Your website is one of those things you set up once and then stop thinking about. It sits there doing its job, so there’s no reason to touch it. That’s exactly why a neglected website is one of the common ways a small business gets hacked.

Most small-business sites run on WordPress, which powers more than 40% of all websites, according to W3Techs. WordPress itself is solid. The risk is usually the plugins and themes added to it, which often don’t get updated for years.

How a neglected website gets hacked

Attackers don’t usually pick your business by name. They run automated tools that scan huge numbers of websites looking for known weak spots, like a plugin with a security hole that hasn’t been fixed. When the tool finds one, it breaks in. It’s all automatic, and it isn’t aimed at you personally.

That’s why old plugins are the problem. When a plugin maker finds a security flaw, they release an update to fix it. Until you install that update, the hole stays open, and the automated scanners know exactly what to look for. Security researchers who track WordPress flaws find that the large majority are in plugins and themes, not in WordPress itself.

What a hacked website is used for

A hacked website rarely announces itself. Instead of shutting your site down, attackers usually keep it running and use it for their own purposes:

• Serving malware. Your site gets changed so that visitors are infected or pushed to a page that tries to install something.
• Spam and scam pages. Attackers add hidden pages selling fake goods or pushing scams, riding on your site’s good standing with search engines.
• Stealing form data. If your site has a contact or checkout form, a hacked site can copy what people type into it, including personal or payment details.
• Redirects. Visitors who click your link get sent somewhere else, often a scam or malware site.

The damage lands on you even though the attacker was after your visitors. Search engines flag hacked sites with warnings and drop them down the rankings, and browsers may block them, so customers see a red “this site may be dangerous” screen instead of your homepage.

Is your website at risk?

It depends on how your site is built.

If you use a hosted website builder like Wix, Squarespace, or Shopify, most of the security and updates are handled for you behind the scenes, so your risk is lower.

If you have a self-hosted WordPress site, usually set up by a web designer or agency on your own hosting, then keeping WordPress, the plugins, and the themes updated is someone’s job. The question is whose. On a lot of small-business sites, the honest answer is that nobody has touched it since it launched.

You can usually tell your site is at risk if you don’t know who maintains it, it hasn’t been updated in a year or more, or it’s running plugins from a developer who has since disappeared.

How to keep your website safe

• Keep everything updated. WordPress, plugins, and themes all need updating when new versions come out. Many sites can be set to update automatically.
• Remove plugins you don’t use. Every extra plugin is another thing that can go wrong. If you’re not using it, delete it.
• Stick to well-known plugins. Use ones that are popular, well-reviewed, and updated recently. Avoid anything that hasn’t been touched in years.
• Watch for abandoned plugins. Sometimes a plugin stops being updated, or gets removed from the plugin store because of a security problem. When that happens it stops getting fixes, so check now and then that the plugins on your site are still supported, and replace any that aren’t.
• Lock down the admin login. Use a strong, unique password for the website’s admin account, and turn on multi-factor authentication if your setup supports it.
• Add a security plugin or web firewall. A reputable one can block common attacks and warn you when something changes. Your web host or IT provider can recommend one.
• Keep backups. If the worst happens, a recent backup lets you restore the site instead of rebuilding it from scratch.
• Know who’s responsible. Decide who looks after updates and security, whether that’s your web designer, your IT provider, or your hosting company, and make sure it’s clearly somebody’s job.

What to do if your site is hacked

If your site does get hacked, moving quickly limits the damage:

• Get help straight away. Cleaning a hacked site properly is a job for your web host, IT provider, or a website security service. Most hosts have dealt with this many times and can help.
• Take the site offline. Putting up a simple “down for maintenance” page stops visitors from being harmed while it’s cleaned up.
• Change the passwords. From a device you know is clean, change the passwords for your hosting account and the website’s admin login, and turn on multi-factor authentication.
• Restore a clean backup. If you have a backup from before the hack, restoring it is often the fastest fix. If you don’t, the site will need to be cleaned by hand.
• Update and tidy up before it goes back live. Update WordPress, the plugins, and the themes, and remove anything you don’t recognize or no longer use, so the same hole doesn’t get used again.
• Tell anyone whose data was affected. If the site handled customer details or payments, check whether any of that was exposed, and let those people know if it was.

Frequently asked questions

How do I know if my website has been hacked?

Common signs are a warning from Google or your browser, a drop in search traffic, pages or pop-ups you didn’t add, or your web host getting in touch about a problem. If you’re not sure, your IT provider or web host can check.

Do I need to update my website if it works fine?

Yes. A site can look completely normal to you while an out-of-date plugin leaves a door open for attackers. Updates close those holes, which is why they matter even when nothing looks wrong.

I use Wix or Squarespace. Am I at risk?

Much less so. Hosted builders handle the updates and most of the security for you. You should still use a strong admin password and MFA, but you’re not responsible for patching plugins the way a self-hosted WordPress site is.

Who should maintain my website?

Someone should own it clearly: your web designer or agency, your IT provider, or your hosting company, depending on your setup. The important thing is that someone is actually doing the updates.

What is a security plugin or web firewall?

It’s a tool that sits on your website, blocks common attacks, watches for changes, and can alert you to problems. On WordPress, a reputable security plugin is a common, low-cost way to add that protection.

