If software makes the decision, you’ll soon have to say so
From 10 December 2026, businesses that use automated systems to make decisions affecting individuals must disclose it in their privacy policy. Chatbots and triage tools count.
FortiBleed — 75,000 Fortinet VPN credentials, and why the edge keeps doing this
Mid-June saw a dataset of valid credentials for an estimated 75,000 Fortinet firewalls and SSL-VPN gateways validated in the wild. If your perimeter is a VPN box, this is your reminder.
Agent 365 is here — govern the agents before you turn them loose
Microsoft made Agent 365 and the M365 E7 plan generally available. AI agents that act on your data need the same governance discipline you (should) already apply to Copilot.
Your backup server is an attack surface — patch it like one
A new remote-code-execution flaw in Veeam Backup & Replication is a reminder that the system protecting your data is also a high-value target. Backup infrastructure needs the same patch discipline as everything else.
“The Gentlemen” and the edge-appliance playbook everyone keeps falling for
A ransomware-as-a-service crew that barely existed in mid-2025 is now one of the most active of 2026 — built almost entirely on compromising internet-facing VPNs, firewalls and management interfaces.
Kali365 — the $250 kit that walks straight through your MFA
The FBI and multiple security firms are warning about Kali365, an off-the-shelf phishing kit that steals Microsoft 365 session tokens after MFA succeeds. Adversary-in-the-middle attacks are now a commodity.
Shadow AI by the numbers: a third of staff have already pasted in customer data
The 2026 data on unsanctioned AI use is in, and it’s worse than most owners assume. Shadow-AI-related breaches cost an average of US$670,000 more — and most affected businesses had no AI policy at all.
June’s Patch Tuesday: ~200 fixes, three zero-days, and why cadence is the whole game
Microsoft’s June 2026 update fixed close to 200 vulnerabilities, including three publicly disclosed zero-days and critical flaws in HTTP.sys, Hyper-V and BitLocker. The differentiator isn’t knowing — it’s patching fast.
100,000 small businesses get pulled under the Privacy Act on 1 July
From 1 July 2026, AML-CTF reforms drag real-estate agents, accountants, conveyancers, lawyers and high-value-goods dealers into Privacy Act obligations — many for the first time.
Microsoft 365 prices rise on 1 July — and Copilot stops being optional
New commercial pricing takes effect 1 July 2026: E3 moves to $39, E5 to $60, and the standalone Copilot add-on folds into the plans. A pre-July commitment can lock current rates.
The Exchange Online outage that stopped mail on three continents
Incident EX1331830 delayed email across North America, Asia-Pacific and Europe in early June. The cause was Microsoft’s; the lesson, as ever, is that your continuity plan can’t assume the cloud never blinks.
Why ransomware still wins when you “have backups”
Acronis’s May analysis explains the recurring failure: backups that share a domain, credentials and network with the systems they protect aren’t a recovery plan — they’re a second target.
Your AI features now have a region dependency — Australia East found out
A late-May Azure OpenAI incident hit Australia East particularly hard. As AI gets wired into everyday workflows, the resilience question moves from “is email up?” to “is the model up?”
90% feel safe. Under a third actually recover. Veeam’s 2026 numbers.
Veeam’s Data Trust and Resilience Report 2026 found a wide gap between recovery confidence and recovery reality — only 28% of ransomware victims fully recovered their data.
Essential Eight is now the price of cyber insurance
In 2026 the Essential Eight has shifted from “recommended” to expected — and cyber insurers are now asking for proof of maturity before they’ll quote, renew or pay.
Verizon’s 2026 DBIR: 96% of ransomware victims are small business
The new Data Breach Investigations Report makes the SMB picture stark — 96% of ransomware victims of known size were SMBs, and vulnerability exploitation is now the single biggest way in.
Windows 10 is out of support — the ESU bridge is a stopgap, not a plan
Windows 10 hit end of support on 14 October 2025. Extended Security Updates buy time, but the meter is running and the price doubles each year. If Windows 10 is still in your estate, the clock is the point.
cPanel/WHM under active exploitation — patch the panel you forgot you run
The ACSC flagged active exploitation of a cPanel/WebHost Manager flaw (CVE-2026-4194). Web-hosting control panels are exactly the kind of internet-facing admin surface that gets overlooked.
ACSC flags a surge against critical infrastructure — and the lesson travels down
The ACSC reports a rise in attacks targeting Australia’s critical infrastructure, with the policy focus shifting to resilience. Even if you’re not critical infrastructure, the threat model is the same one aimed at you.
