AI Security
Practical guides to AI tools, client data, agent permissions and AI scams.
View categoryBlog
Field notes from working security operators
Practical writeups on tools, compliance, incident response, personal security, and what actually matters when security has to work in the real world.
Categories
Explore by category
Compliance
SOC 2, HIPAA, CMMC, PCI-DSS, ISO 27001, audit prep, and control mapping for growing teams.
View categoryDevice Management
MDM, Intune, JAMF, Addigy, Workspace ONE, and Kandji guidance for secure device fleets.
View categoryEndpoint & Detection
EDR, MDR, XDR, Huntress, SentinelOne, CrowdStrike, Defender, and practical endpoint detection guidance.
View categoryIdentity Security
Plain-English guides to protecting work accounts, choosing identity monitoring and deciding who responds when a sign-in becomes an incident.
View categoryPersonal Security
Online scams, identity theft, family digital safety, and personal cybersecurity explained in plain language.
View categorySecurity Awareness
Phishing simulation, scam recognition, social engineering, and awareness training programs that actually change behavior.
View categorySmall Business Security
Plain-English hardening for the tools small businesses actually run. Workspace, Microsoft 365, connected SaaS, shared logins, offboarding.
View categoryThreat Intelligence & Incident Response
Threat actor profiles, recent breaches, vendor compromises, and incident response playbooks.
View categoryFeatured
Start with the current benchmark article
Cyber Insurance for First-Time SMB Buyers: What the 2026 Questionnaire Actually Asks and How to Pass It
A practical walkthrough of cyber insurance for first-time SMB buyers in 2026 — what the policy covers, what the questionnaire asks.
SMB
Read articleSearch
Find the topic you need
Browsers that act for you: Perplexity Comet and ChatGPT’s browser agent
Review AI browser access and actions at a small firm: Comet’s controls, what OpenAI says replaced the retired Atlas, and an approval checklist.
Microsoft 365 Copilot and oversharing: fix permissions first
A permission-cleanup and rollout checklist for firms of 50 to 500 people preparing for Microsoft 365 Copilot, grounded in Microsoft documentation.
AI meeting notes at an RIA: Regulation S-P and recordkeeping
Decide how AI meeting notes are reviewed, retained and retrieved at an RIA, with SEC Regulation S-P dates and a checklist for the compliance officer.
AI notetakers and client confidentiality at a small law firm
Decide which AI notetakers may join client calls, what to tell clients and what to verify, using ABA Opinion 512 and a practical approval checklist.
AI scribes and patient audio: ask the BAA question first
Before an AI scribe receives patient audio, confirm its agreement, plan and features. A vendor checklist for dental and medical practices.
CPA firms: put your AI tools in your WISP
Put the AI tools your CPA firm actually uses in its WISP, with IRS Publication 5708, FTC guidance and a practical inventory and approval checklist.
Recent
Recent articles across the site
Filter by audience, industry, or article type. The list updates after Apply.
Browsers that act for you: Perplexity Comet and ChatGPT’s browser agent
Review AI browser access and actions at a small firm: Comet’s controls, what OpenAI says replaced the retired Atlas, and an approval checklist.
Law firmsFinancial servicesSMB
Read articleMicrosoft 365 Copilot and oversharing: fix permissions first
A permission-cleanup and rollout checklist for firms of 50 to 500 people preparing for Microsoft 365 Copilot, grounded in Microsoft documentation.
Law firmsAccounting firmsFinancial servicesSMB
Read articleAI meeting notes at an RIA: Regulation S-P and recordkeeping
Decide how AI meeting notes are reviewed, retained and retrieved at an RIA, with SEC Regulation S-P dates and a checklist for the compliance officer.
Financial servicesSMB
Read articleAI notetakers and client confidentiality at a small law firm
Decide which AI notetakers may join client calls, what to tell clients and what to verify, using ABA Opinion 512 and a practical approval checklist.
Law firmsSMB
Read articleAI scribes and patient audio: ask the BAA question first
Before an AI scribe receives patient audio, confirm its agreement, plan and features. A vendor checklist for dental and medical practices.
Dental practicesSMB
Read articleCPA firms: put your AI tools in your WISP
Put the AI tools your CPA firm actually uses in its WISP, with IRS Publication 5708, FTC guidance and a practical inventory and approval checklist.