Sources and further reading

• W3Techs: WordPress usage statistics — the share of websites that run on WordPress.
• Patchstack: WordPress vulnerability report — research showing most WordPress security holes are in plugins and themes.
• NCSC: Small Business Guide — UK guidance on keeping software updated and patched.

If you’re not sure whether your website is being kept up to date, or who’s responsible for it, that’s worth sorting out before something goes wrong. Your IT provider or web host can check where things stand and take over the upkeep. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Scammers count on that. They buy ads on the names of trusted companies and popular software, so their fake site appears right at the top, above the real one, and you click it thinking it’s the official page.

How the scam works

The trick is called malvertising, short for malicious advertising. A scammer buys a search ad for a term people trust, like the name of your bank, a Microsoft login, or a common program such as a PDF reader or a video player. The ad looks normal, with the real brand name and a web address that looks right.

READ MORE:  How to Spot a Scam Email Now That They Look Real

When someone clicks it, they land on a page built to look exactly like the real one. Sometimes that page asks you to log in and hands your username and password straight to the scammer. Other times it offers the software you were after, and the download installs malware instead of the real program.

Why these ads are so easy to fall for

These ads are convincing. They sit above the real result, so they’re the first thing you see. They use the real company’s name and a web address that looks right. And they show up on a search you started yourself, so they don’t feel as suspicious as a random email or text would.

Attackers have also gotten good at hiding from the checks meant to stop them. They show a clean, harmless page to the ad reviewers and the real, malicious page to everyone else, so the ad can pass review and still do damage.

How common is this?

Very. In its 2025 Ads Safety Report, Google said it blocked or removed more than 8.3 billion ads that broke its rules, suspended 24.9 million advertiser accounts, and took down 602 million ads tied to scams. Google also noted that criminals are now using AI to make fake ads faster. 

Security researchers have found scam search ads pretending to be well-known programs like VLC, 7-Zip, and CCleaner, and even Google’s own apps, with downloads that installed password-stealing malware. These show up on the everyday searches you run.

What this means for you

The risks comes up in two everyday situations: downloading software, and logging in. 

When someone downloads software, they search for a tool, click the top ad, and install something that steals the passwords and logins saved in their browser.

When someone logs in, they search for “Microsoft 365 login” or their bank, click the ad rather than the official link, and type their username and password straight into a fake page. 

In both cases, the problem is info-stealing malware. Once it’s on a machine, it can steal saved passwords, browser cookies, and session tokens, which can get an attacker into accounts even when multi-factor authentication is switched on.

How to protect yourself

Scroll past the sponsored results. The ads sit at the top, marked “Sponsored” or “Ad.” The real website is usually just below, in the normal results.

• Don’t download software from an ad. Type the maker’s web address yourself, or search and use the normal result, then download from the official site.
• Bookmark the sites you log into. For your bank, Microsoft 365, and other important accounts, use a saved bookmark instead of searching each time.
• Keep devices and browsers updated. Turn on automatic updates so a bad download is less likely to work.
• Tell your friends and family this is a thing. Most people have no idea the top result can be a trap, and once they know, they stop clicking it.

Frequently Asked Questions

Aren’t ads at the top of Google checked and safe?

Google reviews ads and removes billions that break its rules, but scammers still slip through by showing reviewers a clean page and everyone else the malicious one. A “Sponsored” label doesn’t mean the site is safe.

What is malvertising?

Malvertising is short for malicious advertising: scammers buy online ads, often on trusted brand names, to send people to fake sites that steal logins or install malware.

How do I download software safely?

Go to the maker’s official website by typing the address yourself, or search and use the normal (non-ad) result. Don’t download from a sponsored ad, and don’t trust a download that arrives through one.

READ MORE:  Why Pirated Software Isn’t Worth the Risk

What should I do if someone clicked a scam ad?

If they only visited the page, close it and don’t enter anything. If they typed a password, change it and turn on MFA. If they downloaded and ran a file, disconnect the device and have Hopedale Technologies check it for info-stealing malware.

Does a paid antivirus help?

It can. We recommend and sell Managed Vipre Antivirus which helps block unsafe websites. It isn’t a complete fix since scammers are always adding fake sites, so use the habits above too.

When you search Google for a program to download or a website to log into, the first thing you see is usually an ad. It sits at the top, marked “Sponsored,” and most people click it without a second thought, because the top result is normally what you wanted.

Scammers count on that. They buy ads on the names of trusted companies and popular software, so their fake site appears right at the top, above the real one, and you click it thinking it’s the official page.

How the scam works

The trick is called malvertising, short for malicious advertising. A scammer buys a search ad for a term people trust, like the name of your bank, a Microsoft login, or a common program such as a PDF reader or a video player. The ad looks normal, with the real brand name and a web address that looks right.

When someone clicks it, they land on a page built to look exactly like the real one. Sometimes that page asks you to log in and hands your username and password straight to the scammer. Other times it offers the software you were after, and the download installs malware instead of the real program.

Why these ads are so easy to fall for

These ads are convincing. They sit above the real result, so they’re the first thing you see. They use the real company’s name and a web address that looks right. And they show up on a search you started yourself, so they don’t feel as suspicious as a random email or text would.

