# Bart McDonough — Full Content Guide Canonical source: https://bartmcd.com ## A Practical Checklist for AI Vendor Selection - URL: https://bartmcd.com/blog/ai-vendor-selection-checklist - Published: 2026-10-10 A compelling AI demonstration can make a purchasing decision look easy. The system summarizes a document, answers a difficult question, or completes a workflow in seconds. What the demonstration rarely reveals is where your data goes, how the system handles failure, or what happens when the underlying model changes. Consider an AI assistant that drafts customer-service responses. Producing a polished answer is useful. Inventing a refund policy, exposing another customer’s information, or sending an unauthorized response is not. Vendor selection must distinguish between impressive output and dependable operation. Choose an AI vendor based on evidence of business value, data protection, operational controls, and an achievable exit—not the quality of its demonstration. The following checklist turns that principle into a practical procurement process. Start With Evidence and Shared Accountability AI procurement should involve the business owner, IT, security, privacy, legal, and procurement—not become an isolated technology purchase. Assign a lead who can consolidate findings and resolve conflicting requirements. For every checklist item, record four things: The vendor’s answer: What capability, commitment, or limitation is being represented? Supporting evidence: Which document, test, demonstration, or contractual provision supports it? Internal reviewer: Who is qualified and accountable to evaluate the answer? Unresolved conditions: What must change, who owns that change, and when must it be completed? This checklist is a practical synthesis informed by sources including NIST’s AI Risk Management Framework . The framework is voluntary guidance, not a certification or a guarantee of legal compliance. Apply scrutiny proportionate to the intended use: an internal drafting tool and an autonomous payment agent require different controls. The Eight-Point AI Vendor Selection Checklist 1. Define the Job Before Evaluating the Vendor Start with a workflow, not a product category. “We need AI” is not a purchasing requirement. “We need to reduce the time employees spend finding approved policy information” is a testable objective. Identify the workflow, users, business owner, and intended benefits. Document current performance and measurable acceptance criteria. Specify prohibited uses and the consequences of incorrect results. Determine which decisions or actions require human approval. Request: A use-case-specific implementation proposal, known limitations, and a written division of responsibilities. For the customer-service assistant, separate drafting from sending. Define whether it may suggest refunds, access account information, or communicate externally. NIST’s AI RMF core guidance emphasizes intended use, business value, risk, and human oversight. 2. Map Where Your Data Goes “We do not train on your data” is only the beginning of the conversation. It does not explain retention, human access, logging, or other secondary uses. Inventory prompts, uploaded files, outputs, logs, feedback, and any stored representations of your data. Identify hosting locations, subprocessors, model providers, and personnel with access. Confirm retention periods, deletion procedures, and backup exceptions. Clarify whether data supports training, fine-tuning, evaluation, or other secondary purposes. Request: A data-flow diagram, subprocessor list, applicable privacy terms, and contractual data-use commitments. Include support tickets and diagnostic logs in the review; sensitive information can leave the main application through troubleshooting. The FTC warns AI providers to honor privacy and confidentiality commitments . Ensure the contract reflects the promises made during sales discussions. 3. Investigate the Whole Supply Chain You may be buying an interface built on someone else’s model, cloud platform, retrieval service, and external APIs. Those dependencies affect availability, security, and your ability to adapt. Identify underlying models, external APIs, retrieval services, and critical dependencies. Distinguish components the vendor controls from those it purchases. Review how suppliers and model changes are assessed. Identify fallback arrangements for dependency outages or withdrawal. Request: An architecture diagram, component inventory, and supplier-risk process. Ask what happens if an upstream provider becomes unavailable or changes its terms. Can your workflow continue safely? The NCSC’s secure-development guidance calls for assessing AI supply chains and maintaining secure, documented components. 4. Test Security—Not Just Paperwork Independent assurance reports matter, but their scope matters more. Determine whether they cover the proposed service, relevant infrastructure, and controls you will actually use. Review identity management, access restrictions, encryption, tenant separation, and audit logging. Examine relevant independent assessments and remediation evidence. Test prompt injection and sensitive-data disclosure in generative AI systems. Test authorization boundaries and approval controls wherever AI can take actions. Request: Security architecture, assessment scope, recent findings, and demonstrations of controls. For example, place malicious instructions inside a test document and assess whether the assistant follows them. Test whether an action-taking system can exceed the user’s permissions. Conduct testing in an authorized environment. NIST’s Generative AI Profile recommends adversarial testing, including prompt-injection testing. 5. Run a Representative, Bounded Pilot A pilot should answer a purchasing question, not simply generate enthusiasm. Define its scope, approved data, duration, and pass/fail criteria before results arrive. Use examples drawn from the intended workflow, with appropriate data approval. Include ambiguous inputs, edge cases, and consequential failure scenarios. Measure correctness, unsupported claims, consistency, latency, and human-review effort. Where relevant, evaluate performance across affected user groups. Document failures and limitations—not just successful outputs. Request: Reproducible evaluation methods, test results, and documented limitations. In the customer-service example, include incomplete account histories and conflicting policy documents. Measure how much correction employees perform. A fast draft that requires extensive checking may not improve the workflow. Record the model version and configuration so later comparisons remain meaningful. 6. Plan for Changes and Incidents The system you approve may not behave identically after a model update, configuration change, or new data connection. Selection must include ongoing operating responsibilities. Assign responsibility for monitoring performance and security. Require notice of material model or service changes. Establish retesting triggers, pause controls, and fallback procedures. Agree on incident notification, support escalation, and response commitments. Protect monitoring logs according to their sensitivity. Request: Monitoring demonstrations, incident procedures, release policies, and service-level commitments. A fallback might mean disabling automated sending while preserving human-reviewed drafting. The NCSC’s operation and maintenance guidance recommends monitoring behavior and supporting customers’ evaluation of model changes. Clarify both vendor obligations and your internal response duties. 7. Negotiate Rights and Exit Conditions A workable exit is part of a responsible purchase. Address it before your workflows and data become difficult to move. Clarify rights to inputs and outputs, including relevant usage restrictions. Have counsel review liability, indemnities, and applicable sector requirements. Specify export formats, deletion verification, transition support, and termination charges. Test whether another tool or a manual process can replace the service. Request: Proposed contract language and a demonstrated export process. Exporting documents alone may be insufficient. Depending on the workflow, you may also need configurations, evaluation records, prompts, and audit history. Verify that exports are usable, not merely downloadable. Do not assume that contractual output rights resolve every intellectual-property issue; counsel should assess the intended use. 8. Calculate the Full Cost Advertised subscription or usage rates rarely capture the complete operating expense. Compare vendors against the same workload and control requirements. Include subscription fees and usage charges. Add integration, storage, support, and required security features. Estimate evaluation, monitoring, employee training, and human-review costs. Account for overages, renewal increases, and eventual migration. Request: An itemized commercial proposal with pricing assumptions and relevant contract terms. Use pilot measurements to build expected-use and high-use scenarios. Include repeated requests, document processing, and correction effort. Compare the cost of completing an acceptable task—not simply the cost of generating an answer. Keep projected benefits separate from benefits actually demonstrated. Use Mandatory Gates Before Weighted Scoring A weighted score can conceal an unacceptable risk. Strong functionality and attractive pricing should not compensate for unresolved critical data, security, authorization, or contractual requirements. Define mandatory gates before comparing proposals. These might include acceptable data-use commitments, enforceable access controls, required human approvals, and workable deletion and exit terms. A vendor that fails a mandatory gate should not advance to production approval. Then score acceptable vendors on workflow performance, operational fit, total cost, support, and portability. Set weights before reviewing final results so procurement does not become an exercise in justifying a favorite. Record the decision as approve, approve with conditions, or reject . Conditional approval must specify an owner, deadline, verification method, and permitted scope. It must not become a workaround for unresolved mandatory requirements. Make the Decision Defensible The best AI vendor is not necessarily the one with the most impressive demonstration. It is the one that can deliver measurable value within boundaries your organization understands and can enforce. Before your next vendor meeting, define the workflow, appoint the reviewers, and establish the mandatory gates. Ask for evidence, test representative failures, and verify the exit. Those steps turn an exciting technology purchase into a defensible business decision. ## AI at Work: A Practical Guide to Safer Adoption - URL: https://bartmcd.com/blog/ai-at-work-practical-guide-to-safer-adoption - Published: 2026-10-10 A manager uses artificial intelligence to draft an internal briefing. The draft arrives quickly, reads well, and appears ready to share. But it includes an unsupported claim, draws on information the manager should not have uploaded, and leaves nobody clearly responsible for checking the result. This hypothetical scenario captures the challenge of business AI adoption: getting an output is easy. Making that output trustworthy, secure, and useful requires deliberate work. AI covers many technologies, from predictive analytics to systems that generate text, images, and code. This guide focuses primarily on generative AI and the workplace tools built around it. These systems can help people organize information, explore ideas, and prepare drafts. They can also introduce errors, expose sensitive data, and execute actions beyond their intended scope. The goal is not to eliminate every risk before using AI. It is to define acceptable uses, establish controls, and expand based on evidence—not enthusiasm alone. Start With a Business Problem, Not an AI Mandate “We need an AI strategy” is not a sufficiently specific starting point. “We need to reduce the effort required to prepare an internal briefing from approved public materials” is a problem you can test. A useful first pilot has a narrow purpose, clear inputs, and a result that someone can evaluate. Avoid beginning with workflows where an error could directly affect a person’s employment, access to credit, medical care, or other consequential outcomes. Consider a pilot that drafts an internal FAQ using an approved, non-sensitive policy document. Employees remain responsible for confirming that each answer matches the source. The tool does not publish the FAQ or respond directly to customers. Before testing, document: The intended benefit: What should improve—drafting effort, consistency, or access to information? The permitted inputs: Which documents and data categories may the tool receive? The reviewer: Who has the expertise and authority to approve the output? The unacceptable outcomes: What would trigger a pause, such as disclosure of restricted information or repeated factual errors? This turns a broad technology experiment into a manageable business decision. Decide What Information AI May Receive Data protection begins before an employee enters a prompt. It includes uploaded files, connected repositories, conversation histories, generated outputs, and records retained by vendors or internal systems. The joint AI data-security guidance from NSA, CISA, FBI, and international partners emphasizes reliable data sources, provenance tracking, integrity checks, access controls, secure storage, and ongoing monitoring. It also addresses risks involving data supply chains, maliciously modified data, and data drift. For business leaders, the practical implication is straightforward: assess the entire information flow, not just the chat interface. An Approved-Data Checklist Before permitting a workflow, confirm that: Data classification is clear. Employees know whether the material is public, internal, confidential, or restricted. The specific service is approved. Review the product, subscription plan, contractual terms, and relevant settings. Training and retention practices are understood. Determine whether submissions may be used for model improvement, how long records persist, and what deletion options exist. Access is appropriately limited. Check employee permissions, administrative access, shared conversations, and connected data sources. Legal and contractual obligations are satisfied. Consider privacy requirements, confidentiality commitments, intellectual property, and restrictions on data transfer. Sources remain trustworthy. Identify who owns the source material and how changes or suspicious modifications will be detected. Do not assume every AI service trains on every submission. Equally, do not assume an enterprise label resolves every concern. Verify the actual arrangement. If a workflow can succeed using public, synthetic, or appropriately de-identified information, start there. Removing names alone may not sufficiently protect sensitive data; context can still reveal identities or confidential details. Treat Generated Answers as Drafts, Not Evidence Generative AI can produce confident, polished statements that are incorrect. NIST calls this risk confabulation in its Generative AI Profile , which also addresses privacy, information integrity, and information security. The profile accompanies NIST’s voluntary AI Risk Management Framework. The operational lesson is simple: fluency is not verification. Suppose an AI tool summarizes a supplier agreement. It may accurately describe most provisions while misstating a termination requirement. A summary that is mostly correct can still be unsuitable for a consequential decision. Build Verification Into the Workflow Factual claims: Compare material assertions with authoritative sources. Citations: Open the source and confirm that it exists and supports the claim. Calculations: Recompute important figures using a reliable method. Recommendations: Review assumptions, missing context, and potential consequences. Code: Use established review, testing, and security processes before deployment. Match review depth to potential harm. An internal brainstorming list needs a different review process from customer advice or production code. In every case, the reviewer needs adequate context, competence, and time—not merely an approval button. AI can help produce an answer. Your organization remains responsible for deciding whether that answer is fit for use. Give Automation Limited Authority An assistant that drafts text presents a different risk from one that can send messages, modify records, or execute transactions. As capabilities expand, so should the controls surrounding them. For an initial pilot, consider read-only access to a narrowly defined information set. Require human approval before external communications, changes to business systems, or other consequential actions. These are risk-reduction measures, not guarantees of safety: read-only access can still expose information if permissions are too broad. Connected tools also create opportunities for prompt injection, where instructions embedded in retrieved documents, messages, or other content attempt to redirect an AI system. Treat that external content as untrusted input, not as authority to change the tool’s behavior. For example, an assistant summarizing customer emails should not follow an instruction inside an email to retrieve unrelated confidential documents. Limit available actions, enforce permissions outside the model, and record significant activity. Avoid relying on a prompt such as “never disclose sensitive information” as the primary security control. The system’s actual access and capabilities should reflect its authorized purpose. Make Accountability Explicit—and Train People to Question Outputs “A human is in the loop” is not an accountability model. Name the business owner, technical administrator, reviewer, and escalation contact. In a smaller organization, one person may hold several roles, but the responsibilities still need to be clear. Employees should know which tools are approved, what information is prohibited, when review is required, and how to report a questionable result or accidental disclosure. Make the approved path practical; a policy that employees cannot realistically follow will not provide dependable protection. Training should preserve professional judgment rather than teach prompt-writing alone. CISA’s guidance on using AI advises users to avoid sharing sensitive information and maintain their own expertise instead of relying exclusively on generated content. CISA also warns about synthetic voices and images used for impersonation. Reinforce independent verification for unusual payment requests, credential requests, or instructions to bypass normal procedures. A familiar voice is not sufficient authorization; confirm through an established, trusted channel. Measure the Whole Workflow and Keep an Exit Plan A fast first draft does not necessarily mean a better process. If employees spend additional time checking, correcting, and reformatting it, the apparent gain may disappear. Evaluate the complete workflow against the existing process. Useful measures include: Completed, usable work: How often does the output meet the agreed standard? Review and correction effort: What work remains before the result can be used? Error patterns: Which mistakes recur, and how consequential are they? Security and privacy events: Have inappropriate disclosures, access problems, or unauthorized actions occurred? Operational dependence: Can the team continue working if the tool becomes unavailable? Establish pause criteria before the pilot begins. Assign an owner who can restrict access or stop the workflow when those criteria are met. Preserve a fallback process and understand how to disconnect integrations, revoke credentials, and handle retained information. Reassess after meaningful changes to the model, vendor terms, integrations, source data, or business purpose. A previously approved workflow can develop new risks as its environment changes. Expand Only When the Evidence Supports It Responsible AI adoption does not require choosing between innovation and security. It requires treating security, accuracy, and accountability as part of the innovation process. Start with one useful workflow. Establish its data boundaries, limit its authority, appoint a capable reviewer, and measure the full cost of producing a usable result. Keep the ability to pause. Your next step: bring the business owner, security lead, and intended users together to define that pilot. Decide what success looks like—and what would make you stop—before connecting more data or granting more authority. Then expand only when the evidence supports it. ## A Practical Checklist for AI Data Governance - URL: https://bartmcd.com/blog/practical-ai-data-governance-checklist - Published: 2026-10-09 An employee wants to use an AI assistant to summarize customer conversations. The business case is straightforward: less administrative work, faster follow-up, and more time for customers. The governance questions are less obvious. Can the assistant access every customer record? Will the provider retain the conversations? Could a summary expose information to someone who cannot access the original? These are not reasons to reject AI. They are reasons to approve it deliberately. Before approving an AI use case, establish what data it can access, who is accountable, what the provider may do with that data, and how your organization will verify its controls. A policy alone cannot answer those questions. You need named owners, documented decisions, and evidence that safeguards work. This vendor-neutral checklist gives business leaders, IT and security teams, and tool approvers a practical way to evaluate AI data use before deployment—and keep it governed afterward. Start with the Use Case, Not the Tool “We approved the platform” is not the same as “we approved every use of it.” Drafting marketing copy from public information presents different risks from analyzing employee records, reviewing confidential contracts, or connecting an assistant to internal repositories. Define the proposed purpose, users, data sources, outputs, and actions the system can take. Identify whether it only generates suggestions or can also update records, send messages, or trigger transactions. Apply review effort proportionate to sensitivity and potential consequences. The NIST AI Risk Management Framework provides a useful foundation through its Govern, Map, Measure, and Manage functions. It is voluntary. The checklist below is a practical implementation aid, not an official NIST checklist or a guarantee of legal compliance. Approve a defined use case with defined data access—not an open-ended permission to use AI. The AI Data Governance Checklist ☐ 1. Name an Accountable Owner Assign a business owner responsible for the use case and its risks. Identify security, privacy, legal, and technical reviewers. Document who can authorize deployment, accept exceptions, and suspend the system. The owner should have decision-making authority, not simply responsibility for completing paperwork. NIST’s framework core emphasizes clear, documented roles and communication channels for managing AI risks. Owner: Business sponsor, supported by the governance lead. Evidence: Responsibility matrix, named approvers, and a recorded approval decision. ☐ 2. Inventory AI Tools and Their Data Flows Include standalone applications, custom systems, and AI features embedded in existing software. Map prompts, uploads, connected repositories, training or fine-tuning data where applicable, outputs, and logs. Identify where data crosses organizational or service boundaries. For example, a meeting assistant may process more than audio: attendee details, transcripts, summaries, and shared links also belong in the inventory. The NIST Generative AI Profile recommends inventories covering provenance, sensitive data, underlying models, and oversight. Owner: IT asset manager and system architect. Evidence: AI register and data-flow diagram identifying storage locations and downstream services. ☐ 3. Define Permitted Data and Purposes Specify which data classifications each use case may process and which are prohibited. Address personal information, confidential business records, intellectual property, and regulated data explicitly. Review licenses, confidentiality obligations, privacy commitments, and applicable legal requirements before using third-party or personal data. An assistant approved for public product documentation should not automatically receive customer contracts. Likewise, permission to access a dataset does not necessarily establish permission to use it for model training. Owner: Data owner, with privacy and legal reviewers. Evidence: Permitted-use policy, classification mapping, and documented data-rights review. ☐ 4. Review the Provider’s Data-Use Commitments Ask whether the provider uses inputs or outputs for training, allows human review, retains data, or shares it with other parties. Check the specific service, subscription, contract, and configuration being purchased. Consumer, enterprise, and API offerings may have different terms. The FTC warns that AI providers must honor privacy and confidentiality commitments , including promises about training use. Capture contractual protections and verified settings rather than relying on marketing statements. Owner: Procurement and legal, supported by security. Evidence: Vendor assessment, relevant contract terms, and dated configuration records. ☐ 5. Minimize Sensitive Inputs Send only the information needed for the task. Remove unnecessary identifiers, credentials, secrets, and unrelated records before transfer. Evaluate masking, pseudonymization, aggregation, or other privacy-preserving techniques against the intended purpose. For a customer-service trend analysis, issue categories may be sufficient without names, addresses, or account numbers. Do not assume masking makes data anonymous: remaining details can still identify individuals, and transformations can affect accuracy. Owner: Data engineering lead and privacy reviewer. Evidence: Documented preprocessing process, sample checks, and a rationale for retained sensitive fields. ☐ 6. Enforce Access and Integrity Controls Apply least-privilege access to users, service accounts, repositories, and administrative functions. Verify encryption in transit and storage, review permissions, and protect datasets against unauthorized alteration. The joint government guidance on AI data security addresses these controls alongside data minimization and provenance. For a repository-connected assistant, test whether users can retrieve or infer information they cannot access directly. A connector should not turn restricted documents into broadly available answers. Owner: Security engineering and identity administrators. Evidence: Access-review results, permission tests, encryption configuration, and integrity checks. ☐ 7. Track Data Provenance Record where data originated, which version was used, how it was transformed, and who changed it. Include reference documents and retrieval indexes, not just datasets used to train models. Define how questionable, outdated, or potentially tampered data will be investigated. If an assistant gives incorrect policy guidance, the team should be able to determine whether the source was obsolete, the ingestion process changed it, or the system misinterpreted it. Owner: Data steward and AI system maintainer. Evidence: Dataset or source register, transformation records, version history, and investigation procedure. ☐ 8. Test Before Release—and After Changes Set acceptance criteria for output quality, privacy, security, and relevant harmful-bias risks before testing. Evaluate representative tasks, failure scenarios, unauthorized-access attempts, and attempts to manipulate the system through malicious instructions in retrieved content. Repeat evaluations when models, source data, permissions, integrations, or intended uses change. A successful pilot using public documents does not validate a later deployment using personnel records. Record unresolved risks and the authority accepting them. Owner: Evaluation lead, with security and relevant business reviewers. Evidence: Test report, acceptance criteria, unresolved-risk register, and release decision. ☐ 9. Define Retention and Exit Procedures Set retention rules for prompts, uploads, outputs, logs, indexes, and other stored artifacts. Document how those rules interact with legal holds, contractual obligations, and provider deletion practices. Verify what deletion covers and what may remain in backups or downstream systems. Decommissioning should include disabling connectors, revoking credentials, removing unnecessary stored data, and addressing dependent workflows. Canceling a subscription is not a complete exit plan. Owner: Records-management lead and system owner. Evidence: Retention schedule, deletion verification where available, dependency inventory, and exit checklist. ☐ 10. Monitor and Rehearse Incident Response Monitor for unauthorized access, sensitive-data exposure, unexpected transfers, and deteriorating data quality. Collect enough information to investigate without unnecessarily copying sensitive prompts into monitoring systems. Define escalation paths and containment actions, including disabling connectors or suspending access. Rehearse a scenario in which an assistant exposes restricted information: who stops access, preserves evidence, contacts the provider, and assesses notification obligations? Owner: Security operations and incident-response lead, with the business owner. Evidence: Monitoring reports, response playbook, exercise record, and tracked remediation actions. Turn the Checklist into an Approval Gate Use one tracking sheet for each use case: Control | Owner | Status | Evidence | Next review | Exception expiry Link each entry to its supporting document or test result. If a control does not apply, record why. If a gap requires an exception, document its scope, compensating safeguards, approving authority, and expiration. Do not mark a control complete without evidence. Approval can be conditional. For example, a team might pilot a summarization tool with public documents while contractual questions remain unresolved. That approval should explicitly prohibit confidential uploads and repository connections until the required reviews are complete. Revisit approval after material changes, not only on a calendar. Expanded data access, new provider terms, or a new automated action can change the risk substantially. Make Governed Adoption the Default Effective AI data governance makes adoption more predictable. Employees know what they may use, approvers know what they must verify, and leaders understand who owns the residual risk. Start with one proposed AI use case this week. Name its owner, map its data flows, and work through the checklist. Document the gaps, assign remediation, and require explicit approval before expanding access. The goal is not paperwork for its own sake. It is knowing what your AI can touch—and having evidence that those boundaries hold. ## Cybersecurity Basics: A Practical Plan to Protect Your Business - URL: https://bartmcd.com/blog/cybersecurity-basics-business-protection-plan-1 - Published: 2026-10-09 Cybersecurity becomes a business issue the moment an employee cannot access email, a customer’s information is exposed, or a fraudulent payment leaves the company’s account. The technology matters, but the consequences are operational: interrupted work, damaged relationships, financial losses, and difficult decisions under pressure. For business owners and nontechnical leaders, the goal is not to understand every security tool. It is to establish clear responsibilities, protect essential systems, and prepare the organization to respond when something goes wrong. Buying software is part of that effort—not a substitute for it. NIST’s cybersecurity basics guidance provides a practical foundation: stronger authentication, software updates, protected backups, employee training, and continuous improvement. The following plan turns those principles into manageable business actions. Cybersecurity is an ongoing business responsibility—not a one-time technology purchase. 1. Start With What Your Business Needs to Protect You cannot make sound security decisions without knowing what the business depends on. Begin with an inventory of devices, software, cloud services, and sensitive information. Include systems outside the office: employee laptops, remote-access tools, accounting platforms, and services used by contractors. For each critical system, identify its owner and explain what would happen if it became unavailable or its information were exposed. Would payroll stop? Would customer service lose access to records? Could someone change payment instructions? Build a Simple Asset and Risk Inventory A spreadsheet is enough to get started. Include these columns: System or service: What is it, and what work does it support? Owner: Who is responsible for its operation and security? Sensitive data: What customer, employee, financial, or confidential information does it contain? Access permissions: Who can use it, and who has administrative privileges? Operational importance: What happens if it fails, and which business activities depend on it? Use the inventory to prioritize. A system that controls payments or stores sensitive customer records deserves different attention than a low-impact scheduling tool. NIST’s small-business guide to the Cybersecurity Framework organizes this work around Govern, Identify, Protect, Detect, Respond, and Recover. It is voluntary and adaptable, not a universal compliance checklist. Start by naming a business leader accountable for security decisions, even when an outside provider performs the technical work. 2. Protect Accounts With Stronger Authentication An account compromise can give an attacker access to messages, documents, payment workflows, and other services. Prioritize multifactor authentication, or MFA, for email, financial accounts, administrator accounts, and remote access. MFA requires more than a password to sign in. However, not all methods offer the same protection. Text-message codes can provide an additional barrier, but they are not equivalent to phishing-resistant authentication. Where supported, prefer properly configured phishing-resistant methods, such as FIDO-based security keys or passkeys. CISA’s MFA guidance explains why stronger authentication should be a business priority. Pair MFA with unique passwords and a password manager. Reusing a password creates an avoidable connection between otherwise separate accounts. Replace default manufacturer passwords on devices and systems rather than assuming installation made them secure. Protect the Recovery Process, Too Review who can reset passwords, change authentication settings, or recover an account. Store recovery codes securely, limit access to them, and remove outdated recovery contacts. A strong sign-in process loses value if its recovery process is easy to manipulate. Practical action: Review your most important accounts and confirm that MFA is required for every relevant user, not merely available as an optional setting. 3. Make Suspicious Requests Easy to Verify and Report Phishing attempts try to persuade people to reveal information, open malicious content, or take an unauthorized action. They often exploit ordinary business habits: responding quickly, helping a colleague, or resolving an apparent account problem. Hypothetical example: An employee receives a message that appears to come from a familiar vendor. It says an invoice is waiting and asks the employee to sign in through an unexpected link. The message’s appearance is not proof that the request is legitimate. Give employees a repeatable verification process: Open the company’s website independently instead of using an unexpected login link. Verify unusual requests through a phone number or contact method already known to be correct. Confirm payment changes through an established approval process. Report suspicious messages through one clearly identified internal channel. The FTC’s small-business cybersecurity resources offer accessible guidance on phishing and related threats. Reinforce that reporting is welcome even after someone clicks a link. Blame discourages the early reporting that can help limit damage. 4. Maintain Devices, Limit Access, and Watch for Warning Signs Software maintenance is a security responsibility, not housekeeping. Operating systems, browsers, applications, and network equipment need updates. Enable automatic updates where appropriate; where updates require testing or scheduled downtime, assign someone to manage that process. Maintain security software and confirm that it is operating—not simply installed. Use encryption where appropriate to help protect information on lost or stolen devices. Replace unsupported software and devices when they can no longer receive necessary security fixes. Give People the Access Their Jobs Require Employees should have enough access to do their work, not unrestricted access by default. Administrative privileges deserve particular scrutiny because they can allow changes affecting many users or systems. Review permissions when people join, change roles, or leave. Include contractors and vendors. Remove access that is no longer needed, and favor individual accounts over shared logins so actions can be traced and permissions managed. Assign Responsibility for Detection Decide who reviews important alerts, such as unusual sign-ins, unexpected administrator changes, or failures of backup jobs. If a service provider handles monitoring, clarify what it monitors, when it escalates, and who receives notifications. Practical action: Put updates, access reviews, and alert handling under named owners. “The IT provider handles it” is insufficient unless the scope and responsibilities are explicit. 5. Back Up Data—and Prove You Can Recover It A backup is useful only if it survives the incident and can be restored. Start with the information and systems identified as critical in your inventory, then choose a backup schedule that reflects how much lost work the business could tolerate. Protect backup copies from unauthorized access, deletion, and alteration. Where appropriate, maintain an offline or otherwise disconnected copy that an attacker cannot reach through the same compromised network. FTC guidance recommends backups that are not connected to the network to support recovery after an attack. Do not assume that cloud storage or file synchronization automatically provides an independent, recoverable backup. Confirm what your service retains, how restoration works, and who can delete recovery copies. Practical action: Restore a sample of important files and record whether recovery worked. For critical applications, test whether the restored system supports actual business work. Document missing dependencies and realistic recovery expectations. A successful backup job is not the same as a successful business recovery. 