You download a new app, open it for the first time, and a pop-up appears: “Allow this app to access your contacts?” Most people tap “Allow” without a second thought. The app seems to need it for something, and it takes less effort to say yes than to wonder why.

But that tap shares a lot more than most people expect. Your contacts list isn’t just your information; it’s a collection of names, phone numbers, email addresses, and sometimes job titles belonging to people who never downloaded that app, never agreed to its terms, and have no idea their details just went with you.

What apps actually do with that data

The most common explanation apps give is that contact access helps you find friends who are already on the platform. Some apps genuinely do stop there, but many don’t.

A significant number of apps upload your entire contacts list to their servers the moment you tap “Allow,” regardless of whether you ever use the friend-finding feature. That data gets used to build a detailed map of who knows whom, sometimes called a “social graph,” which helps platforms target advertising more precisely, including at people who’ve never even created an account.

READ MORE:  6 Ways to Combat Social Phishing Attacks

In a number of well-documented cases, contact data has been sold to or shared with data brokers, companies that compile detailed profiles on individuals from dozens of different sources. Your doctor, your boss, your elderly parent: anyone in your list could end up in one of those profiles without ever knowingly interacting with the app.

The angle most people don’t consider

Most privacy conversations focus on what apps know about you. The contacts issue is different because the people most affected are not you but everyone on your list, and they never had a choice in the matter.

When you tap “Allow,” you’re making a privacy decision on behalf of other people. That’s worth sitting with for a moment, because it changes how you think about the permission prompt next time.

How to check what you’ve already allowed

It’s straightforward to see which apps currently have access to your contacts and cut off the ones that don’t need it.

On an iPhone, go to Settings, then Privacy and Security, then Contacts. You’ll see every app that’s been granted access. Tap any one to change it to “None” if there’s no good reason for it to have that permission.

On Android, the path varies slightly depending on your phone’s manufacturer, but you’re generally looking for Settings, then Apps, then Permissions, then Contacts. Some versions have a dedicated Privacy section or Permission Manager that shows the same information in a cleaner layout.

READ MORE:  Beware These Social Media Scams

Go through that list with a critical eye. A weather app, a shopping tool, a photo editor: none of these have a legitimate reason to read your contacts, and if they’re on that list, you can safely remove their access right now.

A simple test for future permission prompts

Before tapping “Allow” on any permission request, ask yourself one question: what would this app actually lose if I said no? For most apps, the honest answer is very little. If you decide later that you want to grant access for a specific feature, you can turn it on manually. Turning it off after the fact is something most people never remember to do.

If you’ve got questions about your devices, need help with your home network, or just want someone to take a look at what’s running on your phone or computer, give us a call. That’s what we’re here for.

According to the FBI’s 2025 Internet Crime Report, business email compromise (BEC) cost US businesses more than $3 billion last year.

This makes it one of the most financially damaging cybercrimes on record. 

AI has made these attacks harder to detect. The question for AP teams is no longer whether they can identify suspicious requests. It is whether the processes around payments make fraud difficult regardless of how convincing it looks.

Why AP Teams Are in the Crosshairs

Accounts payable sits at the intersection of trust and timing. AP teams process invoices, manage supplier details, and execute payments, often under pressure to keep operations running smoothly. 

For attackers, that combination is ideal.

Most successful fraud does not involve breaking into systems. 

The FBI’s Internet Crime Complaint Center (IC3)  has consistently found that BEC attacks rely on impersonation. This involves posing as a trusted executive, supplier, or internal colleague to redirect payments or update bank details before anyone notices.

AI has made that impersonation dramatically more scalable. 

Where it once required skill and time to craft a convincing request, tools are now widely available that automate the research, writing, and contextual tailoring that make fraud blend into normal AP workflows.

By mid-2024, an estimated 40% of BEC phishing emails were already AI-generated, with that share expected to grow significantly.

What AI-Enhanced Fraud Looks Like in Practice

Emails that blend into normal workflow

Traditional phishing relied on volume and imperfection. AI has changed that. 

Modern BEC emails are grammatically correct and written in the specific tone of the executive or supplier being impersonated. They reference active projects, current invoice numbers, and upcoming payment runs. 

For AP teams processing high volumes of routine communications, that level of familiarity is exactly what lowers the guard.

Invoice and payment redirection

One of the most common AP fraud patterns involves payment redirection. 

Attackers may intercept a legitimate invoice exchange and quietly alter the destination account. They then send a short message claiming a supplier has updated its banking details, or re-issue a real invoice with minor modifications. 

The surrounding content looks entirely legitimate because, in many cases, it is drawn from real correspondence. 

Voice cloning and executive impersonation

Email isn’t the only channel being exploited. 

AI voice-cloning tools can replicate a person’s voice from a short audio sample. That makes it possible to leave convincing voicemails or place calls that sound like a known executive.

For AP teams accustomed to verbal approvals on high-value or urgent payments, this removes one of the few remaining verification methods that email security alone cannot address. 

Why Traditional Checks No Longer Work

Security awareness training still matters, and investing in it remains worthwhile. But AI has changed what AP teams are up against.

 Attacks no longer contain the signals that training programs once focused on: awkward phrasing, mismatched logos, odd sender addresses, or generic greetings. 

Modern fraud emails can reference the recipient’s organization, active suppliers, and current invoice values drawn from publicly available or previously intercepted sources.