Attackers have also gotten good at hiding from the checks meant to stop them. They show a clean, harmless page to the ad reviewers and the real, malicious page to everyone else, so the ad can pass review and still do damage.

How common is this?

Very. In its 2025 Ads Safety Report, Google said it blocked or removed more than 8.3 billion ads that broke its rules, suspended 24.9 million advertiser accounts, and took down 602 million ads tied to scams. Google also noted that criminals are now using AI to make fake ads faster.

Security researchers have found scam search ads pretending to be well-known programs like VLC, 7-Zip, and CCleaner, and even Google’s own apps, with downloads that installed password-stealing malware. These show up on the everyday searches your team runs.

What this means for your business

For a business, the risk comes up in two everyday situations: downloading software, and logging in.

When someone downloads software, they search for a tool, click the top ad, and install something that steals the passwords and logins saved in their browser.

When someone logs in, they search for “Microsoft 365 login” or their bank, click the ad rather than the official link, and type their username and password straight into a fake page.

In both cases, the problem is info-stealing malware. Once it’s on a machine, it can steal saved passwords, browser cookies, and session tokens, which can get an attacker into accounts even when multi-factor authentication is switched on.

How to protect your team

• Scroll past the sponsored results. The ads sit at the top, marked “Sponsored” or “Ad.” The real website is usually just below, in the normal results.
• Don’t download software from an ad. Type the maker’s web address yourself, or search and use the normal result, then download from the official site.
• Bookmark the sites you log into. For your bank, Microsoft 365, and other important accounts, use a saved bookmark instead of searching each time.
• Keep devices and browsers updated. Turn on automatic updates so a bad download is less likely to work.
• Tell your team this is a thing. Most people have no idea the top result can be a trap, and once they know, they stop clicking it.

Frequently asked questions

Aren’t ads at the top of Google checked and safe?

Google reviews ads and removes billions that break its rules, but scammers still slip through by showing reviewers a clean page and everyone else the malicious one. A “Sponsored” label doesn’t mean the site is safe.

What is malvertising?

Malvertising is short for malicious advertising: scammers buy online ads, often on trusted brand names, to send people to fake sites that steal logins or install malware.

How do I download software safely?

Go to the maker’s official website by typing the address yourself, or search and use the normal (non-ad) result. Don’t download from a sponsored ad, and don’t trust a download that arrives through one.

What should I do if someone clicked a scam ad?

If they only visited the page, close it and don’t enter anything. If they typed a password, change it and turn on MFA. If they downloaded and ran a file, disconnect the device and have your IT provider check it for info-stealing malware.

Does an ad blocker help?

It can. A reputable ad blocker hides many sponsored results, which takes the fake links off the page before anyone can click them. It isn’t a complete fix, so keep the habits above too.

Sources and further reading

• Google: 2025 Ads Safety Report — Google’s own figures on the scale of scam and policy-breaking ads.
• FTC: Online search results — the good, the bad, and the scammy — US consumer guidance on scrolling past ads and downloading software safely.
• BleepingComputer: Malware pushed via Google search ads for VLC, 7-Zip, CCleaner — a real example of scam ads impersonating popular software.

If you’d like to give your team a plain rundown of what a scam ad looks like, or tighten how software gets installed on your computers, your IT provider can help with both. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Your data enters a pipeline

The moment someone submits their details on a phishing page, that information is transmitted to the attacker, often within seconds. From there, it gets bundled with data from other victims and sold in bulk on Dark-Web forums.

These bulk archives are relatively cheap because they are raw and unverified. A buyer cannot know which entries are still active, which passwords have been changed, or which accounts have value. So a second group enters the picture: analysts who sort and verify the data.

READ MORE:  Phishing 2.0: How AI is Amplifying the Danger and What You Can Do

Sorting, verification, and resale

These buyers test credentials against live services to confirm they still work. They check whether the same password is reused across other accounts, and they cross-reference entries with data from older breaches to build a fuller picture of each individual. What comes out the other end is a verified dataset worth significantly more than what was paid for it, and it gets resold at a higher price.

Account access is priced by value. Access to bank accounts and cryptocurrency platforms commands the highest prices; social media accounts and messaging apps are cheaper but still traded in volume because they are useful for launching further attacks against the victim’s contacts.

The follow-up attack

Once a cybercriminal purchases a verified profile, the original phishing incident is almost beside the point. The attacker now knows who the victim is, where they work, which services they use, and potentially has access to their accounts. That information gets used to craft targeted attacks: a convincing email impersonating a senior staff member, a message to a client pretending to be the victim, or an extortion attempt using compromising material pulled from a hacked account.

This is the part most business owners never connect back to the original click. A staff member’s credentials stolen in a phishing attack this month can be the starting point for a business email compromise attempt six months from now.

What to do if your business has been affected

The window for action is short, but the actions themselves are straightforward. Any staff member who entered credentials on a suspicious site should change that password immediately across every service where it is reused. If payment details were entered, the relevant cards need to be cancelled, not just monitored. Two-factor authentication should be enabled on any account that supports it, using an authenticator app rather than SMS where possible.

READ MORE:  What Are Passkeys, and Should Your Business Use Them?

Beyond the immediate steps, it is worth reviewing which accounts your staff have access to and whether those access levels are still appropriate. A credential compromised today is as dangerous only as the access it carries.