6. Prepare Before an Incident Forces the Conversation A written incident-response plan helps people act deliberately when systems are unavailable and information is incomplete. Keep it concise, accessible, and available outside the systems most likely to be affected. Identify the business lead, technical responder, important service-provider contacts, and communication responsibilities. Include relevant legal, insurance, and other specialist contacts. Notification obligations depend on the facts and applicable requirements; obtain appropriate advice rather than improvising. Establish which systems should be restored first. Recovery priorities should reflect business dependencies, not simply which application is easiest to bring back. Practice an Email-Account Compromise Walk through a hypothetical compromised email account with the people responsible for responding. Who receives the report? Who coordinates account containment and evidence preservation? How will the team communicate if email cannot be trusted? Who checks whether payment requests or other accounts were affected? The exercise should expose unclear responsibilities before a real incident does. Record the gaps, assign corrective actions, and revisit the plan when systems, personnel, or providers change. A Practical Four-Week Cybersecurity Checklist This is an editorial implementation schedule—not a government-mandated timeline. Adjust it to your business, and address urgent weaknesses immediately. First week: Inventory critical systems, identify sensitive information, and assign security responsibilities. Second week: Review MFA, unique passwords, account recovery, and unnecessary access. Third week: Check software updates, security monitoring, and backup protection. Complete a sample restoration. Fourth week: Practice phishing reporting and walk through the incident-response plan. Ongoing: Review progress, resolve gaps, and update the plan as the business changes. Make Cybersecurity Part of How You Run the Business No checklist makes a business attack-proof. These fundamentals help reduce avoidable exposure and improve the organization’s ability to respond and recover. Start with ownership: appoint a responsible leader, inventory your essential systems, and identify the most consequential gaps. Then put authentication, maintenance, reporting, backups, and response planning on a recurring management agenda. The next step is not another security purchase—it is assigning an owner and taking action on the risks that matter most. ## A Practical Checklist for Ransomware Recovery - URL: https://bartmcd.com/blog/practical-ransomware-recovery-checklist - Published: 2026-10-08 When ransomware disrupts a business, the pressure to restore systems is immediate. Employees cannot work, customers need answers, and leadership wants to know when operations will resume. That urgency can push teams toward a dangerous shortcut: restoring data before understanding whether the environment is safe. Ransomware recovery means restoring trusted business operations—not simply decrypting files. A server that starts successfully may still contain an attacker’s foothold. A restored application may depend on compromised credentials. And working backups do not resolve the exposure of stolen customer information. The practical objective is to contain the attack, establish what happened, rebuild trust, and validate essential business services before returning them to production. The following checklist gives business leaders, IT managers, and incident-response coordinators a structured approach. A successful restore proves that data can be recovered. A successful recovery proves that the business can operate safely. 1. Contain the Incident Before Restoring Anything Restoring systems while attackers retain access can turn recovery into another incident. Start by limiting their ability to spread, encrypt additional systems, or interfere with backups. ☐ Identify and isolate affected systems from wired, wireless, and other network connections. ☐ Coordinate broader network isolation when multiple systems or shared infrastructure are affected. ☐ Use out-of-band communications, such as telephone calls, rather than potentially compromised corporate email or messaging. ☐ Protect backup infrastructure from access by compromised systems and accounts. ☐ Avoid routine shutdowns; involve responders in decisions that could destroy evidence. According to CISA’s ransomware guidance , powering down may be necessary when network disconnection is not possible, but it destroys volatile evidence. Containment decisions must balance evidence preservation against the immediate risk of further damage. Practical example: If several employee devices display ransom demands, do not assume the incident is limited to those devices. Investigate shared storage, administrative accounts, and other systems they accessed before reconnecting replacements. 2. Establish Ownership and Preserve Evidence Recovery needs clear decision-making authority. Without it, one team may restore a server while another is still examining it for evidence. ☐ Appoint an incident lead with authority to coordinate containment, recovery, and communications. ☐ Engage qualified incident responders, legal counsel, operational leaders, and the cyber insurer. ☐ Maintain a central incident record with timestamps, discoveries, decisions, owners, and completed actions. ☐ Have responders preserve relevant logs, system images, and memory captures before destructive cleanup or rebuilding. ☐ Assign responsibility for employee, customer, partner, and executive updates. The UK National Cyber Security Centre’s immediate recovery guidance emphasizes coordinated leadership and recordkeeping. Keep the incident record in a trusted location accessible to the response team. Communications should distinguish confirmed facts from open questions. “Order processing is unavailable; the recovery team is validating replacement systems” is more useful than an unsupported promise that everything will be back shortly. 3. Define What “Recovered” Means for the Business Technical availability is not the same as operational readiness. Recovery priorities should come from the business functions required for safe minimum operations, not simply from which servers are easiest to restore. ☐ Identify essential business services and their operational owners. ☐ Map supporting applications, identity services, networks, data, integrations, and external dependencies. ☐ Define acceptable service levels and business acceptance tests. ☐ Investigate initial access, attacker movement, compromised accounts, and persistent access. ☐ Investigate possible data theft separately from encryption. Practical example: Restoring a shipping application is insufficient if employees cannot authenticate, inventory records are unreliable, or the carrier integration fails. The acceptance test should demonstrate that an authorized employee can complete a shipment using validated data. Data theft also changes the recovery picture. Even when systems function again, legal obligations, customer communications, and extortion risks may remain. Keep those workstreams active rather than treating successful restoration as incident closure. 4. Report the Incident and Evaluate Recovery Options Bring law enforcement and counsel into the process early. Reporting can support the investigation and help identify legitimate recovery resources. ☐ In the United States, report the incident to the local FBI field office or IC3, and consider requesting CISA assistance. ☐ Preserve the ransom demand, attacker contact details, encrypted-file extensions, and payment addresses. ☐ Ask law enforcement about available decryptors; do not trust unknown downloads. ☐ Have counsel assess regulatory, contractual, breach-notification, and other applicable obligations. ☐ Review available backups, clean rebuild options, and verified decryption tools with responders. The FBI does not support paying ransom , and payment does not guarantee data recovery. It also does not establish that stolen information has been deleted or that attacker access has ended. Any payment discussion should involve leadership, counsel, the insurer, and law enforcement, including assessment of legal restrictions. Do not let negotiations displace containment and recovery work. Reporting requirements vary by jurisdiction, industry, contract, and incident facts. There is no universal deadline that applies to every organization. 5. Verify Backups and Rebuild Trust The newest backup is not automatically the safest backup. Attackers may have gained access before encryption began, meaning earlier copies can also contain malicious changes or compromised configurations. ☐ Check candidate backups for compromise, corruption, completeness, and application consistency. ☐ Select recovery points using investigation findings—not backup timestamps alone. ☐ Scan backup data for malware and connect it only to known-clean devices. ☐ Re-establish trusted identity and administrative systems. ☐ Reset affected credentials, including privileged accounts, and revoke compromised sessions or tokens where applicable. ☐ Rebuild compromised systems where appropriate, patch exploited vulnerabilities, and remove unauthorized access. NIST SP 800-61 Revision 3 emphasizes verifying restored assets and addressing incident causes before returning systems to production. A clean malware scan is one check—not proof that a backup or system is trustworthy. Coordinate credential changes with identity recovery. Resetting passwords through a still-compromised administrative environment may leave attackers able to capture or replace them. Also document the business implications of the selected backup. An older recovery point may require reconciliation of missing orders, payments, or records. Business owners must understand and approve how those gaps will be handled. 6. Restore in Controlled Stages and Validate Each Service Use a clean, isolated recovery environment to rebuild priority services and their dependencies. Do not reconnect everything at once simply because restoration jobs have completed. ☐ Establish trusted administration, security monitoring, and required infrastructure for recovery. ☐ Admit only validated clean systems into the recovery environment. ☐ Restore services in dependency order, guided by business priorities. ☐ Test security controls, data integrity, integrations, and essential workflows. ☐ Obtain documented security and business approval before production reconnection. ☐ Monitor restored systems and revise the plan as investigation findings change. Practical example: Before releasing a restored payroll service, verify authorized access, reconcile employee and payment data, and test the payment workflow without unintentionally issuing live payments. A login screen alone is not an acceptance test. Reconnection approval should answer three questions: Have the relevant incident causes been addressed? Does the service operate correctly? Can the team detect and respond to suspicious activity after reconnection? The NCSC’s guidance on recovery and ongoing investigations reinforces that restoration and investigation must remain coordinated. Newly discovered evidence may require pausing a restore or revisiting previously cleared systems. Use a Service-by-Service Recovery Tracker Create a shared worksheet with the following fields. This is a practical coordination tool, not a prescribed government form: Business service | Supporting systems | Recovery owner | Backup selected | Security checks | Business acceptance test | Reconnection approval | Status Require evidence alongside status updates. “Complete” should point to test results, an approval, or another verifiable record—not merely a finished restoration job. 7. Close the Incident Deliberately Recovery should end through a documented decision, not because the emergency meetings stop. ☐ Confirm essential services meet agreed security and operational acceptance criteria. ☐ Document remaining risks, outstanding actions, owners, and deadlines. ☐ Complete an after-action report covering causes, response decisions, restoration, and lessons learned. ☐ Update incident-response and business-continuity plans. ☐ Exercise backup restoration and business workflows, including identity and integration dependencies. Track remediation through completion. A lessons-learned report provides little protection if its recommendations never become assigned, funded work. Prepare Before Recovery Becomes an Emergency No responsible checklist can promise a fixed recovery time. Scope, attacker access, backup integrity, and business dependencies all affect the path back. What leaders can control is readiness. Name an incident lead, map critical services, and run a supervised restoration exercise using this checklist. Require both security validation and business acceptance. The goal is not merely to bring systems online—it is to restore operations the organization can trust. ## Cybersecurity Basics: A Practical Plan to Protect Your Business - URL: https://bartmcd.com/blog/cybersecurity-basics-business-protection-plan - Published: 2026-10-08 An employee receives an urgent email that appears to come from a familiar supplier. It requests a change to banking details before the next invoice is paid. The message looks routine, the deadline feels real, and the employee wants to keep business moving. But if the request is fraudulent, one ordinary decision can become a serious financial loss. This hypothetical scenario illustrates a central cybersecurity lesson: protecting a business depends on more than buying security software. It requires clear ownership, reliable processes, protected accounts, maintained systems, and the ability to recover when something goes wrong. The NIST Cybersecurity Framework 2.0 organizes that work into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. For business leaders, these translate into practical questions: What matters most? Who is responsible? How do we prevent avoidable problems? How will we recognize trouble, contain it, and restore operations? 1. Know What Matters—and Who Owns the Risk Start with the business, not the technology. Identify which activities must continue for your organization to serve customers, pay employees, meet commitments, and generate revenue. Then identify the systems, information, accounts, and providers supporting those activities. A useful starting inventory includes: Critical systems: Email, accounting, payroll, customer records, operational software, and websites. Sensitive information: Employee data, payment details, customer information, contracts, and intellectual property. Important accounts: Administrator accounts, financial accounts, and accounts that can reset other users’ access. External dependencies: Cloud platforms, managed service providers, payment processors, and other essential vendors. Assign an owner to each critical system and a leader responsible for security decisions. An IT provider may perform the work, but leadership remains responsible for deciding which risks the business can accept. For example, if your accounting platform becomes unavailable, who contacts the provider, determines whether payroll is affected, and authorizes an alternative process? Answering that question before a disruption is governance in practice. 2. Protect Accounts Before Adding More Tools Compromised accounts can give attackers access to conversations, documents, payment workflows, and other systems. Begin with email, banking, accounting, and administrator accounts, then expand protections across the organization. Use Unique Passwords and a Password Manager Every account should have a unique password. Reusing passwords means a compromise at one service can expose accounts elsewhere. A password manager helps employees create and store strong passwords without relying on memory or shared spreadsheets. Use individual accounts where possible. When shared credentials are unavoidable, control access through an approved system and update access when employees change roles or leave. Choose Strong Multifactor Authentication Enable multifactor authentication, or MFA, wherever available. It adds protection beyond a password, but methods differ significantly. NIST’s authentication guidance distinguishes phishing-resistant methods from methods attackers can trick people into completing. FIDO2 passkeys with user verification support phishing-resistant authentication because authentication is bound to the legitimate service. Manually entered authenticator codes and SMS codes are not phishing-resistant. Prefer phishing-resistant options where supported. Other MFA methods can still reduce risk compared with passwords alone, but employees should never share codes or approve unexpected prompts. No authentication method makes an account unhackable; device security, recovery settings, and access management still matter. 3. Verify Requests Involving Money or Access Attackers often exploit familiar business processes rather than technical weaknesses. A request may impersonate an executive, a supplier, or a support representative. It may even arrive from a genuinely compromised account. The strongest response is a repeatable verification rule: independently confirm unexpected payment requests, changes to banking details, and requests for credentials or sensitive information. The FBI’s guidance on business email compromise recommends verifying changes in account numbers or payment procedures with the requester. Use a previously established phone number or one located independently—not contact information supplied in the questionable message. For example, if a supplier emails new bank details, pause the payment and call the supplier using your existing records. Replying to the email does not independently verify the request. Document the verification process so employees do not have to improvise. Require a second approver for sensitive payment changes. Make clear that urgency and executive seniority do not override the process. Do not rely solely on poor spelling or awkward wording to identify fraud. A polished message is not proof of authenticity. 4. Maintain Systems and Limit Access Security fundamentals become less effective when devices go unpatched, default passwords remain unchanged, or former employees retain access. The FTC’s small-business cybersecurity guidance highlights practical safeguards such as software updates, encryption, and access restrictions. Translate those safeguards into routine responsibilities: Keep software supported and updated. Enable automatic updates where appropriate. For critical systems, establish a maintenance process that accounts for compatibility and downtime. Remove default credentials. Change factory passwords on devices and services before putting them into use. Encrypt sensitive information. Protect data on laptops and other storage, and use secure methods when transmitting it. Apply least privilege. Give people only the access needed for their work. Separate everyday accounts from administrator accounts. Review access changes. Remove unnecessary permissions when roles change and promptly disable access when someone leaves. Include new applications in this process. An employee should not upload confidential business information to an unapproved AI tool simply because it makes a task easier. Establish clear rules for which services may handle sensitive data. 5. Decide How You Will Recognize Trouble Prevention is essential, but detection closes the gap between something going wrong and someone taking action. Decide which warning signs matter and who will review them. Useful signals include unexpected MFA prompts, unfamiliar account sign-ins, unexplained mailbox forwarding rules, unusual administrator changes, failed backups, and unexpected financial activity. Where supported, enable relevant security alerts and retain logs that can help investigate an incident. Ask your IT team or service provider who receives alerts, how they are assessed, and when leadership is notified. Give employees a simple reporting channel for suspicious messages and unusual device behavior. Encourage early reporting—even after someone clicks a link. A culture of blame can turn a quickly contained mistake into a prolonged incident. 6. Make Recovery a Tested Capability A backup is useful only if the business can restore what it needs. A successful backup notification does not prove that files are intact, applications can run, or recovery will happen quickly enough. Start by defining how long critical operations can be unavailable and how much recent data the business can afford to lose. Use those requirements to guide backup frequency and recovery planning. Back up essential data and the configurations needed to restore important systems. Keep protected copies that a compromised everyday account cannot easily alter or delete. Test restoration regularly and after significant system changes. Check backup integrity before restoring data following an incident. Document dependencies, recovery steps, and access to necessary credentials. For example, restoring an invoice spreadsheet is not enough if employees still cannot access the accounting platform required to process payments. Test the business activity, not just the file. The practical test of resilience is whether your business can resume essential work—not whether a backup dashboard shows green. 7. Prepare a Short Incident-Response Plan A useful response plan should be easy to find and follow under pressure. It does not need to begin as a lengthy manual. Document who coordinates the response, who provides technical support, which operations take priority, and who can authorize emergency spending. Include contact details for relevant providers, your insurer if applicable, legal counsel, and financial institutions. Keep a securely accessible copy outside your primary business systems. Plan how to communicate if email is unavailable or compromised, and how essential work can continue while systems are investigated. Avoid sending sensitive response discussions through an account suspected of compromise. For suspected payment fraud, contact the financial institution immediately to ask about stopping or recalling the transaction. The FBI also advises reporting the incident to its Internet Crime Complaint Center. Preserve relevant messages and transaction details. Work with qualified responders on containment and evidence preservation. Avoid wiping devices or deleting suspicious messages before receiving guidance. Periodically rehearse a realistic scenario and update the plan when gaps emerge. A Seven-Day Cybersecurity Starter Checklist This proposed checklist creates momentum; it does not make a business fully secure in a week. Day 1: Inventory critical systems, accounts, information, and providers. Day 2: Review MFA coverage, prioritizing sensitive and administrator accounts. Day 3: Establish an independent payment-change verification procedure. Day 4: Review software updates, unsupported systems, and unnecessary access. Day 5: Test restoration of an important backup and record the result. Day 6: Write down incident contacts, response responsibilities, and alternative communication methods. Day 7: Assign owners and review dates for unfinished work. Make Cybersecurity a Leadership Habit Cybersecurity is an ongoing management discipline, not a one-time purchase. These fundamentals reduce risk, but they do not eliminate attacks, guarantee compliance, or replace an assessment tailored to your business. Start today by naming a security owner and scheduling a review of your most critical accounts and systems. Then turn identified gaps into assigned tasks, tested procedures, and regular leadership conversations. Consistent execution—not a promise of perfect protection—is what builds a more resilient business. ## A Practical Checklist for Decision Making - URL: https://bartmcd.com/blog/practical-decision-making-checklist - Published: 2026-10-07 A consequential decision rarely arrives with complete information and unlimited time. It arrives as a budget request, a vendor proposal, a hiring question, or a problem that needs attention before the next meeting. The pressure to act is real. So is the temptation to confuse a persuasive presentation with a sound choice. Good decision making is not about eliminating uncertainty. It is about making uncertainty visible, comparing realistic alternatives, and connecting your choice to a clear objective. A practical checklist helps you do that without turning every decision into a research project. The goal is simple: make a choice you can explain, execute, and revisit when the evidence changes. Start With the Right Amount of Structure NASA’s decision-analysis guidance emphasizes defining the decision, establishing evaluation criteria, comparing alternatives, examining uncertainty, and documenting the rationale. Importantly, the depth of analysis should fit the decision. HM Treasury’s 2026 Green Book adds useful disciplines: consider a broad range of options, retain business as usual as a comparison, test uncertain assumptions, and plan evaluation before implementation. Although written for UK public-sector appraisal, these principles can inform business decisions without becoming rules for American companies. The checklist below is an editorial synthesis of those frameworks, not a validated assessment tool. Use a brief version for low-impact, reversible choices. Apply more scrutiny when a decision creates substantial expense, operational disruption, security exposure, or commitments that are difficult to unwind. Use enough analysis to understand the trade-offs—not so much that analysis becomes a substitute for action. Before Choosing: Define the Decision ☐ 1. State the decision clearly. Write one sentence describing what you must decide and the outcome you want. “Should we buy this platform?” starts with a proposed solution. “How should we reduce delays in resolving customer issues?” starts with the problem. Then identify the decision owner and deadline. Clarify who recommends, who provides input, and who has authority to commit. Otherwise, a team can spend weeks comparing options without knowing who will choose. ☐ 2. Set the criteria before comparing options. Define what success requires: cost, speed, reliability, usability, risk reduction, or another outcome. Separate nonnegotiable requirements from preferences. For example, access controls or compatibility with a critical system might be mandatory. A cleaner interface might be desirable. An option that fails a mandatory requirement should not win because it scores well elsewhere. Establish these distinctions before a compelling demonstration influences the discussion. ☐ 3. Consider genuine alternatives. Include a materially different approach, not just competing versions of your preferred solution. Could you improve the existing process, change responsibilities, purchase a service, or test a smaller intervention? Include the status quo, too. Continuing as you are provides a baseline, but it is not necessarily cost-free or risk-free. Describe the consequences of waiting, including recurring problems and missed opportunities. This prevents “do nothing” from receiving an artificially favorable comparison. ☐ 4. Separate evidence from assumptions. Label what you know, what you estimate, and what remains uncertain. A documented support backlog is evidence. A vendor’s forecast of faster resolution is a claim that needs examination. An expectation that employees will adopt a new workflow is an assumption. Ask which missing information could change the choice. That question turns an open-ended search into a targeted investigation. While Evaluating: Make the Trade-offs Visible ☐ 5. Compare options consistently. Apply the same criteria to every alternative. A simple comparison sheet can list each option’s cost, implementation effort, expected benefit, risks, and evidence gaps. If you use scores or weights, explain what they mean. Do not let arithmetic imply precision the underlying evidence cannot support. A small scoring difference may matter less than a major uncertainty. The comparison should reveal judgment, not conceal it behind a total. ☐ 6. Challenge optimistic forecasts. Compare projected costs, timelines, and benefits with relevant completed projects when that information is available. Include transition work, training, integration, ongoing support, and exit costs—not just the purchase price. Test a less favorable scenario. What if adoption is slower, implementation takes longer, or the expected benefit is smaller? Ask someone to explain how the preferred option could fail. A decision that depends on everything going right deserves additional scrutiny. ☐ 7. Look beyond the headline number. Consider who benefits, who carries the burden, and which effects resist meaningful conversion into dollars. Employee workload, customer trust, privacy, accessibility, and resilience can materially change the assessment. This is particularly important with cybersecurity and AI. A tool that promises efficiency may also introduce sensitive-data exposure, unreliable outputs, or additional oversight work. Those concerns belong in the decision criteria, not in a footnote after the purchase. ☐ 8. Keep research proportional. Gather more information when it could change your decision and is worth the time and cost. Do not demand exhaustive certainty for a reversible experiment. Do not treat a high-consequence commitment like a routine purchase. Set a stopping rule: identify the evidence you need, how you will obtain it, and when you will decide. A pilot can resolve uncertainty, but only if its scope, safeguards, and success criteria are defined beforehand. After Choosing: Turn Judgment Into Action ☐ 9. Record the rationale. Document the selected option, the alternatives rejected, the supporting evidence, and the uncertainties that remain. Capture the main trade-off honestly. “We accepted a slower rollout to reduce integration risk” is more useful than “This was the best option.” Assign the first action to a named person with a deadline. A decision without an implementation owner is still an intention. ☐ 10. Plan the review before implementation. Choose the measures that will show whether the decision achieved its objective. Record the starting point, schedule a review, and define evidence that would justify changing course. Distinguish a disappointing outcome from a flawed process. A reasonable choice can produce a poor result under uncertainty. Conversely, a lucky result does not validate weak reasoning. Review both the outcome and the assumptions behind it. A Hypothetical Example: Choosing an AI Support Tool Define the Problem, Not the Purchase Imagine a company considering an AI assistant for its customer-support team. This is a hypothetical example. The proposed decision initially sounds like “Which AI product should we buy?” A better formulation is: “How should we reduce time spent drafting routine responses without lowering answer quality or exposing customer information?” That framing creates genuine alternatives: keep the current workflow, improve templates and the knowledge base, or pilot an AI assistant with appropriate controls. Compare What Actually Matters The team establishes mandatory data-handling requirements and evaluates each option for answer quality, staff effort, total cost, and implementation difficulty. It separates demonstrated capabilities from sales claims and includes the time employees would spend checking AI-generated responses. If the AI option remains promising, a limited pilot could test unresolved questions. Its design should include suitable data protections, human review, and clear evaluation criteria. A faster draft is not a useful improvement if correcting it takes longer than writing the original. Choose With Conditions The team might authorize a bounded pilot rather than a full rollout. The decision record explains why, identifies the owner, and states what evidence would support expansion or stopping. The checklist does not dictate the answer; it makes the reasoning and next steps explicit. A Copy-and-Fill Decision Worksheet Use this original worksheet before your next consequential choice. Keep it concise enough that colleagues can understand the reasoning without reconstructing every meeting. Decision: Desired outcome: Decision owner and deadline: Nonnegotiable requirements: Alternatives, including the status quo: Evidence and key assumptions: Main trade-off: Chosen option and rationale: First action and responsible person: Review date and evidence that would justify reconsideration: Make Your Next Decision Explainable No checklist guarantees the correct outcome. What it can do is expose weak assumptions, prevent inconsistent comparisons, and keep a decision connected to the problem it is supposed to solve. Choose one decision currently on your desk. Before approving the proposal or scheduling another discussion, complete the worksheet. If you cannot state the objective, identify a genuine alternative, or explain the main uncertainty, address those gaps first. Before you commit, make the choice explainable: what you want, what you considered, what you know, and what would cause you to reconsider. Then give the decision an owner, take the first step, and review what happens. ## AI at Work: Start Small, Protect Your Data, Keep Humans Accountable - URL: https://bartmcd.com/blog/ai-at-work-protect-data-keep-humans-accountable - Published: 2026-10-07 The first meaningful decision about artificial intelligence is not which tool to buy. It is which business problem to solve—and what boundaries must remain intact while solving it. AI can help draft documents, organize information, and support analysis. But a useful capability can become a business liability when employees submit confidential information without understanding how it is handled, accept polished answers without verification, or give automated systems more authority than the task requires. For business owners, executives, and managers, the right approach is neither unrestricted experimentation nor a blanket prohibition. Treat AI adoption as a controlled business experiment: define a useful task, establish boundaries, evaluate results, and expand only when the evidence supports it. This article focuses on generative AI and AI agents used in everyday business workflows. The objective is not to eliminate every risk. It is to make those risks visible, manageable, and proportionate to the value being pursued. Start With One Bounded Business Task “Use AI to improve productivity” is an ambition, not a pilot plan. A workable pilot identifies a specific task, a responsible owner, acceptable inputs, and a clear definition of success. Choose work that is repeatable, easy to evaluate, and unlikely to cause material harm if an output is wrong. Drafting an internal outline from public materials is a better starting point than making employment decisions, interpreting sensitive client records, or changing financial information. Hypothetical example: A marketing manager pilots an approved AI tool to create an internal briefing outline from public industry reports. The tool receives only those reports. The manager checks the outline against the originals before sharing it. The system cannot publish content or contact customers. This pilot has a defined purpose and limited consequences. It also creates something measurable: whether the reviewed outline meets the team’s quality standard with less total effort. Define the task: What will AI produce, and what will it not do? Name the owner: Who is responsible for the workflow and its results? Set the baseline: How is the task completed today? Define acceptance: What must be accurate, complete, and useful before the output is accepted? Set Data Rules Before Employees Start AI adoption is also a data-governance decision. Information entered into a tool may be stored, logged, reviewed, or processed under terms that differ across providers, products, and account types. Do not assume that every service handles submitted information identically. The NIST Generative Artificial Intelligence Profile identifies privacy risks involving leakage, unauthorized disclosure, and inference of sensitive information. Before introducing confidential material, understand the relevant data-handling arrangements and whether they meet your organization’s requirements. A Practical Data-Protection Checklist Approved tools and accounts: Which services may employees use, and must they use organization-managed accounts? Allowed information: What may users submit? Explicitly address customer records, employee information, contracts, credentials, and proprietary material. Access: Who can view prompts, uploaded files, outputs, and activity logs? Retention and deletion: How long is information retained, and what deletion options exist? Training use: Can submitted information be used to train or improve models, and what contractual terms or verified settings govern that use? Incident reporting: What should an employee do after submitting prohibited information? If these answers are unclear, restrict the pilot to public or carefully constructed synthetic material. Removing a name alone may not make a document non-sensitive; surrounding details can still reveal an identity or confidential business relationship. Make the rules usable. Employees need examples of permitted and prohibited inputs, an accessible approval process, and a clear way to report mistakes. Make Human Review a Real Control A fluent answer can create the impression that the underlying work is sound. That impression is not evidence. NIST identifies confabulation as a generative-AI risk: confidently presented false or erroneous content. This can include fabricated citations and reasoning. Asking a tool to provide sources is helpful only if someone verifies that the sources exist and support the claims. Review should match the consequences of error. An internal brainstorming outline needs a different level of scrutiny than a customer-facing financial explanation. In both cases, the reviewer must know what to check and have access to the original material. Verify important facts against authoritative sources. Open citations and confirm that they support the stated conclusions. Recalculate material figures independently. Look for missing exceptions, limitations, and contradictory evidence. Check whether the output introduces claims absent from the supplied material. Hypothetical example: An AI-generated policy summary sounds clear but omits an exception that changes who qualifies for a benefit. Checking grammar would not catch the problem. Comparing the summary with the original policy would. Human accountability is more than a final approval click. The reviewer needs the expertise, evidence, time, and authority to reject the output. Separate Drafting From Taking Action A tool that drafts a message presents a different risk from an agent that sends it. The distinction becomes even more important when systems can modify records, retrieve sensitive files, or interact with other services. CISA and international partners’ guidance on AI agents recommends limiting autonomy and access, strengthening identity management and oversight, and conducting continuous monitoring and security assessments. The leadership implication is straightforward: do not grant operational authority simply because a system produces convincing text. Give Agents Only the Access They Need Begin with read-only access where practical. Restrict accessible systems and records to the task’s actual requirements. Use identifiable, managed service identities rather than broad shared credentials, and record meaningful actions so they can be investigated. Require explicit approval before consequential actions such as sending external communications, changing permissions, or modifying financial records. The approver should see the proposed action, its target, and the information supporting it—not just a generic confirmation button. Also treat retrieved documents, websites, and messages as untrusted content. They may contain malicious instructions designed to redirect an AI system. Controls should prevent that content from expanding permissions or authorizing actions. Hypothetical example: A support assistant proposes a reply using approved reference material. An employee reviews and sends it. Automatically issuing refunds or changing account details would require a separate risk assessment and stronger controls. Measure the Whole Workflow Before Expanding A faster first draft does not necessarily mean a better business process. If review and correction consume the time saved, the benefit may disappear. Compare the pilot with the existing workflow using measures that reflect completed, acceptable work: Total time: Include preparation, prompting, review, corrections, and rework. Quality: Track material errors, omissions, and outputs rejected by reviewers. Cost per completed task: Include tool costs and employee effort. Incidents: Record prohibited submissions, unauthorized actions, and near misses. Consistency: Check performance across representative tasks, not just selected successes. These are evaluation measures, not promised outcomes. Some pilots will justify expansion; others should be redesigned or stopped. The NIST AI Risk Management Framework and its generative-AI profile can help structure risk management. The framework is voluntary guidance—not a mandatory certification or a guarantee of compliance. Legal, contractual, and sector-specific obligations still require separate attention. Put the Pilot on One Page Before launching, create a short AI pilot charter. It should be clear enough for the employee using the tool, the manager evaluating it, and the security team reviewing its boundaries. Purpose: The specific business task and intended benefit. Owner: The person accountable