Accounting firmsSMB
Read articleCan a browser stop files from downloading to the computer?
What an enterprise browser is, how download blocking really works, where the file goes instead, and what it does not cover on an iPhone or iPad.
SMB
Read articleAI agents on work laptops: what can they reach?
Review what AI agents can read, change and send. Obsidian Ridge explains permissions, approval checks and how to start with an inventory.
SMB
Read articleFake AI app downloads: how to spot a poisoned Claude or ChatGPT ad
Huntress and Cato report fake AI download campaigns. Obsidian Ridge explains the lures, safer installation checks and the limits of trusted domains.
SMB
Read articleWhat AI tools are my employees using? How to find out
Find the AI apps, extensions and agents staff use. Obsidian Ridge explains what to check and how its free assessment reviews access and risky actions.
SMB
Read articleIs it safe to run a Terminal command ChatGPT gives you?
Check AI-generated Terminal commands before running them. Obsidian Ridge explains poisoned shared chats, safe checks and what to do after a mistake.
SMB
Read articleHow to stop employees pasting client data into ChatGPT
Stop client data reaching unapproved AI tools with approved accounts and tested controls. Obsidian Ridge explains how to put an AI policy into practice.
Law firmsAccounting firmsDental practicesSMB
Read articleBrowser security statistics for 2026, with sources
Browser security figures for 2026 with the analyst, year, sample size and who paid for each one, plus a plain warning about where most of them come from.
SMB
Read articleGiving contractors and personal laptops access without a VPN
A part-time bookkeeper on a home laptop does not need a VPN. What four companies report after cutting VPN use, and what a browser actually controls.
SMB
Read articleWhat two banks report after switching to an enterprise browser
Two banks published their enterprise browser results: a spear-phish stopped at the password box, setup in about two days, and far less deployment effort.
Financial servicesSMB
Read articleReplacing VDI or Citrix with an enterprise browser: what companies report
Published results from four companies that moved work off virtual desktops, the Forrester figures, and an honest section on when you still need VDI.
SMB
Read articleNGRAVE LIQUID notifications hijacked: what happened and what to do
NGRAVE says attackers hijacked LIQUID push notifications to send fake Moscow sync alerts. How to spot the ngrave.support phishing site and what to do.
IndividualsSMB
Read articleIsland vs SURF vs Prisma Browser for Small Advisory Firms
Obsidian Ridge compares Island, SURF and Prisma Browser for a small advisory firm: download controls, personal devices, minimums and audit logs.
Financial servicesSMB
Read articleThe Small Business Microsoft 365 Security Review: What to Check, in Plain English
For a small firm on Microsoft 365: ten settings you can check in an hour, covering who can create groups, buy apps, consent to apps and sign in.
SMB
Read articleDevice code phishing on Microsoft 365, explained
A short code typed into Microsoft's own sign-in page can hand an attacker your mailbox. How device code phishing works, and how to block it.
SMB
Read articleCybersecurity for a small investment adviser: Reg S-P, Reg S-ID and state exams
For a solo or two-person advisory firm: which cybersecurity rules you answer to under Regulation S-P, S-ID, state rules and the FTC Safeguards Rule.
Financial servicesSMB
Read articleAI security assessments for small businesses compared
For a business that wants to know which AI tools staff are using: what discovery tools, cloud AI security and a managed assessment each cover.
SMB
Read articleManaged security for small businesses using Google Workspace
Compare Google Workspace controls, Huntress ITDR and Obsidian Ridge on identity coverage, response, cost, term and minimum.
SMB
Read articleManaged SIEM for HIPAA and cyber-insurance evidence
Compare five SIEM options, Obsidian Ridge's Ridge Log included, on evidence, retention, response, pricing, contract terms and minimums for a practice.
Dental practicesLaw firmsSMB
Read articleManaged cybersecurity cost for a dental or medical practice
What Obsidian Ridge charges a 5, 10 or 20 person practice monthly, with onboarding, contract terms and the work a medical or dental office still needs.
Dental practicesSMB
Read articleAI usage policy for law firms and dental offices
How law firms and dental offices can stop staff pasting client data into ChatGPT, with policy and managed browser controls from Obsidian Ridge.