If you would like help reviewing your business’s exposure or putting response steps in place, get in touch. This is exactly the kind of situation where having a managed-IT provider like Hopedale Technologies on your side makes a real difference.

For years, the advice for spotting a scam email was simple: look for bad spelling and clumsy grammar. A real bank or supplier writes properly, the thinking went, so a message full of mistakes was probably fake. It was easy to teach, and for a long time it worked.

It doesn’t anymore. Scammers now use AI to write their emails, and AI writes cleanly. The typos and awkward phrasing that used to give phishing away are gone, and the messages landing in your team’s inbox read as well as anything from a real company. Worse, they can be written to sound like they came from someone you already know.

Why the old advice stopped working

The spelling-and-grammar tell worked because a lot of scammers were writing in a language that wasn’t their own, and the mistakes showed. AI took that away.

The UK’s National Cyber Security Centre says generative AI can now create convincing phishing lures “without the translation, spelling and grammatical mistakes that often reveal phishing.” The FBI says the same: criminals use AI to limit the grammar and spelling errors that used to mark a message as fake, so it reads as believable. That means the one thing most people were trained to look for no longer tells you much.

Why these emails are so convincing now

• The writing is clean. A scam email reads like a normal business email, because a machine wrote it in seconds, in whatever tone the attacker asked for.
• It’s personal. Attackers can feed public details about your company into an AI tool, pulled from your website, your team’s LinkedIn profiles, or a press release, and get a message tailored to you: the right names, the right job titles, and a believable reason to be in touch.
• There’s more of it. AI makes each message faster to produce, so attackers send far more. The FBI’s Internet Crime Complaint Center added a section on AI to its annual report for the first time, tied to more than 22,000 complaints and nearly $893 million in reported losses.

These days, the scam email isn’t the obvious one anymore. Instead of “Dear customer, your account is suspended,” someone in your finance team gets a message that looks like it’s from a supplier they really deal with, mentions a real project, and asks to update the bank details for the next invoice. It reads exactly like a real supplier email. The only thing wrong is that the supplier never sent it.

Your spam filter won’t catch them all

It’s tempting to assume your email security will handle this. It catches a lot, and you should keep it switched on. But a well-written, personalized email that asks a normal-sounding question doesn’t always look dangerous to a filter, especially when it carries no obvious bad link or attachment. Both the NCSC and the FBI expect AI to push more of these messages through, which is why the last line of defense is a person who knows what to check.

It’s not just email anymore

AI has done the same thing to phone calls and texts. The FBI warns that criminals can clone a voice from a short audio clip, enough to leave a voicemail that sounds like your boss or a family member asking for an urgent payment. The same thing that makes AI emails so convincing makes AI phone scams convincing too. The defense is the same: if a call or voicemail asks for money or logins, hang up and call the person back on a number you already have.

Here are the signs you should still pay attention to

If you can’t trust how an email is written, look at what it’s asking you to do. That’s where the real warning signs are, and AI hasn’t changed them:

• It asks for money, gift cards, or a payment to a new account.
• It asks for a login, a verification code, or personal details.
• It creates pressure: a deadline, a threat, or a “do this now.”
• It asks you to change the bank details for an invoice or a supplier.
• It comes with a link or attachment you weren’t expecting.
• The display name looks right, but the actual email address doesn’t match it.

Every one of these is about what the email is asking for. So the rule to teach your team is simple: when a message is about money, logins, or how you pay someone, slow down before you act.

How to protect your team

• Check money and login requests another way. If an email asks you to pay a new account or change a supplier’s bank details, call the person on a number you already have. Don’t reply to the email or use a number it gives you.
• Stop telling staff to watch for bad spelling. Tell them to look at what the email is asking for, and to slow down when it’s about money or logins.
• Make one rule for payment changes: confirm every change to bank details by phone, even when it’s urgent.
• Turn on phishing-resistant MFA or passkeys, so a stolen password is harder to use even if someone gets tricked.
• Make it easy to report a suspicious email and make sure nobody feels silly for checking.
• Remind the team now and then that scam emails look perfect these days. A quick five-minute chat beats a poster nobody reads.

Frequently asked questions

Can you still spot a phishing email by bad spelling and grammar?

Not reliably. Attackers use AI to write clean, correct emails now, so a message with perfect spelling can still be a scam. Judge it by what it asks you to do.

What are the warning signs that still work?

The request itself: paying money, changing bank details, sharing a login or code, or being pushed to act urgently. Those signs don’t depend on how the email reads.

Is AI-generated phishing really more effective?

Yes. The NCSC and the FBI have both warned that AI makes phishing more convincing and more personal, and the FBI has tied AI to tens of thousands of fraud complaints and hundreds of millions in losses. Cleaner, tailored messages get opened and clicked more often.

Will my spam filter stop AI phishing?

It will catch a lot, and you should keep it on. But a well-written, personalized email with no obvious bad link can still look legitimate to a filter, so don’t rely on it alone. A trained person is the backstop.

What should staff do if they aren’t sure about a message?

Slow down and check through a channel they trust, like calling a known number or asking the person directly. And report it, even if it turns out to be genuine.

Sources and further reading

•  NCSC: The near-term impact of AI on the cyber threat — the UK cyber agency on AI producing phishing lures without the usual spelling and grammar mistakes.