ClickFix: the “fix it yourself” prompt that runs malware for the attacker
The ACSC warned of ClickFix campaigns spreading through compromised WordPress sites. The trick is social, not technical — it convinces the user to paste and run the malicious command themselves.
Cloud desktops just got 20% cheaper — and AVD Hybrid changes the maths
Microsoft cut Windows 365 Business pricing by 20%, renamed Frontline to Flex, and previewed AVD Hybrid for running cloud-managed desktops on your own servers. The cloud-desktop calculation is worth redoing.
Ransomware payment reporting is now enforced, not just explained
Australia’s mandatory 72-hour ransomware-payment reporting regime has moved past its education-first grace period. From January 2026 the focus is compliance and enforcement.
The January 2026 M365 outage — what really took it down
Microsoft attributed the global M365 disruption to a maintenance event and third-party network issue, not an attack. The lesson for SMBs is BCDR, not blame.
QR-code phishing doubled in Q1 2026 — your existing filters won't see it
Microsoft's Threat Intelligence team blocked 8.3 billion phishing emails in Q1 2026. The fastest-growing vector: QR codes that move the attack off email and onto an unmanaged phone.
Verizon's 2025 DBIR: 88% of SMB breaches now involve ransomware
The annual Data Breach Investigations Report puts the SMB ransomware rate at 88% — and notes operators now disrupt backups in the first hour of intrusion.
If you turn Copilot on before Purview, you have a data problem
Copilot reads what your users can read. Without sensitivity labels and access scoping, that's everything in SharePoint. Purview before Copilot — not after.
Essential Eight 2026 — tighter, not optional
The ACSC is pushing Essential Eight from box-tick to measurable. Patching speed, privileged access discipline, and hardening are the three areas tightening this year.
72 hours to report — Australia's mandatory ransomware payment law is live
Since May 2025, organisations with turnover above $3M (or critical-infrastructure responsibility) must report any ransomware payment to the ASD within 72 hours.
Privacy Act expansion — 100,000+ small businesses regulated from 1 July 2026
An estimated 100,000 small businesses become Privacy Act-regulated from 1 July 2026. If you handle customer data and you've never read the APPs, the time is now.
Your VPN is the breach vector. Stop calling it the perimeter.
Microsoft's 2026 threat reporting consistently puts VPN authentication at the start of domain-wide compromise. AVD with Conditional Access is the modern replacement.
Immutable backup is the baseline now. Tested immutable backup is the standard.
Modern ransomware operators delete or encrypt backups before triggering the main payload. Immutable storage plus monthly restore-tests is no longer optional.
The $254K SMB attack — and why insurance doesn't make it go away
Microsoft Security pegs the average SMB cyber-attack cost at $254,445. NinjaOne data shows 60% of SMBs fail within six months of a serious breach.
Microsoft critical vulnerabilities doubled in 2025 — what that actually means
Critical Microsoft vulnerabilities surged from 78 to 157 year-over-year. Azure and Dynamics critical CVEs jumped 9x. Patching cadence is the differentiator.
Microsoft 365 Business Premium is doing more work than most owners realise
M365 Business Premium quietly bundles Intune, Defender for Business, Conditional Access and AIP. Most SMBs are paying for it and using ~30% of it.
AI-powered phishing — when the bait stops being clumsy
The new generation of phishing campaigns uses generative AI to produce grammatically perfect, context-aware lures. The old "watch for bad English" advice is dead.
AVD without cost control is an Azure invoice waiting to surprise you
Azure Virtual Desktop is powerful and, without orchestration, expensive. Nerdio Manager Enterprise auto-scales host pools and keeps the monthly bill predictable.
Security Defaults isn't Conditional Access — don't confuse the two
M365's free Security Defaults are a good starting line. Conditional Access is the actual finishing line, and most SMBs need it.
Supply-chain attacks via MSP tooling — why your provider's posture is your posture
MSP tooling has been a high-value target for nation-state and ransomware groups for years. In 2025–26, your provider's RMM and PSA are part of your attack surface.
ACSC responded to 1,200+ incidents in FY24–25 — up 11%
The Australian Cyber Security Centre's annual figures show 1,200+ incidents responded to and 1,700+ alerts issued. The volume isn't slowing.