Law firmsDental practicesSMB
Read articleChoosing dental security before cyber-insurance renewal
Obsidian Ridge's dental cyber-insurance renewal checklist covers devices, accounts, response, evidence, backups and truthful questionnaire answers.
Dental practicesSMB
Read articleCPA firm WISP and FTC Safeguards: a practical guide
CPA cybersecurity for an IRS WISP and FTC Safeguards: Obsidian Ridge explains controls, evidence and responsibilities with IRS and FTC sources.
Accounting firmsSMB
Read articleSmall law firm cybersecurity: duties, costs and choices
A three-attorney cost example from Obsidian Ridge, ABA duties, provider questions and the evidence a small law firm should ask for.
Law firmsSMB
Read articleBest MDR providers for small businesses (2026)
For a small business choosing managed detection and response: seven options compared on who responds, what each publishes, terms and minimums.
SMB
Read articleWhat managed detection and response costs for a 5, 10, or 25 person business (2026)
For a business of about ten people pricing MDR: what it costs per device, what onboarding adds, and how the device plan differs from the per-person one.
SMB
Read articleManaged ITDR for Microsoft 365 and Google Workspace compared
For a firm on Microsoft 365 or Google Workspace, or both: five identity options compared on coverage, who responds, pricing, term and minimum.
SMB
Read articleWhat DMARC Is and Why Your Dental Practice Needs It
DMARC in plain English for dental offices: what it does, why most local practices we checked don't have it, and how to add it without breaking reminders.
Dental practicesSMB
Read articleSecurity awareness training providers for companies under 100 employees compared (2026)
For a firm under 100 staff buying awareness training: six options compared on simulations, reporting, who runs it, price, term and seat minimum.
SMB
Read articleManaged cybersecurity providers in the Research Triangle: an honest comparison (2026)
For a Triangle business choosing a security provider: seven local options compared only on what each publishes about pricing, terms and SOC model.
SMB
Read articleBest MDR providers for dental practices compared (2026)
Six MDR options for a dental practice, Obsidian Ridge included, compared on HIPAA fit, identity coverage, price, term, seat minimum and who responds.
SMB
Read articleHow to lock down a parent's Windows computer against remote-access scams
Six steps to lock down a parent's Windows computer against remote-access scams, and one family rule. Plain steps, honest limits, and when to get help.
Individuals
Read articleHow Scammers Abuse Remote-Access Tools Like AnyDesk and TeamViewer
AnyDesk, TeamViewer, and ScreenConnect are real tools scammers misuse. Learn how the refund scam works, warning signs, and how to protect your family.
Individuals
Read articleTravelers' MFA Supplement, Question by Question
Every question on Travelers' Multi-Factor Authentication Supplement (CYB-14306), what a true Yes takes, and the evidence to have ready before you sign.
SMB
Read articleWho Signs a Cyber Insurance Application?
Who signs a cyber insurance application, what the signature represents, and why the signer must check the security answers with IT first.
SMB
Read articleThat 'Microsoft' pop-up is fake: what to do right now
That pop-up warning is fake. Do not call the number. A plain guide for older adults: how to close it safely, what to do next, and how to prevent it.
Individuals
Read articleYour firm has MFA. Here is how attackers sign in anyway.
Attackers steal the session cookie your browser gets after the MFA prompt. What adversary-in-the-middle phishing is, and what stops it.
Accounting firmsSMB
Read articleHuntress ITDR vs Defender for Identity: same name, different problem
Defender for Identity installs sensors on domain controllers. If your business has no on-premises Active Directory, there is nothing for it to watch.
SMB
Read articleHuntress vs ThreatLocker: block everything, or watch everything
Comparing allowlisting with monitoring: ThreatLocker blocks what is not approved, Huntress watches what gets through. Which problem does your firm have?
SMB
Read articleHuntress vs Todyl: are you buying a layer or a whole stack?
Todyl sells a six-module platform including the network layer, channel-only, with no published pricing. Huntress sells a layer and publishes its rates.
SMB
Read articleHuntress vs Blackpoint Cyber: two MDR models, two ways to buy
For a small business comparing two 24/7 SOC services: what each publishes about price, terms and how you buy, and what that tells you before a demo.
SMB
Read articleHuntress vs Microsoft Defender for Business: you already own EDR
For a firm already paying for Microsoft 365 Business Premium: you have the EDR. This explains what you do not have, and who reads the alerts.