for the pilot and escalation decisions. Approved tool: The authorized service, account type, and relevant configuration. Allowed data: Permitted inputs and explicitly prohibited information. Permissions: What the system may access, generate, or change. Reviewer: Who checks outputs and what verification is required. Success criteria: Quality, time, cost, and risk measures compared with the current process. Stop conditions: Events that trigger a pause, such as sensitive-data exposure, unauthorized actions, or unacceptable error patterns. Include a review point and a fallback to the existing workflow. Update the charter before adding sensitive data, new integrations, or broader authority. Expansion changes the risk assessment; it is not merely an extension of the original approval. Make the Next Step Deliberate Responsible AI adoption is a leadership discipline. It requires clear objectives, understandable rules, meaningful review, and evidence that the new workflow delivers value without exceeding acceptable risk. Choose one bounded task. Write the pilot charter. Confirm the data rules. Name the reviewer. Then test the workflow before expanding it. The goal is not to deploy AI everywhere. It is to build the judgment and operating controls that let your organization use AI where it genuinely helps—and retain human accountability where it matters. ## AI and Cybersecurity: Who Gains the Advantage—and How to Prepare - URL: https://bartmcd.com/blog/ai-cybersecurity-advantage-and-how-to-prepare - Published: 2026-10-07 Current as of October 6, 2026. Consider a payment request that arrives from a familiar account, references a real transaction, and matches the sender’s writing style. The message is convincing because an attacker has access to the conversation—and AI can help turn that access into targeted fraud. Better grammar is not the central threat. Better use of stolen context is. At the same time, defenders can use AI to investigate suspicious activity, identify software weaknesses, and reduce repetitive work. The technology creates opportunity on both sides while introducing systems that need protection themselves. The question is not whether AI favors attackers or defenders in the abstract. It is who can deploy it effectively, what authority it receives, and whether controls keep pace . For organizations and individuals, preparation starts with understanding that asymmetry. How AI Is Changing Cyberattacks Familiar attacks become faster and more targeted Microsoft’s 2026 Digital Defense Report summary describes threat actors using AI for reconnaissance, social engineering, malware and exploit development, and post-compromise activity. Much of the observed use supports particular stages of existing workflows rather than replacing an entire attack with autonomous execution. That distinction matters. Organizations should not become so focused on hypothetical AI superattacks that they neglect compromised accounts, exposed systems, or abused trusted access. AI can accelerate those familiar routes without changing their underlying mechanics. Compromised information becomes more useful In September 2026, Microsoft reported disrupting EvilTokens , a cybercrime service whose AI tools analyzed compromised inboxes, identified trusted relationships and payment conversations, and helped prepare impersonation-based fraud. This is a vendor’s account of a specific investigation—not a measurement of all AI-enabled crime. The practical implication extends beyond email security. A finance team needs an independent process for verifying bank-account changes even when a request comes from a legitimate account. Authentic access does not guarantee an authentic instruction. Vulnerability management faces greater pressure The UK National Cyber Security Centre’s assessment through 2027 anticipates that AI-assisted vulnerability research and exploitation will increase pressure to remediate weaknesses quickly. This is a forecast, not a guaranteed outcome. Nevertheless, accurate inventories, visibility into internet-facing systems, and timely mitigation remain sensible priorities. Where AI Can Strengthen Defense AI is most useful when it helps security teams work with evidence. It becomes dangerous when its output is mistaken for evidence. NIST’s Cyber AI Profile , still an initial preliminary draft , organizes the challenge around securing AI, conducting AI-enabled defense, and thwarting AI-enabled attacks. Its proposed defensive applications include incident triage and containment recommendations with human review. Useful starting points include: Summarizing an incident while linking conclusions to original records. Suggesting investigation steps for an analyst to evaluate. Flagging possible code weaknesses for developer review. Drafting containment options without executing them. Google’s Chrome Security Team has described AI-assisted vulnerability discovery, triage, and patching in its development workflow. That demonstrates a real application, not a guarantee that every team will achieve similar results. NIST’s Generative AI Profile warns about confidently incorrect output. A persuasive incident summary still needs validation against logs, code, configuration, or other independently verifiable material. The Asymmetry: Equal Access Does Not Mean Equal Advantage The following is a strategic interpretation of the evidence, not a quantified prediction. Attackers can adopt assistance faster than defenders can operationalize it An attacker may use a model to improve one narrow task without building an enterprise-grade system. A defender must consider data confidentiality, integrations, permissions, reliability, auditability, and accountability. Access to the same technology therefore does not imply equal implementation burdens. Defenders have advantages—but must activate them Organizations control their own identities, systems, telemetry, and business processes. Those assets can give defensive AI valuable context. But incomplete inventories, fragmented logs, and unclear ownership reduce that advantage. Smaller organizations may benefit from managed services rather than building custom AI workflows. The tradeoff is dependence on provider controls, visibility, and incident-response support—not an automatic improvement in security. The gap between prepared and unprepared organizations can widen The NCSC anticipates a divide between systems that keep pace with AI-enabled threats and those that become more vulnerable. The advantage is not permanently assigned to attackers. It depends partly on whether defenders improve fundamentals while adopting useful automation. AI adoption is not the outcome. Faster, better-validated security decisions are the outcome. AI Creates an Attack Surface of Its Own An AI application includes more than a model. Its exposure includes connected documents, tools, identities, permissions, infrastructure, and external services. Prompt injection: untrusted content becomes an instruction Imagine an assistant retrieving a document that contains malicious directions to disclose confidential information. The risk is that the model treats those directions as instructions rather than untrusted document content. OWASP’s prompt-injection guidance explains that retrieval-augmented generation and fine-tuning do not fully mitigate this problem. A stronger system prompt is not a complete security boundary. Authorization must also be enforced by application code and downstream systems. Excessive agency: a mistake becomes an action A recommendation-only assistant can produce a bad suggestion. An agent with broad permissions might also delete records, publish information, or change access. OWASP recommends limiting functionality, permissions, and autonomy, with approval for consequential actions. Data integrity: unreliable inputs undermine outputs Manipulated source material can influence an AI system’s behavior. Joint NSA-led guidance emphasizes data provenance, authenticated revisions, and lifecycle protection. Organizations need to know where important AI inputs originate and who can change them. A Practical Plan for Organizations 1. Strengthen identity and business verification Prioritize phishing-resistant authentication for sensitive access. CISA identifies FIDO/WebAuthn and enterprise PKI-based options , while acknowledging legacy-system constraints. Plan recovery and fallback procedures alongside deployment. For compromised accounts, follow platform-specific response instructions, including session and token revocation where appropriate. A password reset alone may not terminate existing access. Independently verify payment changes through a trusted second channel. 2. Inventory AI systems and their connections Record each application’s owner, data sources, integrations, permissions, and permitted actions. Include internally developed agents and employee-adopted services. CISA’s agentic-AI guidance emphasizes layered defenses, identity management, monitoring, and limits on autonomy. Ask vendors about retention, training use, administrative logs, incident notification, and access revocation. Do not assume enterprise controls exist merely because a product includes an AI feature. 3. Start with bounded assistance Choose a narrow, read-only pilot. For example, let an assistant draft an investigation summary, but require an analyst to verify its claims before approving the record. Read-only access still creates confidentiality risk, so restrict the information available to the task. If execution authority is later justified, use narrowly scoped tools and identities. Require meaningful approval outside the model for high-impact actions, and establish a tested way to disable the agent. 4. Measure total performance before expanding Compare the pilot with the existing workflow. Measure time to a validated conclusion, review effort, incorrect recommendations, missed findings, unauthorized-action attempts, and total operating cost. Define stop conditions in advance. The tradeoff is straightforward: automation may reduce drafting time while increasing verification work. A faster response is not an improvement if it is less reliable. What Individuals Should Do Do not rely on spotting an artificial voice or an unusually polished message. The FBI’s impersonation warning notes that generated content can be difficult to identify. For urgent requests involving money or account access, stop and contact the person using a number or channel you already trust—not details supplied in the message. Never share authentication codes. Establish a family verification phrase, use phishing-resistant authentication where available, and report suspected fraud through the FBI’s Internet Crime Complaint Center. An AI-Security Readiness Checklist Use this as a planning aid, not a certification: Ownership: Every AI application and agent has an accountable owner. Access: Data, tool, and execution permissions are documented and minimized. Verification: Important recommendations are checked against original evidence. Testing: Evaluations include prompt injection and unauthorized-action scenarios. Authorization: High-impact actions require controls outside the model. Monitoring: Activity is auditable, and access can be revoked promptly. Recovery: Teams can disable a compromised agent and preserve relevant records. People: Staff independently verify payment changes and unusual requests. Value: Success is measured through validated outcomes and total cost. The Advantage Goes to Disciplined Deployment AI can accelerate both useful security work and criminal activity. It also introduces risks through the data and authority connected to it. None of those realities makes maximum autonomy the right objective. Start with one bounded defensive use case, one clear owner, and measurable acceptance criteria. In parallel, strengthen identity, patching, verification, and recovery. Expand only when evidence supports doing so. The organizations best positioned to benefit will not simply use more AI—they will control it more deliberately. ## Android Malware: How to Detect It, Remove It, and Protect Your Phone - URL: https://bartmcd.com/blog/android-malware-detection-removal-protection - Published: 2026-10-07 A delivery notification asks you to install a tracking app. A browser warning insists your phone is infected. An unfamiliar app requests permission to read your screen. These situations can look unrelated, but each deserves the same response: stop, verify, and investigate through settings you control—not through instructions supplied by the warning itself. Android malware can threaten your device, your accounts, and your money. Effective cleanup means addressing all three. Start with built-in protections, investigate suspicious apps, and secure affected accounts separately. A clean scan does not undo stolen credentials or unauthorized transactions. Safety exception: If you suspect an abusive partner or another person is monitoring your phone, do not immediately uninstall apps or reset it. Changes could alert that person. Use a device they cannot monitor to seek help and plan your next steps. The FTC’s stalkerware guidance explains safety planning and evidence preservation. What Is Android Malware? Android malware is harmful software or code that compromises a device, personal information, or accounts. “Virus” is often used as a catchall, but Android threats include several different categories. Google’s harmful-app classifications include: Credential theft and phishing: Apps that capture passwords, banking credentials, or payment information. Spyware and stalkerware: Software that collects private information or monitors activity without appropriate consent. Billing fraud: Hidden or deceptive activity that generates unwanted charges. Trojans and hostile downloaders: Apparently useful apps that perform harmful actions or install additional threats. Ransomware and backdoors: Software that restricts access or enables unwanted remote control. These categories overlap. One malicious app may steal credentials, monitor messages, and download additional software. How Harmful Apps Get Installed Attackers often disguise installation requests as ordinary tasks: tracking a parcel, listening to voicemail, claiming a refund, or updating an essential service. Instead of using an unexpected message’s link, find the organization’s app independently through its official website or a trusted app store. Be especially cautious when an installation requires disabling protection or granting powerful access. Accessibility permissions, for example, support legitimate assistive tools but may also allow an app to read screen content and interact with other apps. Android’s restricted-settings guidance advises against allowing restricted settings unless you trust the developer. A request to bypass a security warning is a reason to investigate—not a routine setup step. Warning Signs: What Deserves Investigation? Persistent pop-ups, unexpected storage loss, poor performance, messages sent without your knowledge, unusual data use, and unexplained battery drain can warrant investigation. However, symptoms alone do not establish infection. An aging battery, a demanding app, or a software problem can produce similar behavior. Separate three situations: An app-security warning: Open Play Protect directly rather than following an advertisement’s link. A browser alert: Check website notification permissions. A site displaying “Your Android is infected” has not demonstrated that it scanned your phone. An account alert or unauthorized payment: Investigate the account and contact its provider, even if a device scan finds nothing. For example, notifications that started after you tapped “Allow” on a website may be unwanted browser permissions—not evidence of an installed malicious app. How to Check and Remove Android Malware Menu names vary by manufacturer and Android version. Use Settings search or your manufacturer’s instructions when the paths below differ. Consider the stalkerware safety exception before making changes. 1. Run Google Play Protect On phones with the Google Play Store, open Play Store → profile picture → Play Protect , then select Scan where displayed. In Play Protect settings, keep Scan apps with Play Protect enabled. Google explains that Play Protect checks apps from Google Play and other sources and may warn about, disable, or remove harmful apps. The optional Improve harmful app detection setting allows unknown apps to be sent to Google for analysis—a protection benefit with a data-sharing tradeoff. 2. Install Available Updates Check Android software updates, security updates, and Google Play system updates. Typical locations include Settings → System → Software updates and Settings → Security & privacy → System & updates . Update availability depends on the model, manufacturer, and carrier. If your phone no longer receives security updates, plan to replace it. Scanning software cannot compensate for every unpatched vulnerability. Google’s Android update guidance explains how to check your version and update status. 3. Review Apps and Sensitive Permissions Open Settings → Apps and inspect the complete app list. Focus on apps you do not trust, no longer need, or installed shortly before the problem began. Open each questionable app’s information page, review its permissions, and uninstall it if you cannot establish that it is trustworthy. Review camera, microphone, location, contacts, and SMS access, along with accessibility access and other special permissions. A flashlight app requesting SMS access, for example, deserves scrutiny because the access does not obviously match its purpose. Follow Google’s permission-review instructions , but do not remove unfamiliar system components solely because their names look technical. Verify them with your manufacturer or IT administrator. 4. Troubleshoot Apps That Will Not Uninstall An app with device-administrator privileges may resist removal. On Samsung devices, search Settings for Device admin apps ; suspicious administrator access may need deactivation before uninstalling. Samsung’s guidance also cautions that employer-managed devices can have legitimate restrictions. Contact IT before disabling management software. Safe mode can help when a troublesome app interferes with normal operation. It disables third-party apps temporarily, making investigation easier. Follow your manufacturer’s procedure; Samsung provides instructions in its Galaxy malware guidance . Safe mode is a troubleshooting tool, not proof that every threat is gone. 5. Remove Unwanted Browser Notifications In Chrome, open Settings → Site settings → Notifications and revoke access for untrusted sites. Keep Pop-ups and redirects blocked. Chrome may also offer an Unsubscribe option directly on a notification. Use Chrome’s notification controls rather than installing a “cleaner” advertised by the alert. Browser cleanup and app removal solve different problems. 6. Secure Accounts Separately While the phone remains suspect, use another trusted device for sensitive account recovery. For your Google Account and other affected services: Review security activity and signed-in devices; sign out unfamiliar sessions. Check recovery details and third-party access. Change compromised or reused passwords and enable two-step verification. Inspect email forwarding rules and filters you did not create. Contact your bank promptly about unauthorized transactions or exposed financial information. Google’s compromised-account guidance provides detailed recovery checks. Removing an app does not invalidate credentials an attacker already obtained. 7. Reset Only After Preparing If problems persist, Google recommends considering a factory reset or manufacturer assistance . First preserve important files and necessary evidence, confirm your Google Account credentials and screen-lock information, and arrange access to essential accounts. A reset erases local data and installed apps. Google’s reset instructions advise waiting 24 hours if you recently reset your Google Account password. Reinstall needed apps individually from trusted sources. For suspected stalkerware, the FTC warns that restoring apps from the old backup could reinstall monitoring software. If suspicious behavior returns after a fresh setup, seek qualified help rather than repeatedly resetting. Prevent Reinfection Without Adding Unnecessary Complexity Keep Play Protect enabled, install updates, and limit which apps can install software from unknown sources. Supported Samsung devices also offer Auto Blocker to restrict unauthorized installations. Installing outside an app store is not automatically malicious, but it transfers more verification responsibility to you. Conversely, an app-store listing is not a guarantee of safety. Check the developer, purpose, and requested permissions. Start with built-in protections before adding security apps. Samsung specifically discourages third-party anti-malware products in its Galaxy guidance; that is manufacturer-specific advice, not a universal rule. Evaluate any additional product’s permissions, privacy practices, cost, and concrete benefit. Your Android Malware Checklist Use this checklist only after considering personal-safety risks: Run Play Protect and keep scanning enabled. Install Android, security, and Google Play system updates. Investigate suspicious apps and sensitive permissions. Check administrator access; involve IT for managed devices. Revoke unwanted browser notification permissions. Secure affected accounts from a trusted device. Investigate unauthorized payments with the relevant provider. Preserve files and evidence before resetting. Reinstall trusted apps carefully; seek help if problems persist. Take Control, Not the Bait The strongest response to Android malware is a sequence of verified actions—not a panic-driven download. Check device protections, remove untrusted software, and address account exposure independently. Start today: open Play Protect, check for updates, and review apps with sensitive access. If the evidence points to financial theft, persistent compromise, or personal danger, escalate to the appropriate provider, manufacturer, or safety advocate. ## AI Cybersecurity: Benefits, Risks, and a Practical Security Checklist - URL: https://bartmcd.com/blog/ai-cybersecurity-benefits-risks-security-checklist - Published: 2026-10-07 An AI assistant summarizes a suspicious email in seconds. Another reads an invoice and prepares a payment request. Both save time—but the second can create far greater consequences if it follows malicious instructions hidden in a document. That distinction is central to AI cybersecurity. The question is not simply whether artificial intelligence can improve security. It is whether an organization can capture its benefits while controlling the information it accesses, the decisions it influences, and the actions it takes. For business leaders and security teams, a sound strategy addresses three priorities: using AI for cyber defense, defending against AI-enabled attacks, and securing AI systems themselves. These areas were also reflected in NIST’s preliminary Cyber AI Profile, announced on December 16, 2025 . How AI Can Improve Cybersecurity AI cybersecurity is broader than a chatbot for security analysts. Machine-learning systems can help identify unusual activity and classify threats. Generative AI can summarize evidence, explain technical material, and assist investigations. Neither should be treated as an independent authority. Start with bounded, evidence-based tasks Useful initial applications include: Alert triage: Group related alerts and summarize the evidence for analyst review. Incident documentation: Draft timelines from approved logs and investigation notes. Technical analysis: Explain a suspicious script or detection rule without executing it. Security communication: Translate technical findings into clear remediation instructions. For example, an assistant could assemble an account-compromise timeline from identity and email logs. It should identify the underlying records, flag missing evidence, and distinguish observations from interpretations. An analyst—not the model’s confidence—determines whether the account was compromised. The Australian Cyber Security Centre’s guidance on AI in cyber defense emphasizes verifying outputs and preserving human accountability. AI cannot compensate for missing logs, inaccurate asset inventories, or poorly understood permissions. Measure security outcomes, not demonstration quality Before a pilot, establish a baseline. Compare investigation time, summary accuracy, missed findings, unsupported recommendations, review effort, and operating cost. Include ambiguous cases and incomplete records. A tool that produces answers faster but requires substantial correction may not improve the workflow. How Attackers Use AI—and What Changes for Defenders Attackers can use AI to make familiar scams more convincing. The FBI warns about personalized phishing and AI-generated voice or video impersonation . Polished writing and a recognizable voice are no longer sufficient reasons to trust a request. Consider an employee receiving an urgent voice message that appears to come from an executive requesting a bank-account change. The safest response is not to debate whether the voice sounds artificial. It is to follow an established verification process. Verify independently: Contact the requester using a previously established number or trusted channel—not contact details supplied in the suspicious message. Separate sensitive approvals: Require independent approval for payment changes, privileged access, and consequential credential resets. Train for behavior: Focus on urgency, secrecy, and pressure to bypass procedures rather than spelling mistakes. Strengthen authentication: Prioritize phishing-resistant multifactor authentication for high-risk accounts. Deepfake detection can support an investigation, but it should not be the only barrier protecting money, credentials, or sensitive information. The Main Security Risks in AI Applications Securing AI requires protecting the entire application: models, data sources, connectors, credentials, tools, and infrastructure. Joint government guidance on secure AI deployment combines conventional security controls with AI-specific protections. 1. Prompt injection Prompt injection attempts to redirect a model through malicious instructions. An indirect injection arrives through material the AI reads, such as a webpage, email, or document. Imagine a support assistant retrieving a document that instructs it to send customer records to an external address. The document is evidence to process—not an authority to obey. Retrieval-augmented generation, which supplies relevant documents to a model, does not eliminate this risk. Practical controls: Treat external content as untrusted, separate it from application instructions, limit available tools, and test malicious-document scenarios. As OWASP’s prompt-injection guidance explains, mitigation requires multiple controls; a system prompt is not a reliable security boundary. 2. Sensitive-data exposure An AI application may reveal information through submitted prompts, retrieved documents, generated answers, or operational logs. Broad access can turn a useful assistant into an unintended route to confidential material. Practical controls: Minimize submitted data, enforce access permissions before retrieval, and review provider terms covering retention, training use, deletion, and incident responsibilities. The NIST Generative AI Profile provides a governance foundation. An “enterprise” product label does not replace reviewing the actual configuration and contract. 3. Excessive agency Risk increases when an assistant can send messages, execute commands, modify records, or change permissions. A mistaken answer becomes more dangerous when it triggers an operational action. Practical controls: Begin with read-only access, narrowly scope tool credentials, and require explicit approval for high-impact actions. Enforce authorization in the application or downstream service—not through the model’s interpretation of policy. OWASP’s excessive-agency guidance explains why functionality, permissions, and autonomy all matter. 4. Unsafe output handling Generated text is not trusted code. Passing it directly into a browser, database, or command interpreter can introduce vulnerabilities. Practical controls: Validate structured outputs, use parameterized database queries, apply context-appropriate output encoding, and prevent unrestricted command execution. Human review supports these controls; it does not replace secure engineering. See OWASP’s improper-output-handling guidance . 5. Poisoning and supply-chain compromise Attackers can target datasets, models, dependencies, and other AI lifecycle components. Unverified artifacts can compromise an application before a user submits a prompt. Practical controls: Use approved sources, verify provenance and integrity, version datasets and model artifacts, inspect unfamiliar components in isolation, and retain known-good releases. NIST’s adversarial-machine-learning guidance describes poisoning and other attacks against AI systems. A Practical AI Security Adoption Plan Step 1: Inventory use and assign ownership Identify approved applications, embedded AI features, employee-selected tools, models, and integrations. Give each deployment an accountable owner and documented purpose. Establish acceptable-use rules that explain what information employees may submit and how exceptions are approved. Step 2: Map data access and action boundaries Document what enters the system, what it retrieves, which identities it uses, and which actions it can initiate. Ask what happens if an answer is wrong or an external document is malicious. Apply existing security controls—including patching, secrets management, and access reviews—alongside AI-specific defenses. A model’s willingness to refuse a request is not a substitute for an application’s ability to prevent it. Step 3: Test boundaries before expanding access Test legitimate tasks, unauthorized-data requests, malicious documents, and prohibited tool actions. Confirm that one user cannot retrieve another user’s restricted information. Success means the application’s controls hold, not merely that the model gives a reassuring response. Repeat testing when models, permissions, connectors, or data sources change. Step 4: Monitor and prepare for failure Record relevant retrieval and tool activity while protecting sensitive log content. Set usage limits to constrain runaway requests and unexpected costs. Establish a procedure to disable the capability, revoke credentials, preserve evidence, restore a known-good configuration, and continue through a manual workflow. Understand the Tradeoffs More data can improve context but increase exposure. More automation can reduce repetitive work but amplify mistakes. More logging supports investigations but creates additional sensitive records. Self-hosting offers deployment control while transferring maintenance and security responsibilities to your team. Match controls to consequences. A drafting assistant and an agent with production-administrator access should not receive the same risk treatment. Use NIST’s AI Risk Management Framework to structure governance, and evaluate systems against realistic business needs—not pressure to automate. AI Cybersecurity Checklist Review these items before launch and after significant changes: Every AI system has an accountable owner and defined purpose. Tools, models, data sources, and integrations are inventoried. Sensitive-data uses and provider terms have been reviewed. Human accounts have strong authentication. Tool identities use narrowly scoped permissions. Retrieved content is treated as untrusted input. Access authorization is enforced outside the model. High-impact actions require explicit approval. Outputs are validated before downstream use or execution. Adversarial tests cover data access and tool actions. Performance, security events, costs, and errors are monitored. Shutdown, credential revocation, and fallback procedures are tested. Build Trust Through Controls, Not Confidence AI can strengthen cybersecurity, but confident answers and impressive demonstrations are not proof of safety. Dependable outcomes require reliable evidence, limited permissions, verified outputs, and accountable people. Start with one bounded use case. Assign an owner, establish a baseline, map its access, test its failure modes, and rehearse recovery. Expand only when both the business value and the surrounding security controls have proved dependable. ## Bart McDonough Quoted in InvestmentNews: Cybersecurity Lessons for Investment Advisers - URL: https://bartmcd.com/blog/bart-mcdonough-investment-adviser-cybersecurity - Published: 2026-10-07 Updated October 7, 2026 An investment adviser’s cybersecurity program is tested when a client’s email account is compromised, a technology provider reports a breach, or an employee loses access to critical records. At that moment, written policies matter—but so do working safeguards, clear responsibilities, and rehearsed decisions. Those practical concerns connect Bart McDonough’s historical commentary in InvestmentNews with the challenges advisory firms face today. The publication quoted McDonough on cybersecurity fundamentals, vendor risk, and the difficulty of turning regulatory expectations into effective protection. It identified him at the time as Agio’s founder and CEO; he is now its former CEO. This coverage concerned protecting advisory businesses and client information, not stock-market predictions. Editorial note: This is a newly written article summarizing verified coverage and providing current guidance. Multiple InvestmentNews stories contain McDonough’s comments, so the unavailable page cannot confidently be associated with a single article. This content does not reconstruct or reproduce that page. Where InvestmentNews Quoted Bart McDonough The following publisher articles provide verified starting points for readers seeking McDonough’s cybersecurity commentary: December 20, 2018 — “Finra updates cybersecurity best practices report.” McDonough discussed making technical guidance understandable and giving appropriate prominence to management support and threat intelligence. July 1, 2019 — “Ask these cybersecurity questions.” His comments addressed evaluating vendors according to their security practices, access to information, and risk profiles. July 1 is the date displayed by the publisher. October 7, 2019 — “Small advisers struggle with cybersecurity demands of regulators.” The coverage addressed missing basic safeguards, including device updates, and considering cloud technologies. The consistent theme is implementation: advisers need security measures that operate in daily business, not merely policies that describe what should happen. The sections below are current editorial guidance based on federal resources, not new quotations or commentary attributed to McDonough. Build a Security Program Around Responsibilities and Evidence Start with ownership and an inventory Before purchasing another tool, establish what the firm must protect. Inventory devices, applications, sensitive information, administrative accounts, and important service providers. Assign an accountable business owner who can approve priorities, resolve competing demands, and track progress. The NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide organizes this work around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. It is adaptable guidance, not a certification or guarantee of regulatory compliance. For example, an adviser might discover that its client relationship management platform, document storage, and email service contain overlapping client information. Naming an owner for each system makes it easier to review access, identify unnecessary copies, and determine who acts when something goes wrong. Keep an action register with four fields: the issue, its owner, its deadline, and the evidence needed to close it. “Enable MFA” is a task; a report showing enrollment and unresolved exceptions is evidence. Protect identities and keep systems supported CISA recommends multifactor authentication , beginning with administrative accounts and people handling sensitive information. Extend protection to email, remote access, and file storage—not just financial platforms. Prefer phishing-resistant methods, such as appropriately implemented security keys, where supported. The tradeoff: Stronger authentication requires enrollment, training, and reliable recovery procedures. Use the strongest available MFA while improving systems that cannot yet support phishing-resistant methods. Delaying all protection until every application is ready creates avoidable exposure. Updates require similar discipline. Follow CISA’s Cyber Essentials guidance by maintaining supported technology and deploying updates appropriately. Ask for a device-level report rather than assuming a managed-service agreement covers every laptop. Some patches need testing to avoid disrupting essential applications. That operational concern should produce a documented deployment plan and temporary safeguards—not indefinite postponement. Ask Better Questions About Vendors and Cloud Services Match scrutiny to access and potential harm McDonough’s July 2019 InvestmentNews commentary emphasized that vendors differ in both security practices and access to information. A provider administering email and backups presents a different exposure from a supplier with no access to client records. For important providers, ask: What client information can you access, store, or process? Which personnel have administrative access, and how is that access restricted? Who handles updates, monitoring, backups, and incident response? What triggers an incident notification, and how quickly will we receive it? What evidence supports your security claims? How can we retrieve our information and terminate access when the relationship ends? Document responsibilities and escalation contacts. When reviewing an assessment or assurance report, check its scope, date, exclusions, and relevance to the service being purchased. A security document is useful evidence, but it is not a substitute for understanding the relationship. NIST’s guidance on building a cybersecurity team recommends considering providers’ experience and ability to support specific requirements, not simply price. Outsourcing can supply expertise a small firm cannot maintain internally, but it does not transfer the firm’s responsibility for protecting its information. Treat cloud migration as a change in responsibilities The October 2019 InvestmentNews article reported McDonough’s recommendation that advisers consider cloud technologies. Current CISA ransomware guidance also encourages reputable managed cloud services where maintaining internet-facing systems is difficult. Cloud adoption can reduce infrastructure maintenance, but identity management, access permissions, logging, and recovery still require attention. For example, moving documents into a cloud platform does not make an employee’s broadly shared folder appropriate. Before migrating, request a responsibility matrix showing what the cloud provider handles, what the IT provider handles, and what remains with the advisory firm. Compare costs against that division of work. A lower subscription price may exclude monitoring, recovery assistance, or configuration support the firm still needs. Test Response and Recovery Before an Incident A completed backup job does not demonstrate that an adviser can restore usable records. CISA’s ransomware guidance recommends protecting backups and testing their availability and integrity. Its small-business resources also address logging, encryption, phishing awareness, and other foundational safeguards. Run a practical exercise using a hypothetical compromised email account. Ask who can disable access, preserve relevant logs, contact the provider and counsel, assess affected information, and authorize communications. Keep emergency contact information accessible if normal email becomes unavailable. Then test restoration of a critical system or representative data set. Record what worked, what failed, and who owns corrective actions. Recovery planning should account for both security and business continuity: restoring quickly is not enough if the restored environment remains compromised. A useful security review asks not only whether a safeguard exists, but whether the firm can show that it works. Current Regulatory Context: Regulation S-P As of October 7, 2026, both compliance dates for the SEC’s 2024 Regulation S-P amendments have passed: December 3, 2025, for larger entities and June 3, 2026, for smaller entities . For investment advisers, the amendments cover SEC-registered advisers; state-only registration does not automatically place a firm within that category. Other applicable obligations still require review. The SEC’s Small Entity Compliance Guide explains requirements for written incident-response policies and procedures, service-provider oversight, and compliance records. Provider oversight must address notification as soon as possible, but no later than 72 hours after the provider becomes aware of a qualifying breach involving unauthorized access to its customer information system. According to the SEC’s announcement of the amendments , affected-individual notice generally must occur as soon as practicable, and no later than 30 days after awareness of the relevant incident, subject to the rule’s conditions and exceptions. These are distinct requirements, not interchangeable deadlines. Do not treat 30 days as permission to delay investigation. Have qualified counsel confirm applicability, notification decisions, and required records before an incident forces those questions. Investment Adviser Cybersecurity Checklist Use this checklist as a review aid, not a compliance certification: Ownership: Assign an accountable business leader and maintain a prioritized action register. Inventory: Identify sensitive information, systems, accounts, and providers. Authentication: Require MFA for email, remote access, and privileged accounts; prefer phishing-resistant methods. Maintenance: Verify patch coverage and replace unsupported technology. Access: Remove unnecessary permissions and review provider access. Vendor oversight: Document responsibilities, evidence, notification expectations, and exit procedures. Detection: Establish who reviews alerts and how urgent issues are escalated. Recovery: Protect backups and demonstrate restoration. Response: Exercise incident procedures with actual decision-makers. Obligations: Confirm applicable rules and retain required documentation. Turn Cybersecurity Commentary Into Action The verified InvestmentNews coverage connects Bart McDonough with practical cybersecurity concerns facing investment advisers. Its enduring value is the emphasis on fundamentals, informed vendor decisions, and implementation. Start with a focused review: choose a critical system, verify its authentication and update coverage, confirm provider responsibilities, and test recovery. Assign owners to every gap. The objective is not another policy on file—it is a firm that can protect client information, respond decisively, and demonstrate that its safeguards work. ## Public Cloud: Why It Can Be Better—and When It Isn’t - URL: https://bartmcd.com/blog/public-cloud-benefits-and-trade-offs - Published: 2026-10-07 A growing business needs more computing capacity. The traditional response is to buy hardware, arrange installation, configure systems, and plan for future demand. Public cloud offers another route: provision resources on demand, expand when necessary, and release capacity when it is no longer useful. That flexibility is why public cloud can be better than private cloud or traditional on-premises infrastructure. But flexibility is not the same as guaranteed savings, security, or reliability. A poorly managed cloud environment can become expensive and difficult to control. The right question is not whether public cloud is universally better. It is whether it delivers a better combination of speed, cost, security, reliability, and control for a particular workload. What Public Cloud Actually Means Public cloud provides computing services through infrastructure available to multiple customers. Its defining characteristics include on-demand self-service, shared resource pools, rapid elasticity, and measured usage, according to the NIST definition of cloud computing . “Public” describes the service’s availability—not whether your business data is publicly accessible. Access to your resources should be restricted through identity controls, permissions, and appropriate configuration. The alternatives are different: Private cloud: Cloud infrastructure dedicated to one organization, whether hosted internally or externally. Traditional on-premises infrastructure: Company-operated systems that do not necessarily provide cloud capabilities. Owning servers does not automatically create a private cloud. Hybrid cloud: Connected, distinct cloud environments that support data or application portability. Service selection also matters. Renting virtual machines leaves more work with your team than using a managed database or a provider-operated software application. Five Reasons Public Cloud Can Be Better 1. Faster Deployment and Experimentation Public cloud separates many technology decisions from hardware procurement. Teams can obtain computing, storage, and database services without installing equipment for every project. This supports faster experimentation and deployment, as outlined in AWS’s cloud computing overview . For example, a development team can create a temporary testing environment and remove it when testing ends. The business avoids reserving permanent infrastructure for a short-lived need. The safeguard is governed self-service: approved configurations, clear ownership, and automatic cleanup of temporary resources. Without those boundaries, faster provisioning can simply create faster sprawl. 