When a fraudulent request is indistinguishable from a legitimate one, placing the burden of detection on the AP team puts it in the wrong place. 

The organizations that reduce risk are not asking staff to be more suspicious. They are building verification processes that work independent of how a message looks.

Building Process Around the Risk

The most effective defense is not sharper instincts. It is removing ambiguity from high-risk actions.

Out-of-band verification as standard

Any request to change supplier bank details or approve an urgent payment outside the normal cycle should require secondary confirmation through a known, independent channel — not a reply to the same email thread. Calling a supplier on a number already on file, or confirming with a colleague directly, breaks the impersonation chain regardless of how convincing the original request appeared. This step does not require technology. It requires a written procedure and the team’s habit of following it.

Layered access and authentication controls

Restricting access to financial systems and enforcing multi-factor authentication limits the damage a compromised account can cause. If an attacker gains access to a vendor’s email, MFA requirements on the receiving end create friction that can slow or stop a fraudulent change before any money moves.

A culture that supports slowing down

Fraud prevention improves when staff feel safe questioning requests, including from senior leadership. 

A team member who pauses a payment to verify it is not being obstructive. They are doing exactly what good process requires. 

Building that culture starts with leadership modeling the behavior and making clear that slowing down on high-risk actions is always the right call.

The FBI’s 2025 Internet Crime Report included a dedicated AI section for the first time, logging more than $893 million in AI-enabled scam losses across more than 22,000 complaints.

When verification is standard and questioning is encouraged, AI-enhanced fraud loses much of its advantage. 

The technology attackers use is advancing quickly, but the process controls that contain the damage do not have to be complicated. They have to be consistent.

Shift the Burden From People to Process

Concerned about AI-enhanced fraud targeting your finance teams or clients? 

Contact us or schedule a consultation to review your current controls and identify where the most important gaps are.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

That scenario surprises many businesses, particularly those that rely on multi-factor authentication (MFA) to protect cloud accounts. But this is exactly how Adversary-in-the-Middle (AiTM) phishing attacks work. 

Rather than stealing passwords for later use, these attacks silently hijack an already-authenticated session in real time.

MFA remains a core control, and getting it implemented correctly is still a critical first step for any business. 

But AiTM attacks exploit something MFA was never designed to protect: the trusted session that exists after authentication has already completed.

Phishing Has Moved Beyond Passwords

Phishing remains the most common starting point for account compromise, but the objective has changed. 

Traditional phishing collected usernames and passwords. Modern phishing is after something more immediately useful: the authenticated session itself.

Security researchers have documented a significant shift toward session and token theft, where attackers intercept the authentication process as it happens. 

Rather than reusing stolen credentials, which MFA typically blocks, they wait until the user successfully completes login, then steal the session token that proves it already occurred.

The technique has matured quickly. Phishing-as-a-Service (PhaaS) platforms now supply ready-made proxy toolkits that let even low-skilled attackers run AiTM campaigns targeting Microsoft 365 and Google Workspace. 

How AiTM Attacks Actually Work

The fake login page that isn’t fake

An AiTM phishing site is not a basic replica of a login page. It is a live reverse proxy.

The attacker’s infrastructure sits between the user and the real authentication service. Every keystroke, redirect, and server response flows through the attacker’s system in real time. From the user’s perspective, nothing looks wrong. 

The page behaves exactly like the real service, with correct branding, working redirects, and a functioning MFA prompt. In most cases, the only clue is a slightly altered URL that goes unnoticed on a mobile screen or when someone is under time pressure.

Why MFA doesn’t stop it

This is where many security assumptions fall apart.

MFA protects the moment of authentication, not what comes after it. 

Once a user successfully completes MFA, the service issues a session cookie. What this means is that the cookie signals to the application that the user is already verified. From that point, no password or MFA prompt is required. The system trusts the token. Whoever holds the cookie holds the access.

AiTM attacks simply wait for that cookie to be issued then steal it.

Microsoft tracked a 146% rise in AiTM attacks over the past year, as cybercriminals increasingly shift focus to accounts already protected by MFA.

Much of this increase is driven by PhaaS platforms like Evilginx that allow even low-skilled attackers to run convincing reverse-proxy campaigns at scale, targeting major cloud identity providers with minimal setup.

Session cookies

Session tokens act as bearer credentials. So, whoever possesses the token can access the account, with no password or MFA challenge required.

Once the cookie is stolen, the attacker imports it into their own browser and immediately resumes the session. 

This is a session replay attack. The attacker does not log in. They pick up where the legitimate user left off, inside a fully trusted, already-verified session.

What Happens After a Session Is Stolen

The aftermath of an AiTM attack tends to be quiet, which is precisely what makes it dangerous. 

The attacker is operating inside a legitimate, authenticated session. There are no failed MFA attempts, no unusual login alerts, and nothing in standard sign-in logs to signal a problem.

Research from Proofpoint shows that attackers who gain access through session hijacking commonly create hidden inbox rules to redirect mail, register additional MFA methods to lock in persistent access, monitor email threads for financial conversations, and use the trusted account to launch phishing campaigns against internal colleagues or finance teams.

These follow-on actions are a key reason AiTM attacks are frequently uncovered late, after financial fraud, data exposure, or wider network compromise has already begun.