SMB
Read articleHuntress vs CrowdStrike Falcon Go: the dollar that isn't the difference
For a small business comparing Falcon Go with Huntress Managed EDR: what each includes at the same list price, and why price is not the difference.
SMB
Read articleThe SIG Lite questionnaire: what it is and how to answer it
What the SIG Lite questionnaire is, who sends it, how it differs from SIG Core, and how a small business answers it honestly without a security team.
SMB
Read articleHuntress pricing 2026: buying direct vs buying managed
For a business under 50 seats pricing Huntress: what it costs direct, what the seat minimum does to the total, and when buying direct is still right.
SMB
Read articleHuntress vs Arctic Wolf: which MDR model fits a small business
For a small business choosing between two MDR models: Arctic Wolf runs the tools you already own, Huntress brings its own. Which fits, and why.
SMB
Read articleThe Small Business Google Workspace Security Review: What to Check, in Plain English
A practical Google Workspace security review for small businesses. Eight checks, one hour, no jargon. What to fix, what to skip, and when to get help.
SMB
Read articleYour IT Company Is Not Your Security Team: What CPA Firms Actually Need
Filing season concentrates the exposure. What IT covers, what a security operation covers, and the reporting path the IRS walks after a preparer breach.
Accounting firmsSMB
Read articleYour IT Company Is Not Your Security Team: What Dental Practices Actually Need
For a dental practice, downtime is revenue. Why the PMS server needs a security operation of its own, and what to ask before the schedule empties.
Dental practicesSMB
Read articleYour IT Company Is Not Your Security Team: What Law Firms Actually Need
Confidentiality is a bar duty before it is an IT one. What your IT provider owns, what a security operation owns, and how MR 5.3 applies to the vendor.
Law firmsSMB
Read articleMDR vs. Antivirus: What Your Cyber Insurance Application Actually Asks For
Cyber insurance carriers stopped accepting 'we have antivirus' years ago. Here is what they ask about endpoint protection and how each term maps.
SMB
Read articleEmail Security for SMBs in 2026: Gateway vs API vs Built-In (Defender)
Plain-English 2026 buyer guide to the three email-security architectures small businesses actually pick between: built-in Defender or Google Workspace.
SMB
Read articleControl #15 Deep-Dive: Link Protection and Sandboxing for Inbound Mail
A hands-on deep-dive on cyber-insurance control #15 — link rewriting, time-of-click URL analysis, and attachment sandboxing.
SMB
Read articleCyber Insurance Renewal Calendar: What to Fix 90, 60, and 30 Days Before Renewal
A practical 90/60/30-day cyber insurance renewal calendar for small businesses that need cleaner answers, better evidence, and fewer last-minute surprises.
SMB
Read articleBackups Are Not Recovery: How to Prove You Can Restore Before Ransomware
For a business that has backups but has never tested them: how to prove a restore works, and the record an underwriter can ask to see.
SMB
Read articleThe Family Fraud Fire Drill: What Everyone Should Decide Before the Scam Call Comes
A practical family fraud fire drill for urgent scam calls, fake bank alerts, AI voice-cloning attempts, and money requests that need a calm second check.
Individuals
Read articleWhat to Do If Your Parent Let a Scammer Remote Into Their Computer
A calm, numbered checklist for families: cut the internet, call the bank, change passwords from a clean device, report it. Steps for the first hour.
Individuals
Read articleDo You Need CMMC? A Small Manufacturer's Guide to the 2026 Rules
If you make anything for the defense supply chain — even as a sub-tier subcontractor — CMMC may now gate your contracts.
ManufacturingSMB
Read articleDo Auto Dealers Have to Comply with the FTC Safeguards Rule? (2026)
Most dealerships that arrange financing are 'financial institutions' under the FTC Safeguards Rule — which means a specific.
Auto dealersSMB
Read articleGLBA, the SEC, and Your Small Advisory: Which Cybersecurity Rules Actually Apply
RIAs, insurance agencies, and small advisory firms sit under overlapping cybersecurity rules — the FTC/GLBA Safeguards Rule and, for registered firms.