2. Capacity That Follows Demand Public cloud is particularly useful when demand fluctuates. Consider a retailer preparing for a seasonal sales surge. Rather than purchasing enough equipment for peak traffic and leaving it underused afterward, the retailer can design its application to expand and contract. However, elastic infrastructure does not automatically make an application elastic. A database bottleneck, application state, service quota, or external dependency can still limit performance. Google Cloud’s architecture framework emphasizes design choices, including stateless components, that support scalability and resilience. Test scaling behavior before a business-critical event—not during it. 3. Less Infrastructure to Maintain Public cloud providers operate physical facilities and hardware. Managed services can also transfer portions of operating-system, database, or platform maintenance to the provider. That can let your team focus more attention on applications, data, and customer needs. But moving an unchanged application onto rented virtual machines may preserve much of the existing administration burden. The operational advantage usually grows when you deliberately select services that remove work your business does not need to perform itself. Evaluate that benefit alongside compatibility, cost, and provider dependence. 4. More Building Blocks for Resilience Cloud platforms offer options for redundant resources, backups, monitoring, and deployments across separate locations. These capabilities can support continuity without requiring your organization to build every underlying facility. They still require deliberate architecture. Define recovery time objectives—how quickly service must return—and recovery point objectives—how much data loss is tolerable. Then test whether your design meets them. Google Cloud’s reliability guidance stresses recovery testing. A backup that has never been restored is an unverified recovery assumption. 5. A More Flexible Financial Model Consumption-based services can reduce some upfront infrastructure purchases and make experimentation easier. They do not guarantee a lower total cost. Compare compute, storage, databases, licensing, network connectivity, data transfer, monitoring, support, personnel, backups, and disaster recovery. Include migration work and any period when old and new environments run together. For predictable workloads, compare suitable commitment discounts with on-demand pricing and the full cost of the existing environment. As Microsoft’s cloud cost-model guidance explains, meaningful decisions require a workload-specific model. Track cost per transaction or customer where useful, not just the total invoice. Is Public Cloud More Secure? Public cloud can reduce your infrastructure-security burden, but it does not eliminate your responsibilities. The AWS shared responsibility model illustrates the distinction: customers using virtual machines remain responsible for guest operating systems, applications, and relevant security configurations. More abstracted services shift additional work to the provider, but customers still control important aspects of data and access. Before production deployment, establish: Strong identity controls: Federated access, temporary credentials where supported, and multifactor authentication, preferably phishing-resistant. Least privilege: Give people and applications only the permissions they need. Exposure reviews: Check for unintended public access and inappropriate cross-account access. Operational visibility: Enable appropriate logging, monitoring, and incident-response procedures. AWS’s identity and access management guidance provides practical recommendations. Document who owns each control across your organization, provider, and service partners. An outsourced task still needs an accountable business owner. Public cloud changes the division of responsibility. It does not remove the need for responsible operations. When Public Cloud May Not Be Better Some workloads favor private cloud, on-premises infrastructure, or a hybrid approach. Investigate these conditions rather than treating them as automatic disqualifiers: Steady, predictable demand: An efficiently operated existing environment may be competitive. Compare realistic costs rather than assuming either option wins. Latency or connectivity constraints: Applications dependent on local equipment or unreliable network connections may need local processing. Hosting and data restrictions: Verify permitted storage, processing, replication, and key-management arrangements. Selecting a region does not answer every residency question; Microsoft’s data-controls guidance addresses these considerations. Complex legacy dependencies: Moving an application without understanding its integrations can introduce performance problems and additional expense. Provider dependence: Proprietary services can accelerate delivery while increasing future migration effort. Document data-export options, refactoring needs, and exit costs. Multicloud is not an automatic solution to provider dependence. It adds skills, integration, governance, and security demands. Google Cloud’s hybrid and multicloud guidance recommends evaluating those dependencies and tradeoffs against actual business requirements. A Practical Plan for Adopting Public Cloud Define the Outcome and Establish Guardrails Choose a measurable goal: faster releases, improved recovery, flexible capacity, or reduced infrastructure maintenance. Record your current baseline. Establish identity, network boundaries, logging, approved services, and ownership before teams deploy production workloads. Microsoft’s operating-model guidance provides a framework for assigning responsibilities. Pilot a Bounded Workload Select a workload with manageable dependencies and a clear business benefit. Measure performance, spending, administration effort, and recovery behavior. Use the results to revise your assumptions before expanding adoption. Test Failure, Recovery, and Spending Controls Restore backups, exercise rollback procedures, and test realistic failures in a controlled environment. Confirm that staff can execute recovery—not merely find the documentation. Also test budget notifications and response procedures. AWS warns that budget information and alerts depend on billing-data updates . An alert is not an instantaneous spending cap. Public Cloud Readiness Checklist Before approving production deployment, confirm that: The business objective, baseline, and success measures are documented. Workload dependencies and migration risks are understood. Primary and backup operational owners are assigned. Provider, customer, and partner responsibilities are explicit. Strong authentication, least privilege, and access reviews are established. The cost model includes supporting services, migration, staffing, and recovery. Spending alerts have owners and tested response procedures. Scaling, backup restoration, and recovery have been tested. Data-location and key-management requirements are verified. Provider dependencies and realistic exit requirements are documented. Choose Public Cloud for the Right Reasons Public cloud can be better because it makes capacity available on demand, supports faster delivery, and transfers selected infrastructure responsibilities to a provider. Those advantages matter only when they improve a business outcome. Start with one workload. Define what “better” means, model the complete cost, assign operational ownership, and test the result. Expand when the evidence supports it. The objective is not to put everything in the cloud—it is to build an environment your business can operate securely, reliably, and economically. ## Phone Malware: How to Recognize It, Remove It, and Protect Your Android or iPhone - URL: https://bartmcd.com/blog/phone-malware-signs-removal-android-iphone - Published: 2026-10-06 A warning fills your phone’s screen: “Your device is infected. Download this cleaner now.” It looks urgent, perhaps even official. But the warning itself may be the scam—not evidence that your phone contains malware. Phone malware is real, and both Android and iPhone users need to take security seriously. The challenge is separating malicious software from deceptive websites, compromised accounts, unwanted sharing, and ordinary performance problems. Each requires a different response. Investigate through your phone’s settings and official account-security tools—not through a pop-up offering to clean your device. This guide explains what to check, how to respond safely, and when to get professional help. What Is Phone Malware—and What Isn’t? Phone malware is software that compromises your device, information, or accounts. It can include spyware, credential-stealing apps, and applications that misuse permissions. Google’s harmful-app classifications describe these threats and their different behaviors. Some malicious apps disguise themselves as useful tools. Others persuade users to grant powerful access or install software outside trusted distribution channels. Stalkerware is a particularly sensitive category: software used to monitor someone without their knowledge. However, suspicious activity does not always mean an infected phone: A browser “virus” warning: Often a deceptive webpage. Close it without downloading software, calling its number, or paying. An unfamiliar account login: Investigate account compromise, even if the phone appears normal. Unexpected location sharing: Review account and sharing settings; malware may not be involved. Battery drain, overheating, or slow performance: Possible warning signs, but also common consequences of aging batteries, demanding apps, or software problems. A Play Protect harmful-app warning: Follow the official instructions rather than dismissing it. For example, a fake infection warning that appears only on one website points toward a browser scam. An unfamiliar app requesting accessibility access calls for a different investigation. Match your response to the evidence. First, Consider Personal Safety If someone seems to know your private conversations, movements, or messages, consider both unwanted sharing and stalkerware. If an abusive partner or another threatening person may be monitoring you, do not immediately uninstall apps, reset the phone, or confront them. The Federal Trade Commission warns that stopping surveillance could alert an abuser and escalate danger. Use a different, trusted device to seek help and discuss preserving evidence before changing anything. In the United States, the National Domestic Violence Hotline is available at 1-800-799-7233 , or by texting START to 88788 . How to Check and Clean an Android Phone Android menus vary by manufacturer and version. Use Settings search or your manufacturer’s official instructions if these labels differ. For a work-managed phone, involve IT before making disruptive changes. Check Google Play Protect On a device with Google Play, open Google Play Store → profile icon → Play Protect . Run an available scan, review warnings, and check Play Protect’s settings to confirm that Scan apps with Play Protect is enabled. Play Protect checks apps during installation and periodically scans the device. It may warn about, disable, or remove harmful applications. A clean result is useful, but it is not a guarantee that every threat has been excluded. If you install apps outside Google Play, consider Improve harmful app detection . The tradeoff: enabling it allows Google to receive unknown apps for evaluation. Update Software and Review Installed Apps Install available Android security updates, Google Play system updates, and app updates. Then review Settings → Apps , paying particular attention to software installed when the trouble began. Remove apps you do not need or trust. If removal fails or symptoms persist, follow Google’s malware-removal guidance and contact the manufacturer. Do not download an unfamiliar removal tool advertised by the suspected app. Inspect Powerful Permissions Review accessibility access and other sensitive permissions. Google explains that accessibility permissions can let an app read screen content and interact with other apps on your behalf. A legitimate accessibility tool may need this capability. A flashlight app asking you to bypass restricted settings deserves scrutiny. Evaluate whether the access fits the app’s purpose and whether you trust its developer. How to Investigate an iPhone Apple’s built-in protections reduce risk, but they do not make an iPhone immune to every attack. Focus on updates, suspicious configuration changes, account access, and sharing. Update iOS and Handle Browser Scams Open Settings → General → Software Update and install available updates. Enable automatic updates where appropriate. For suspicious Safari warnings, close the tab instead of using buttons inside the warning. Under Settings → Apps → Safari , enable Block Pop-ups and Fraudulent Website Warning . Apple’s pop-up guidance explains these protections. They help with deceptive browsing experiences; they do not perform system-wide malware removal. Review Configuration Profiles Check Settings → General → VPN & Device Management for configuration profiles. Schools and employers legitimately use them, so an unfamiliar profile is not automatically malware. Investigate its purpose before deleting it. Apple notes that removing a profile also removes associated settings, apps, and data. Ask your administrator about organizational profiles. Use Safety Check for Unwanted Access On supported iPhones running iOS 16 or later, open Settings → Privacy & Security → Safety Check . Manage Sharing & Access lets you review people, apps, and account access individually. Emergency Reset quickly stops sharing covered by the feature. Safety Check manages access; it is not an antivirus scanner. Consider personal safety before making changes. Secure Your Accounts Separately Removing malware does not automatically revoke stolen credentials or end account access. Using a trusted device where possible: Review recent security activity and signed-in devices. Remove unfamiliar access and check recovery contact information. Change compromised passwords and any passwords reused elsewhere. Enable two-factor authentication and review authentication methods. Check unexpected email-forwarding rules and sharing settings. Google’s compromised-account guidance covers these checks. If suspicious activity involves money, contact your financial institution through a known official channel—not a number supplied in a warning. When Should You Factory-Reset a Phone? A factory reset can be appropriate when problems persist after initial cleanup or official support recommends it. It is disruptive, however, and should not replace account recovery or safety planning. Before resetting, preserve necessary files and relevant evidence, confirm your account credentials, and plan how to regain access to important services. Follow device-specific instructions. Google advises waiting 24 hours before an Android factory reset if you recently reset your Google Account password, as explained in its reset guidance . Be selective about restoration. For suspected iPhone tampering or malicious software, Apple advises against restoring a backup that could reinstall the problem. The FTC similarly cautions against restoring old apps in stalkerware cases. Reinstall needed apps from trusted sources. Targeted Spyware Warnings and Security Apps If you receive an Apple threat notification, verify it independently by visiting account.apple.com , rather than following an unexpected message link. Apple’s threat-notification guidance explains verification and recommends expert assistance, including Access Now’s Digital Security Helpline. Genuine notifications do not request passwords, verification codes, or software installations. For sophisticated targeted threats, Lockdown Mode adds protection but restricts certain features. It is not proof that an existing infection has been removed. For everyday protection, start with built-in defenses. An additional Android security product should not replace updates or account checks. On iPhone, app sandboxing limits access to other apps and system resources. Be skeptical of claims that an ordinary app can scan the entire device for every threat. Your Phone-Malware Checklist Prioritize safety if stalking or abuse is possible. Ignore browser “cleaner” offers and investigate through official settings. Install operating-system and app updates. On Android, check Play Protect and review suspicious apps and permissions. On iPhone, review profiles and Safety Check. Secure accounts, recovery details, and authentication methods. Preserve essential data and evidence before resetting. Avoid restoring suspect apps or backups. Seek official support or specialist help for unresolved or targeted threats. Act on Evidence, Not Alarm The goal is not simply to make a warning disappear. It is to identify the problem, remove unauthorized access, and avoid recreating the risk. Start today with software updates, an app-and-permission review, and an account-security check. When the evidence points to stalking or sophisticated spyware, prioritize safety and qualified help over a quick technical fix. ## Fraud19 Data Breach: What Is Verified—and What Still Needs Confirmation - URL: https://bartmcd.com/blog/fraud19-data-breach-verified-facts - Published: 2026-10-06 If you arrived here looking for Bart McDonough’s “Fraud19 data breach” material, the key distinction is this: Fraud19 appears in his speaking portfolio, but the available evidence does not identify a specific breach associated with the missing page. That means the presentation’s subject, affected organization, and security lessons cannot yet be described reliably. The original page at /actions/fraud19-data-breach is unavailable. This is a newly written reference page, not a recovery or reproduction of that content. Its purpose is to explain what the surviving sources establish, help visitors locate the intended material, and identify what must be verified before an incident-specific replacement can be published. In cybersecurity, accuracy is part of risk management. Connecting an event label to the wrong breach can mislead readers about who was affected, what information was exposed, and which protective steps matter. What Does “Fraud19” Refer To? The clearest connection is to Bart McDonough’s speaking material Bart McDonough’s official speaking portfolio lists an entry titled “Fraud19 Keynote.” It separately lists “Data Breach Story.” These entries establish that both labels appear in his speaking material. They do not establish that the entries describe the same session, recording, or incident. The missing URL combines “fraud19” and “data-breach,” which makes a speaking-clip interpretation plausible. However, a descriptive URL is not enough to confirm the contents of an unavailable page. It may reflect an event, a clip title, or an editorial label rather than the established name of a security incident. There is supporting evidence for a 2019 training-event interpretation The AGA Albuquerque chapter’s July 2019 newsletter lists Internal Control & Fraud Prevention training beginning September 18, 2019, with online participation or attendance in Washington, D.C. This supports the existence and timing of a relevant event. It does not establish McDonough’s participation or identify the subject of the missing page. The supplied research also identifies participant material associated with Todd Math connecting AGA’s 2019 training with the hashtag #Fraud19 . That is supporting context, not an official session program or a breach disclosure. The responsible working interpretation is that Fraud19 likely refers to speaking-event material—not a verified breach name. The exact connection still requires confirmation. What the Available Evidence Does Not Establish A useful breach article needs an identifiable incident or clearly described scenario. The available sources do not provide that foundation for this URL. The subject: No affected organization, individual, or system has been confirmed. The scenario: It is unclear whether the material concerned a real incident, a hypothetical example, or a demonstration. The timeline: The training-event date does not establish when any breach occurred. The mechanism: There is no verified account of how unauthorized access happened. The impact: No exposed information, operational consequences, or affected population has been identified. The relationship between entries: “Fraud19 Keynote” and “Data Breach Story” cannot currently be treated as interchangeable titles. These gaps are substantive. Without knowing the mechanism and exposed information, even well-intentioned security advice can miss the actual risk. A speaking-event label is not a breach notification. The missing URL, by itself, does not establish that any reader’s information was exposed. How to Locate the Intended Presentation The most productive next step is to confirm the connection between the URL and a particular piece of speaking material. Searching for an incident that merely sounds similar risks creating a false match. Start with owner-confirmed metadata The publisher or site owner should look for a recording identifier, media-library entry, session description, or content-management record associated with the exact path. A title alone may be insufficient; the record should connect the path to the actual presentation or clip. For example: a media record explicitly connecting the missing path to a named keynote segment would be stronger evidence than a search result containing both “Fraud19” and “breach.” This is a verification example, not a claim that such a record has been found. Confirm the session with an official program An organizer’s program can establish the event, speaker, session title, and description. However, it may still leave the breach scenario unidentified. A session titled around cybersecurity or fraud does not necessarily document a particular incident. The strongest match would combine owner-confirmed metadata with an official session description or an identifiable recording. Each source answers a different question: where the material appeared, who presented it, and what it actually discussed. Then verify any incident claims independently If the presentation identifies a real breach, its claims should be checked against primary incident disclosures where available. Event material may simplify details for an audience, and later disclosures may change the understanding of an incident. The tradeoff is straightforward: holding publication can delay a complete replacement, but publishing an unverified incident narrative creates a larger accuracy problem. A transparent reference page preserves useful navigation without manufacturing certainty. Why Practical Security Advice Must Match the Scenario “Data breach” describes a broad category of events, not a single attack mechanism. Once the Fraud19 material is identified, the replacement should connect each recommendation to the verified facts rather than attach a generic security checklist. The following examples illustrate how the eventual guidance might differ. They are conditional examples, not descriptions of the missing presentation. If account credentials were compromised: The article should explain which accounts require attention and verify the provider’s current instructions for resetting credentials, reviewing access, and strengthening authentication. A password change alone should not be presented as proof that all unauthorized access has ended. If payment information was exposed: The advice should follow the confirmed exposure and the relevant financial institution’s official guidance. Recommendations intended for account credentials may not address payment-related risks. If the presentation described a hypothetical scenario: The replacement should identify it as a teaching example. It should not turn fictional participants or simulated consequences into historical incident claims. If employee deception was the central issue: The article should distinguish awareness training from operational controls. Recognizing a suspicious request and independently verifying a sensitive transaction are related but different safeguards. Historical context also matters. A presentation delivered in 2019 may explain enduring principles, but product features and response procedures can change. A current replacement should distinguish the original scenario from present-day instructions and verify those instructions against official documentation. If your immediate concern is personal exposure, do not use this page’s title as evidence that you were affected. Verify any actual notification through the organization’s independently established website or contact channel. Do not submit sensitive personal information simply because a search result appears relevant. A Verification Checklist for the Replacement Article Before publishing a full incident account under this URL, the editor should be able to complete the following checklist: Confirm the path: Connect /actions/fraud19-data-breach to owner-approved metadata or an identifiable recording. Confirm the event: Establish what “Fraud19” meant in this specific context. Confirm the session: Verify the speaker, title, and presentation description. Confirm the scenario: Determine whether it concerned a real breach, a hypothetical case, or a demonstration. Separate the dates: Distinguish the event date, incident date, disclosure date, and replacement publication date. Validate the facts: Check incident details against primary disclosures where available. Match the advice: Tie protective steps to the actual attack mechanism and exposed information. Check current instructions: Verify any product-specific or organizational response guidance before publication. Disclose uncertainty: Keep unresolved details visible rather than filling gaps with assumptions. Label the replacement accurately: Identify it as newly written content, without implying that the unavailable original was recovered. The Next Step: Confirm the Reference Before Telling the Breach Story The available evidence supports a connection between Fraud19 and Bart McDonough’s speaking material. It does not yet support a detailed account of a particular data breach. If you are seeking the presentation, begin with the official speaking portfolio and request confirmation of the specific session or recording. If you are responsible for publishing the replacement, obtain that confirmation before adding incident details or scenario-specific recommendations. A strong cybersecurity article does more than sound authoritative. It separates evidence from inference, acknowledges what remains unknown, and gives readers actions that fit the facts. That is the standard this replacement should meet once the Fraud19 reference is confirmed. ## The Shared Security Model: Who Protects What—and How to Prevent Fraud - URL: https://bartmcd.com/blog/shared-security-model-responsibilities-fraud-prevention - Published: 2026-10-06 Consider a finance employee who receives a convincing email requesting a supplier’s new bank details. The message arrives through a reputable cloud email service. The platform is available, its infrastructure is protected, and the employee’s account requires multifactor authentication. Yet the payment can still go to a criminal if nobody independently verifies the change. That scenario illustrates the central challenge of shared security: a secure service does not automatically create a secure business process. Providers, customers, managed service partners, and business teams each control different pieces. Effective protection depends on making those boundaries explicit—and testing what happens between them. What Does “Fraud19” Mean? The “Fraud19” identifier appears to be event-related, associated with AGA’s 2019 Internal Control & Fraud Prevention Training, rather than the name of a security framework. Bart McDonough’s speaking page separately lists “Shared Security Model” and “Fraud19 Keynote.” Those listings do not establish the content of the unavailable article or presentation. This newly written guide addresses the shared-security topic associated with that identifier. Its cloud-security focus is an editorial interpretation of the title and cybersecurity context—not a reconstruction of the original presentation. Understand Where the Provider’s Responsibility Ends The cloud industry generally calls this division the shared responsibility model . Providers secure the infrastructure and service layers they operate; customers secure the identities, data, configurations, and workloads they control. The boundary changes with the service. Microsoft’s responsibility guidance explains the distinctions: Infrastructure as a service: The provider operates physical infrastructure and virtualization. Customers generally manage guest operating systems, applications, data, identities, and configurable network controls. Platform as a service: The provider also operates managed platform layers. Customers retain responsibility for their code, application configuration, data, identities, and applicable access settings. Software as a service: The provider operates the supplied application. Customers still manage users, permissions, tenant settings, data governance, and their endpoints. These categories are starting points, not substitutes for service documentation. Under AWS’s model , customers patch the guest operating system on an EC2 instance. With S3, AWS operates the underlying platform, while customers manage their data and permissions. Saying “AWS handles security” obscures that difference. Turn Shared Responsibilities into Named Owners A responsibility diagram explains the arrangement. A responsibility register makes it operational. For each critical service, document the control, internal accountable owner, operator, required evidence, and escalation route. The accountable owner and operator may be different people or organizations. Access: A business owner approves permissions; an identity team implements them; access reviews demonstrate oversight. Patching: An application owner sets priorities; IT or a contracted provider performs updates; reports show unresolved exceptions. Monitoring: A security owner defines coverage; a monitoring team investigates; tested alerts demonstrate response. Payment changes: Finance owns the process; accounts payable executes it; verification records document approval. Adapt these assignments to your organization. NIST’s Cybersecurity Framework guidance emphasizes governance, defined responsibilities, and supply-chain risk management. If a managed service provider participates, establish whether its contract covers configuration, monitoring, investigation, or containment. Confirm after-hours coverage and who may authorize disruptive action. “Managed security” is not a precise scope of work. For every critical control, identify who owns it, how its operation is verified, and who acts when it fails. Verify the Controls That Commonly Fall Between Teams Identity and Access Start with people who can administer services, export sensitive information, change payment details, or grant access. Remove unnecessary privileges and promptly revoke access when roles change or employment ends. Review service accounts and integrations as well as human users. Require MFA, prioritizing privileged access and sensitive workflows. CISA recommends phishing-resistant MFA , including FIDO/WebAuthn-based methods. Number matching can improve push-based authentication while stronger methods are deployed. Tradeoff: Stronger authentication requires enrollment, support, and secure recovery procedures. A weak help-desk reset process can undermine a strong login control. Plan both together. Configuration and Data Exposure Security defaults help, but they do not prove that an existing environment is safe. Review effective permissions, external sharing, public access, and administrator settings. For example, AWS blocks public access for new S3 buckets by default and recommends enabling all four Block Public Access settings at the account level. Its S3 guidance explains how organization, account, bucket, and access-point restrictions interact. Tradeoff: Tightening access can break legitimate applications, including some static-website configurations. Identify genuine public-access requirements, test changes, and document exceptions rather than applying restrictions blindly. Logging and Investigation A logging feature is not the same as an investigation-ready record. Ask the operator to demonstrate which events are collected, where they are retained, who can alter logging, and who investigates alerts. AWS CloudTrail Event history provides the preceding 90 days of management events in an AWS Region. It does not display data events. Longer-term records require a trail or event data store, and data-event collection must be configured explicitly. For a sensitive document repository, test whether investigators can establish who accessed or downloaded a file—not merely who changed its configuration. Tradeoff: Additional collection and retention can increase costs. Prioritize evidence that supports your likely investigations, protect that evidence, and account for privacy obligations. Backup and Recovery Service availability and data recovery are different questions. Determine what is backed up, who controls recovery credentials, and whether a compromised administrator could damage both production data and its recovery copies. CISA’s ransomware guidance recommends offline, encrypted backups of critical data and regular testing of their availability and integrity. Restore a representative critical workload and record the outcome. Include dependencies, configuration, and credentials—not just files. Tradeoff: Isolation and restore testing require storage, time, and coordination. Prioritize services whose loss would most seriously disrupt operations. A successful backup job is not proof of successful recovery. Connect Cloud Security to Fraud Prevention Return to the supplier-payment example. Email filtering may catch the message. MFA may prevent an account takeover. Logging may support an investigation. None of those controls establishes whether new bank instructions are legitimate. The FBI’s business email compromise guidance recommends independently verifying payment requests and changes to account numbers or payment procedures. Use a trusted contact method, not contact details supplied in the suspicious message. A practical finance workflow should: Verify changed instructions with a known contact using previously established details. Separate requesting or entering a change from approving it. Record the verification and approval before releasing payment. Define how urgent exceptions are reviewed rather than letting urgency bypass controls. A familiar sender, realistic voice, or plausible document is not independent verification. The business