The thirteen ways IT delivery breaks in fast-growing firms
DKB Innovative's 2026 analysis of managed-IT delivery problems is required reading for any SMB outgrowing its current provider.
Azure, Dynamics 365 and M365 — fresh IRAP assessments published
Microsoft's 2026 independent IRAP assessments of Azure, Dynamics 365 and M365 are now available, supporting Australian Government and regulated-industry workloads.
Shadow AI — your staff are using it. Your governance probably isn't.
Staff are pasting client data into ChatGPT, Claude, Gemini and a dozen other tools to get work done. The governance question is what you do about it — not whether it's happening.
The December 2025 Teams outage — messaging delay, real lessons
Microsoft Teams suffered a significant worldwide messaging-delay event on 20 December 2025. The cause was infrastructure. The lesson is comms-channel diversity.
Office 365 vs Microsoft 365 — still the most-asked question of 2025
The naming is genuinely confusing. The licensing matters. A short guide to which SKU SMBs should actually be on in 2026.
Why ransomware victims pay — and why "don't pay" is harder than it sounds
The "never pay" mantra is sound public-policy advice. It's also a much harder call when it's your business and your customers' data on the clock.
Essential Eight maturity levels — stop treating ML1 as a destination
Maturity Level One was always a starting line. In 2026 it's increasingly being read by insurers and regulators as the floor, not the goal.
Australia's new statutory tort for serious invasions of privacy — quietly active
Since 10 June 2025, individuals can sue for serious invasions of privacy directly under a new statutory tort. The bar is high. The exposure is real.
What SMBs are actually spending on cybersecurity in 2026
Industry data through 2025–26 shows SMB cyber spend rising sharply — driven less by enthusiasm than by insurance, customer questionnaires, and recent pain.
Microsoft's official guidance: enable Purview Audit before turning Copilot on
Microsoft's own Learn documentation now states: enable Purview Audit before Copilot activation, and verify that Copilot-specific events are captured.
Windows Server 2016 — the end-of-life conversation everyone's deferring
Mainstream support for Windows Server 2016 ended in January 2022. Extended support ended January 2027. If it's still in your environment, the migration window is closing.
Session token theft — the MFA-bypass trend you can't ignore
MFA is no longer enough on its own. Adversary-in-the-middle attacks steal session tokens after auth completes. The defence is Conditional Access and continuous evaluation.
Backup vendors becoming security vendors — the Acronis MDR direction
The line between backup and security has blurred. Acronis, Veeam and others now ship MDR overlays on top of the data-protection stack. The convergence is the point.
SharePoint permissions audit — the silent prerequisite for everything else
Most SMB SharePoint environments have years of permission sprawl. Copilot, sensitivity labels, and DLP all assume the permissions are right. They usually aren't.
The hidden risk report — why high-stakes SMBs need proactive managed services
Breaking AC's May 2026 analysis catalogues the recurring "hidden" IT risks in high-stakes SMBs. None are exotic. All are expensive when they bite.
The MSP staffing shortage — why your tickets sit longer than they used to
The 2026 MSP industry data points to a sustained engineering-talent shortage. The visible effect on customers is slower response, junior reassignments, and churn.
Azure cost controls in 2026 — what most SMBs are still leaving on the table
Azure has accumulated a stack of cost-management features over the past two years. Most SMB tenants use a fraction. The unused features are usually the biggest payoff.
Data Privacy Week 2026 — the practical things SMBs should actually do
Data Privacy Week is a useful annual prompt. Use it for the housekeeping work that doesn't get done the other 51 weeks of the year.
Purview DLP for Copilot prompts — finally a sensible control surface
Microsoft's Purview DLP now supports prompt-level controls for Copilot. You can specify what kinds of content Copilot is allowed to be asked about, and what isn't.
Legacy authentication retirement — the migration the industry kept deferring
Microsoft has been pushing legacy auth retirement for years. In 2026, the deferrals stop being optional. Identify dependencies and plan the remediation.
The minimum-viable incident response runbook — four pages, written this month
Most SMBs don't have a written incident-response plan. They will. The question is whether it gets written this month, or under deadline at 2 a.m.
Intune device compliance — the policy you already own, the policy you should turn on
Intune-driven device compliance ties Conditional Access to device posture. It's bundled in Business Premium. Most SMBs are paying for it and not using it.
The quiet disappearance of break-fix IT
Hourly break-fix IT support is shrinking quietly but persistently. The driver isn't fashion — it's that the threat model has outgrown the model.