire without scrambling at the last minute.
Read postExchange Server Zero-Day CVE-2026-42897: What an SMB Should Do Today
Active exploitation of an OWA XSS zero-day in on-prem Exchange. Verification PowerShell, defensive layers, and why this is the post that should make you start planning the migration off on-prem Exchange.
Read postMay 2026 Patch Tuesday: What an SMB Should Patch This Week
120 fixes, 17 critical. The two CVEs small businesses should patch first, plus what Microsoft's new MDASH scanner means for next month.
Read postIdentity Hardening for the 5-Employee Company: The Real Minimum in 2026
Five identity controls that actually move the needle for a 5-to-25-person business on Microsoft 365: phishing-resistant MFA, separated admin accounts, Conditional Access, no persistent local admins, and legacy auth turned off.
Read postYellowKey & GreenPlasma: Two Windows Bypasses, Explained for Defenders
A plain-talk read on two publicly disclosed Windows bugs: a BitLocker bypass through WinRE and a CTFMON privilege-escalation primitive.
Read postClaude Mythos Found 271 Firefox Bugs in One Run: The Patch-Cadence Shift
Anthropic's Claude Mythos found 271 vulnerabilities in Firefox 150 in a single eval. Why patching is moving from quarterly to continuous, and what that means for small business in 2026.
Read postThe Canvas Data Breach: What Happened and How to Protect Your Information
A plain-talk breakdown of the May 2026 Instructure Canvas breach by ShinyHunters: what was actually stolen, what was not, and the steps to take.
Read postRansomware in 2026: How It Actually Gets In, and What Stops It
How ransomware actually gets into small business networks, what happens after the attackers get in, and the controls that actually stop them.
Read postThe Cybersecurity Mistakes I See in Almost Every Small Business
After years of opening up small business networks for the first time, the same five gaps show up over and over. None of them are exotic. All of them are fixable in a week.
Read postIndustry IT
Industry-specific guidance for businesses operating in regulated or operationally sensitive sectors across the Central Coast.
Hospitality IT and Cybersecurity on the Monterey Bay: Restaurants, Hotels, and Wineries in 2026
A plain-talk guide for restaurants, hotels, inns, and wineries: PCI and POS scope, guest Wi-Fi segmentation, booking and wine-club uptime, seasonal-staff identity, ransomware and quishing defense, PSPS continuity, and a realistic IT budget.
Read postIT for Law Firms, CPAs, and Professional Offices on the Central Coast: A 2026 Guide
Privileged client data and client money make a professional office a target that punches above its weight. Email and BEC defense, client confidentiality, Microsoft 365 hardening, the FTC Safeguards Rule and IRS WISP for tax and financial firms, the lawyer's confidentiality duty, and continuity for filing deadlines.
Read postIT and Cybersecurity for Salinas Valley Agriculture: A 2026 Guide for Growers, Packers, and Coolers
The Salad Bowl of the World runs on a perishable clock. Cold-chain and cooler monitoring, produce ERP and FSMA 204 traceability, food-safety audit IT for PrimusGFS and SQF, seasonal-account hygiene, and the harvest-timed ransomware and wire fraud aimed at produce.
Read postManufacturing IT and Cybersecurity on the Central Coast: OT/IT, CMMC, and Ransomware in 2026
The most-targeted ransomware sector, with the CMMC 2.0 clock already ticking. OT/IT segmentation and shop-floor security, ERP/MES/PLM and CAD-vault uptime, the legacy-CNC problem, and a realistic CMMC and NIST 800-171 readiness path for a Central Coast shop.
Read postEngineering and Architecture IT on the Central Coast: CAD, BIM, and Protecting Your Project Data in 2026
CAD and BIM firms lose billable hours to slow files and carry real risk in an untested vault. Workstation and PDM/vault performance, the VPN large-file fix, IP protection, NCEES seals, ITAR and CMMC flow-down, and tested backup of a multi-terabyte vault.
Read postProperty Management IT in Monterey and Santa Cruz Counties: A 2026 Owner's Guide
A plain-talk guide for firms and HOAs: Yardi and AppFolio uptime, tenant-data protection, resident-network segmentation, vendor-banking and wire-fraud defense, FTC Safeguards and Davis-Stirling compliance, and a realistic IT budget.
Read postHIPAA-Compliant IT for Medical and Dental Practices in Monterey County
What HIPAA-compliant IT actually looks like for a Monterey County medical or dental practice, beyond the marketing checkbox.
Read postPG&E PSPS IT Continuity Plan for Central Coast Businesses
How to keep your business running through Public Safety Power Shutoffs without losing data, customers, or compliance posture.
Read postCloud Services
Moving to the cloud the right way — what to migrate, what to keep, and how to do it without surprise downtime or a surprise bill. See our cloud services for the full program.
Cloud Services for Central Coast Small Business: What to Move, What to Keep, and How to Migrate in 2026
The cloud is not all-or-nothing and not automatically cheaper. What to move first, what to keep on-prem, a phased migration playbook, the real cost math, and how cloud keeps you running through a PG&E shutoff.
Read postWeb Development
Notes on building real websites for small business — fast loading, accessible, well-ranked, and actually maintainable.
ADA Website Accessibility for Small Business: What California Law Actually Requires in 2026
Website accessibility demand letters are hitting small businesses across California, and the Unruh Act makes it more expensive here than almost anywhere else. What actually counts as compliant, and the fixes that close most of the risk.
Read postHow Much Does a Small Business Website Cost in 2026? Real Numbers
Starter sites, full business sites, e-commerce, add-ons, and maintenance — what a professional website actually costs in 2026, with real numbers instead of "it depends."
Read post9 Signs Your Small Business Website Is Costing You Customers
Slow on phones, invisible on Google, running on abandoned software — the warning signs your website is turning customers away, and when a refresh beats a full rebuild.
Read postTop Website Design Companies in Salinas and the Monterey Bay
How to evaluate website design and development providers in Salinas and the Monterey Bay, and what to expect from a small business build.
Read postTroubleshooting Guides
Specific fixes for specific problems — the kind of writeup the engineer keeps in a notebook and reaches for again the next time.
QuickBooks "Can't Complete the Current Action" Email Error: The Real Fix on Windows 11
The XPS Document Writer fix for QuickBooks Desktop's email error on Windows 11, including the trick most guides miss.
Read post