Reducing Your Exposure

MFA is still essential. Building strong authentication practices remains the starting baseline. But reducing AiTM risk requires controls that extend beyond the login event itself.

Adopt phishing-resistant MFA

Methods like FIDO2 hardware keys and passkeys bind authentication to the specific device and the legitimate domain. A proxy in the middle cannot relay them: the process fails if the URL is not the real one. 

The Canadian Centre for Cyber Security analyzed over 100 AiTM campaigns targeting Microsoft Entra ID accounts. It found that phishing-resistant MFA consistently blocked session theft where standard MFA methods (including push notifications and one-time passcodes) did not.

Tighten Conditional Access policies

Risk-based access controls evaluate additional signals, including device compliance, IP location, and session behavior, rather than treating every authenticated session as permanently trusted. 

Configured correctly, these policies can detect and block anomalous access even when a stolen session token appears valid.

Monitor for post-login anomalies

Detecting AiTM compromise typically means watching for activity after login: new MFA method registrations, inbox rules created outside business hours, access from unfamiliar locations, or unusual data activity. 

Authentication logs alone will not surface the problem.

Train users on URL awareness

Employees who understand that a working MFA prompt on an unfamiliar-looking page still represents a risk are better positioned to pause, check the URL, and report before a session is compromised. A brief team walkthrough of what AiTM lures look like in Microsoft 365 contexts can meaningfully reduce exposure.

Stop Protecting Just the Login Screen

MFA is a baseline, not a finish line. The businesses that reduce AiTM risk are the ones that understand how sessions, tokens, and identity trust actually work . And they build controls around each layer, not just the login screen.

Want to review your identity security controls? 

Contact us or schedule a consultation to identify the gaps that matter most before an incident does it for you.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

But something else may have come along for the ride.

This is called malvertising. It’s not a phishing email and it’s not a suspicious link from a stranger. Instead, it’s a malicious advertisement placed at the very top of a search result page, carefully designed to look exactly like the real website you’re trying to visit.

What Actually Happens

Cybercriminals buy Google ads targeting searches people run every day: “Adobe Acrobat download,” “WinRAR,” “Zoom installer,” “7-Zip,” “VLC media player,” and countless others. The ad appears above the legitimate search results, sometimes even above the software company’s own website, and directs users to a convincing copy of the real download page.

The web address is usually just slightly different from the legitimate site—close enough to pass a quick glance. Most people don’t carefully inspect URLs when Google has already done the searching for them.

READ MORE:  ClickFix: The Scam That Learned a New Trick

The download can be almost anything: ransomware, a tool that gives someone remote access to the computer, or a type of malware known as an infostealer that quietly collects saved passwords, browser cookies, and other sensitive information before sending it to an attacker. In some cases, the malicious installer even launches the legitimate software after installation, leaving the victim with no reason to suspect anything is wrong.

The Problem with “Just Be Careful”

Traditional security advice focuses heavily on phishing emails, suspicious attachments, and unexpected links from strangers. Those are still important threats, but none of that training would necessarily protect someone who searched for Zoom, clicked the first result, and downloaded what appeared to be the official installer.

The reality is that they didn’t do anything that seemed risky.

There is also a trust issue with search engines themselves. Many people assume that appearing at the top of Google means a website has been verified or endorsed. While paid advertisements are labeled as “Sponsored,” the label is subtle and often overlooked.

Why This Matters

The risk isn’t limited to businesses.

At home, a malicious download can expose online banking credentials, email accounts, social media accounts, saved passwords, personal documents, and family photos.

In a business environment, the consequences can be even broader. The entry point might be the receptionist’s computer, a new employee’s laptop, or a workstation where someone downloads a free utility to solve a problem quickly. Every device that allows software downloads becomes a potential target.

Passwords stolen from one machine rarely stay there. An infostealer that collects browser-saved credentials can provide access to email accounts, accounting systems, cloud platforms, customer information, and other business-critical resources—all without triggering an obvious warning.

What Actually Helps

Technology can help close the gap that user awareness alone cannot.

DNS filtering acts like a doorman with a list of known bad actors. Before a browser loads a website, it checks whether the destination has already been identified as malicious. If it has, access is blocked regardless of how the user arrived there.

Endpoint detection and response (EDR) tools focus on behavior rather than appearance. A legitimate software installer follows predictable patterns. Malware behaves differently, and modern security tools can often detect and stop those actions even when the installer appears legitimate on screen.

For businesses, managed IT providers can reduce the risk even further by maintaining approved software lists, ensuring devices arrive preconfigured with required applications, controlling software updates, and providing security awareness training that covers modern threats like malvertising—not just phishing emails.

READ MORE:  Phishing 2.0: How AI is Amplifying the Danger and What You Can Do

When the software people need is already available and properly managed, there is far less reason to search for downloads in the first place.

The Bottom Line

Malvertising is effective because it doesn’t ask anyone to do something obviously suspicious. The person who gets infected wasn’t necessarily careless—they followed a process that millions of people use every day.

Protecting against that threat requires more than vigilance alone. It requires layers of protection at the network level, the device level, and the process level. Whether you’re protecting a family computer or an entire business, those layers are what turn a simple search into a much safer experience.

After you sign in, your browser keeps you logged in using a session token (often stored as a cookie). It’s the digital version of a wristband at an event: once you’ve been checked, the wristband proves you belong there. If an attacker steals that wristband, they may not need to beat your MFA prompt at all.