•  FBI IC3: Criminals Use Generative AI to Facilitate Financial Fraud — how criminals use AI-generated text and cloned voices, and how it removes the usual signs of fraud.

If you’d like help teaching your team what to watch for, or turning on phishing-resistant logins so a fooled password doesn’t turn into a break-in, your IT provider can set both up. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Here’s something worth knowing before you panic: a computer that won’t turn on isn’t the same thing as a computer with lost data. Those are two separate problems, and they don’t always go together.

“Dead” is not a diagnosis

When a computer stops responding, there are several reasons it might have happened, and they sit at very different points on the repair spectrum.

Sometimes the fix is straightforward: a faulty power switch, a charging port that’s no longer making proper contact, or a battery that’s completely discharged and won’t hold a charge anymore. The machine looks dead, but the problem has nothing to do with your files. It’s a mechanical or electrical issue, and once that’s resolved, everything inside is exactly as you left it.

READ MORE: DIY Computer Repair: Don’t Do It

Other times, the screen itself has failed. The computer is actually running but not showing you anything. You might hear the startup sounds or see the keyboard backlight come on, but the display is dark. Again, your data is almost certainly untouched.

A more involved scenario is an operating system failure, where the computer powers on but can’t complete the startup process. You might see an error message, a spinning wheel that never stops, or a screen that goes black partway through loading. This one takes more work to diagnose, but it still doesn’t automatically mean your files are at risk.

When the hard drive is actually the problem

Hard drive failure is the scenario most people are imagining when they picture data loss, and it’s the most serious on this list. A hard drive stores your files on magnetic platters or memory chips, and when it develops enough damage to stop functioning, it can take your data with it, sometimes without warning.

Even then, the situation isn’t always hopeless. A drive that’s failing but not completely gone may still allow a technician to pull most or all of your data before things get worse. The sooner it’s looked at, the better the odds.

The silver lining most people don’t know about

Here’s what surprises a lot of people: even when the hardware around the drive has completely failed, the drive itself is often fine. A laptop with a faulty motherboard, a desktop with a dead power supply, or a machine that took a knock and stopped working; in many of these cases, the storage drive can be removed and connected to another computer to retrieve everything on it.

“Dead computer” and “lost data” aren’t the same sentence, and one can be true without the other.

READ MORE: What is the Best Way to Backup?

What not to do

The instinct to keep pressing buttons, try a different charger, or look up a YouTube fix is understandable, but it can make things harder to resolve. If there’s any chance the drive itself is struggling, continued attempts to power the machine on can cause further damage. The same goes for taking the machine apart if you’re not sure what you’re doing.

What to do instead

Bring it in. A proper diagnosis takes the guesswork out of it entirely. You’ll know what’s wrong, what can be recovered, and what your options are, rather than finding out through trial and error. Most of the time, the news is better than people expect.

If a cyberattack hits your business, what you do in the first hour really matters.

It’s also the easiest time to make a costly mistake, like turning off the wrong machine, deleting evidence, or replying from an email account the attacker is already reading.

The steps below tell you what to do, in order, so you’re not guessing in the moment.

Doing these steps doesn’t require technical knowledge.

Before anything else: don’t make it worse

Before you touch anything, avoid these:

• Don’t turn the affected computer off, if you can avoid it. Disconnecting it from the network is better, because powering it down can wipe evidence that helps work out what happened.
• Don’t delete anything. Leave the ransom note, the suspicious email, and any alerts exactly where they are. They’re what your IT team and investigators will need.
• Don’t pay a ransom on the spot.
• Don’t use the hacked email or accounts to talk about the attack. If an attacker is in your inbox, they can read those messages. Switch to phone calls or a different account.

The step by step

Work through these in order, starting the moment you notice something’s wrong.

1. Disconnect the affected devices from the network. Unplug the network cable and turn off Wi-Fi on anything that looks affected. This stops the problem spreading to other computers and to your backups. CISA’s guidance is to isolate devices rather than power them off where you can, and to shut a device down only if you can’t get it off the network any other way.
2. Call your IT provider straight away, by phone. Don’t email, in case the attacker is watching your inbox. If you have cyber insurance, call them next, because many policies require you to involve their incident team early.
3. Leave the evidence alone. Don’t wipe, reinstall, or tidy up the affected machines yet. Screenshots of the ransom note or suspicious emails are useful, but keep the originals too.
4. If money was sent, call your bank immediately. Ask them to recall the transfer and freeze it if they can. With wire and bank fraud, acting in the first few hours makes the biggest difference.
5. Reset passwords from a clean device, and turn on multi-factor authentication. Start with email and any admin accounts, and use a device you know isn’t affected.
6. Report it. That can help you recover, and it’s sometimes legally required. Where to report depends on your country.

Where to report it

You’ve reaWhere you report depends on where you are:

• United States: file with the FBI’s Internet Crime Complaint Center (IC3), and report to CISA.
• United Kingdom: report through the NCSC, and to Action Fraud.
• Australia: report through ReportCyber, or call the 24/7 hotline on 1300 CYBER1.

If money was wired to a scammer, report it fast.

The FBI says reporting wire fraud to IC3 within 72 hours gives its Recovery Asset Team the best chance of clawing it back, and that team recovers funds in about 70% of the cases reported in time.