Financial servicesSMB
Read articleCybersecurity for Nonprofits on a Budget: Donor Data, Grants, and What Actually Matters
Nonprofits face the same attacks as any business on a fraction of the budget. There's no nonprofit-specific cyber law.
NonprofitsSMB
Read articleCybersecurity for Property Management: Tenant Data, Rent Fraud & FCRA in 2026
Property managers hold tenant SSNs and bank details, pull credit reports under FCRA, and move owner money.
Property managementSMB
Read articleHIPAA Cybersecurity for Senior Care & Assisted Living: What's Required in 2026
Skilled nursing and home health are HIPAA covered entities; assisted living often handles PHI too. What senior-care operators must protect.
Senior careSMB
Read articleDoes a Small Store Have to Be PCI Compliant? PCI DSS 4.0 in Plain English
x requirements became mandatory in 2025. What that means for a small merchant, plain-English, without the jargon.
Retail & e-commerceSMB
Read articleWire Fraud, Title Companies, and the GLBA Rule You Didn't Know Applied (2026)
Closing-wire fraud is the costliest cyberattack in real estate, and most title and settlement firms miss that the FTC Safeguards Rule already covers them.
Real estate & titleSMB
Read articleIs Pet Data Covered by HIPAA? Cybersecurity for Veterinary Practices in 2026
No — HIPAA doesn't cover pets, and there's no federal law requiring vets to safeguard animal health records.
VeterinarySMB
Read articleBeyond the Safeguards Rule: The Cyberattacks That Actually Hit Car Dealerships
Compliance is one thing; the attack that stops a dealership is another. Ransomware on the DMS, F&I identity data.
Auto dealersSMB
Read articleWhy Contractors Are a Top Ransomware Target — and How to Protect Your Payments and Projects (2026)
For a contractor or construction firm: how ransomware and payment fraud reach a job site and an office, and the controls that matter most first.
ConstructionSMB
Read articleRansomware on the Factory Floor: Protecting Production for Small Manufacturers
For a small manufacturer, the expensive cyberattack isn't data theft — it's the ransomware that stops the line.
ManufacturingSMB
Read articleCMMC compliance for small defense contractors: costs, timeline, and Level 2 steps
A plain-English CMMC guide for small defense contractors covering what Level 2 means in 2026, what actually drives cost, how the rollout works.
SMB
Read articleNIST 800-171 self-assessment: how to score your SPRS and close gaps
A plain-English guide for defense contractors on how the NIST SP 800-171 self-assessment score works, what SPRS actually stores.
SMB
Read articleNorth Carolina data breach notification law: what small businesses must do
A plain-English guide to North Carolina's data breach notification law for small businesses, including who must notify, what the notice must say.
SMB
Read articlePCI DSS 4.0.1 for small merchants: which SAQ you need and what changed
A plain-English PCI DSS 4.0.1 guide for small merchants covering how to choose the right SAQ, what changed in the v4.0.1 SAQ set.
SMB
Read articleVendor and third-party risk for SMBs: how to vet your software supply chain
A plain-English vendor risk guide for small and midsize businesses covering how to classify suppliers, what to ask software vendors before purchase.
SMB
Read articleAffordable EDR for small business: options with transparent monthly pricing
A plain-English guide to small-business EDR options that actually publish pricing, with official vendor numbers normalized into monthly cost.
SMB
Read articleBest managed EDR for Microsoft Defender users
For a small business already running Microsoft Defender: which managed EDR options build on it, what each adds, and who watches the alerts.
SMB
Read articleThe cheapest MDR for small business: real 2026 pricing by endpoint count
For a small business on a budget: what MDR costs at 10, 25 and 50 endpoints using published vendor pricing, and how seat minimums change the answer.
SMB
Read articleBest password manager for seniors in 2026
For an older adult, or the family helping one: which password managers are genuinely easy to use, and how recovery works if they get locked out.
Individuals
Read articleDo I need an MSSP or just an MSP? A decision guide for North Carolina SMBs
A plain-English guide for North Carolina small businesses deciding whether general IT support is enough, or whether they need an MSSP.
SMB
Read articleHow much does it cost to outsource cybersecurity for a small business?
A plain-English pricing guide to outsourced cybersecurity for small businesses, including endpoint-only coverage, managed programs, identity monitoring.