That’s the core of session cookie hijacking. The attacker isn’t “cracking” MFA. They’re skipping it by replaying your already authenticated session.

This isn’t a reason to stop using MFA. It’s a reason to stop treating MFA as the finish line. 

When sessions can be stolen, the practical defence shifts to layered controls: phishing-resistant sign-ins, device hygiene, tighter session policies, and detection that catches suspicious access early.

Why MFA Isn’t a “Game Over” Control

MFA is still one of the best upgrades most businesses can make, but it doesn’t end an attack on its own. The reason is that attackers don’t always try to beat the login step. They try to go around it.

Cloudflare notes that “attackers are finding new ways to circumvent MFA” and that modern incidents are rarely one isolated technique. They’re “part of a chain of attacks.” 

In other words, MFA can block a lot of credential theft, but it doesn’t automatically protect what happens after a user successfully signs in. 

That’s where session cookie hijacking comes in. 

Microsoft has described adversary-in-the-middle phishing campaigns where attackers use a reverse-proxy site to “steal and intercept” a user’s password and the session cookie that proves they have an authenticated session. 

This is “not a vulnerability in MFA.” The attacker isn’t breaking the MFA. They’re reusing the session. 

What a Session Cookie Is and Why Attackers Want It

When you sign into a web app, the site needs a way to remember that you’ve already proved who you are. That’s what a session is: a temporary “logged-in” state that saves you from entering your password and MFA code on every click. 

Kaspersky explains that session hijacking is “sometimes called cookie hijacking” because cookies are commonly used to store the session identifier that keeps you authenticated. 

Attackers want that session identifier because it’s the shortcut. 

Proofpoint describes session tokens as digital “keys” that let a user stay authenticated. It warns that stealing valid tokens lets attackers impersonate legitimate users and potentially bypass authentication measures “like MFA.” 

That’s why session cookie hijacking is so highly leveraged. 

If an attacker can steal the cookie or token that represents your active session, they’re not trying to defeat the login process. They’re attempting to reuse what you already completed, and access the same apps and data as if they were sitting at your keyboard.

How Session Cookie Hijacking Actually Happens

A lot of teams picture “account takeover” as someone guessing a password or tricking a user into approving an MFA prompt. 

Session cookie hijacking is different. The attacker’s goal is to steal the proof that you’re already logged in, then reuse it, often without triggering another sign-in challenge.

1.) AiTM phishing 

Adversary-in-the-middle (AiTM) phishing is the “proxy login” trap. 

You think you’re signing into a normal service, but you’re actually signing into a lookalike page that sits between you and the real site. The attacker relays the login in real time, so everything appears to work, including MFA.

Attackers use AiTM phishing sites to “steal and intercept” a user’s password and the session cookie that proves the authenticated session. This is “not a vulnerability in MFA.” The attacker isn’t breaking the MFA. They’re capturing the session after MFA is completed and reusing it. 

One such campaign “attempted to target more than 10,000 organisations” since September 2021, which shows how scalable this approach has become. 

2.) Browser-in-the-Middle session stealing

Browser-in-the-middle (BitM) is similar in spirit, but it’s even more “hands-on” from the attacker’s side. 

Instead of stealing a password and running away, the attacker effectively places themselves in control of the browsing session.

Google’s threat intelligence says, “Stealing this session token is the equivalent of stealing the authenticated session.” Once the token is stolen, “an adversary would no longer need to perform the MFA challenge.” 

In other words, the attacker isn’t trying to authenticate instead of you. They’re trying to ride along after you’ve authenticated.

3.) Cookie theft from the endpoint

Not every session hijack starts with a fancy proxy. Sometimes the attacker simply steals session data from the device itself.

Stealing valid session tokens allows attackers to impersonate legitimate users. Tokens act like digital “keys.” If an endpoint is compromised, those “keys” can be extracted and reused.

Invicti explains that an attacker steals HTTP cookies and can gain access. The goal is often to obtain sensitive information stored in cookies. 

MFA Is a Baseline, Not a Finish Line

MFA is still essential. It blocks a huge amount of credential theft and makes basic account takeover harder. But session cookie hijacking is a reminder that attackers don’t always try to defeat the login step. Sometimes they reuse what happens after it.

The practical response is layered and realistic. Make phishing harder to pull off, and treat device health as part of identity. Tighten session behaviour for high-risk apps. Watch for suspicious access patterns that suggest a session is being replayed.

When those controls work together, MFA stops being a comforting checkbox and becomes what it should be: a strong baseline that’s backed by protections around the session itself.

Contact us today for help protecting your login sessions from hijacking.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

This is a real attack pattern that’s been identified by security researchers, and it’s worth understanding exactly why it works so well.

Why this scam is so hard to spot

Most people know to be suspicious of random email attachments or sketchy download sites. This attack sidesteps all of that by looking completely normal at every stage.

It starts with a platform you trust. Google Forms is used by schools, employers, and businesses every day, so landing on one doesn’t set off any alarm bells. The form itself asks for professional information: your work history, your experience, your background. That’s exactly what a real recruiter would ask for, so filling it in feels completely reasonable.