If personal data about your customers or staff was exposed, you may be legally required to notify a regulator and the people affected, sometimes within 72 hours.

The rules depend on where you operate, like GDPR in the UK and Europe, state breach-notification laws in the US, and the Notifiable Data Breaches scheme in Australia.

Ask your lawyer or IT provider early so you don’t miss a deadline.

Should you pay the ransom?

If it’s ransomware, the big question is whether to pay.

The FBI does not recommend it. Paying doesn’t guarantee you get your files back, it marks you as a business that pays, and the money funds more attacks.

It’s ultimately your decision, but it’s one to make with law enforcement, your IT or incident-response team, and your insurer, not alone in the first panicked hour.

Sometimes a free decryption tool already exists for the exact ransomware that hit you, which is one more reason to get the experts involved before you pay anyone.

The best time to prepare is before it happens

All of this is far easier if you’ve decided some of it in advance. You don’t need a thick binder, just a simple plan that covers:

• Who to call first (your IT provider, your insurer) and their numbers, kept somewhere you can reach without your main systems.
• Where your backups are, and proof they’ve been tested by restoring from them.
• Which accounts and devices matter most, so you know what to protect first.

A single page covering those is enough for most small businesses, and it’ll save you a lot of scrambling if the day ever comes.

Frequently Asked Questions

What’s the first thing to do in a cyberattack?

Disconnect the affected devices from the network, by unplugging the network cable and turning off Wi-Fi, then call your IT provider by phone. Getting the device off the network stops the problem spreading while you get help.

Should I turn off the computer if I get ransomware?

If you can, disconnect it from the network instead of powering it off. Shutting it down can wipe evidence stored in memory that helps work out what happened. Only power a device off if you can’t get it off the network any other way.

Should I pay the ransom?

The FBI does not recommend it. Paying doesn’t guarantee you get your data back, and it funds more attacks. Make that decision with law enforcement, your IT or incident-response team, and your insurer, and check whether a free decryption tool already exists first.

We wired money to a scammer. What do we do?

Call your bank immediately and ask them to recall the transfer. If you’re in the US, report it to the FBI’s IC3 within 72 hours, because reported quickly, their Recovery Asset Team recovers the money in about 70% of cases. In other countries, contact your bank and your national reporting service straight away.

Who do I report a cyberattack to?

In the US, the FBI’s IC3 and CISA. In the UK, the NCSC and Action Fraud. In Australia, ReportCyber. Also tell your cyber insurer, and check whether you have a legal duty to notify a regulator if personal data was exposed.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

A laptop sitting in a drawer, a software license renewing every year for a tool you replaced two years ago, or duplicate accounts for services nobody coordinated are not dramatic failures or big mistakes but small, quiet leaks that add up to real money leaving your business every month. The problem is not that you bought the wrong thing but that nobody owns the job of knowing what you have, what you use, and what you are still paying for.

Three Categories of Waste

Hardware sitting idle. A laptop that cost $1500 three years ago is still depreciating whether anyone uses it or not. It takes up space, holds old data that should have been wiped, and occasionally prompts someone to ask if they can “bring it back into service.” By then the battery is dead, the operating system is out of date, and getting it working again costs more than it is worth.

Software licenses renewed on autopilot. You replaced your old project management tool with something better, but did anyone cancel the old license? Probably not. The credit card on file still works, the renewal email went to the person who left six months ago, and the charge keeps happening.

READ MORE:  Essentials to Know About Software Licenses

Duplicate accounts and overlapping tools. Someone in marketing signed up for a design platform, then someone in operations signed up for the same platform six months later because they did not know the first account existed. Now, you are paying twice for the same service, and neither team knows the other has access.

Why This Happens

Nobody in a small business wakes up thinking, “I should inventory our software licenses today.” It’s not urgent, and doesn’t generate revenue or impress clients, so it doesn’t get done.

Tools get replaced mid-stream when someone finds a better option and switches over. The old tool sits there, still charging, because turning it off feels like extra work, and nobody wants to risk breaking something. Contracts auto-renew, and the email notification goes to the person who signed up originally. If that person has left the business, nobody sees it.

The charges are not dramatic enough to review. When you sit down to look at expenses, you focus on the big-line items: rent, payroll, inventory. A $30-per-month charge does not feel worth investigating, but if you have ten of those spread across different tools, you are spending $3600 a year on licenses you do not need.

The Real Cost

The money leaving your account every month is the obvious cost, but there are others. That $500 a month could go somewhere useful: better tools, training, or an extra pair of hands during a busy period. Instead, it’s funding software nobody opens.

Unused hardware sitting around might still have client data on it, unlicensed software creates liability, and old email accounts tied to services you forgot about are security holes. When employees have access to six different tools that do similar things, they waste time figuring out which one to use.

READ MORE:  Still on Windows 10? Here’s Why You’re Putting Your Business at Risk

What an IT Audit Uncovers

A proper IT audit covers hardware inventory, software license reconciliation, and account consolidation. Every computer, monitor, and peripheral needs to be tracked. Every software charge needs to be matched to an active user. Every service needs to be checked for duplicate accounts across departments.

Most business owners start this process and abandon it halfway through because something more urgent comes up. Running it properly takes time you do not have and knowledge of what questions to ask vendors.