owner must define legitimate authorization; the technology team must protect the systems supporting it. If a fraudulent transfer occurs, contact the financial institution immediately and report it to the FBI’s Internet Crime Complaint Center. Do not wait for the technical investigation to finish. Test the Handoffs Before an Incident Run a tabletop exercise involving IT, security, finance, leadership, and relevant providers. Use a hypothetical compromised mailbox followed by a payment-instruction change. Test who disables access, preserves evidence, contacts the bank, assesses notification obligations, and coordinates with providers. Confirm that emergency contacts and decision-makers are reachable outside business hours. The UK National Cyber Security Centre describes cloud security as a shared responsibility within an outsourcing relationship. An exercise exposes whether that relationship works operationally—not just contractually. A Practical Shared-Security Checklist Use this checklist during onboarding, renewals, and periodic reviews: Identify critical services and their service-specific responsibility boundaries. Name an accountable internal owner and operator for each important control. Confirm provider and managed-service obligations in writing. Review privileged users, service accounts, offboarding, and MFA coverage. Verify effective permissions, external sharing, and public-access settings. Demonstrate logging coverage, retention, and alert handling. Complete a restore test and document recovery dependencies. Independently verify payment-instruction changes and record approvals. Test incident escalation, emergency contacts, and provider coordination. Assign owners and target dates to unresolved gaps. Make Shared Security Measurable Moving a system to the cloud changes who operates it. It does not eliminate the need to govern access, protect information, verify payments, or prepare for disruption. Start with one critical service and one high-risk business workflow. Map responsibilities, request evidence, and test the handoffs. Then expand the process. Shared security succeeds when every important control has a named owner—and nobody has to discover during an incident that each party thought someone else was responsible. ## Your Worst Cybersecurity Nightmare: How to Prepare, Respond, and Recover - URL: https://bartmcd.com/blog/cybersecurity-nightmare-prepare-respond-recover - Published: 2026-10-06 Imagine starting your workday with three discoveries: your files will not open, customers are receiving fraudulent invoices from your email address, and a payment has reached the wrong bank account. This is an illustrative scenario, not a reported incident. But each part represents a real category of cyber risk: ransomware, account takeover, and payment fraud. When they overlap, the challenge is not simply removing malicious software. It is protecting money, restoring operations, preserving evidence, and maintaining trust. Your worst cybersecurity nightmare is discovering that an attack has happened—and nobody knows what to do next. The practical defense is a combination of preventive controls, tested recovery capabilities, and clear decisions made before an emergency. Know Which Emergency You Are Facing “We have been hacked” is a starting point, not a diagnosis. Different incidents demand different first actions: Account takeover: Someone controls your email, social media, or business account. Recover access and remove unauthorized access paths. Payment fraud: Money has been redirected through deceptive instructions. Contact the bank immediately. Ransomware: Systems or files are inaccessible, often alongside threats involving stolen data. Isolate affected systems and activate incident response. Data exposure: Sensitive information may have been accessed or stolen. Contain the exposure, investigate, and assess notification requirements. These categories can overlap. Restoring encrypted files, for example, does not resolve the separate problem of stolen information. If an Attack Is Happening Now Compromised account: Secure more than the password Use a trusted device and the provider’s official recovery process, rather than a link in an unexpected message. For a workplace account, notify IT immediately; administrators may need to disable the account while investigating. Once access is restored: Set a strong, unique password and change any reused passwords elsewhere. Use available controls to sign out other sessions. Enable multifactor authentication and check for unfamiliar authentication methods. Verify recovery phone numbers and email addresses. Remove suspicious forwarding rules and review sent and deleted messages. Warn contacts if the account sent fraudulent requests. The FTC’s account-recovery guidance explains these consumer steps. For businesses, Microsoft’s compromised-account guidance also covers session revocation, application permissions, authentication registrations, and hidden mailbox rules. Those are administrator tasks: a password reset alone is not a complete investigation. Fraudulent payment: Call the bank first Contact your financial institution through a known, trusted number. Explain that the transfer may be fraudulent and request an immediate recall or reversal. Ask the institution to contact the receiving bank. Do not wait for your internal investigation to finish. Preserve payment details, messages, account numbers, and timestamps. The FBI’s business email compromise guidance also recommends reporting the incident to the Internet Crime Complaint Center, or IC3. Recovery is not guaranteed, but prompt action matters. Ransomware: Isolate affected systems Disconnect affected devices from the network, including Ethernet and Wi-Fi, and contact your response team. A widespread incident may require coordinated network-level containment. Disconnecting is not the same as powering off. The CISA #StopRansomware Guide advises powering down affected devices when network disconnection is not possible, because shutdown destroys evidence held in memory. Use a separate, trusted communication channel if normal email or messaging may be compromised. Do not reconnect systems or begin wiping devices simply because doing so seems faster. Containment, evidence collection, and restoration need coordination. Exposed data: Contain, investigate, and involve the right people For a business, engage qualified technical responders and appropriate legal support. Preserve relevant logs, document decisions, and determine what information was affected and whose information it was. Notification duties depend on the circumstances and applicable law. The FTC’s business breach-response guide recommends assembling a response team, securing operations, addressing vulnerabilities, and communicating appropriately. Avoid declaring that “no data was stolen” before the evidence supports that conclusion. Reduce the Chances—and the Consequences—of an Attack 1. Protect the accounts that control everything else Prioritize email, banking, administrator accounts, and services containing essential information. Email deserves particular attention because it often receives password-reset messages for other accounts. Enable MFA wherever available, preferably phishing-resistant methods such as supported FIDO/WebAuthn security keys or platform authenticators. NIST explains that one-time codes and SMS authentication can still be susceptible to phishing. Use unique passwords and a password manager where appropriate. Test account recovery before enforcing new authentication requirements: losing a phone should not leave the business without a safe way to regain access. 2. Treat backups as a recovery capability A successful backup notification does not prove that operations can resume. Protect backups from attackers, isolate them appropriately, and test restoration. NIST’s ransomware preparation guidance emphasizes isolated backups and recovery testing. Include the applications, configurations, and dependencies needed to use recovered information—not just the documents themselves. For example, restoring invoice files is insufficient if nobody can access the accounting application. Decide how much recent work you can lose and how long each critical service can remain unavailable. Offline or carefully configured immutable backups can improve resilience, but storage costs, retention requirements, and restoration speed still matter. 3. Assign ownership for updates and access Keep an inventory of devices and important software. Assign responsibility for updates and endpoint protection, and confirm that maintenance actually happens. For critical systems, testing and rollback plans should enable timely patching—not justify indefinite delay. Apply least privilege: people and services should receive only the access their tasks require. Use ordinary user accounts for routine work, and remove unnecessary access when roles or providers change. These practices align with NIST’s cybersecurity basics . 4. Verify payment changes independently If a supplier emails new bank details, call a previously known contact number before changing the payment destination. Do not use the number supplied in the suspicious message. A realistic example: an invoice looks legitimate, the sender’s account is familiar, and the request sounds urgent. None of those details establishes that the new bank account is authorized. Independent verification breaks the fraud pathway. For higher-risk payments, consider a second approver. Verification adds friction, so define the process and escalation route in advance. Urgency should not become permission to bypass it. 5. Prepare a response plan that works without email NIST’s incident-response recommendations integrate preparation, detection, response, and recovery into ongoing cybersecurity risk management. Start with a short plan naming the incident lead, who can disable accounts or isolate systems, recovery priorities, and contacts for the bank, responders, counsel, and insurer where applicable. Keep a copy accessible outside potentially compromised systems. Rehearse a simple scenario: email is unavailable, a computer displays a ransom note, and a customer reports a suspicious invoice. Unclear decisions identified during an exercise are much cheaper to fix than during an attack. Recovery Is More Than Getting Files Back The FBI does not support paying ransomware demands . Payment does not guarantee recovery and encourages criminal activity. Involve qualified responders and legal counsel rather than treating payment as a shortcut around containment and investigation. Before restoring normal operations, address the identified entry point, review account access, validate restored systems and data, and monitor for continuing compromise. NIST’s data-integrity recovery guidance emphasizes trustworthy recovery supported by monitoring and audit information. Recovery means restoring trustworthy operations—not simply making the warning message disappear. Communicate confirmed facts, explain what remains unknown, and give affected people practical protective steps. Reassurance should follow evidence, not replace it. Your Cybersecurity Readiness Checklist Use this checklist to identify gaps, not as a certification of security: Important accounts have MFA, preferably phishing-resistant. Passwords are unique, and recovery details are current. Updates and endpoint protection have an assigned owner. Unnecessary user, administrator, and provider access is removed. Critical data has protected backups, with a successful restoration test. Payment-detail changes require independent verification. Response contacts and instructions are available without normal email. Someone has authority to contain systems and contact the bank. The response plan has been rehearsed. Evidence preservation, legal review, and communications are covered. Make the Next Step Concrete No security program can promise that an attack will never happen. A prepared individual or business can, however, avoid turning an incident into an uncontrolled crisis. Choose one unchecked item today, assign an owner, and set a completion date. Then verify that it works. Preparation becomes valuable when it changes what you can actually do under pressure. ## Fraud19 Keynote: Context and a Current Fraud-Prevention Guide - URL: https://bartmcd.com/blog/fraud19-keynote-context-fraud-prevention-guide - Published: 2026-10-06 A familiar vendor sends new banking instructions. An executive calls with an urgent payment request. An email arrives inside an existing conversation, complete with the right names and a plausible explanation. The challenge is not simply spotting something suspicious. It is ensuring that a convincing request cannot bypass a reliable verification process. Looking for Bart McDonough’s Fraud19 keynote? His speaking page lists “Fraud19 Keynote” under “In Action.” That listing establishes the context for this address, but the original page is unavailable. The available information does not establish the presentation’s exact event, date, recording availability, or contents. This is a newly written replacement article—not a transcript, recap, or reconstruction. It provides current, independently sourced guidance on preventing payment fraud, strengthening authentication, managing AI-enabled impersonation, and responding when money has already moved. Start With the Transaction, Not Just the Message Business email compromise, or BEC, uses apparently legitimate communications to deceive people into transferring money or sharing sensitive information. The FBI’s BEC guidance describes schemes involving fraudulent vendor-payment requests and altered real-estate wire instructions. Attackers may impersonate someone trusted or operate through a compromised account. That distinction matters. Checking the sender’s address is useful, but a message from a genuine account can still carry fraudulent instructions. Professional language and familiar branding do not authenticate a transaction. Recognizing the sender and verifying the transaction are different tasks. A familiar message should never replace an independent check of changed payment instructions. Consider an illustrative example: a supplier emails that its bank account has changed just before a scheduled payment. The invoice amount is correct, and the signature looks familiar. The safe response is not to decide whether the email “feels real.” It is to confirm the change through an established contact channel before releasing funds. Build Verification Into the Payment Workflow Independently confirm changed instructions The FBI recommends verifying payment requests and changes to account numbers or payment procedures independently. For organizations, that advice should become a required process rather than a reminder to “be careful.” Pause the transaction when banking details, payment destinations, or established procedures change. Use trusted contact information already on file or obtained independently—not a phone number supplied in the questionable message. Confirm the specific change , including the intended recipient and destination account. Record the verification , including who performed it, which channel was used, and what was confirmed. Maintain trusted contact details separately from incoming payment instructions, and establish a controlled process for updating them. Otherwise, an attacker could replace both the banking information and the number employees use to verify it. The tradeoff is friction: legitimate payments may take longer. Reduce that burden with clear ownership, current contact records, and an escalation route. Urgency should trigger escalation—not permission to skip verification. Separate verification from authorization Verification asks whether a request is authentic. Approval asks whether the organization should authorize it. Those are separate decisions. The Office of the Comptroller of the Currency’s fraud-risk guidance identifies dual controls and segregation of duties as preventive measures for banks. Other organizations can adapt these principles without treating bank-specific supervisory guidance as a universal legal requirement. A practical workflow assigns one person to record a requested change, another to verify it, and an authorized approver to review the evidence before payment. Avoid letting one person change vendor details, validate the change, and release the funds without additional review. Small organizations may not have enough staff for complete separation. Document that limitation and consider an owner or manager review for higher-risk transactions. A deliberate compensating control is better than an unacknowledged gap. Strengthen Accounts Without Overtrusting Authentication Payment controls and account security address different parts of the problem. Better authentication can reduce account compromise, but it cannot establish that every request from an authenticated user is legitimate. CISA recommends aiming for phishing-resistant multifactor authentication . FIDO/WebAuthn-based approaches are designed to resist phishing in ways that manually entered codes do not. A practical rollout should prioritize email, administrator accounts, and systems involved in financial workflows. Identify supported methods, test enrollment, and plan backup access and account recovery before enforcing a new requirement. Follow each provider’s current configuration guidance. The tradeoffs include compatibility, deployment effort, and support needs. Recovery deserves particular attention: users need a workable way to regain access, but recovery must not become an easy bypass around stronger authentication. Keep payment verification in place after upgrading MFA. A fraudster may manipulate a legitimate employee, impersonate someone outside the organization, or exploit a process weakness without compromising the payer’s account. Keep AI-Enabled Impersonation Inside the Same Controls The FTC warns that scammers can use AI to imitate a loved one’s voice and pressure people into emergency payments. Its advice is to contact the supposed caller using a number already known to be correct, or check with another trusted person. The same verification principle is useful in business. An unexpected voice request—even one that sounds like a senior executive—should not override the payment workflow. For example, suppose an employee receives a call that appears to come from the CEO demanding an immediate transfer. The employee should end the incoming conversation and initiate verification through an established channel. The task is to authenticate the request, not diagnose whether the audio is synthetic. This approach has a practical advantage: employees do not need to become deepfake specialists. They need a repeatable process and explicit permission to challenge urgent requests, regardless of the apparent caller’s seniority. Assess Fraud Risk Before Buying Another Tool Technology can support prevention, but buying a product before understanding the exposed workflow can leave the central weakness untouched. AGA’s fraud-mitigation resources recommend assessing relevant risks, ownership, likelihood, financial impact, and controls. Start with specific scenarios: diverted supplier payments, unauthorized payroll changes, fraudulent refunds, or altered wire instructions. For each, record: Exposure: Where could the fraud occur, and what would be affected? Ownership: Which role is accountable for the risk? Prevention: What stops an unauthorized action? Detection: What review, reconciliation, alert, or reporting channel would reveal it? Improvement: What needs to change, who will act, and by when? Evaluate tools against those needs. The OCC advises banks to consider fraud-prevention tools in relation to cost, value, complexity, and risk profile—a useful purchasing principle beyond banking, though not a universal regulatory mandate. Test whether the controls actually work A written policy is not evidence of consistent execution. Review a sample of payment changes: was independent verification documented, did approval happen before release, and were exceptions handled properly? GAO’s guidance on evaluating antifraud activities emphasizes evaluating effectiveness and adapting activities, considering more than financial returns and tailoring evaluation to available capacity. Useful measures include verification completion, procedural overrides, reporting speed, corrective-action closure, and staff time. Use the results to improve the workflow—not merely repeat the training. Organizations seeking a broader framework can consult GAO’s Green Book . The 2025 edition became effective for federal agencies beginning with fiscal year 2026; it is not automatically binding on every private business. If Money Has Already Been Sent, Act Immediately Contact your financial institution immediately. The FBI advises asking it to contact the institution that received the transfer. Report suspected BEC to the FBI’s Internet Crime Complaint Center using the reporting route linked from its BEC guidance. Do not wait for a completed internal investigation before contacting the bank. Activate your incident-response process and preserve payment details, relevant communications, and the known timeline. Coordinate account containment with the security team if compromise is suspected. These actions support response; they do not guarantee recovery. For consumer scams, the FTC guidance linked above provides a separate fraud-reporting route. A Practical Fraud-Prevention Checklist Independently verify changed payment instructions. Maintain trusted contact details outside incoming requests. Record verification evidence before approval. Separate payment changes, verification, and authorization where feasible. Document compensating controls for small teams. Assess phishing-resistant MFA and secure recovery options. Keep urgent voice requests within normal verification procedures. Assign owners to specific fraud risks. Test controls and track corrective actions. Keep bank and incident-response contacts readily available. Make Verification a Business Habit The verified Fraud19 keynote listing establishes this page’s context, not the contents of the unavailable presentation. The guidance here stands independently: reduce reliance on appearances and make sensitive actions depend on verifiable evidence. Start with one workflow this week. Review how your organization changes supplier banking details, test whether verification survives an urgent request, and close the gaps you find. Effective fraud prevention comes from making the safe process clear, practical, and difficult to bypass. ## Public Cloud: Why It’s Growing Rapidly—and How Businesses Can Benefit - URL: https://bartmcd.com/blog/public-cloud-growth-and-business-benefits - Published: 2026-10-06 A business needs more computing capacity, developers need a testing environment, and an AI initiative needs access to specialized infrastructure. Traditionally, each request could trigger procurement, hardware installation, and lengthy planning. Public cloud changes that process: organizations can provision technology services on demand rather than build every capability themselves. That shift explains much of public cloud’s rapid growth. Businesses want faster delivery, flexible capacity, and access to managed services. AI is adding demand for computing power and data platforms. But adoption is not automatically a financial or security improvement. The right question is not “Should we move to the cloud?” It is “Which workloads will benefit, and what controls will make those benefits sustainable?” What Is Public Cloud? Public cloud is computing infrastructure offered for use by the general public and operated on a provider’s premises. According to NIST’s definition of cloud computing , its essential characteristics include on-demand self-service, shared resource pools, rapid elasticity, network access, and measured usage. “Public” describes the availability of the service—not the visibility of your information. Properly configured cloud services can restrict business data to authorized users and applications. The main service models distribute operational responsibilities differently: Infrastructure as a service: Rent computing, storage, and networking while retaining responsibility for operating systems, applications, and relevant configurations. Platform as a service: Deploy applications into a provider-managed environment while managing application code and settings. Software as a service: Use a complete application while managing access, customer settings, and appropriate data handling. These differ from deployment models. Private cloud serves an exclusive organization; hybrid cloud combines distinct cloud environments. Businesses can also retain conventional on-premises systems alongside public-cloud services. What Recent Evidence Shows About Growth Major providers’ results demonstrate strong demand. For the quarter ended June 30, 2026, Amazon reported AWS sales of $42.2 billion, up 37% year over year . Microsoft reported that Azure and other cloud services revenue increased 43% for its fiscal fourth quarter. These figures describe different business categories. They are not measurements of the entire public-cloud market and should not be combined into an industry growth rate. Looking ahead, Gartner’s June 2026 public-cloud forecast identifies AI-driven demand for high-performance infrastructure as a growth driver. That is a forecast, not a guarantee of future spending. Why Public Cloud Is Growing Rapidly 1. Faster Provisioning Accelerates Business Delivery On-demand resources reduce the delay between identifying a need and obtaining capacity. Development teams can create environments without waiting for new hardware, then remove them when the work ends. For example, a team testing a new customer portal can provision a temporary environment instead of purchasing equipment for a short-lived project. The business value is faster experimentation—not simply a different location for its servers. 2. Elastic Capacity Fits Changing Demand Public cloud lets organizations expand and contract resources as demand changes. That is useful for seasonal activity, unpredictable application growth, and occasional processing jobs. A retailer might increase capacity during a promotion and reduce it afterward. However, elasticity must be configured and tested. Application bottlenecks, service quotas, and regional capacity constraints can still limit performance. 3. Flexible Pricing Reduces Some Upfront Commitments Cloud services can replace some hardware purchases with usage-based charges. For example, AWS EC2 On-Demand pricing offers compute capacity without long-term commitments. This makes uncertain projects easier to start, but pay-as-you-go does not mean pay-less . Idle resources, excessive storage, and unnecessary data transfers can undermine the economics. Predictable workloads may benefit from commitment-based pricing, provided the organization understands the utilization risk. 4. Managed Services Reduce Infrastructure Work Managed databases, storage, and application platforms allow providers to operate more of the underlying technology. That can free internal teams to focus on applications and business requirements. The tradeoff is reduced control over some implementation details and potentially greater dependence on provider-specific capabilities. Select managed services because they remove valuable operational work—not because “managed” sounds maintenance-free. 5. AI Expands Demand for Compute and Data Services AI requires infrastructure for training, inference, data preparation, and application integration. Public cloud gives businesses access to specialized compute and managed AI capabilities without requiring them to build the entire supporting environment. For an AI document-processing application, evaluate cost per successfully processed document rather than compute spending alone. Include model quality, human review, data protection, and production demand. A successful demonstration is not yet a sustainable operating model. The Tradeoffs Businesses Must Manage Cost Flexibility Requires Financial Discipline Cloud spending can grow through many small deployment decisions. Model compute, storage, networking, data egress, security tooling, support, staffing, migration, and recovery—not just virtual-machine pricing. Assign owners and review spending against business outcomes. AWS’s cost-optimization guidance treats optimization as an ongoing activity. Budget alerts are useful, but they are not necessarily spending caps: AWS warns that billing and notification delays can allow costs to exceed thresholds . Provider Security Does Not Replace Customer Security Under the AWS shared responsibility model , responsibilities vary by service. With EC2, customers retain duties such as guest operating-system patching. More abstracted services shift additional infrastructure responsibilities to AWS, but customers still manage data and permissions. Document equivalent responsibilities for whichever provider you choose. Establish least-privilege access, strong authentication, secrets management, appropriate encryption, logging, and incident-response procedures before production deployment. Resilience Must Be Designed and Tested Cloud offers building blocks for resilient systems; it does not guarantee uninterrupted service. Define recovery-time and recovery-point objectives, identify dependencies, and test restoration. Multi-region designs can improve resilience, but they also increase cost and complexity. AWS’s reliability guidance emphasizes architecture, change management, and proven recovery processes. An untested backup remains an assumption. Convenience Can Create Switching Costs Provider-specific platforms may accelerate development while making future migration harder. Evaluate data export, licensing, retraining, application changes, and transfer charges. Portability does not require avoiding every proprietary service; it requires understanding the dependency and its business consequences. Public cloud transfers some operational work to a provider. It does not transfer accountability for your business outcomes. A Practical Approach to Public-Cloud Adoption Start With a Measurable Business Problem Identify the outcome: faster provisioning, better recovery, reduced maintenance, or access to a new capability. Establish a baseline and acceptance criteria before choosing services. Evaluate Workloads Individually Document dependencies, demand patterns, latency requirements, data sensitivity, permitted locations, and licensing constraints. Decide whether to retain, retire, replace, migrate, or redesign each workload. A variable-demand web application may be a strong candidate. A tightly coupled legacy system with specialized hardware or strict latency requirements may justify staying on-premises. Market growth is not a workload assessment. Build Guardrails Before Scaling Establish approved deployment patterns, identity controls, centralized logging, ownership tags, and financial reporting. Use infrastructure as code where appropriate to make deployments repeatable and reviewable. Provider guidance such as the AWS Well-Architected Framework can structure reviews; adapt it to your environment. Pilot Under Realistic Conditions Measure performance, total cost, operational effort, security findings, and recovery results under normal and peak demand. Test rollback and important dependencies. Expand only after comparing results with the baseline and correcting significant gaps. Public-Cloud Readiness Checklist Before approving production deployment, confirm that: A measurable business outcome and baseline are documented. Application, data, security, and financial owners are named. Dependencies, peak demand, and performance requirements are tested. Data-handling, residency, and compliance requirements are reviewed. Provider and customer responsibilities are documented. Access controls, logging, and incident-response procedures are established. Normal and high-demand costs include networking and supporting services. Budget alerts reach someone authorized to act. Recovery objectives are defined and restoration is tested. Data export, portability assumptions, and rollback are evaluated. Ongoing cost and architecture reviews have accountable owners. Turn Cloud Growth Into Business Value Public cloud is growing because it offers a faster, more flexible way to acquire technology, while managed services and AI expand what organizations can accomplish. Those advantages are real—but so are the financial, security, and operational responsibilities. Start with one workload and one measurable outcome. Bring business, technology, security, and finance stakeholders together, run a representative pilot, and use the results to guide expansion. The objective is not to put everything in public cloud. It is to put the right workloads there—and operate them with discipline. ## A Practical Checklist for AI Adoption: Start Small, Protect Data, Prove Value - URL: https://bartmcd.com/blog/ai-adoption-checklist-protect-data-prove-value - Published: 2026-10-06 A team wants to use AI to draft customer responses. The demonstration looks impressive: clear language, fast answers, and less time staring at a blank screen. But a polished draft does not answer the questions that matter to the business. Does it use accurate information? Can it expose customer data? Who checks its work? And does it save time after verification and corrections? Those questions should come before a broad rollout—not after an avoidable incident. Successful AI adoption is an operational discipline, not a software purchasing exercise. The goal is to improve a specific business outcome while keeping the organization in control of its data, decisions, and responsibilities. Approve a defined use case—not unrestricted use of a tool. The checklist below gives business owners, executives, and operational leaders a practical path from proposal to pilot to responsible expansion. Before Choosing a Tool: Establish Value and Accountability This checklist draws on the NIST AI Risk Management Framework , organized around Govern, Map, Measure, and Manage. It is an editorial adaptation, not an official NIST checklist or a guarantee of compliance. NIST describes its framework as voluntary, flexible, and nonsequential; apply these checkpoints to your organization’s circumstances. 1. Define One Business Problem “We need an AI strategy” is not a pilot objective. “We want to reduce the effort required to draft customer responses without increasing factual errors” is something you can evaluate. Describe the task, its users, the intended improvement, and its boundaries. Record the current turnaround time, quality, and cost—including time spent reviewing and correcting work. Without that baseline, an impressive demonstration can easily become an unprovable success story. Check: Can you explain the problem and the desired outcome without naming a product? Deliverable: A one-page use-case proposal with baseline measures and explicit exclusions. 2. Assign Accountability Before Access Name a business owner who is responsible for the outcome. Identify who approves security, privacy, legal, and operational risks, as appropriate. Also specify who can suspend the system when something goes wrong. A smaller business may assign several responsibilities to the same person. That is workable; leaving them unassigned is not. A vendor can provide technology and contractual commitments, but your organization still needs ownership of how that technology is used. Check: Does every approval, escalation, and suspension decision have a named owner? Deliverable: An owner-and-approver list with a clear escalation path. 3. Assess the Consequences of Failure A flawed internal brainstorming suggestion is not equivalent to an inaccurate medical explanation, an improper hiring recommendation, or an unauthorized payment. Match controls to the consequences—not to how easy the tool is to operate. Ask who could be harmed by incorrect outputs, exposed information, or inappropriate decisions. Consider customers, employees, business partners, and people whose information appears in the data. Define prohibited uses and identify activities requiring additional review. Check: Have you documented likely failures, affected people, and unacceptable outcomes? Deliverable: A short risk assessment and explicit prohibited uses. Before Connecting Company Data: Set Security Boundaries AI systems introduce new paths through which information can be accessed, transformed, or disclosed. Connecting a tool to company data should therefore be a deliberate security decision, not a convenience setting. 4. Decide Which Data May Enter the System Create an approved-data list. Address personal information, customer records, employee data, contracts, credentials, financial information, and confidential business material. Do not assume public information is automatically harmless. Combining public records with internal context can create privacy risks. The NIST Generative AI Profile provides guidance on privacy and other generative AI risks. For an initial customer-response pilot, synthetic or carefully de-identified examples may be sufficient. Evaluate whether de-identification actually reduces risk rather than treating it as a guarantee. Check: Do employees know what they may submit and what must stay out? Deliverable: An approved-data list and handling rules. 5. Review the Vendor and the Actual Contract Request security documentation and a threat model describing relevant threats and protections. Ask how prompts, uploaded files, retrieved information, and outputs are retained, deleted, shared, or used for training. Identify relevant subprocessors and incident-notification obligations. Verify answers against the specific service, subscription, configuration, and contract you intend to use. A general marketing statement is not a substitute for an applicable commitment. The joint guidance on securely deploying AI systems supports a security-focused approach to deployment. Its recommendations are most applicable to organizations deploying externally developed systems on premises or in private clouds, especially in high-threat, high-value environments; its stated scope excludes organizations merely using AI systems deployed by others. Tailor the review to your environment and threat profile. Check: Are important vendor assurances documented and applicable to your deployment? Deliverable: A vendor assessment recording evidence, gaps, and approval conditions. 6. Limit Access and Permissions Apply least privilege to users, integrations, and service accounts. Protect API credentials, restrict accessible information, and establish appropriate logging without unnecessarily capturing sensitive content. A drafting assistant does not automatically need permission to send messages, change customer records, or initiate transactions. Start with only the access required for the approved task. Treat retrieved documents and external content as potentially untrusted, particularly where malicious instructions could influence the system. Check: Can the system read or change anything beyond the approved workflow? Deliverable: A reviewed access-and-integration configuration. Before Launching the Pilot: Test the Workflow, Not the Demo 7. Build a Repeatable Test Set Test representative work, difficult inputs, incomplete information, and known failure scenarios. A few successful examples do not establish reliability. NIST’s Generative AI Profile cautions against extrapolating capabilities from narrow or anecdotal assessments. For the customer-response example, include conflicting policy documents, an outdated instruction, a request containing personal information, and a question the system cannot answer from approved sources. Check factual accuracy, citation validity, privacy, and relevant bias risks. Evaluate the complete workflow, including retrieval and review—not just the generated text. Set acceptance criteria before seeing the results. Check: Can another reviewer repeat the evaluation and understand why it passed or failed? Deliverable: A repeatable test set with documented acceptance criteria. 