READ MORE: LinkedIn “Social Engineering”: Protecting Your Staff from Fake Recruitment Scams

Then comes the download. In a genuine hiring process, it’s common to receive a contract to review, a role overview to read through, or a brief to look at before an interview. Downloading a file feels like a normal next step, not a trap.

The files are named to match the situation too, using real company names from well-known industries such as finance, logistics, and technology. Nothing about the experience feels out of place until it’s too late.

What the file actually does

The ZIP or RAR file you download contains a hidden malicious program. Once you open it, it installs itself quietly in the background and gives the attacker remote control over your device.

From that point, they can run commands on your computer without you knowing; collect your passwords, saved browser data, and any crypto wallet details; and pull information from apps such as Telegram. They can also install additional tools to dig deeper over time, and the infection is designed to survive a restart, so simply turning your computer off and on won’t remove it.

You likely wouldn’t notice any of this happening. There’s no pop-up, no obvious slowdown, and no message telling you something is wrong.

How to spot it before you click

A few things should make you pause before you download anything:

The download is a ZIP or RAR file, not a straightforward PDF or Word document. Legitimate employers don’t typically send compressed archives as part of an initial application process.

The link goes to a file-sharing site you haven’t heard of, or it’s hidden behind a shortened URL that doesn’t show you where it actually leads.

The opportunity came out of nowhere, especially if you didn’t apply for the role and the contact isn’t someone you know.

If any of these apply, it’s worth stopping before you click.

What to do instead

Go to the company’s real website and search for the role to confirm it actually exists. If you can’t find it there, that tells you everything. If you’re unsure, call the company directly using the contact details on their official site, not the number or email provided in the form.

READ MORE: How to Spot Fake Download Buttons and Stay Safe

Never download a file from a form you weren’t expecting, even if the form looks professional and the company name is familiar.

If you’ve already opened a suspicious file and something feels off with your device, whether it’s running slowly, behaving strangely, or showing activity you don’t recognize, bring it in and we’ll take a look. And if you’d rather not rely on spotting these things yourself, there’s a better option. We can install protection software on your device that catches malicious downloads before they ever have a chance to run, so even if you click something you shouldn’t have, the threat gets stopped at the door. Give us a call, and we’ll get you set up.

But in practice, a browser extension is more like a micro-SaaS vendor sitting inside your browser session. It can see what you see, interact with the pages you open, and sometimes access the same cloud apps your business runs on all day.

That’s why a browser extension security check matters. 

Not because every extension is bad, but because it only takes one over-permissioned add-on or one bad update to turn “helpful” into exposure.

The good news is you don’t need a 40-page policy to reduce the risk. A simple five-minute check can prevent most extension problems before they start.

Why Browser Extensions Are a High-Leverage Risk

Browser extensions sit in the most sensitive place in modern work: the browser tab where your staff live all day. 

That matters because extensions aren’t just “apps”. They’re granted special authorisations inside the browser. That makes them attractive targets and gives them leverage that’s disproportionate to how “small” they feel. 

UC Berkeley’s guidance says extensions get “special authorisations,” and the more you install, the bigger the attack surface becomes.

The risk is often permission-based. OWASP calls out “permissions overreach” as a core problem. Extensions can request more access than they need, including access to “all tabs, browsing history, and even sensitive user data.” 

When an extension can read and modify what happens in the browser, it can potentially see data in cloud tools, capture what’s typed into forms, or alter content on a page.

It’s also a “change over time” risk. A useful extension today can become a different extension tomorrow. 

The 5-Minute Browser Extension Security Check

This browser extension security check is designed to be fast, repeatable, and realistic. It helps staff make safe decisions in minutes without turning every extension into a big IT ticket.

Vet the developer like a real vendor

If you wouldn’t give a random supplier access to your customer records, don’t give a random extension access to your browser.

Start with the basics:

• Confirm the developer has a real website, support details, and a consistent name across listings
• Look for a track record (other products, a clear company presence, updates that look normal)
• Prefer official stores and trusted sources over “download this .zip” links

Read the description like a contract

Treat the store listing as a mini security disclosure. It should clearly explain what the extension does and why it needs access.

What to look for:

• Specific, concrete function 
• Clear explanation of what data it touches 
• Any hint of tracking, analytics, or data sharing that doesn’t match the core feature.

Permission sanity check

Permissions are the whole game. This is where a “helpful tool” can become a high-leverage risk.

Microsoft’s Edge Add-ons policies say extensions “must only request those permissions that are essential for functioning,” and requesting permissions for “future proofing” is “not allowed.”

How to do a fast check:

• Ask: “Does this permission match the feature?” If not, it’s a red flag.
• Be cautious of anything that effectively means “read and change everything you do in the browser.”
• Remember: Google even publishes guidance for admins to “evaluate the security risk” of different extension permissions.

Check updates and change risk

Extensions aren’t static. They update. And updates can change what the extension can do.

Two things to watch:

• Permission creep: If an extension suddenly requests new permissions, you should be wary. And if you can’t justify it, “it’s probably better to uninstall”
• Update abuse: Treat unexpected permission changes or sudden feature shifts as a reason to pause and escalate

Decide: approve, avoid, or escalate

You don’t need a committee for every install. 

