Microsoft is moving businesses toward passkeys and phishing resistant authentication. Here is what small business owners need to know about Microsoft 365 passkeys, Windows Hello, Authenticator, password managers, YubiKeys, new phones and account recovery.

A small business incident response plan should reflect how the business actually operates. Learn how to plan for cyberattacks, BEC fraud, stolen devices, disasters, insurance, regulatory requirements, recovery and the people responsible for responding

Claude Teams gives a small business a shared, secure AI workspace, but the tool is only half the job. The other half is governance: a written AI Acceptable Use Policy, clear rules for what data can and cannot go into the tool, and guardrails that match the business's compliance obligations. Done right, it turns multi-hour weekly tasks into minutes without creating a data-leak or compliance problem.

Does HIPAA apply to your law firm just because you handle medical records? Not necessarily. I explain when HIPAA may apply to a law firm, what that means for your technology, and what I discovered during an IT Baseline Assessment that uncovered problems with backups, shared accounts, Microsoft 365 security, access controls, and documentation.

Microsoft 365 is more than email and Office apps. Learn what small businesses should know about Business Premium, MFA, device management, email security, SharePoint, backups, third-party applications and preparing Microsoft 365 for AI.

Updated August 2026: I originally wrote about this client after helping a small defense contractor deal with a compromised Microsoft 365 email account. Since then, what started as an email security problem has become a much larger conversation about Microsoft 365 for small DoD contractors, CUI, and what CMMC Level 2 actually changes in the technology environment. The company handles Controlled Unclassified Information, or CUI, which means the conversation has expanded well be

A suspicious email led to the discovery that a law firm’s Microsoft 365 account had been compromised for months. See what I found, how I investigated the firm’s email environment, and the security changes I implemented to better protect its email, identities, and Microsoft 365 environment.

Does your small business still need a VPN? Learn when a VPN still makes sense, what is changing with SSL VPN, and how cloud services, ZTNA, MFA and managed devices are changing secure remote access.

Most small businesses using Microsoft 365 do not realize their accounts are open to the world by default. In this post, I share a real-world example of how I helped a client recover from an email breach, then took their security further with country-based restrictions, passkeys, and Microsoft Defender for Business. Learn how to protect your accounts and keep your data safe.

A real Microsoft 365 account compromise showed why having MFA enabled is only part of the security conversation. Learn how passkeys, phishing resistant authentication, Conditional Access, and Microsoft's changing authentication requirements are reshaping how small businesses protect their accounts.

A cyberattack is not always obvious. Learn the warning signs I look for across Microsoft 365, email, devices and networks, plus why preserving evidence, screenshots, timestamps and logs matters when investigating a possible compromise. Why? Because attackers count on you not having strong protections in place. Over the years, I have helped small business owners identify threats they were unaware of. Emails were being sent from their accounts. Their systems slowed down. Cli

How well do you know the technology your business depends on? This practical small business IT checklist covers devices, cloud services, networks, backups, cybersecurity, ownership, AI, documentation, lifecycle planning and cyber insurance readiness so you can identify what you know, what you do not know and what may need a closer look.

Ransomware is no longer just about an employee clicking a bad link and finding encrypted files. Learn how ransomware affects small businesses today and why identity security, endpoint protection, network segmentation, protected backups, incident response and recovery planning all need to work together.

Many decisions affect how efficiently your business will run when it comes to your IT security. No matter how big or small your business is