8. Make Human Review an Actual Procedure “A human will check it” is not an operational control until you define who checks what, when, and against which evidence. Specify which outputs require approval, what reviewers must verify, and how errors are escalated. Give reviewers enough time and source access to do the job. Train them to inspect underlying evidence: confident wording and plausible citations are not proof. For the pilot, customer-facing drafts might require approval before sending, with escalation when sources conflict or the answer cannot be verified. Check: Can reviewers reject an output and revert to the existing process? Deliverable: A review procedure and employee training materials. Before Expanding Adoption: Require Evidence and a Recovery Plan 9. Make a Documented Go/No-Go Decision Compare pilot results with the original business objective and baseline. Measure accepted work, errors, correction effort, total turnaround time, and cost—not merely how quickly the system generates text. Include licensing, integration, support, training, and review effort. Record unresolved risks separately; they should not disappear inside a favorable productivity summary. The decision may be to expand, continue testing, narrow the use case, or stop. A pilot that identifies an unsuitable application has provided useful evidence. Expansion into a materially different workflow requires its own assessment. Check: Does the evidence support the benefits claimed, and are remaining risks acceptable to the accountable owners? Deliverable: A pilot scorecard and approval record. 10. Plan Monitoring, Suspension, and Recovery Approval is the beginning of oversight, not its conclusion. Track failures, user feedback, security events, and changes in performance. Establish a process for reviewing incidents and correcting recurring problems. Define reassessment triggers, including model updates, new data sources, changed permissions, different users, and expanded purposes. Determine how to suspend access, preserve relevant evidence, notify responsible people, and return to a fallback workflow. Test that fallback. A recovery plan is only useful if employees can continue essential work when the AI system is unavailable or unsafe. Check: Can the organization detect a problem, stop the system, and recover safely? Deliverable: A monitoring plan and tested suspension or rollback procedure. The Next Step: Approve One Controlled Pilot Responsible AI adoption does not require solving every possible AI problem before starting. It requires understanding the particular problem you are trying to solve—and maintaining control as you solve it. Start narrow. Protect the data. Test the actual workflow. Keep someone accountable. Scale only after the evidence supports it. Choose one candidate workflow and assign its business owner. Before purchasing or connecting a tool, complete the use-case proposal, baseline, and initial risk assessment. That is how AI moves from an interesting demonstration to a defensible business capability. ## Cybersecurity That Works: Protect Your Accounts, Verify Requests, and Prepare to Recover - URL: https://bartmcd.com/blog/business-cybersecurity-accounts-verification-recovery - Published: 2026-10-06 A message arrives from a familiar vendor asking your finance team to update its banking details. The branding looks right. The language sounds professional. There is even a plausible explanation: the vendor has changed banks. The decisive question is not whether someone can spot a suspicious phrase. It is whether your business has a process that requires independent verification before money moves. That distinction captures what effective cybersecurity looks like. Security tools matter, but they work best when supported by clear responsibilities, repeatable decisions, and tested recovery procedures. A business cannot purchase its way out of every cyber risk. It can make common attacks harder to execute and reduce the damage when something goes wrong. For business owners and leaders, the priorities are practical: protect important accounts, stop trusting unexpected requests at face value, maintain systems, and prove that critical operations can recover. Make Cybersecurity a Business Discipline Cybersecurity protects more than computers. It protects the information, services, relationships, and revenue your organization depends on. That makes it a leadership responsibility, even when technical work is delegated to an internal team or outside provider. NIST’s small-business cybersecurity guidance provides a useful foundation: understand your risks, implement protections, and improve continuously. Begin by identifying what would most disrupt your business if it became unavailable, exposed, or manipulated. Important accounts: Email, banking, payroll, cloud storage, and administrator access. Critical information: Customer records, contracts, financial data, and intellectual property. Essential services: The systems needed to serve customers, communicate, and collect payments. Responsible people: Whoever owns account security, updates, backups, and incident coordination. Keep this inventory manageable. Its purpose is to help you prioritize, not produce a document nobody uses. Include outside providers, and clarify which security tasks they perform versus which remain your responsibility. Cybersecurity becomes more effective when every important safeguard has an owner and a way to verify that it works. Protect Accounts with Stronger Authentication A stolen password should not be enough to enter your business. Multifactor authentication, or MFA, adds protection beyond a password. Enable it wherever available, starting with email, financial services, remote access, and administrator accounts. However, MFA methods are not equally resistant to attack. A criminal can build a fake login page that captures both a password and a one-time code. Text-message authentication also carries risks associated with control of the phone number. NIST’s MFA guidance explains why phishing-resistant authentication deserves special attention. Options such as FIDO/WebAuthn security keys and supported passkeys bind authentication to the legitimate service, making them resistant to credential-stealing websites. Choose Protection That Fits the Account Use phishing-resistant options where supported, particularly for sensitive and administrator accounts. Where they are unavailable, another supported MFA method is generally preferable to leaving an account protected only by a password. Do not assume every passkey deployment automatically satisfies your organization’s MFA requirements. Implementation, device protection, account recovery, and applicable policies still matter. Practical action: Review the security settings of your important accounts. Record available authentication options, enable appropriate protection, and secure recovery methods. Store recovery codes safely—not in an exposed document beside the password they are meant to protect. Use Unique Passwords Without Relying on Memory When a service still requires a password, use a long, unique one. Reusing credentials creates a chain reaction: exposure at one service can give attackers a starting point at others. A password manager makes unique passwords practical. It can generate and store credentials so employees do not have to invent memorable variations or keep passwords in spreadsheets. NIST’s password guidance supports using password managers and strong passwords rather than relying on reuse. Protect the password manager itself with a strong master password and MFA where supported. For business use, establish rules for sharing credentials, recovering access, and removing access when employees leave. Practical action: Replace reused passwords on sensitive accounts first, then work through the remaining accounts. Avoid shared administrator credentials where individual accounts are available; individual access makes permissions and accountability easier to manage. Verify Requests Before Sharing Information or Sending Money Phishing defense should not depend on employees finding spelling mistakes. Fraudulent messages can be polished, accurately branded, and built around real business relationships. AI-generated writing and convincing voice impersonation make appearance and familiarity even less reliable. The stronger defense is a verification process. The FTC’s small-business cybersecurity guidance recommends independently visiting account websites and using known, trusted phone numbers to confirm suspicious requests. It also recommends policies requiring confirmation of emailed wire-transfer requests. Build Verification into the Workflow Suppose a supplier requests a change to its payment destination. The employee handling the request should contact the supplier using a number already held in approved records—not the number included in the message. Any required payment approvals should still apply after verification. Unexpected login request: Open the service through a trusted bookmark or independently entered address. Changed payment instructions: Confirm through a separate, trusted channel before changing records or transferring funds. Sensitive-information request: Verify the requester’s identity, authority, and business need. Urgent executive instruction: Follow the established approval process, even when the message demands secrecy or speed. Give employees a clear reporting channel and permission to pause. Treat prompt reporting as useful risk reduction, including when someone has already clicked a link or shared information. Keep Software Current—and Prove Backups Work Assign Responsibility for Updates Software vulnerabilities do not disappear because a device still appears to work. Enable automatic updates where appropriate, and assign responsibility for maintaining business applications, operating systems, browsers, phones, and network equipment. Some business systems require testing or scheduled maintenance before updates. That is a reason to manage the process, not leave it open-ended. Track exceptions and replace unsupported software that no longer receives security fixes. Limit administrator access to people who need it. An employee performing routine work should not have unrestricted control simply because it is convenient. Test Recovery, Not Just Backup Completion A successful backup notification does not prove that your business can recover. Backups may be incomplete, corrupted, inaccessible, or reachable by the same attacker who compromises production systems. Maintain protected backups of critical data, including offline or appropriately isolated copies. Encrypt backups where appropriate, protect their access credentials, and ensure recovery does not depend entirely on the environment you may need to rebuild. Practical example: Restore a sample customer record, an important shared folder, and relevant application data into a safe test environment. Confirm that the information is complete, readable, and usable. Document how long restoration takes and what dependencies are required. Compare those results with business needs. If operations depend on a system returning quickly, a backup that takes too long to restore leaves a meaningful gap. Cloud storage and synchronization are not automatically substitutes for a recoverable backup. Decide How to Respond Before an Incident Occurs During an incident, confusion consumes time. Prepare a short response plan that identifies who receives reports, who coordinates technical assistance, who authorizes business decisions, and how employees will communicate if normal email is unavailable. Include contacts for relevant service providers, legal counsel, and insurers where applicable. Identify essential operations and practical alternatives if systems must remain offline. Keep an accessible copy of the plan outside the systems it covers. For suspected ransomware, the FTC advises disconnecting infected devices from the network without powering them down, because shutdown can destroy useful investigative information. Involve qualified technical responders promptly rather than improvising cleanup or deleting evidence. Rehearse the plan with a realistic scenario: an employee reports a compromised email account, followed by suspicious payment requests. Who secures the account? Who checks related access? Who contacts the bank if money moved? Who determines whether notification obligations apply? A discussion like this exposes gaps before an emergency does. Update the plan when systems, providers, or responsibilities change. A Practical Cybersecurity Checklist Use this checklist to turn priorities into accountable work: Identify critical accounts, information, systems, and service providers. Enable MFA and prioritize phishing-resistant options for sensitive access. Replace reused passwords and secure the password manager. Review permissions and remove unnecessary or departed-user access. Require independent verification of payment changes and sensitive requests. Publish a simple way to report suspicious activity. Assign ownership for updates and track unsupported systems. Protect backups and test whether important data can be restored. Document incident contacts, decision-makers, and continuity procedures. Rehearse the response plan and correct the gaps it reveals. Start Small, Then Make Improvement Routine No single control guarantees protection from every breach. The goal is to reduce avoidable risk and build a business that can respond effectively when prevention falls short. Start with one important account, one verification rule, and one recovery test. Then assign owners and repeat. Put cybersecurity on the operating agenda, review what is working, and address what is not. Consistent follow-through turns security from a collection of tools into a dependable business practice. ## A Practical Checklist for Identity and Access Controls - URL: https://bartmcd.com/blog/identity-and-access-management-checklist - Published: 2026-10-05 A departing employee’s directory account is disabled. The ticket is closed. Yet a separately managed application account remains active, and an existing session still works. The offboarding process looks complete—until someone tests it. This scenario illustrates a fundamental challenge in identity and access management: a configured control is not necessarily an effective control. Multifactor authentication helps protect sign-ins, but it does not resolve excessive permissions, orphaned service accounts, incomplete departures, or weak recovery procedures. For business leaders, IT managers, and security teams, the objective is straightforward: know who and what can access your systems, limit that access to legitimate needs, remove it when circumstances change, and verify the outcome. The work is continuous, not a one-time implementation. Make Access Control an Operating Process The joint CISA–NSA identity and access management guidance brings together identity governance, authentication, and monitoring. Your operating process should connect those disciplines rather than treating them as separate projects. For every checklist item below, record four things: Owner: The person accountable for the control, including coordination with application and business owners. Status: Implemented, partially implemented, missing, or covered by an approved exception. Evidence: A report, configuration, approval record, or test result demonstrating what actually happens. Next review date: When the control will be reassessed, with earlier reviews triggered by material changes. The evidence suggestions are practical implementation aids, not regulatory requirements. A smaller organization can start with a controlled register; a larger organization may automate collection and review. Neither approach removes the need for accountability. The Practical Identity and Access Checklist ☐ 1. Inventory Identities and Permissions Include employees, contractors, guests, administrators, local accounts, service accounts, and application identities. Reconcile directory records with critical applications: the central directory will not necessarily reveal every account or sign-in path. Record each identity’s owner, purpose, permissions, and relevant lifecycle information. Flag accounts with no clear business need or accountable owner. For example, an active contractor account should prompt a check against the current engagement—not an assumption that access remains appropriate. Evidence: An account-and-permission register reconciled against directories and critical applications, with unresolved discrepancies assigned for investigation. ☐ 2. Formalize Onboarding, Role Changes, and Departures Require approved access requests tied to job responsibilities. When someone changes roles, review and remove obsolete permissions rather than simply adding new ones. Otherwise, an internal transfer becomes a mechanism for accumulating access. Connect departure notifications to directory disablement, application deprovisioning, and session revocation where supported. Identify who initiates the process, who executes it, and who verifies completion. Include contractors and guests whose departure may not appear in the employee workflow. Evidence: Joiner, mover, and leaver records showing approvals, changes, removal actions, and completion verification. ☐ 3. Limit Administrative Access Grant only the permissions needed for the task. Separate everyday accounts from administrative accounts so routine email and browsing do not occur under elevated privileges. Where supported, use approved, time-limited privilege elevation instead of permanent administrative access. For example, an administrator troubleshooting one application should not automatically need unrestricted control of the identity platform. Microsoft’s identity governance guidance recommends separate administrative accounts, least-privileged roles, and just-in-time access. Evidence: A privileged-account inventory, approved role assignments, and records of privilege elevation and review. ☐ 4. Enforce MFA and Prioritize Phishing Resistance Check coverage across email, remote access, file storage, and administrative systems. Enrollment alone is insufficient: confirm that policy actually requires MFA and identify bypasses, legacy authentication, and excluded accounts. Prefer appropriately configured FIDO/WebAuthn authenticators for phishing-resistant authentication. As CISA explains , MFA methods offer different levels of protection. Number matching improves push-based authentication but is not equivalent to phishing resistance. Document unsupported systems and their migration or compensating-control plans. Evidence: A coverage report and controlled tests demonstrating that sign-ins cannot bypass the required authentication policy. ☐ 5. Replace Outdated Password Rules For systems implementing NIST SP 800-63B-4 , passwords used as the sole authentication factor must contain at least 15 characters. Passwords used within MFA may be shorter but must contain at least eight characters. These requirements apply within the guideline’s scope; they are not a universal legal mandate. Block common or compromised passwords, support password managers, and avoid arbitrary periodic changes and character-composition rules. Require a change when compromise is evident. Test application behavior rather than relying solely on the written policy. Evidence: Documented requirements and verified settings, including password-length enforcement and blocked-password checks. ☐ 6. Govern Nonhuman Identities Service accounts and application identities need owners, defined purposes, and limited permissions. Include integrations, automation jobs, and AI applications that can retrieve data or perform actions. An application identity with broad document access can expose information even when every employee uses MFA. In Azure, prefer managed identities for supported workloads rather than manually managed service credentials. Where credentials remain necessary, protect them and define their replacement and revocation procedures. Investigate dependencies before removing an apparently unused identity. Evidence: A workload-identity register with owners, permissions, credential-management arrangements, and review decisions. ☐ 7. Centralize Authentication Where Practical Assess which applications can use single sign-on. Central authentication can simplify policy enforcement and lifecycle management, but an application is not fully governed merely because its main login page supports SSO. Inventory local accounts, alternate login paths, and exceptions. For example, a local administrator account may bypass the protections applied to federated users. Determine whether those paths can be disabled or require separate controls and monitoring. Evidence: An application integration map and an exception register identifying owners, risks, protections, and review dates. ☐ 8. Review Access and Act on Findings Ask resource owners to confirm whether access remains necessary. Include application permissions, guest access, sensitive groups, and privileged roles. Provide enough context for meaningful decisions: a list of unfamiliar account names encourages rubber-stamping. Track removal through completion. If a manager rejects a former team member’s access to financial reports, the review is not finished until that permission is removed and verified. Set review frequency according to sensitivity, privilege, and organizational change. Evidence: Recorded decisions, assigned remediation actions, and proof that rejected access was removed. ☐ 9. Monitor Identity Activity Collect relevant authentication and administrative logs. Investigate unexpected privileged activity, account creation, permission changes, and changes to authentication or recovery settings. Establish expected behavior so unusual but authorized maintenance can be distinguished from suspicious activity. Every alert needs a destination and a response process. Define who assesses legitimacy, how they obtain business context, and when they escalate. Logging without someone responsible for acting on it leaves a substantial operational gap. Evidence: A controlled alert test showing delivery to a named responder and a documented assessment. ☐ 10. Test Revocation, Recovery, and Emergency Access Verify that departure and compromise procedures stop access to critical applications. Disabling an identity does not necessarily terminate every application session immediately; Microsoft documents token and application-session limitations . Test application behavior and use additional revocation measures where needed. Document recovery procedures with appropriate identity verification and notifications. Secure emergency-access arrangements, monitor their use, and test them without creating an uncontrolled bypass. Recovery should restore legitimate access—not offer attackers an easier route around authentication. Evidence: A controlled revocation test and recovery exercise, including identified limitations and corrective actions. Measure Results, Not Just Configuration Use a small set of operational measures to expose gaps and guide investment: MFA coverage: Distinguish enrollment from enforced protection and report exceptions separately. Accounts without owners: Track unresolved human and nonhuman identities. Unnecessary access awaiting removal: Measure outstanding remediation, not just completed reviews. Verified departure removal time: Measure from notification to confirmed removal across relevant systems. These are proposed management measures, not industry benchmarks. Define their scope and denominators clearly. A strong percentage can conceal a serious weakness if privileged accounts or critical applications are excluded. Close the Loop on Access A control is not complete because it is enabled—it is complete when someone owns it, its coverage is known, and a test demonstrates that it works. Start with your critical applications and highest-risk identities. Assign owners, document gaps, prioritize corrective work, and schedule controlled tests. Bring business owners into decisions about legitimate access rather than leaving every judgment to IT. The next step is practical: select one critical application, trace an identity from approved access through removal, and verify the result. Use what that test reveals to strengthen the process across your organization. ## Before You Scale AI: Five Controls That Protect Your Business - URL: https://bartmcd.com/blog/five-ai-controls-to-protect-your-business - Published: 2026-10-05 A compelling AI demonstration can make adoption look easy. A tool summarizes a lengthy report, drafts a customer response, or answers questions across company documents in seconds. The business opportunity is real. But the demonstration rarely shows what happens when the source material is wrong, a confidential document enters an unapproved service, or the system gains permission to take actions nobody intended. For executives and boards, the right question is not simply whether artificial intelligence works. It is whether a particular use of AI delivers value within boundaries the business understands and can enforce. Evaluate AI by the task it serves, the data it receives, and the actions it can take—not just the quality of its answers. Generative AI creates content; AI agents can also interact with applications and execute workflows. Those capabilities introduce different risks and should receive different levels of oversight. Security should not be a reason to avoid AI. It should be the discipline that makes useful adoption sustainable. These five controls provide a practical starting point. 1. Know Where AI Is Already Being Used An organization cannot govern tools it cannot see. Employees may already be using AI through browser-based services, features embedded in existing software, or applications connected to company accounts. A formal purchasing process alone will not capture that activity. The NIST Generative AI Profile recommends maintaining an AI-system inventory, including information about underlying models, access methods, known issues, and human oversight responsibilities. Translate that guidance into a register people can actually maintain. Tool and owner: What is being used, and who is accountable for its business purpose? Intended use and permitted data: Which tasks and information are approved? Connections and access: Which applications, accounts, and underlying models does it use? Oversight and limitations: Who reviews results, and what known weaknesses matter? Shutdown procedure: Who can disable the tool or revoke its connections? Start by asking department leaders what their teams use and why. Make disclosure constructive rather than punitive. Employees who expect punishment for experimenting are less likely to reveal the workflows that need attention. For example, an assistant used to draft public marketing copy is materially different from one connected to customer support records. Both belong in the inventory, but they should not receive identical approval conditions. 2. Set Explicit Boundaries Around Sensitive Data AI can only process information it can access. That makes data boundaries a business decision, not just a technical setting. The UK National Cyber Security Centre’s secure-design guidance for AI systems emphasizes evaluating external providers’ security and controlling information sent outside the organization’s control. Before approving a service, understand what happens to inputs, uploaded files, outputs, and connected data. Ask Questions About the Actual Product and Contract How long is information retained, including logs and backups? Can inputs or outputs be used for model training, and what settings or contractual terms govern that use? Who can access the information, including provider personnel and third parties? What access controls, deletion mechanisms, and audit capabilities are available? What information can connected services retrieve or share? Do not assume every AI service trains on every user input. Equally, do not assume that a familiar vendor or paid subscription automatically provides the protections your use case requires. Verify the specific product, plan, configuration, and agreement. Give employees concrete rules. Credentials, authentication secrets, customer records, confidential financial information, and proprietary code should not enter tools unless that use has been explicitly approved with appropriate safeguards. Suppose a manager wants help summarizing a customer complaint. An approved workflow might use a minimized version containing only the details needed for the task, rather than uploading the customer’s entire account history. Removing a name alone may not make the remaining information safe to share. 3. Require Verification, Not Just Fluent Answers AI-generated content can sound authoritative while being wrong. NIST describes this risk as confabulation : confidently presented false or erroneous content. Its Generative AI Profile recommends reviewing generated sources and citations during testing and ongoing monitoring. The practical lesson is straightforward: fluent language is not evidence. A source link may be irrelevant, a quotation may be inaccurate, and a calculation may rest on an incorrect assumption. Assign an accountable reviewer to consequential outputs. That reviewer needs access to the original evidence, enough expertise to evaluate it, and time to perform a meaningful check. Research and communications: Verify factual claims, quotations, and references against original sources. Financial work: Check source data, assumptions, formulas, and calculations. Software development: Review generated code and test it for functionality and security before deployment. Customer-facing decisions: Confirm that responses reflect current policy and the customer’s actual circumstances. Consider an AI-generated briefing that cites a company policy. The reviewer should open the policy, confirm it is current, and check whether it supports the recommendation. Asking the same model whether its answer is correct is not independent verification. Match review intensity to potential harm. Brainstorming a meeting agenda does not warrant the same scrutiny as advice affecting a payment, contract, or individual’s access to services. AI should accelerate the work—not eliminate accountability for the result. 4. Limit What an AI Agent Can Do A drafting assistant produces suggestions. An agent connected to email, files, business systems, or payment workflows may change records, send messages, or initiate transactions. That shift from generating content to exercising authority deserves explicit approval. NCSC’s secure-design guidance recommends least-privilege access and restrictions on AI-triggered actions. In practical terms, give an agent only the permissions necessary for its approved task. Start With Narrow Permissions and Approval Gates Use read-only pilots where feasible. Restrict access to relevant repositories rather than entire environments. Separate the ability to propose an action from the authority to execute it. Require independent approval for sensitive changes, external communications, payments, and permission updates. Prompt injection is a particular concern. Instructions embedded in a retrieved document, webpage, or message may attempt to redirect the system away from its authorized task. For example, a document being summarized could contain hostile instructions to retrieve unrelated confidential files and include them in the response. Treat external content as untrusted, and test these scenarios before deployment. Check whether the system can cross data boundaries, invoke unnecessary tools, or bypass approval steps. Do not assume a filtering product or a well-written prompt eliminates the risk. Enforce important restrictions outside the model through application permissions and workflow controls. Maintain useful activity logs and a tested way to revoke access. If an agent behaves unexpectedly, the business needs a reliable stop mechanism—not another conversation asking it to stop. 5. Update Fraud-Verification Procedures AI adoption is not only about the tools your organization chooses. It is also about the tools criminals use against it. In its December 3, 2024 alert , the FBI described criminals using AI-generated text, images, audio, and video to support fraud. It recommends independently verifying callers through a trusted contact number. A familiar voice, convincing video, or polished message is not sufficient proof of identity. Your procedures should remain effective even when the impersonation looks credible. Independently confirm unusual payment requests and changes to bank details. Use a trusted number or established verification channel—not contact details supplied in the suspicious request. Apply existing approval requirements even when a request appears to come from a senior executive. Give employees permission to pause urgent requests involving money or sensitive information. For example, if someone appearing to be the CEO requests an immediate transfer during a video call, finance should still follow the established approval process. The control should depend on independent verification, not an employee’s ability to spot a synthetic face or voice. A Practical Checklist Before Expanding an AI Pilot The following is an implementation proposal, not a government-mandated standard. Before scaling, confirm that the pilot has: An accountable owner and a clearly defined business task. Documented data boundaries supported by verified provider terms and settings. Limited permissions and approval gates appropriate to the potential harm. A review process with named reviewers and access to original evidence. Performance measures covering accuracy, usefulness, checking time, and rework. Stop conditions and a tested procedure for disabling access and investigating problems. Compare the AI-assisted workflow with the existing process. Measure the effort required to produce an acceptable result, not just the volume of output. A fast draft that demands extensive correction may offer less value than its demonstration suggests. Scale the Value, Not the Exposure Responsible AI adoption does not require perfect certainty. It requires clear ownership, bounded access, proportionate verification, and the ability to stop when the system exceeds those boundaries. Before approving your next expansion, bring the business owner, security team, and relevant reviewers together to complete the checklist. If they cannot explain what data the tool receives, what it can do, who checks its work, and how to disable it, the pilot is not ready to scale. Establish those controls first—then expand the uses that demonstrate real business value. ## Leadership That Scales: Clear Decisions, Accountable Teams, and Responsible Innovation - URL: https://bartmcd.com/blog/leadership-that-scales-decisions-teams-innovation - Published: 2026-10-04 A team can have talented people, strong technology, and ambitious goals—and still struggle to execute. Priorities compete. Decisions wait for approval. Risks surface without resolution. Everyone is busy, but nobody is certain which trade-offs they are authorized to make. These are not always problems of effort or expertise. Often, they are problems of leadership design. For executives, founders, and managers in technology-enabled businesses, leadership must be more than setting direction or inspiring confidence. It is a practical operating discipline: establish priorities, clarify authority, invite concerns, and review outcomes. Cybersecurity and artificial intelligence make this discipline especially visible because both involve decisions whose consequences extend beyond a single team. Leaders do not need to make every decision. They need to establish how decisions are made, who owns the consequences, and how the organization learns. 1. Start With the Outcome, Not the Tool Technology proposals often arrive with a solution already attached: deploy an AI assistant, migrate a platform, purchase a security product. The leadership task is to step back and define the business result before approving the implementation. Ask two questions: What must improve, and what must not be compromised? The first establishes value. The second establishes boundaries. Consider a hypothetical customer-service team proposing an AI assistant. “Adopt AI” is not a useful outcome. Helping employees locate accurate answers more quickly is. Constraints might include protecting customer information, preserving human review for sensitive requests, and avoiding unsupported responses. That framing changes the decision. Instead of debating whether the technology is impressive, the team can evaluate whether it solves the intended problem within acceptable limits. Make Trade-Offs Visible Every meaningful priority consumes resources that could support something else. Leaders should identify what will be deferred, which risks remain, and what evidence would justify changing course. A priority without an acknowledged trade-off is often just an additional demand. Clear leadership gives teams permission to stop lower-value work, not merely instructions to do more. 2. Make Decision Rights Explicit Delegation fails when responsibility moves downward but authority stays at the top. A manager may own a deadline without controlling staffing. A security leader may own risk reduction without access to the budget or executives needed to address it. Accountability requires authority, resources, and a defined path for escalation. Assigning a name to a problem is not enough. The NIST Cybersecurity Framework 2.0 provides a useful governance reference for organizations of any size, sector, or maturity. It does not prescribe one implementation method. Its governance outcomes, including GV.RR-01 through GV.RR-03 , connect leadership responsibility with communicated roles, appropriate authority, and resources aligned to cybersecurity risk strategy. The broader leadership lesson is straightforward: make authority understandable before a consequential decision becomes urgent. A Reusable Decision Record For decisions involving significant cost, customer impact, sensitive data, or operational risk, use a short record: Decision and intended outcome: What are we deciding, and what business result should improve? Accountable owner: Who is responsible for execution and follow-through? People consulted: Whose operational, security, legal, or customer expertise is needed? Approval authority: Who can authorize the action and accept the associated trade-offs? Constraints and resources: What boundaries apply, and what support is available? Escalation trigger: What change, uncertainty, or potential harm requires senior review? Review date and evidence: When will the decision be reassessed, and against what results? This is not paperwork for every routine choice. It is a way to prevent ambiguity where ambiguity is expensive. Routine, reversible decisions should stay close to the work; consequential decisions need clearer oversight. 3. Invite Concerns—and Close the Loop Telling employees to speak up is only the beginning. What happens after they raise a concern determines whether the invitation is credible. If a manager flags unrealistic delivery expectations and receives no response, the organization has collected information without using it. If an employee questions an AI output and the concern disappears into a chat thread, the same failure has occurred. Create a visible process for recording concerns, assigning review ownership, and communicating the disposition. A concern might lead to a change, further investigation, or a documented decision to proceed. Each response should explain the reasoning and identify any follow-up. Inviting challenge does not require consensus on every decision. Leaders can listen carefully and still choose a direction. The essential distinction is between disagreement that receives a reasoned response and disagreement that is ignored. During reviews, separate what was knowable at the time from what became clear later. Ask whether assumptions were reasonable, whether warnings reached the right people, and whether the owner had sufficient authority. This supports learning without removing accountability. 