You need a simple decision tree:

• Approve when the vendor is credible, the purpose is clear, and permissions are tight and match the feature
• Avoid when the extension is vague, over-permissioned, or feels like it wants access “just in case”
• Escalate when it’s genuinely useful but touches sensitive systems or asks for broad permissions. 
• Have IT review it and, if approved, add it to an allowlist

From “Quick Install” to Clear Standards

Browser extensions aren’t “bad”. Unvetted extensions are the problem.

A simple browser extension security check turns installs from impulse decisions into repeatable standards. 

You’re not trying to slow people down. You’re trying to make sure the tools that live inside your browser have a clear purpose, tight permissions, and a vendor you’d actually trust.

Start small. Reduce extension sprawl, treat permission changes as a red flag, and escalate anything that touches sensitive systems. 

Then make it easier for staff to do the right thing by default with an approved list and browser-level controls. When installs are standardised, extensions stop being a hidden risk and become just another managed part of the environment.

Contact us today to schedule a browser extension audit.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

In many cases, it begins days, or even weeks, before encryption, with something mundane, like a login that never should have succeeded.

That’s why an effective ransomware defense plan is about more than deploying anti-malware. It’s about preventing unauthorized access from gaining traction.

Here’s a five-step approach you can implement across your small-business environment without turning security into a daily obstacle course.

Why Ransomware Is Harder to Stop Once It Starts

Ransomware is rarely a single event. It’s typically a sequence: initial access, privilege escalation, lateral movement, data access, often data theft, and finally encryption once the attacker can inflict maximum damage.

That’s why relying on late-stage defenses tends to get messy.

Once an attacker has valid access and elevated privileges, they can move faster than most teams can investigate. Microsoft says, “In most cases attackers are no longer breaking in, they’re logging in.”

By the time encryption begins, options are limited. The general guidance from law enforcement and cybersecurity agencies is clear: don’t pay the ransom, there’s no guarantee you’ll recover your data, and payment can encourage further attacks.

There isn’t a silver bullet for preventing a ransomware attack. A ransomware defense plan is most effective when it disrupts the attack before encryption ever begins. That’s why recovery needs to be engineered upfront, not improvised mid-incident.

The goal isn’t “stop every threat forever.” The goal is to break the chain early and limit how far an attacker can move. And if the worst happens, you want recovery to be predictable.

The 5-Step Ransomware Defense Plan

This ransomware defense plan is built to disrupt the attack chain early, contain the damage if access is gained, and ensure recovery is dependable. Each step is practical, easy to implement, and repeatable across small-business environments.

Step 1: Phishing-Resistant Sign-Ins

Most ransomware incidents still begin with stolen credentials. The fastest win is to make “logging in” harder to fake and harder to reuse once compromised.

What this means: “Phishing-resistant” sign-ins are authentication methods that can’t be easily compromised by fake login pages or intercepted one-time codes. It’s the difference between “MFA is enabled” and “MFA still works when someone is specifically targeted.”

Do this first:

• Enforce strong MFA across all accounts, with priority given to admin accounts and remote access
• Eliminate legacy authentication methods that weaken your security baseline
• Implement conditional access rules, such as step-up verification for high-risk sign-ins, new devices, or unusual locations

Step 2: Least Privilege + Separation

What this means: “Least privilege” means each account gets only the access it needs to do its job, and nothing more.

“Separation” means keeping administrative privileges distinct from everyday user activity, so a single compromised login doesn’t hand over control of the entire business.

NIST recommends verifying that “each account has only the necessary access following the principle of least privilege.”

Practical moves:

• Keep administrative accounts separate from everyday user accounts
• Eliminate shared logins and minimize broad “everyone has access” groups
• Limit administrative tools to only the specific people and devices that genuinely require them

Step 3: Close known holes

What this means: “Known holes” are vulnerabilities attackers already know how to exploit, typically because systems are unpatched, exposed to the internet, or running outdated software. This step is about eliminating easy wins for attackers before they can take advantage of them.

Make it measurable:

• Set clear patch guidelines: critical vulnerabilities addressed immediately, high-risk issues next, and all others on a defined schedule
• Prioritize internet-facing systems and remote access infrastructure
• Cover third-party applications as well, not just the operating system

Step 4: Early detection

What this means: Early detection means identifying ransomware warning signs before encryption spreads across the environment.

Think alerts for unusual behavior that enable rapid containment, not a help desk ticket reporting that files suddenly won’t open.

A strong baseline includes:

• Endpoint monitoring that can flag suspicious behavior quickly
• Rules for what gets escalated immediately vs what gets reviewed

Step 5: Secure, Tested Backups

What this means: “Secure, tested backups” are backups that attackers can’t easily access or encrypt, and that you’ve verified you can restore successfully when it matters most.

Both NIST’s ransomware guidance and the UK NCSC emphasize that backups must be protected and restorable. NIST specifically calls out the need to “secure and isolate backups.”

Keep backups up-to-date so you can recover “without having to pay a ransom”, and check that you know how to restore your files.

Make backups real:

• Keep at least one backup copy isolated from the main environment.
• Run restore drills on a schedule
• Define recovery priorities ahead of time, what needs to be restored first, and in what sequence

Stay Out of Crisis Mode

Ransomware succeeds when environments are reactive, when everything feels urgent, unclear, and improvised.

A strong ransomware defense plan does the opposite. It turns common failure points into predictable, enforced defaults.

You don’t need to rebuild your entire security program overnight. Start with the weakest link in your environment, tighten it, and standardize it.