SMB
Read articleIs antivirus enough for my small business? Why ransomware walks past it
A plain-English small-business guide to what antivirus still does well, where ransomware bypasses it, and what controls have to sit around it.
SMB
Read articleAI voice-cloning scams: how to protect your family with a safe word
How AI voice-cloning scams fake a family emergency call, why a familiar voice proves nothing, and the safe-word rule that stops a panicked payment.
Individuals
Read articleDo you really need a VPN? An honest 2026 answer
A plain-English guide to whether most people actually need a VPN in 2026, what a VPN really does, when it helps, and what it does not protect you from.
Individuals
Read articleGovernment impersonation scams: when the IRS, SSA, or Medicare calls
A plain-English guide to government impersonation scams, including IRS, Social Security, Medicare, and FTC fake-contact schemes.
Individuals
Read articleHow to freeze your credit for every family member in 30 minutes
A practical step-by-step guide to freezing credit for adults, kids, and aging parents, with what a freeze actually blocks, what it does not.
Individuals
Read articleHow to tell if your email or password was leaked in a data breach
A plain-English guide to checking whether your email or password was exposed in a data breach and the exact steps to take next if it was.
Individuals
Read articleIdentity theft protection: what to do in the first 24 hours
A plain-English first-day response guide for suspected identity theft, covering the federal recovery steps that matter most before more accounts.
Individuals
Read articleInvestment and crypto scams: how fake trading platforms steal retirement savings
A plain-English guide to modern investment and crypto scams, how fake trading platforms create the illusion of profits.
Individuals
Read articleThe most common scams targeting seniors in 2026
A plain-English guide to the scams hitting older adults hardest in 2026, and the single response rule that prevents most of the losses.
Individuals
Read articleOnline shopping scams during the holidays: how to spot fake deals before you click
A plain-English holiday shopping scam guide covering fake online stores, scam ads, package-text tricks.
Individuals
Read articlePhishing explained: how to recognize a scam email or text in 30 seconds
A plain-English guide to spotting phishing emails and texts fast, what the common red flags actually look like.
Individuals
Read articlePublic Wi-Fi safety: what's actually risky and what isn't
Public Wi-Fi in 2026: what is still risky, what is outdated fear, and the habits that make airport, hotel and café networks safer to use.
Individuals
Read articleRomance scams: warning signs and how to help someone who's being targeted
A practical guide to the warning signs of romance scams and how to help someone who may already be emotionally involved.
Individuals
Read articleSmart home security: how to lock down cameras, doorbells, and speakers
A plain-English guide to securing smart home devices in 2026, with the practical steps that matter most for cameras, video doorbells, smart speakers.
Individuals
Read articleStrong passwords vs passkeys: what to use in 2026
A plain-English guide to passkeys versus passwords in 2026, when passkeys are better, where passwords still matter.
Individuals
Read articleWhat is multi-factor authentication and why it stops most account takeovers
A plain-English MFA explainer: what multi-factor authentication is, why it blocks many password-based account takeovers.
Individuals
Read articleWhat is ransomware? A plain-English guide for non-technical people
A plain-English explanation of ransomware: how it spreads, what attackers actually want, and what to do first if you think you have been hit.
IndividualsSMB
Read articleEmail security for small business: stopping BEC and phishing on a budget
A plain-English small-business email security guide focused on the cheap controls that cut business email compromise and phishing risk first.
SMB
Read articleHIPAA risk assessment: how to use the free HHS SRA Tool and when to get help
A plain-English guide to using the free HHS and ASTP/ONC Security Risk Assessment Tool for HIPAA Security Rule work, including what the tool does well.
SMB
Read articleSmall Business Cybersecurity Basics: 10 Things to Do This Week
A plain-English small business cybersecurity checklist — the ten controls most worth doing first, before you spend a dollar on tools you may not need yet.
SMB
Read articleWhat Controls Do Cyber Insurers Require in 2026? The 10 That Decide Your Application
The 10 security controls cyber insurers actually score in 2026 — what carriers ask, what passes, and the quiet answers that get applications declined.
SMB
Read articleHow to protect aging parents from online scams without overwhelming them
A practical guide for adult children who want to reduce scam risk for aging parents without treating them like children or burying them in security advice.
Individuals
Read articleWhat to do in the first 24 hours after a small business ransomware scare
A practical first-24-hours ransomware checklist for small businesses: isolate systems, preserve evidence, call the right parties.