4. Rehearse Difficult Decisions Before They Become Urgent Hypothetical scenario: A critical service becomes unavailable during a suspected cyber incident. The cause is uncertain. Customers are asking questions, and restoring service quickly could interfere with investigation or introduce additional risk. The technical team needs to diagnose the problem. Leadership must resolve different questions: Who can suspend affected operations while the facts remain incomplete? Who can authorize emergency recovery spending? Which business functions must continue, and through what alternatives? Who approves customer communications, and how will uncertainty be described? What evidence is needed before normal operations resume? These questions should not receive their first serious attention during an incident. CISA’s guidance for corporate leaders and CEOs recommends involving security leadership in risk decisions, including executives and board members in response exercises, and testing continuity for critical business functions. Although that guidance was framed for a heightened threat environment, these recommendations offer useful preparation practices. A cross-functional exercise need not be elaborate. Walk through the scenario, introduce uncertainty, and require participants to make decisions using existing authority and procedures. Afterward, document where the process stalled. Missing contact information is one kind of gap. Unclear authority to interrupt revenue-generating operations is another—and requires leadership action, not simply an updated technical runbook. 5. Govern Innovation Without Freezing It AI creates pressure to move quickly. It also creates opportunities to confuse activity with progress: launching pilots without an owner, approving tools without examining data use, or measuring adoption without evaluating output quality. The answer is neither unrestricted experimentation nor approval processes so burdensome that useful ideas never reach testing. It is bounded experimentation with explicit oversight. NIST describes its AI Risk Management Framework as voluntary guidance for incorporating trustworthiness into AI design, development, use, and evaluation. That provides a risk-management foundation, not a universal compliance checklist. Define the Pilot Before Launch The following are practical leadership recommendations informed by risk-management principles, not quoted NIST requirements: Name a business owner: Someone must be accountable for the use case and its operational consequences. Approve the data: Identify what information may be used and what must remain excluded. Set evaluation criteria: Test usefulness, accuracy, failure modes, and relevant security or privacy concerns. Specify human oversight: Clarify which outputs require review before they affect customers or business decisions. Establish stop conditions: Define what would pause or end the pilot, and who can act. In the hypothetical customer-service example, a pilot could begin with approved internal reference material and employee-reviewed responses rather than autonomous customer communications. Expansion would depend on demonstrated performance within the defined boundaries. A successful pilot answers a decision question. It does not automatically justify broader deployment. 6. Put the Discipline Into Practice: A 30-Day Reset Leadership improvement does not require redesigning the entire organization at once. Start where uncertainty is delaying work or concentrating decisions unnecessarily. Week 1: Select three priorities. Define the desired outcomes, constraints, and work that will be deferred. Week 2: Clarify ownership and authority. Apply the decision record to consequential choices and resolve gaps between responsibility and resources. Week 3: Run one cross-functional exercise. Test decisions under uncertainty, not just whether participants know the written procedure. Week 4: Review and assign follow-up. Examine unresolved risks, decisions, and lessons. Give each action an owner and review date. Leadership Checklist Can the team explain the priorities and their trade-offs? Does each consequential decision have an owner with appropriate authority? Do raised concerns receive a visible response? Have senior leaders rehearsed disruption decisions? Do innovation pilots have evaluation criteria and stop conditions? Leadership Is the Clarity Others Can Act On Leadership that scales replaces dependence on individual judgment with a system for exercising judgment well. It establishes direction, distributes authority responsibly, and creates opportunities to challenge assumptions before consequences escalate. Start with one stalled decision. Identify the missing outcome, authority, resource, or escalation path. Resolve it, document the lesson, and apply it to the next decision. Where is your team waiting for clarity that only leadership can provide? ## Cybersecurity Basics: Five Practical Steps to Protect Your Accounts and Business - URL: https://bartmcd.com/blog/cybersecurity-basics-five-steps-to-protect-your-business - Published: 2026-10-04 A payment request arrives from a familiar vendor. An employee receives an urgent account warning. A laptop keeps postponing a software update. None of these moments looks like a major business crisis—but each can become the starting point for one. Cybersecurity is not simply an IT concern. It protects the systems that keep revenue moving, customer information private, and daily operations running. For a small business, losing access to email or financial records can disrupt work even without a sophisticated attack. The practical response is not to chase every new threat. It is to build dependable habits around account access, passwords, verification, software maintenance, and recovery. These fundamentals reduce common risks while giving your organization a stronger foundation for more advanced security measures. As the National Institute of Standards and Technology’s small-business guidance emphasizes, cybersecurity is a continuous process, not a one-time project. Start with these five steps, then make someone responsible for keeping them working. 1. Strengthen Account Access Your email account deserves special attention. It often contains sensitive conversations and receives password-reset messages for other services. An attacker who gains access may be able to impersonate you, intercept business communications, or attempt to take over additional accounts. Enable multifactor authentication, or MFA , wherever available. MFA adds another requirement beyond a password, making a stolen password less useful on its own. Prioritize: Business and personal email accounts. Banking, payment, and payroll services. Remote access and cloud applications. Administrator accounts that control users, systems, or security settings. Choose stronger authentication where possible Not every MFA method offers the same protection. Codes delivered by text message and some approval prompts can still be exploited through deception. CISA recommends MFA for businesses and encourages moving toward phishing-resistant methods. Correctly implemented FIDO/WebAuthn passkeys and compatible security keys can provide phishing resistance by tying authentication to the legitimate service . That makes it harder for a look-alike website to capture credentials that can be reused elsewhere. These methods are not “unhackable.” They do not prevent every compromised device, stolen session, or fraudulent payment request. Where phishing-resistant options are unavailable, use another supported MFA method rather than leaving an account protected only by a password. Practical action: Secure your primary email account first. Review its recovery settings, protect recovery codes, and remove access that no longer belongs there. Businesses should also review administrator privileges and promptly disable departing employees’ accounts. 2. Stop Reusing Passwords Password reuse creates a connection between otherwise unrelated accounts. If a password exposed through one service also opens your business email, the original incident can become your problem—even if your own systems were never breached. Use long, random, unique passwords for accounts that require them. A password manager makes this manageable by generating and storing different passwords without requiring you to memorize each one. NIST’s password guidance recommends long passwords and password managers as practical security measures. A manager reduces the temptation to reuse a familiar password, but it is not a guarantee of safety. Protect the password manager itself with a strong master password and MFA where supported. Understand its recovery process before you need it. For business use, choose an approach that supports controlled sharing and removing access when someone leaves, rather than putting credentials in a shared spreadsheet. Practical example: If your payroll service and an online shopping account share a password, change the payroll password immediately. Then work through email, financial services, and other important accounts before addressing lower-impact services. Where a service supports passkeys, consider adopting them. Where passwords remain necessary, uniqueness still matters. 3. Verify Unexpected Requests Independently Phishing works by making a request seem credible enough that you act before checking. The message may impersonate a supplier, executive, bank, delivery company, or technology provider. It might ask you to open an attachment, enter credentials, approve a login, or change payment details. Poor spelling is not a dependable warning sign. Convincing messages can be polished and personalized, and AI tools can make fraudulent communications easier to produce . Evaluate what the message asks you to do , not just how professionally it is written. The Federal Trade Commission’s phishing guidance recommends contacting an organization through a website or phone number you already know is genuine—not through contact information supplied in the suspicious message. Build verification into business workflows Suppose a vendor emails new bank details just before an invoice is due. Do not confirm the change by replying to that same email. Call an established contact using a number already in your records. For significant payments, require a separate approval before money moves. Apply the same principle to an unexpected account warning: open the company’s app or navigate independently to its website instead of following the message’s link. Payment changes: Verify through an established, separate channel. Unexpected login prompts: Do not approve requests you did not initiate. Requests for secrets: Do not send passwords or verification codes in response to an unexpected message. Urgent executive requests: Follow normal approval procedures, regardless of the sender’s apparent seniority. Give employees a clear, blame-free way to report suspicious messages. Early reporting is more useful than silence from someone worried about admitting a mistake. 4. Keep Software Current Security updates address weaknesses that attackers may exploit . Delaying them leaves known problems unresolved, sometimes on systems that handle your most sensitive information. Include phones, computers, browsers, business applications, networking equipment, and security tools in your update routine. Enable automatic updates where appropriate, and make sure required restarts actually happen. For business-critical systems, updates may require testing and a planned maintenance window. That is a reason to organize the work—not to postpone it indefinitely. Know what you are maintaining You cannot reliably update equipment or software you do not know exists. Maintain a basic inventory showing what the business uses, who owns it, and who is responsible for maintenance. Check whether products still receive security updates. Unsupported software and devices need a replacement or retirement plan. A system that appears to work normally may still lack protection against newly identified weaknesses. Practical example: A small company might keep office laptops updated while overlooking the router and a rarely used remote-access tool. Reviewing the full inventory helps expose those gaps. When an outside provider handles updates, ask what is covered, how urgent security fixes are prioritized, and how you will know the work is complete. 5. Make Recovery Part of Prevention Even well-managed organizations experience mistakes, equipment failures, and security incidents. Your objective is not just to reduce their likelihood. It is also to limit disruption when something goes wrong. Regular backups are essential, but their value depends on whether they contain the right information, remain protected, and can actually be restored. CISA’s #StopRansomware Guide recommends protected offline backups and regular recovery testing. The useful question is not simply “Do we have backups?” It is “Have we demonstrated that we can recover the information we need?” Identify the information and systems your business cannot operate without. Then establish backup arrangements that reflect how much lost work and downtime you can tolerate. Protect backup access: Limit who can modify or delete backup data, and avoid relying entirely on the same access that controls production systems. Reduce exposure: Consider offline or appropriately configured immutable backups so an attacker cannot easily alter every copy. Test restoration: Recover representative files and, where practical, a critical application or workflow. Document dependencies: Record the credentials, software, instructions, and provider support needed to restore operations. Do not assume that storing information in the cloud automatically meets your backup needs. Understand your provider’s retention and recovery capabilities. Create a short incident-response plan as well. Name the decision-maker, technical support contacts, and an alternative communication channel if email becomes unavailable. Address customer communication and applicable reporting obligations before an incident forces rushed decisions. Your Cybersecurity Action Checklist Turn these recommendations into assigned work rather than an open-ended intention: Start today: Secure one important account with MFA and replace one reused password. Next: Establish independent verification for payment changes and suspicious account messages. Review maintenance: Check update settings, identify unsupported systems, and assign owners. Prove recovery: Restore important information from a backup and record any gaps. Keep it running: Schedule recurring reviews of access, updates, backups, and employee reporting procedures. Make Security a Business Habit Cybersecurity becomes more effective when it is part of ordinary operations rather than an occasional emergency. Strong account access, unique passwords, independent verification, timely updates, and tested recovery reinforce one another. None eliminates risk; together, they make common attacks harder and recovery more manageable. Choose one action from the checklist today, assign an owner, and set a completion date. Then repeat the process. Sustainable security starts with practical decisions your business can maintain. ## Why Did We Acquire a Cybersecurity Firm? The Business Case—and What Customers Should Expect - URL: https://bartmcd.com/blog/why-agio-acquired-cybersecurity-firm-business-case - Published: 2026-09-28 An IT-services company can keep systems running without fully addressing the risks those systems create. A cybersecurity firm can identify serious threats without having the authority to fix the underlying technology. Bringing those capabilities together can close an important gap—but only if the integration works. Agio’s documented rationale was preparation for growing cybersecurity threats and regulatory demands. In its January 15, 2020 company announcement , Agio identified its purchase of Secure Enterprise Computing as a 2013 acquisition. This analysis uses that published history as a starting point. The broader question remains relevant: why acquire security expertise, and how should customers judge whether the transaction delivers? Editorial principle: A cybersecurity acquisition should buy more than a broader service catalog. It should create a demonstrably better way to protect, respond, and recover. What an IT-Services Company Is Really Buying The strongest acquisition rationale begins with a specific capability gap. Perhaps the provider can manage infrastructure but lacks incident-response expertise. Perhaps it has security tools but insufficient staff to investigate alerts. Or perhaps customers need governance and regulatory support alongside technical operations. The NIST Cybersecurity Framework 2.0 offers a useful structure: Govern, Identify, Protect, Detect, Respond, and Recover. Map existing services against those functions, identify missing capabilities, and determine which gaps the target actually fills. What matters is the operating capability behind the offering: People: Experienced practitioners with complementary technical and advisory skills. Processes: Repeatable investigation, escalation, remediation, and recovery practices. Evidence: Records showing that services operate as described. Accountability: Clear ownership of decisions and customer outcomes. These assets are not guaranteed to survive a transaction. If essential employees leave or workflows remain disconnected, the buyer may acquire the brand without retaining the capability. The Practical Benefit: Connecting Detection to Action Consider a hypothetical compromised-account incident. A security analyst identifies suspicious activity, but the IT team controls the identity platform. Someone must decide whether to revoke sessions, disable the account, isolate a device, or interrupt a business-critical workflow. When responsibilities are unclear, the incident can stall between detection and action. Common ownership creates an opportunity to reduce those delays—not an automatic solution. Before an incident, the combined provider should establish: Who investigates and validates suspicious activity. Who can take containment actions, under what authorization. Who preserves evidence and informs the customer. Who verifies that recovery is safe and complete. NIST’s incident-response guidance, SP 800-61 Revision 3 , finalized in April 2025, integrates incident response into broader cybersecurity risk management. The acquisition lesson is straightforward: connect preparation, detection, response, and recovery rather than simply combining ticket queues. Why Acquire Instead of Building or Partnering? Acquisition is one route to stronger security services, not the default answer. Compare it with realistic alternatives. Build internally Building allows the provider to shape the service around its customers and operating model. The tradeoff is the work of recruiting specialists, developing procedures, establishing leadership, and sustaining coverage. Hiring talented individuals does not instantly create a functioning security operation. Partner with specialists Partnerships can provide targeted expertise without owning the entire operation. They may be especially useful for occasional or highly specialized needs. The tradeoff is dependency: escalation, access, evidence sharing, commercial terms, and exit arrangements must work across organizational boundaries. Acquire an established capability Buying can bring a team, processes, and customer relationships together under common ownership. But ownership introduces integration costs and retention risk. Model the full investment, including remediation, overlapping tools, training, and transition work—not just the purchase price. Test the downside: If key employees leave or expected cross-selling does not materialize, does the acquisition still support a credible operating plan? Apply Security Due Diligence to the Security Firm A cybersecurity company should not receive a diligence exemption because of its specialty. Its own administrative systems, remote-access tools, subcontractors, and recovery arrangements deserve scrutiny. NIST SP 1326, finalized in July 2026 , provides a current supplier due-diligence starting point covering ownership and influence, provenance, resilience, foundational cybersecurity practices, and supply-chain dependencies. It is not a complete corporate-acquisition playbook, but its categories can help organize technical questions. Request evidence rather than relying on presentations: Identity and access: Privileged-account inventories, access reviews, and authentication controls. Operational security: Vulnerability-management records, incident procedures, and unresolved findings. Resilience: Restoration-test results and dependencies that could interrupt service. Delivery model: Which services employees operate and which depend on subcontractors. Continuity: Key-person dependencies, documented procedures, and retention arrangements. Separately, qualified legal, financial, and transaction advisers should examine liabilities, customer concentration, contract transferability, intellectual property, and commercial obligations. Strong technical diligence cannot substitute for complete deal diligence. Integration Creates Concentration Risk, Too A combined IT and security provider may hold extensive access to customer environments. That access makes coordination possible, but it also makes the provider an attractive attack path. The joint government advisory on threats to managed service providers and their customers recommends measures including multifactor authentication, least privilege, separation of customer environments, and logging. Those controls become especially important when integrating organizations. Do not merge administrative access merely because the deal has closed. Validate identity controls, remote-management paths, customer boundaries, and visibility into provider activity first. For example, replacing separate management platforms with one shared platform may simplify operations. It can also concentrate access and create migration risk. Consolidate only after testing permissions, monitoring, rollback procedures, and customer separation. There is also an assurance tradeoff. The team managing a system should not be its only evaluator. Customers may still need independent assessments to test whether controls work as claimed. What Customers Should Gain—and What Must Be Written Down Customers should expect clearer responsibility, coordinated response, and access to relevant expertise. They should not have to infer service changes from an acquisition announcement. Provide a written explanation of: Scope: What is included, excluded, unchanged, or separately priced. Authority: Whether monitoring includes active containment and who approves disruptive actions. Communication: Incident-notification expectations and escalation contacts. Recovery: What restoration support is included and who validates readiness. Data and exit: How logs, evidence, and access are handled during transition or termination. An acquisition also does not automatically make customers compliant. Security services can support regulatory obligations, but customers still need governance, appropriate legal advice, and evidence that relevant controls operate effectively. Integrate in Stages and Measure the Result Use a risk-based sequence rather than treating closing day as permission to connect everything. Establish the baseline Document capability gaps, critical dependencies, unresolved risks, and essential personnel. Define the conditions that must be satisfied before systems or access are combined. Stabilize and exercise Confirm service ownership and escalation contacts. Run a joint incident exercise that follows a realistic alert through authorized containment and recovery. Record missing permissions and ambiguous decisions. Consolidate selectively Retire overlapping tools only after validating coverage, evidence retention, customer boundaries, and rollback arrangements. Tool reduction is useful only when it does not weaken the service. Measure verified monitoring coverage, elapsed time from a validated alert to authorized containment, overdue remediation, and successful restoration tests. Define scope and establish baselines before claiming improvement. A faster response metric means little if important systems are excluded from monitoring. Cybersecurity Acquisition Success Checklist Use this checklist during deal approval, integration reviews, and customer-service evaluations: The acquisition addresses a documented capability gap. Building and partnering were evaluated as alternatives. The business case includes retention, remediation, and integration costs. Critical expertise has a credible continuity plan. Technical diligence examined the target’s controls and dependencies. Privileged access and customer boundaries were validated before integration. Customers received clear scope and responsibility statements. Incident-response authority and escalation paths were exercised. Recovery was demonstrated through testing. Leadership assigned measurable outcomes and owners for unresolved risks. The Acquisition Is the Beginning, Not the Result Agio’s published explanation points to preparation for cybersecurity threats and regulatory demands. For any comparable acquisition today, the enduring business case is connecting security expertise with the operational ability to act. But the transaction itself proves little. Better protection must show up in clear responsibilities, controlled access, tested response, and reliable recovery. Before approving an acquisition—or accepting a provider’s claims about one—ask for the capability map, responsibility matrix, integration safeguards, and outcome scorecard. Those documents turn a strategic announcement into an accountable delivery plan. ## Brilliance in the Basics #1: The Power of Two-Factor Authentication - URL: https://bartmcd.com/blog/two-factor-authentication-account-security-basics - Published: 2026-09-28 A stolen password should not be enough to unlock your digital life. Yet without another layer of protection, a password exposed through phishing, malware, or reuse can become an attacker’s entry point into your email, finances, or business. Two-factor authentication, or 2FA , changes that equation. It requires additional evidence before granting access—not just knowledge of a password. But enabling it is only the beginning. The method you choose, the prompts you approve, and the recovery options you maintain all matter. The practical goal is straightforward: protect important accounts with the strongest supported authentication method, then make sure you can recover access safely. What Is Two-Factor Authentication? 2FA combines two different categories of evidence: Something you know: a password or PIN. Something you have: a registered security key or an authenticator containing a cryptographic secret. Something you are: a biometric characteristic, such as a fingerprint, used to activate an authenticator. A password plus an authenticator-generated code is a familiar example. Two passwords are not two factors: both belong to the same category. Multifactor authentication, or MFA, is the broader term for authentication using multiple factors. Do not confuse the number of screens with the number of factors. A passkey activated with a device PIN or fingerprint can combine possession and local verification in one streamlined action. NIST’s authentication guidance explains these distinctions. Why 2FA Matters—and Where Its Protection Ends Consider a reused password exposed through an unrelated service. An attacker tries it against your email account. With password-only access, that may be enough. With properly configured 2FA, the attacker must also satisfy the additional authentication requirement. That protection matters because email often controls password resets for other accounts. One compromised inbox can put much more than messages at risk. However, 2FA is not a universal shield. Fake sign-in pages can capture and relay verification codes. Repeated approval prompts can pressure someone into accepting a fraudulent request. Malware can steal an active session, allowing an attacker to bypass a fresh login. Strong authentication complements—not replaces—unique passwords where still required, updated devices, and secure recovery procedures. Which Authentication Method Should You Choose? CISA recommends the strongest available MFA method , with phishing-resistant authentication as the preferred option. Here is how the common choices compare. Passkeys: Strong Protection with Less Friction Passkeys use cryptographic credentials bound to the legitimate service rather than a password or code you type into a website. That design makes them resistant to credential phishing. A passkey may replace the password-and-code sequence entirely. FIDO Alliance guidance distinguishes synced passkeys, available across devices through a provider, from device-bound credentials that remain on a particular device. Synchronization can simplify device replacement, but makes the provider account and its recovery protections important. Device-bound credentials require deliberate backup planning. FIDO Security Keys: A Physical, Phishing-Resistant Option A compatible FIDO security key can provide phishing-resistant authentication and may store passkeys. It is particularly useful for administrators and other high-impact accounts. The tradeoffs are hardware cost, device compatibility, and the possibility of loss. Where supported, enroll a spare and keep it separately. Authenticator Codes: Useful, but Still Phishable Authenticator apps generate codes without depending on text-message delivery. They are a practical alternative when phishing-resistant methods are unavailable. However, an attacker can trick you into entering a current code on a fake page and relay it immediately. Push Notifications: Prefer Number Matching Number matching makes accidental approval harder than a simple “Approve” button. It does not make push authentication phishing-resistant. Approve only a sign-in you initiated and whose details match your activity. SMS and Voice Codes: Better Than Password-Only Access Phone-based codes are accessible, but vulnerable to phone-number takeover and code phishing. If SMS is the only option, use it rather than leaving the account password-only. Move to a stronger method when available. Evaluate the actual feature, not just the app’s name. One authenticator app may offer codes, push approval, and passkeys with different security properties. How to Enable 2FA Without Creating a Lockout 1. Start with Accounts That Control Other Accounts Prioritize your primary and recovery email, password manager, and core Apple, Google, or Microsoft account. Then protect financial services, work accounts, cloud storage, and other valuable accounts. This is a rollout order, not a reason to leave the rest unprotected. 2. Open the Service Directly Use the official app or navigate to the website yourself—not through an unexpected security message. Look under Security, Sign-in, Two-factor authentication, or Two-step verification. Google: Follow the 2-Step Verification setup guide ; managed accounts may require administrator assistance. Microsoft: Use the personal account’s security settings and two-step verification instructions . Apple: Check your account’s Sign-In & Security settings using Apple’s 2FA guidance . Protection may already be enabled. 3. Complete Enrollment and Test It Installing an authenticator does not protect an account automatically. Register it through each service’s settings. For code-based authentication, this commonly means scanning the service’s QR code, then entering a generated code to confirm setup. Treat that QR code and its setup secret as credentials. Keep your existing session open while testing a fresh sign-in in a separate private browser window. Confirm the new method works before removing an old one. A remembered device may not request verification every time; review the account’s settings to confirm protection is enabled. Recovery Is Part of Security Strong authentication needs a backup route that keeps you in without making it easy for an attacker to follow. Save backup codes somewhere you can reach without the locked account. A printed copy in a secure location is one option. Do not store your only recovery copy inside the account it unlocks. For Google, each backup code works once, and generating a new set invalidates the previous set, as its backup-code guidance explains. Understand synchronization before replacing a phone. Authenticator backup behavior varies. Google Authenticator supports synchronization, while transferring unsynchronized codes requires the old device. Review the official transfer instructions before erasing or trading in a phone. Avoid circular recovery. If restoring your authenticator requires signing into an account that demands the unavailable authenticator, you need an independent alternative. A separately stored security key or recovery code can help where supported. If a device disappears, use your backup route, revoke missing credentials where applicable, and follow the provider’s lost-device instructions. Review fallback methods too: an easily manipulated recovery process can undermine excellent authentication. How to Handle an Unexpected Approval Request Imagine receiving a work-account approval prompt while you are not signing in. Deny it—even if another prompt follows. Do not approve it to stop the interruptions, and never read sign-in codes to an unsolicited caller claiming to be support. Open the service independently, review account activity, and report work-account requests to IT. If you find unauthorized access, secure the account and revoke suspicious sessions. Number matching helps reduce mistaken approvals, but CISA treats it as an interim defense , not a substitute for phishing-resistant MFA. For Business Leaders: Enforce It and Protect Recovery Offering MFA is not the same as requiring it. Prioritize administrators, email, remote access, file storage, and users handling sensitive information. Prefer phishing-resistant methods and verify that policies cover contractors and the actual applications people use. Check for legacy sign-in paths and weaker fallback options that bypass your intended controls. Document lost-device procedures, credential revocation, and account resets. Support staff need a verification process they will not abandon because a caller sounds urgent or authoritative. Rollout success means more than enrollment: employees can authenticate, recovery works safely, and exceptions have clear owners and review dates. Your Practical 2FA Checklist Inventory important personal and business accounts. Enable 2FA or MFA wherever supported. Prefer passkeys or FIDO security keys. Use authenticator codes or number matching when stronger options are unavailable. Complete enrollment and test a fresh sign-in. Store backup codes securely, outside the locked account. Register an independent backup method where supported. Test replacement-device access before erasing the old device. Deny unexpected prompts and protect verification codes. For businesses, verify enforcement and document secure recovery. Make the Basic Protection Standard Practice Brilliance in the basics means doing foundational security well—not merely checking a box. Two-factor authentication can stop a stolen password from becoming immediate account access. Phishing-resistant methods strengthen that protection, while thoughtful recovery keeps it usable. Start with your primary email today. Choose its strongest supported method, complete enrollment, test access, and establish a safe backup. Then repeat that process across the accounts your life and business depend on. ## Detection and Response First, Prevention Second: A Practical Cybersecurity Strategy - URL: https://bartmcd.com/blog/detection-response-first-cybersecurity-strategy - Published: 2026-09-28 Imagine a finance employee’s account is compromised overnight. Multifactor authentication is enabled, but the attacker has obtained a usable session token. No malware needs to run on the employee’s laptop. The warning signs may appear in identity logs, mailbox changes, or unusual access to sensitive files. Would your organization recognize those signals? Who would investigate them? Could that person contain the compromise without waiting until morning? That is the point of “detection and response first, prevention second.” It is not an instruction to weaken prevention. It is a challenge to build security around what happens when prevention fails—not merely around the hope that it will succeed. A Planning Principle, Not a Spending Formula Prevention reduces the likelihood of compromise. Detection identifies suspicious activity. Response investigates and limits harm. Recovery restores trustworthy operations. An effective program needs all four, supported by governance and a clear understanding of business risk. The NIST Cybersecurity Framework 2.0 treats Govern, Identify, Protect, Detect, Respond, and Recover as concurrent, continuous functions. They are not sequential stages, and the framework does not prescribe a detection-first budget allocation. “First” should therefore mean asking how your organization will discover and handle a failure before deciding that another preventive purchase completes the job. Detection without response produces alerts. Response without recovery can leave the business contained but unable to operate. Plan for safeguards to fail. Keep strengthening those safeguards. Prove that someone can recognize the failure and act. Keep the Prevention Baseline Nonnegotiable A monitoring service cannot compensate for every avoidable exposure. Maintain these foundations while developing response capabilities: Strong authentication: Require MFA, particularly for privileged and remote access, and prioritize phishing-resistant methods. CISA’s MFA guidance provides a practical starting point. Risk-based remediation: Address actively exploited vulnerabilities and exposed critical systems promptly. Use CISA’s Known Exploited Vulnerabilities catalog alongside asset importance and exposure—not severity scores alone. Restricted access: Apply least privilege, secure configurations, controlled administrative access, and appropriate network segmentation. Protected recovery resources: Maintain offline or appropriately isolated backups, protect their administrative access, and test restoration. Follow the preparation recommendations in the CISA #StopRansomware Guide . Fix an immediate, material exposure immediately. Otherwise, direct the next investment toward the most consequential weakness across prevention, detection, response, and recovery. A rigid spending ratio cannot make that decision for you. Build an Operating Capability, Not an Alert Collection 1. Start with business consequences Identify the services whose interruption, manipulation, or disclosure would seriously harm the organization. Document their owners, important data, administrative identities, technology dependencies, and restoration priorities. Then select realistic scenarios: a compromised finance account, ransomware affecting order processing, or misuse of a cloud administrator account. For each, ask what evidence would reveal the problem, who would investigate, and which action would limit damage. This connects security work to business outcomes. The objective is not simply to detect an unusual login; it is to prevent that access from becoming fraudulent payments, data theft, or prolonged disruption. 2. Collect evidence you can actually use Start with identity events, endpoint security activity, cloud administrative changes, and logs from critical applications and network devices. Include relevant software-as-a-service platforms; endpoint visibility alone will not explain every account-based compromise. Joint government logging guidance emphasizes trustworthy timestamps, centralized collection, protected logs, and an enterprise logging policy. Attackers may alter local evidence, so the compromised system should not hold the only copy. Choose retention periods based on investigation needs, applicable obligations, privacy, and cost. Monitor whether expected logs are arriving. A dashboard with no alerts may indicate quiet operations—or broken collection. Tradeoff: Retaining useful evidence does not require sending every record into an expensive analytics platform. Government SIEM ingestion guidance recommends prioritizing sources by their purpose and analytical value. 