When the fundamentals are consistently enforced and regularly tested, ransomware shifts from a headline-level crisis to a contained incident you’re prepared to manage.

If you’d like help assessing your current defenses and building a practical, repeatable ransomware protection plan, contact us today to schedule a consultation. We’ll help you identify your biggest exposure points and turn them into controlled, measurable safeguards.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

That’s the flaw in the old “castle-and-moat” model. Once someone gets past the perimeter, they can often move through the environment with far fewer restrictions than they should.

And today, with cloud apps, remote work, shared links, and BYOD, the “perimeter” isn’t even a clearly defined boundary anymore.

Zero-trust architecture for small businesses represents the shift that breaks that chain reaction. It’s an approach that treats every access request as potentially risky and requires verification every time.

What Is Zero-Trust Architecture?

Zero Trust is a model that moves defenses away from “static, network-based perimeters.” Instead, it focuses on “users, assets, and resources.” It also “assumes there is no implicit trust granted to assets or user accounts” based only on network location or ownership.

Microsoft sets the idea down into a simple principle: the model teaches us to “never trust, always verify.” In practice, that means verifying each request as though it came from an uncontrolled network, even if it’s coming from the office.

IBM reports that the global average cost of a data breach is over $4 million, which is why reducing blast radius isn’t a nice-to-have.

So, what does “Zero Trust” actually do differently day to day?

Microsoft frames it around three core principles: verify explicitly, use least privilege access, and assume breach.

In small-business terms, that usually translates to:

• Identity-first controls: Strong MFA, blocking risky legacy authentication, and applying stricter policies to admin accounts.

• Device-aware access: Evaluating who is signing in and whether their device is managed, patched, and meets your security standards.

• Segmentation to limit impact: Breaking your environment into smaller zones so access to one area doesn’t automatically grant access to everything else. Cloudflare describes microsegmentation as dividing perimeters into “small zones” to prevent lateral movement between systems.

Before You Start

If you try to “implement Zero Trust” everywhere at once, two things usually happen:

1. Everyone gets frustrated.
2. Nothing meaningful gets completed.

Instead, start with a defined protect surface, a small group of critical systems, data, and workflows that matter most and can realistically be secured first.

What Counts as a “Protect Surface”?

A protect surface typically includes one of the following:

• A business-critical application
• A high-value dataset
• A core operational service
• A high-risk workflow

The 5 Surfaces Most Small Businesses Start With

If you’re unsure where to begin, this shortlist applies to most environments:

1. Identity and email
2. Finance and payment systems
3. Client data storage
4. Remote access pathways
5. Admin accounts and management tools

BizTech makes the point that there’s no “Zero Trust in a box.” It’s achieved through the right mix of people, process, and technology.

The Roadmap

This is where zero-trust architecture for small businesses stops being a concept and becomes a plan. Each phase builds on the one before it, so you get meaningful risk reduction without creating a security obstacle course.

1. Start with Identity

Network location should not be treated as a trusted signal. Access should be based on who or what is requesting it, and whether they should have access at that moment. That’s why identity is step one.

Do these first:

• Enforce multifactor authentication (MFA) everywhere
• Remove weak sign-in paths
• Separate admin accounts from day-to-day user accounts

2. Bring Devices into the Trust Decision

Zero Trust isn’t just asking, “Is the password correct?” It’s asking, “Is this device safe to trust right now?”

Microsoft’s SMB guidance explicitly calls out securing both managed devices and BYOD, because small businesses often have a mix.

Keep it simple:

• Set a clear baseline: patched operating systems, disk encryption, and endpoint protection
• Require compliant devices for access to sensitive applications and data
• Establish a clear BYOD policy: limited access, not unrestricted access

3. Fix Access

Microsoft’s principle here is “use least privilege access.” This means users should have only what they need, when they need it, and nothing more.

Practical moves:

• Eliminate broad “everyone has access” groups and shared login accounts
• Shift to role-based access, where job roles determine defined access bundles
• Require additional verification for admin elevation, and make sure it’s logged

4. Lock Down Apps and Data

The old perimeter model doesn’t map cleanly to cloud services and remote access, which is why organizations shift towards a model that verifies access at the resource level.

Focus on your protect surface first:

• Tighten sharing defaults
• Require stronger sign-in checks for high-risk apps
• Clarify ownership: every critical system and dataset needs an accountable owner

5. Assume Breach

Microsegmentation divides your environment into smaller, controlled zones so that a breach in one area doesn’t automatically expose everything else.

That’s the whole point of “assume breach”: contain, don’t panic.

What to do:

• Segment critical systems away from general user access
• Limit admin pathways to management tools
• Reduce lateral movement routes

6. Add Visibility and Response

Zero Trust decisions can be informed by inputs like logs and threat intelligence. Because verification isn’t a one-time event, it’s ongoing

Minimum viable visibility:

• Centralize sign-in, endpoint, and critical app alerts
• Define what counts as suspicious for your protect surface
• Create a simple response plan

Your Zero-Trust Roadmap

Zero Trust architecture for small businesses doesn’t begin with a shopping list. It begins with a clear, focused plan.

If you’re ready to move from “good idea” to real implementation, start with a single protect surface and commit to the next 30 days of measurable improvements. Small steps, consistent execution, and fewer unpleasant surprises.