Some things can be decommissioned immediately: cancelling the duplicate licenses, turning off accounts for people who left, and wiping the old hardware. Some things need refresh cycles planned so you can budget for replacements before they fail. Some things reveal a process issue: if you find three different tools doing the same job, employees are working around each other because nobody standardized the workflow.

The businesses that grow sustainably treat IT spending like any other part of the budget. They know what they own, what they use, and what they are paying for.

If you have not run an audit like this in the past year, you are probably wasting money right now. If you would like us to find out what you are paying for that you do not need, get in touch.

Passwords are the weak point in most businesses.

People reuse them across accounts, write them on sticky notes, and type them into convincing fake login pages without realizing it.

Passkeys are the technology built to replace passwords, and they fix the parts that cause the most trouble.

A passkey lets you sign in with the same fingerprint, face scan, or PIN you already use to unlock your phone or laptop. There’s no password to type, so there’s nothing for an attacker to steal, guess, or trick out of you.

Let’s look at what passkeys are, why they’re so much harder to attack than passwords, and whether your business should start using them.

What is a passkey?

A passkey replaces your password with your device’s own security.

Instead of typing a password, you prove it’s you the same way you unlock your phone: a fingerprint, a face scan, or a PIN.

When you set up a passkey for a website, your device creates two matching keys.

The private key stays locked on your device and never leaves it.

The public key is stored by the website.

When you sign in, the site sends a challenge that only your private key can answer, your device answers it once you confirm with your fingerprint or PIN, and you’re in. The website never sees a password, because there isn’t one. This approach comes from a standard called FIDO, which Apple, Google, and Microsoft all build on.

Why passkeys are harder to attack than passwords

A password is a secret you share with the website every time you log in, and that’s exactly what attackers go after.

A passkey has no shared secret. That one difference fixes the biggest problems with passwords.

• They can’t be phished. A passkey only works on the real website it was created for. Land on a convincing fake, and the passkey simply won’t work, so there’s nothing to hand over. That matters, because phishing is how most break-ins start.
• There’s no password to steal in a breach. The website only keeps your public key, which is useless on its own. If the company gets hacked, there’s no password list to grab and try on your other accounts.
• Nothing to reuse or forget. Each passkey is unique to one site and made automatically, so reused and weak passwords stop being a problem.

Older methods like text-message codes and app approval prompts can still be tricked out of people.

Where you can use passkeys already

Support has spread fast.

You can already sign in with passkeys to Microsoft, Google, and Apple accounts, plus a growing list of banks, password managers, and business tools.

Apple, Google, and Microsoft have built passkeys into their phones, laptops, and browsers, so the device in your pocket can already store and use them.

There are two types worth knowing.

A synced passkey is backed up to your Apple, Google, or Microsoft account, so it works across all your devices and you’re covered if you lose one.

 A device-bound passkey stays on a single device, like a physical security key you plug in, which is the most locked-down option and a common pick for sensitive accounts.

Should your business use them?

For most businesses, yes, and you can start small. There’s no need to switch everything overnight or drop passwords on day one.

If you use Microsoft 365, passkeys are already available through Microsoft Entra.

Staff can sign in with a passkey stored in the Microsoft Authenticator app, a security key, or their own device. Google Workspace supports them too.

They’re also just faster. Microsoft says signing in with a synced passkey takes about 3 seconds, against roughly 69 seconds for a password plus a traditional MFA code. Across a whole team, that adds up.

Here’s how you can start using passkeys:

1. Turn passkeys on for your most sensitive accounts first: administrators, finance, and anyone who can move money or change systems.
2. Let everyone else add a passkey as a faster, safer way to sign in, alongside their normal login at first.
3. Make sure each person has a backup, like a second device or a security key, so a lost phone doesn’t lock anyone out.

Your IT provider can switch this on and run the rollout so nobody gets locked out along the way.

What to watch out for

Passkeys aren’t magic, and a few things are worth planning for.

• Account recovery. If someone loses the only device with their passkey and has no backup, they can get locked out. A synced passkey or a second registered device fixes this, but you have to set it up ahead of time.
• Not everything supports them yet. Support is growing fast, but some older systems and smaller vendors still rely on passwords, so you’ll run both side by side for a while.
• Shared devices and logins. Passkeys are tied to a person and their device, so any shared computers or shared accounts need their own plan.

Frequently Asked Questions

What is a passkey in simple terms?

It’s a way to log in using your fingerprint, face, or PIN instead of a password. Your device proves it’s you to the website, and no password is ever typed or stored.

Are passkeys safer than passwords?

Yes. They can’t be phished, there’s no password for a hacker to steal in a data breach, and there’s nothing to reuse or forget. Security agencies like CISA recommend FIDO-based logins, which is what passkeys are, as the strongest widely available option.

What happens if I lose the device with my passkey?

If it was a synced passkey, it’s backed up to your Apple, Google, or Microsoft account and still available on your other devices. If it was device-bound and you have no backup, you’d use a recovery method to get back in, which is why setting up a second passkey or device in advance matters.

Does Microsoft 365 support passkeys?

Yes. Passkeys are available through Microsoft Entra at no extra cost, including the free tier. Staff can use a passkey in the Microsoft Authenticator app, a security key, or their device.

Do passkeys replace multi-factor authentication?