SMB
Read articleCyber Insurance for Accounting Firms: The Controls Underwriters Are Asking About in 2026
What cyber insurance for CPA and tax firms actually covers in 2026, the underwriting questionnaire controls carriers review.
Accounting firmsSMB
Read articleCyber Insurance for First-Time SMB Buyers: What the 2026 Questionnaire Actually Asks and How to Pass It
A practical walkthrough of cyber insurance for first-time SMB buyers in 2026 — what the policy covers, what the questionnaire asks.
SMB
Read articleCyber Insurance Questionnaire 2026: The 22 Controls Underwriters Are Asking About
The 22 controls cyber insurers verify in 2026: what each application question asks, why underwriters care, and the evidence behind a yes.
SMB
Read articleMulti-location DSO M365 consolidation: a four-quarter security program walkthrough
A scenario walkthrough of a DSO with multiple M365 tenants and no central detection, brought to consolidated identity coverage in four quarters.
Dental practicesSMBEnterprise
Read articleIRS Publication 4557 & FTC Safeguards Rule for CPA Firms: What You Actually Have to Do in 2026
What IRS Publication 4557 and the FTC Safeguards Rule actually require of CPA firms in 2026 — the safeguards, the written program, and where firms slip.
Accounting firmsSMB
Read articleThe IRS WISP Template for Solo and Small CPA Firms (12 Pages, Not 60)
What an IRS Publication 4557-aligned Written Information Security Plan (WISP) actually has to contain for a small CPA firm in 2026.
Accounting firmsSMB
Read articleMDR vs EDR vs MSSP vs SOC-as-a-Service: An Operator's Decision Tree for Small Business
MDR, EDR, MSSP, and SOC-as-a-service compared honestly for small business buyers — what each delivers, what each costs.
SMBEnterprise
Read articleSecuring Lacerte, Drake, CCH Axcess, UltraTax, and ATX: A Practical Hardening Guide for Small Tax Firms
Field-tested hardening guide for the tax software CPA firms actually use — Lacerte, Drake, CCH Axcess, UltraTax, and ATX.
Accounting firmsSMB
Read article1Password vs Bitwarden vs Apple Passwords: What a CISSP Actually Uses at Home (2026)
For a household choosing a password manager: 1Password Families, Bitwarden and Apple Passwords compared on sharing, recovery and what each costs.
Individuals
Read articleLifeLock vs Norton 360 with LifeLock — and why we withdrew our Aura recommendation (2026 update)
For a family comparing identity-theft protection: what LifeLock and Norton 360 with LifeLock actually monitor, and why we withdrew our Aura recommendation.
Individuals
Read articleThe Complete 2026 Guide to Personal Cybersecurity for Families
What actually matters for personal and family cybersecurity in 2026 — identity protection, password managers, MFA, browser protection, device protection.
Individuals
Read articleGuardio vs Bitdefender vs Malwarebytes: Browser-Layer Protection Compared (2026)
A vendor-neutral comparison of Guardio, Bitdefender Total Security, and Malwarebytes Plus for browser-layer and endpoint protection in 2026.
Individuals
Read articleWire Fraud and Client-Trust Compromise: The BEC Pattern That's Costing Accounting Firms Six Figures
How BEC and wire-fraud unfold in CPA firms — refund redirect, payroll wire interception, vendor payment scams.
Accounting firmsSMB
Read articleDental practice BEC and mailbox-rule wire fraud: a scenario walkthrough
A scenario walkthrough of an adversary-in-the-middle phish on a dental practice, an inbox rule staged for wire fraud, and the ITDR chain that broke it.
Dental practicesSMB
Read articleLaw-firm Akira ransomware: a Friday-night scenario walkthrough
A scenario walkthrough of an Akira ransomware chain, Pikabot delivery, and the host auto-isolation that cut the attacker's access.
Law firmsSMB
Read articleTax Season Ransomware: Why CPA Firms Get Hit Between February and April
Why ransomware operators target accounting firms during tax season, the attack chains that work, the recovery timelines firms cannot afford.
Accounting firmsSMB
Read articleWhat do the ABA rules require of a law firm's cybersecurity?