If you’d like help defining your protect surface and building a practical Zero Trust roadmap, contact us today for a consultation. We’ll help you prioritize the right controls, align them to your environment, and turn Zero Trust into steady progress, not complexity.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Most small businesses aren’t falling short because they don’t care. They’re falling short because they didn’t build their security strategy as one coordinated system. They added tools over time to solve immediate problems, a new threat here, a client request there.

On paper, that can look like strong coverage. In reality, it often creates a patchwork of products that don’t fully work together. Some areas overlap. Others get overlooked.

And when security isn’t intentionally designed as a system, the weaknesses don’t show up during routine support tickets. They show up when something slips through and turns into a disruptive, expensive problem.

Why “Layers” Matter More in 2026

In 2026, your small business security can’t rely on a single control that’s “mostly on”. It must be layered because attackers don’t politely line up at your firewall anymore. They come in through whichever gap is easiest today.

The real story is how quickly the landscape is changing.

The World Economic Forum’s Global Cybersecurity Outlook 2026 says “AI is anticipated to be the most significant driver of change in cyber security… according to 94% of survey respondents.”

That’s more than a headline. It means phishing becomes more convincing, automation becomes more affordable, and “spray and pray” attacks become more targeted and effective. If your security model depends on one or two layers catching everything, you’re essentially betting against scale.

The NordLayer MSP trends report highlights that active enforcement of foundational security measures is becoming the standard. It also points to a future where you are expected to actively enforce foundational security measures, not just check a compliance box.

It also highlights that regular cyber risk assessments will become essential for identifying gaps before attackers do. In other words, the market is shifting toward consistent security baselines and proactive oversight, rather than best-effort protection.

And the easiest way to keep layers practical and not chaotic, is to think in outcomes, not tools.

A Simple Way to Think About Your Security Coverage

The easiest way to spot gaps in your security is to stop thinking in products and start thinking in outcomes.

A practical way to structure this is the NIST Cybersecurity Framework 2.0, which groups security into six core areas: Govern, Identify, Protect, Detect, Respond, and Recover.

Here’s a simple translation for your business:

• Govern: Who owns security decisions? What’s considered standard? What qualifies as an exception?
• Identify: Do you know what you’re protecting?
• Protect: What controls are in place to reduce the likelihood of compromise?
• Detect: How quickly can you recognize that something is wrong?
• Respond: What happens next? Who is responsible, how fast do they act, and how is communication handled?
• Recover: How do you restore operations, and demonstrate that systems are fully back to normal?

Most small business security stacks are strong in Protect. Many are okay in Identify. The missing layers usually live in Govern, Detect, Respond, and Recover.

The 5 Security Layers MSPs Commonly Miss

Strengthen these five areas, and your business’s security becomes more consistent, more defensible, and far less reliant on luck.

Phishing-Resistant Authentication

Basic multifactor authentication (MFA) is a good start, but it’s not the finish line.

The common gap is inconsistent enforcement and authentication methods that can still be tricked by modern phishing.

How to add it:

• Make strong authentication mandatory for every account that touches sensitive systems
• Remove “easy bypass” sign-in options and outdated methods
• Use risk-based step-up rules for unusual sign-ins

Device Trust & Usage Policies

Most IT systems manage endpoints. Far fewer have a clearly defined and consistently enforced standard for what qualifies as a “trusted” device, or a defined response when a device falls short.

How to add it:

• Set a minimum device baseline
• Put Bring Your Own Device (BYOD) boundaries in writing
• Block or limit access when devices fall out of compliance instead of relying on reminders

Email & User Risk Controls

Email remains the front door for most cyberattacks. If you’re relying on user training alone to stop phishing and credential theft, you’re betting on perfect attention.

The real gap is the absence of built-in safety rails, controls that flag risky senders, block lookalike domains, limit account takeover impact, and reduce the damage from common mistakes.

How to add it:

• Implement controls that reduce exposure, such as link and attachment filtering, impersonation protection, and clear labeling of external senders
• Make reporting easy and judgement-free
• Establish simple, consistent process rules for high-risk actions

Continuous Vulnerability & Patch Coverage

“Patching is managed” often really means “patching is attempted.” The real gap is proof, clear visibility into what’s missing, what failed, and which exceptions are quietly accumulating over time.

How to add it:

• Set patch SLAs by severity and stick to them
• Cover third-party apps and common drivers/firmware, not just the operating system
• Maintain an exceptions register so exceptions don’t become permanent

Detection & Response Readiness

Most environments generate alerts. What’s often missing is a consistent, repeatable process for turning those alerts into action.

How to add it:

• Define your minimum viable monitoring baseline
• Establish triage rules that clearly separate “urgent now” from “track and review”
• Create simple, practical runbooks for common scenarios
• Test recovery procedures in real-world conditions
  

The Security Baseline for 2026

When you strengthen these five layers—phishing-resistant authentication, device trust, email risk controls, verified patch coverage, and real detection and response readiness—you turn your business’s security into a repeatable, measurable baseline you can be confident in.

Start with the weakest layer in your business environment. Standardize it. Validate that it’s working. Then move to the next. If you’d like help identifying your gaps and building a more consistent security baseline for your business, contact us today for a security strategy consultation. We’ll help you assess your current stack, prioritize improvements, and create a practical roadmap that strengthens protection without adding unnecessary complexity.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.