A passkey can count as multi-factor authentication on its own. Unlocking it needs both your device (something you have) and your fingerprint, face, or PIN (something you are or know), so it covers two factors in one step and can replace the old password-plus-text-code routine.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Microsoft stopped supporting Windows 10 on October 14, 2025.

If your business is still running it, and plenty are, your computers aren’t getting security updates anymore.

Everything still turns on and works like normal, which is exactly why it’s easy to put off doing anything about it. The trouble is, the longer you stay on Windows 10, the more security holes pile up that nobody is ever going to fix.

So what does it mean for your business, and what are your options?

There are three: upgrade to Windows 11, pay for extended updates to buy some time, or replace the machine.

Let’s go through what you’re dealing with first.

What “end of support” means

When Microsoft ends support for a version of Windows, the updates stop. That includes the monthly security patches that fix newly found flaws.

Microsoft has confirmed that since October 14, 2025, Windows 10 gets no more security fixes, quality updates, feature updates, or technical support.

Your PCs don’t stop working. Nothing switches off the moment support ends. What’s different now is that Microsoft has stopped fixing Windows 10’s security flaws.

Attackers and security researchers keep finding new ones, and now nobody’s patching them. So every new flaw that turns up is another way into your computers, and it never gets fixed.

Why this is a real risk for your business

This is about more than an old, slow computer.

• They’re an easy target. Attackers go looking for computers running software that doesn’t get fixed anymore, because they know the flaws will just sit there. The UK’s National Cyber Security Centre points out that holes in unsupported products stay exploitable, often by fairly low-skilled attackers.
• You can fall out of compliance. If you handle card payments, health records, or personal data, rules like PCI DSS and HIPAA expect you to run supported, patched software. Windows 10 no longer counts, which can put you out of compliance.
• It can hit your cyber insurance. Insurers are asking more and more whether your systems are supported and patched. Running an unsupported operating system can push your premium up, shrink your coverage, or give the insurer a reason to fight a claim.
• Your other software will drop it. Over time, browsers, accounting tools, and other programs stop supporting Windows 10, so the apps you rely on every day can stop updating, or stop working altogether.

CISA puts running supported, updated software on its short list of basic security steps for businesses.

<H2>Your three options</H2>

You’ve really got three options, and most businesses end up mixing them across their computers.

1. Upgrade to Windows 11(free, if the hardware qualifies)

If you bought the PC in the last few years, upgrading to Windows 11 is free, and it’s usually the right move. The catch is the hardware. Windows 11 needs a supported processor, TPM 2.0, and Secure Boot, and that rules out a lot of older machines. To check whether a particular PC qualifies, run Microsoft’s free PC Health Check app.

2. Buy Extended Security Updates as a bridge

If a PC can’t move to Windows 11 yet, Microsoft will sell you Extended Security Updates (ESU) to keep the security patches coming for a while longer.

For businesses, that’s $61 per device for the first year, and it doubles every year after that, up to three years.

Keep one PC on Windows 10 the whole time and you’re looking at around $427 over those three years.

Home users get a much cheaper deal. A one-time $30 payment covers up to 10 devices with security updates through October 12, 2027, and it’s free if you sync your PC settings.

ESU gives you security patches and nothing else. No new features, no real tech support. It’s there to buy you time while you sort out the upgrade or a new machine.

3. Replace the PC

Some machines are just too old for Windows 11 and not worth paying ESU on year after year.

For those, buying a new PC that already runs Windows 11 usually works out cheaper, once you add up the ESU fees and the cost of keeping an old machine going.

How to plan the move

You don’t have to do all of this at once, but you do need a plan. A sensible order looks like this:

1. Make a list of every computer still on Windows 10.
2. Check which ones can move to Windows 11, using the PC Health Check app or your IT provider.
3. Upgrade the ones that qualify. It’s free, and it keeps your files and programs in place.
4. For the rest, choose between ESU to buy time or replacing the machine, depending on how old it is and what it’s used for.

Your IT provider can run that inventory quickly and tell you the best option for each machine.

Frequently Asked Questions

Is Windows 10 still safe to use after October 2025?

It still works, but it’s not getting security updates anymore, so the risk creeps up as new flaws are found and left unpatched. If you’re going to keep using it, either enroll in Extended Security Updates or plan your move to Windows 11.

What happens if I keep using Windows 10 and do nothing?

Your PCs will keep running, but they turn into an easier target for attackers, can put you out of compliance with payment and privacy rules, and may cause problems with your cyber insurance. And over time, the apps you depend on will start dropping Windows 10 too.

How much does Windows 10 ESU cost for a business?

For businesses, it’s $61 per device for the first year and doubles each year after that, up to three years, which comes to about $427 per device in total. Home users get a better deal: a one-time $30 payment covers up to 10 devices through October 12, 2027, or it’s free if you sync your PC settings.

Can my PC upgrade to Windows 11 for free?

If it meets the hardware requirements, yes. Windows 11 needs a supported processor, TPM 2.0, and Secure Boot. The PC Health Check app will tell you whether a specific machine qualifies, and PCs from the last few years usually do.

Should I just buy a new computer?

If a PC can’t run Windows 11, a new one is often cheaper than paying escalating ESU fees for years on top of running aging hardware. If it can upgrade, start with the free Windows 11 upgrade.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.