What ABA Model Rule 1.6(c), Formal Opinions 477R and 483, and the NC State Bar’s 2011 FEO 6 and 2024 FEO 1 ask of a law firm’s security.
Law firmsSMB
Read articleCyber Insurance for Dental Practices: The Controls Underwriters Are Asking About in 2026
What dental cyber insurance actually covers in 2026, the underwriting questionnaire controls carriers review.
Dental practicesSMB
Read articleCyber Insurance for Law Firms: The Controls Underwriters Are Asking About in 2026
What law firm cyber insurance actually covers in 2026, the underwriting questionnaire controls carriers review.
Law firmsSMB
Read articleHIPAA Cybersecurity for Dental Practices: What the Security Rule Actually Requires
What the HIPAA Security Rule actually requires of dental practices in 2026 — risk analysis, administrative safeguards, MFA, encryption, breach response.
Dental practicesSMB
Read articleMulti-Location Dental & DSO Cybersecurity: The Consolidation Problem
Why DSO and multi-location dental groups inherit the worst cybersecurity posture of their weakest practice.
Dental practicesSMBEnterprise
Read articleMulti-Office Law Firm Cybersecurity & Cyber Diligence in Legal M&A: The Consolidation Problem
Why multi-office firms and acquiring firms inherit the worst cybersecurity posture of their weakest office.
Law firmsSMBEnterprise
Read articleProtecting Privileged Communications and Sealed Court Records: The Confidentiality Stack Every Small Law Firm Should Build
How small law firms actually protect attorney-client privileged communications, work product, and sealed court records in 2026.
Law firmsSMB
Read articleSecuring Dentrix, Eaglesoft, and Open Dental: A Practical Hardening Guide
A field-tested hardening guide for Dentrix, Eaglesoft, and Open Dental — server isolation, account hygiene, backup strategy, audit logging.
Dental practicesSMB
Read articleSecuring NetDocuments, iManage, Clio, MyCase, ProLaw, and PracticePanther: A Hardening Guide for Small Law Firms
A field-tested hardening guide for the document management and practice management systems law firms actually use.
Law firmsSMB
Read articleBusiness Email Compromise in Dental Offices: The $50k Wire-Fraud Pattern
How BEC and wire fraud actually unfold in a dental practice — the supplier-impersonation pattern, the inbox-rule trick, the controls that catch it.
Dental practicesSMB
Read articleDental Ransomware in 2026: Why Practice Management Systems Are the Number-One Target
Why ransomware operators target dental practices, how attacks land on Dentrix and Eaglesoft, what a real incident week looks like.
Dental practicesSMB
Read articleBusiness Email Compromise in Law Firms: The Closing-Wire-Fraud Pattern That Keeps Costing Firms Millions
How BEC and closing-wire-fraud actually unfold in a law firm — the impersonation pattern, the inbox-rule trick, the controls that catch it.
Law firmsSMB
Read articleLaw Firm Ransomware in 2026: Why Mid-Size Firms Are the New Sweet Spot for Ransomware Operators
Why ransomware operators target law firms specifically, how the attack chain works against a typical practice, what a real incident week looks like.
Law firmsSMB
Read articleIntune for small businesses: when it is enough and when it is not
A practical SMB guide to where Microsoft Intune is enough on its own, where it falls short, and how to decide without overspending.
SMB
Read articlePhishing training program for small business: what works
Learn how to build a phishing training program for small business employees with realistic simulations, easy reporting, and metrics that matter.
SMB
Read articleHuntress vs SentinelOne for SMBs: what actually changes operationally
For a small business weighing Huntress against SentinelOne: what changes in daily work, who handles alerts, and which one suits a team with no analyst.
SMB
Read articleThe 3 a.m. alert: anatomy of an ITDR save before payroll Monday
A scenario walkthrough of what Identity Threat Detection & Response should catch when an attacker tries to redirect payroll wires over a long weekend.
SMB
Read articleSOC 2 readiness for small businesses: what founders should do first
A practical guide to SOC 2 readiness for small businesses, including what founders should do first, what to avoid.
SMB
Read articleEDR vs MDR vs XDR: A 2026 buyer's guide for small businesses
A practical 2026 buyer's guide to EDR, MDR, and XDR for small businesses, with honest recommendations, tradeoffs, and staffing realities.
SMBEnterprise
Read article