3. Make detections actionable Build a manageable set of detections tied to your scenarios. Candidate signals might include: Account misuse: Unexpected authentication followed by a mailbox forwarding rule or privilege change. Endpoint compromise: Suspicious process activity combined with attempts to disable security controls. Cloud administration abuse: Unapproved permission changes or the disabling of audit logging. These are investigation hypotheses, not production-ready rules. Legitimate work can generate similar events. Correlate signals, establish context, and validate detections safely in your environment. Every important alert needs an owner, investigation instructions, escalation criteria, and an expected response time. Tune unnecessary alerts without silently removing coverage for the underlying risk. 4. Establish authority before the emergency In the hypothetical finance-account incident, responders may need to revoke active sessions, reset credentials, inspect mailbox rules, review access, and coordinate with finance on suspicious payment requests. A password reset alone should not be assumed to terminate every form of access. Who can authorize those actions? Who covers the role after hours? What happens if the account supports an essential workflow? Government incident-response planning guidance emphasizes roles, escalation, communications, and provider responsibilities. Document evidence-preservation procedures and when to involve legal counsel, insurers, or external responders. Keep contacts and essential instructions accessible if normal systems are unavailable. Tradeoff: Fast containment can interrupt legitimate operations. Pre-authorize narrowly scoped actions where appropriate, but require operational review for measures that could disrupt critical or safety-related services. Automation needs tested boundaries, not blanket authority. 5. Demonstrate recovery A successful backup job is not proof of recoverability. Restore a representative service in a controlled environment and verify its data, configuration, identity dependencies, and business functionality. Agree with the service owner on acceptable downtime and data loss before testing. Measure restoration through business acceptance—not merely until a server starts. Recovery should also address the compromise that caused the incident; restoring an exposed system without remediation invites repeat failure. NIST SP 800-61 Revision 3 integrates incident response with broader risk management. Use exercise and incident findings to improve preventive controls as well as response procedures. Buy Tools and Services Around Responsibilities A security information and event management platform, or SIEM, supports log analysis. Endpoint detection and response, or EDR, provides endpoint visibility and response capabilities. Managed detection and response, or MDR, adds a service layer. None of those labels establishes exactly what your organization receives. Before purchasing, ask: Which identities, devices, applications, and cloud services are covered? Who investigates outside business hours? Does the service notify, investigate, contain, or perform all three? Which actions require customer approval, and who can provide it? Can you access and export evidence? Who detects monitoring failures? How will the complete arrangement be tested? Joint guidance for managed service providers and customers recommends explicitly allocating security responsibilities. Outsourcing work does not eliminate the need for an accountable internal owner. A Practical 90-Day Starting Plan This is a suggested implementation schedule, not a regulatory deadline. Adapt it to your organization, and never postpone urgent remediation to fit the calendar. Days 1–30: Identify critical services, address urgent exposures, assign response roles, and assess logging gaps. Days 31–60: Connect priority evidence sources, validate initial detections, approve playbooks, and confirm provider responsibilities. Days 61–90: Exercise the complete path from test event to investigation, containment, and recovery. Assign corrective actions and retest them. Measure validated coverage, alert acknowledgment, verified containment, business-accepted recovery, and corrective-action completion. Define each measurement’s start and end points. Faster alert handling is not necessarily better security if responders close cases without establishing scope. Detection and Response Readiness Checklist For each item, record an owner, supporting evidence, and the last test date. An untested assumption is not a completed control. Critical services, dependencies, and business owners are documented. MFA, access restrictions, and urgent vulnerability remediation are maintained. Priority logs are arriving, searchable, protected, and retained appropriately. Detection scenarios have been safely validated. Important alerts reach a responsible person after hours. Containment authority and operational exceptions are documented. Internal and provider responsibilities are explicit. Contacts and procedures remain available during an outage. A representative service has been restored and business-validated. Exercise findings have owners, deadlines, and retest criteria. Make the Next Investment Close a Real Gap Detection and response first is a corrective to incomplete planning—not an argument against prevention. Prevent what you reasonably can. Discover what gets through. Give responders the authority to act. Prove that recovery works. Start this week with one critical service and one realistic compromise scenario. Walk through who notices, who decides, who acts, and how operations resume. Fund the most consequential gap that exercise reveals—not simply the next product promising stronger protection. ## Brilliance in the Basics: An Essential Cybersecurity Guide for Everyone - URL: https://bartmcd.com/blog/cybersecurity-basics-guide-secure-your-digital-life - Published: 2026-09-28 Your email, phone, bank accounts, and family photographs may feel like separate parts of your digital life. In practice, they are connected. Your inbox receives password-reset links. Your phone approves sign-ins. Your cloud account holds documents you cannot easily replace. Protecting those connections does not require becoming a cybersecurity expert or buying every security product advertised. It requires doing a few important things consistently—and knowing how to recover when something fails. Brilliance in the basics means prioritizing protection over complexity. Start with your most important accounts, strengthen your sign-ins, keep devices supported, verify unexpected requests, and maintain backups you can actually restore. 1. Secure Your Email First Your main email account is often the recovery route for other accounts. Someone who controls it may intercept password resets and use your identity to deceive your contacts. That makes email a sensible starting point, as the UK National Cyber Security Centre explains . Use a strong, unique password if the account still requires one. Enable a passkey or the strongest available multifactor authentication. Confirm that recovery phone numbers and email addresses belong to you. Review signed-in devices, connected applications, and forwarding rules. Remove unfamiliar access. Next, protect your password manager, primary device or cloud account, and financial accounts. Prioritize accounts that could unlock others or cause serious disruption if lost. 2. Stop Reusing Passwords A password can be long and complicated yet still create risk if you reuse it. When one service exposes a password, attackers can try that same credential elsewhere. A password manager makes unique passwords practical. It generates and stores credentials so you do not have to memorize each one. NIST recommends using a password manager rather than relying on memory alone. Replace reused passwords on important accounts first. Let the manager generate long, random passwords. For a password you must remember, favor a long passphrase without predictable personal information. Adding a new digit to an old password is not a meaningful reset. The tradeoff: A manager concentrates valuable credentials. Protect it with a strong master password, MFA where supported, and a recovery plan. Do not change strong, unique passwords simply because the calendar changed. NIST’s authentication guidance rejects arbitrary periodic changes ; change compromised or exposed passwords promptly and follow applicable workplace requirements. 3. Choose Stronger Sign-Ins—and Plan for Recovery Multifactor authentication adds another requirement beyond a password, but different methods provide different protection: Passkeys and FIDO security keys: Provide phishing-resistant authentication tied to the legitimate service. Authenticator-app codes: Add protection, but a convincing fake website can still trick you into submitting a code. Text-message codes: Better than a password alone when stronger options are unavailable, but vulnerable to phishing and phone-number takeover. A passkey replaces a typed password with cryptographic credentials. You generally approve its use by unlocking a device or security key with a PIN or biometric check. Some passkeys synchronize through a provider; others stay on one device or hardware key. Synchronization improves convenience but makes protecting the provider account important. Device-bound credentials require planning for loss or replacement. Before changing sign-in methods, check your recovery options, register an additional authenticator where supported, and store recovery codes securely offline. Do not keep your only recovery route inside the account you might lose. Never approve an unexpected sign-in prompt. Phishing-resistant does not mean scam-proof. Strong authentication cannot stop you from being persuaded to send money or install malicious software. 4. Verify Requests Instead of Judging Appearances A polished message, familiar logo, or convincing voice is not proof of identity. The safer habit is independent verification. Suppose a text says your bank account is frozen. Rather than following its link, open the banking app yourself. If a caller requests a transfer, hang up and call the number on your card—not the number the caller provides. The FTC’s phishing guidance supports this approach: contact the organization through a website or phone number you already know is genuine. Pause: Urgency is a reason to check, not rush. Switch channels: Use a known app, saved bookmark, or trusted number. Protect credentials: Do not share passwords, recovery codes, or sign-in codes with someone who contacts you. Report: Use the service’s reporting feature or your workplace security process. The FTC also warns about AI-assisted family-emergency scams . If a familiar-sounding voice urgently requests money, call that person independently or contact another trusted relative. Establish this household rule before an emergency happens. 5. Keep Devices Supported, Updated, and Locked Turn on automatic updates for operating systems, browsers, apps, and security software. Complete required restarts; an update waiting indefinitely is not helping you. Use a strong screen-lock PIN or password, keep built-in security protections enabled, and download software from official stores or developers’ genuine websites. Remove applications you no longer use. Check support status, not just whether a device still works. A functioning phone, computer, or router may no longer receive security fixes. The NCSC’s device guidance emphasizes keeping devices protected and updated. You do not need the newest model; you need a supported one. Schedule updates around important tasks instead of postponing them indefinitely. For employer-managed equipment, follow your organization’s approved process. 6. Back Up What You Cannot Replace Start with family photographs, important records, and essential documents. Automate backups where practical and keep an independent copy separate from the original. Cloud synchronization alone is not a complete backup strategy. A synchronized deletion or unwanted change may reach other devices. Version history can help, but retention limits and account access still matter. The NCSC recommends an independent copy of critical data . Check how your service handles deleted files and previous versions. Disconnect removable backup drives when they are not being used. Encrypt sensitive backups and store recovery keys securely. Periodically restore several files and confirm that they open. Cloud backups reduce manual effort but depend on account access and provider policies. External drives offer separation but require a reliable routine. Choose an approach you can maintain—and test. A successful backup notification is useful; a successful restore is better evidence. 7. Give Your Home Network Basic Attention Change the router’s default administrator password, use a separate strong Wi-Fi password, enable WPA3 Personal where supported or WPA2 Personal, and keep router software updated. Disable remote administration if you do not need it. These steps align with FTC home-network guidance . A guest network can separate visitors and connected devices from your main network, depending on its settings. Test features such as printing and casting afterward. Public Wi-Fi deserves perspective: widespread encryption means it is not automatically unsafe. But HTTPS protects the connection, not the honesty of the website . A scam site can be encrypted, too. 8. Know Your First Moves After an Incident Respond to what happened, using a trusted device if yours may be compromised: An account was taken over: Use the provider’s official recovery process. Reset credentials, end other sessions where possible, correct recovery details, and remove unfamiliar email-forwarding rules. Warn contacts about fraudulent messages. You installed suspicious software or granted remote access: Disconnect the affected device from the network and stop following the sender’s instructions. Seek trusted help. For a work device, contact IT promptly rather than attempting an unapproved cleanup. You sent money: Contact the bank or payment provider immediately. Explain what happened and ask whether the payment can be stopped or reversed. Recovery is not guaranteed. Your identity information was misused: Visit IdentityTheft.gov for U.S. recovery guidance. Report scams at ReportFraud.ftc.gov . The FTC’s scam-response guide provides additional steps. Consider a free credit freeze separately at Equifax, Experian, and TransUnion. Freezes help prevent new-account fraud; they do not secure existing accounts. Your Cybersecurity Basics Checklist Start today Secure your main email and verify its recovery details. Enable stronger authentication and save recovery codes. Install pending security updates. Work through this week Replace reused passwords using a password manager. Create an independent backup and test a restore. Check device support and router settings. Agree on a family callback rule for urgent requests. Revisit regularly Confirm updates and backups are completing. Review recovery options, account access, and financial activity. Make the Basics a Routine Effective cybersecurity is not a one-time purchase. It is a manageable set of habits that reduces exposure and makes recovery possible. Start with your primary email today. Then strengthen your other important accounts, test a backup, and discuss independent verification with your household. Brilliance in the basics means doing the important things reliably—not trying to do everything at once. ## Why You Need a Password Manager: A Cybersecurity Must-Have - URL: https://bartmcd.com/blog/why-you-need-a-password-manager - Published: 2026-09-28 A password manager makes one of cybersecurity’s most important habits practical: using a different, strong password for every account. Instead of remembering dozens of credentials—or recycling one familiar password—you let software generate, store, and retrieve them from a protected vault. Consider an everyday scenario: you use the same password for an online store and your primary email. If the store’s credentials are stolen, an attacker can try them against your email, potentially gaining access to password-reset messages for other accounts. A unique password helps break that chain. The goal is not simply to install an app. It is to choose a trustworthy manager, protect its access, and prepare for recovery before you need it. Why Unique Passwords Matter More Than Clever Passwords A complicated password is not enough if you reuse it. Attackers can test credentials stolen from one service against others, a technique called credential stuffing . Adding a different year or website name to a familiar password is not a dependable substitute for generating an independent credential. A password manager removes the memorization problem. It can create a long, random password for each account and retrieve it when needed. CISA recommends password managers for creating and remembering strong passwords. This approach also aligns with current standards. NIST’s final SP 800-63B-4, published in July 2025 , requires covered password-verification systems to permit password managers and autofill. That requirement applies to systems within the guidance’s scope—not automatically to every website. The objective is not a better password to reuse. It is a unique password for every account, without relying on memory. Is Keeping All Your Passwords in One Place Safe? A password vault is a valuable target. If someone gains access to its readable contents, multiple accounts can be exposed. Software vulnerabilities, weak vault protection, and compromised devices are real concerns. But the relevant comparison is not a password manager versus perfect security. It is a well-protected manager versus your actual alternative: reused passwords, predictable variations, or unsecured notes. The UK National Cyber Security Centre concludes that password managers’ benefits outweigh their risks , while emphasizing careful selection. Protection requires several layers: Vault encryption: Understand how the provider protects stored credentials and who can decrypt them. Strong access controls: Use a unique master passphrase where applicable and enable supported multifactor authentication, or MFA. Device security: Keep software updated, lock your devices, and avoid opening your vault on untrusted computers. MFA helps protect account sign-in. It does not necessarily prevent offline attacks against a stolen encrypted vault, nor does it neutralize malware on an unlocked device. Encryption design and endpoint security still matter. How to Choose: Built-In, Cloud-Synced, or Local? You do not automatically need another subscription. Choose a storage model and workflow you can use consistently. Browser or operating-system managers Built-in tools offer convenient integration and may already meet your needs. For example, Apple’s Passwords app supports passwords, passkeys, and autofill . Check compatibility across every device and browser you use, along with recovery and export options. Cloud-synced standalone managers These can simplify access across platforms and provide family or business sharing. The tradeoff is dependence on the provider’s security architecture, service availability, and account-recovery design. Synchronization is convenient, but it is not automatically a substitute for a recovery plan or backup. Local vaults A local vault gives you more control over where the database resides. You also take responsibility for backups, synchronization, and recovery. A lost laptop should not mean losing your only vault copy. Local storage does not make malware or device theft irrelevant. Before choosing, review security documentation, independent assessments where available, update practices, export support, and recovery rules. An audit is useful evidence—not a guarantee. For work accounts, use the organization’s approved manager and sharing process rather than a personal workaround. Set Up Your Password Manager Safely 1. Secure the vault before filling it If the manager uses a master password, create a long, unique passphrase. Do not reuse your email password. Enable MFA when supported and configure automatic locking. Prefer phishing-resistant authentication, such as a supported security key. An authenticator app is another useful option; text-message codes are better than no second factor but carry risks such as phone-number takeover. The FTC explains these authentication tradeoffs . 2. Plan for losing your phone or forgetting your password Do not keep your only recovery information inside the vault it must unlock. Follow the provider’s instructions and store recovery codes, emergency documents, or backup keys somewhere protected and independently accessible. Ask what happens if you lose every signed-in device. Can you recover access? What information is required? Do not assume customer support can decrypt your vault. Walk through the documented process before an emergency. 3. Import carefully—and clean up afterward Use the documented migration process and verify important entries before retiring your old manager. Confirm that passwords, website addresses, and essential notes transferred correctly. Exports deserve special care. Bitwarden’s export guidance , for example, distinguishes plaintext files from encrypted exports. Do not email an unencrypted password file to yourself. Remove temporary exports after confirming the migration, including unnecessary copies in synced folders or trash. 4. Replace reused passwords, starting with critical accounts Importing a weak password does not strengthen it. Prioritize primary email, financial services, work accounts, and accounts that control recovery for others. Generate a unique password, complete the change on the actual website, and confirm the manager saved the new credential. At least 16 randomly generated characters is a practical default where supported—not a universal compliance requirement. Use longer passwords when practical and follow each service’s constraints without reusing the result. 5. Decide where verification codes belong Some managers store authenticator codes alongside passwords. That is convenient, but access to a readable vault may then expose both. A separate authenticator or security key provides greater separation. For high-value accounts, weigh that benefit against the additional recovery responsibilities. Use Autofill as a Helpful Check, Not a Guarantee Password managers typically associate credentials with website addresses. That can help you avoid entering a password on an unrelated phishing domain, but behavior depends on the product and settings. Bitwarden’s documentation illustrates different matching modes and their limitations. If your bank’s saved login suddenly does not appear, pause before copying the password manually. Check the address and, if uncertain, open the bank through a trusted bookmark or app. An autofill failure does not prove phishing, and a suggestion does not guarantee safety. Keep matching rules appropriately restrictive and avoid automatic filling on page load where your manager offers that control. Do Passkeys Make Password Managers Unnecessary? Not yet for most people. Passkeys use cryptographic credentials and provide phishing-resistant sign-in . They can be synchronized through a credential provider or remain tied to a device, including a security key. Some password managers also store passkeys. Use passkeys where supported, while keeping unique passwords for services that still require them. Before relying on a passkey, understand how you will sign in after losing a device and whether it works across your platforms. Verify transfer options before switching providers. A strong sign-in method also needs a strong recovery process. Review any remaining password fallback and account-recovery settings. What to Do After a Compromise Routine password changes are not a substitute for unique credentials. NIST advises covered systems against requiring periodic changes without evidence of compromise. If an account is compromised, change its password from a trusted device, revoke unfamiliar sessions, and review MFA and recovery settings. For email, inspect forwarding rules and filters. The FTC’s account-recovery guide explains these steps. If vault contents may have been exposed, follow the provider’s incident guidance. Changing only the master password does not invalidate passwords already stolen from individual accounts. Replace affected credentials and review exposed recovery codes or other secrets. Your Password-Manager Checklist Confirm compatibility with your devices and browsers. Understand encryption, storage, export, and recovery options. Protect the vault with unique credentials and supported MFA. Store recovery material securely outside the vault. Verify imported entries and remove temporary plaintext exports. Replace reused passwords, prioritizing critical accounts. Enable passkeys or stronger MFA where available. Review autofill settings, device updates, and automatic locking. Check recovery arrangements after changing devices or providers. Start With Your Most Important Account A password manager is a cybersecurity must-have because it makes safer behavior sustainable—not because it eliminates every threat. Start today: choose a suitable manager, secure its access, and document recovery. Then give your primary email a unique password and enable strong authentication. Work through your remaining accounts from there. Consistent, recoverable protection is more valuable than another clever password you will eventually reuse. ## Spear Phishing: A Threat to Hedge Funds and Private Equity Firms - URL: https://bartmcd.com/blog/spear-phishing-hedge-funds-private-equity - Published: 2026-09-28 A private equity deal is approaching closing. An email arrives in an existing conversation with counsel: the receiving bank account has changed, and the wire must leave immediately. The names, documents and timing all look right. This is an illustrative scenario, not a documented incident. But it captures the central danger: attackers exploit trusted relationships and legitimate business pressure to make fraudulent instructions seem routine. For hedge funds and private equity firms, defending against spear phishing requires more than teaching employees to spot suspicious emails. It requires controls that protect payment instructions, investor information and deal communications—even when a trusted account is compromised. A convincing message should never be enough to change where money goes. How Spear Phishing Becomes Financial Fraud Spear phishing is targeted deception. Rather than sending an identical lure to everyone, an attacker tailors a message to a person, organization or transaction. The objective may be stealing credentials, obtaining confidential documents or persuading someone to authorize a payment. Business email compromise, or BEC, is a related fraud category involving apparently legitimate business communications. As the FBI explains , criminals may impersonate trusted senders, use spear phishing to compromise accounts or access genuine email conversations before introducing fraudulent instructions. Malware is not always necessary. The FBI’s 2025 IC3 Annual Report records approximately $3.05 billion in reported BEC losses. That is a broad, complaint-based figure—not a measurement of hedge fund or private equity losses. The operational lesson is nevertheless relevant: account security and financial controls must work together. Where Fund Workflows Are Exposed The following examples are illustrative planning scenarios , not accounts of actual attacks: Capital calls: An apparent fund administrator sends limited partners revised funding instructions. Establish the verification process with investors before issuing calls, including how to confirm bank-detail changes independently. Redemptions and distributions: Someone impersonating an investor requests payment to a replacement account. Authenticate the request separately and require independent approval of beneficiary changes. Acquisition closings: An apparent lawyer sends urgent replacement wiring instructions. Agree on payment details, authorized contacts and escalation procedures before closing day. Investor onboarding: A fake document portal requests identity documents or tax information. Access approved portals independently rather than through unexpected links. Portfolio-company payments: A message apparently from the sponsor demands a confidential transfer. Sponsor and executive requests must follow ordinary payment controls. These risks extend beyond stolen money. A compromised mailbox may expose investor records, negotiations and transaction schedules that make subsequent fraud more convincing. Six Controls That Reduce the Risk 1. Independently Verify Sensitive Instructions The FBI’s IC3 guidance recommends a secondary channel to verify changes to account information. Build that requirement into payment procedures, rather than leaving verification to individual judgment. Contact an authorized person using a previously established number—not one supplied in the new request. Record who confirmed the instruction, when and through which channel. Require a separate approver to review the beneficiary change and payment. If verification fails, hold the transaction and escalate. Tradeoff: Verification takes time. Maintain backup contacts and approvers before busy periods instead of creating deadline-based exceptions. A second approval offers little protection if both reviewers rely on the same fraudulent email. 2. Deploy Phishing-Resistant MFA Prioritize email, administrative access, finance personnel and executives for phishing-resistant multifactor authentication. CISA recommends phishing-resistant MFA , including FIDO/WebAuthn-based methods. SMS codes and basic push approvals do not provide equivalent protection. Where stronger authentication cannot yet be deployed, number matching is an interim improvement over simple push approval. Also review legacy authentication, enrollment and account-recovery processes: weak fallback methods can undermine a strong primary login. Tradeoff: Deployment requires compatibility testing and lost-device planning. MFA also does not authorize a transaction or eliminate every account-compromise path, so retain payment verification and monitoring. 3. Authenticate Email Domains—Without Overtrusting Them SPF, DKIM and DMARC help receiving systems evaluate whether messages are authorized to use a domain. Follow a staged rollout: inventory legitimate senders, monitor authentication results, correct failures and move toward enforcement. Microsoft’s DMARC guidance explains that progression. Include administrator communications, investor-relations platforms and other services sending on the firm’s behalf. Tradeoff: Premature enforcement can disrupt legitimate messages. More importantly, DMARC does not establish that payment instructions are genuine. A compromised legitimate account can send authenticated email, while a lookalike domain may authenticate successfully for its own domain. 4. Monitor Account Changes, Not Just Incoming Email An attacker with mailbox access may create forwarding rules, hide replies or grant application access. Microsoft’s compromised-account guidance identifies authentication methods, application permissions, inbox rules, forwarding and audit records as investigation priorities. Ask IT or the security provider to demonstrate how suspicious changes are detected, who reviews alerts and who can contain an account after hours. Confirm that relevant logs are retained and accessible. Tradeoff: Additional monitoring creates noise and operating costs. Prioritize actionable detections with named owners; collecting alerts without responding to them is not a functioning control. 5. Define Responsibilities With Service Providers Fund administrators, law firms and outsourced technology providers participate in workflows attackers can exploit. Document who can change bank details, who verifies changes, who approves payments and who executes them. Agree on incident escalation, evidence access and investor communications before an incident. Ask providers to explain their controls with supporting evidence, not simply confirm that they have a security policy. Tradeoff: Providers may use different systems and procedures. Establish minimum requirements and resolve gaps explicitly. For portfolio companies, set appropriate expectations without assuming every business has the same resources or legal obligations. 6. Train for Decisions, Not Spelling Mistakes Warning signs include changed beneficiaries, unusual secrecy and attempts to bypass normal approvals. Polished language is not proof of legitimacy. The 2025 IC3 report describes AI-generated messages and voice cloning in BEC schemes; a familiar-sounding voice should not replace established verification procedures. Practice capital-call revisions, redemption changes and closing-day requests. Measure whether employees report promptly, use trusted contact information and resist executive exceptions—not only whether they click. Tradeoff: Exercises consume staff time. Keep them role-specific and reward rapid reporting, including when someone has already made a mistake. What to Do When an Attack May Have Succeeded If money was sent, contact the originating bank immediately. IC3 recommends requesting a recall or reversal and discussing necessary indemnification documentation. File a detailed IC3 complaint with transaction and banking information. Do not wait for the internal investigation to finish; recovery is not guaranteed. In parallel, activate the incident-response process: Contain access: Have authorized responders disable affected accounts or block access, revoke sessions and secure credentials and authentication methods. Remove persistence: Investigate unauthorized forwarding, inbox rules and application permissions. A password reset alone is insufficient. Preserve evidence: Retain original messages, transaction records and relevant logs while urgent containment proceeds. Protect the workflow: Suspend affected instructions and communicate through trusted channels outside compromised accounts. Coordinate decisions: Involve the incident lead, finance, compliance and counsel to assess disclosures and verified warnings to counterparties. Stopping a fraudulent wire does not establish that investor information remained private. Investigate what the attacker accessed and changed throughout the suspected compromise period. Regulation S-P: A Current Compliance Consideration For SEC-registered investment advisers, amended Regulation S-P requires written incident-response policies and procedures addressing unauthorized access to or use of customer information. The SEC’s compliance guide identifies compliance dates of December 3, 2025, for larger entities and June 3, 2026, for smaller entities. Both have passed as of September 2026. Where notification is required, notice generally must be provided as soon as practicable, but no later than 30 days after awareness of actual or reasonably likely unauthorized access to or use of customer information. Counsel should assess applicability, investigation-based exceptions, service-provider requirements and other obligations. Do not assume every private fund, investor relationship or portfolio company has identical requirements—or treat a notification deadline as permission to delay containment. A Practical Spear-Phishing Readiness Checklist Every bank-detail change receives independently documented verification. Trusted contact information is maintained separately from incoming instructions. Beneficiary changes and payments receive separate approval. Executive requests cannot bypass established controls. High-risk users have phishing-resistant MFA and secure recovery procedures. Legitimate email senders are inventoried and DMARC enforcement is managed. Suspicious account changes have monitoring owners and escalation paths. Provider responsibilities and incident contacts are documented. Bank fraud contacts and responders are reachable after hours. Counsel has mapped notification obligations, and tabletop exercises test the process. Make Verification Part of Doing Business Spear phishing succeeds when trust in a message substitutes for authorization. Technical defenses reduce exposure, but disciplined workflows prevent one deceptive request or compromised account from becoming a financial loss. Start with your next high-value payment. Ask the CFO, COO, compliance lead and security provider to demonstrate how an unexpected instruction would be verified, challenged and contained. Fix any gap before the next capital call, redemption or closing—not during it. ## Ransomware Prevention Simplified: Protect Your Files and Your Business - URL: https://bartmcd.com/blog/ransomware-prevention-protect-files-and-business - Published: 2026-09-28 Imagine opening your laptop and discovering that your invoices, family photos, or customer records will no longer open. Now imagine that the backup drive connected to that laptop has been encrypted, too. That is why ransomware prevention requires more than installing security software. The practical approach is to prevent access, contain damage, and prepare for recovery. Individuals and small businesses can make meaningful progress without an enterprise-sized budget—but the order of operations matters. Ransomware can lock files and disrupt systems. Attackers may also steal information and threaten to publish it. Backups can help restore operations; they cannot reverse data theft. Your defenses need to address both risks. Start with the essentials: protect your accounts, update your systems, and prove that you can restore your important files. 1. Build Backups That Can Survive an Attack A successful backup notification is not proof that you can recover. The real question is whether a usable copy will remain available after an attacker compromises your device—or your administrator account. The UK National Cyber Security Centre’s ransomware guidance recommends keeping backups separate from everyday systems and testing restoration. Keep multiple copies. Include at least one offline or otherwise isolated recovery copy. Disconnect external drives after backing up. A permanently connected drive can become another target. Check cloud recovery features. File synchronization can propagate encrypted or deleted files. Verify version history, retention, and protection against deletion. Test a restore. Recover selected files into a separate location and confirm that they open correctly. For a household, this might mean cloud backup plus a disconnected external drive. A business also needs to test application recovery: restoring accounting files is not enough if the software, credentials, or configuration needed to use them are missing. Ask your provider whether a compromised administrator could delete every backup. The NCSC’s ransomware-resistant cloud backup principles address deletion protection, recovery access, and related safeguards. Tradeoff: Longer retention and stronger protection cost money and require planning. Choose them according to how much data you can afford to lose and how long you can operate without critical systems. 2. Secure Accounts and Close Unnecessary Remote Access Attackers do not always break through software defenses. Sometimes they sign in with stolen credentials. Enable multifactor authentication, or MFA, on email, cloud storage, remote access, and administrator accounts. Prioritize email because it often controls password resets for other services. CISA recommends MFA , with phishing-resistant methods providing stronger protection. Ask about compatible FIDO2/WebAuthn security keys or passkeys rather than assuming every authentication method offers equivalent security. Use unique passwords and a password manager wherever passwords remain necessary. Document account recovery and protect recovery codes. Otherwise, a lost phone or security key can become its own operational emergency. For businesses, identify who can connect remotely and how. Disable unused remote-access services, avoid exposing Remote Desktop directly to the internet, and restrict approved access. Remove former employees’ accounts and review vendor access, too. Practical example: A bookkeeper who needs an accounting application should not automatically receive administrative access to the entire office network. 3. Update Software Before Attackers Exploit It Enable automatic updates where appropriate for operating systems, browsers, applications, and device protection. Remember routers, firewalls, VPN equipment, and other devices that may not update themselves. For a business, maintain an inventory and prioritize exposed systems. CISA’s Known Exploited Vulnerabilities Catalog, referenced in its #StopRansomware Guide , helps identify vulnerabilities already being exploited. It informs priorities; it does not replace broader patch management. Windows users should check support status. Standard Windows 10 support ended on October 14, 2025. Verify whether your specific device and edition still receive security updates through an applicable extended-update program or servicing lifecycle. Otherwise, move to a supported operating system. See Microsoft’s support guidance . Tradeoff: Updates can interrupt work or affect compatibility. For critical business systems, assign an owner, test promptly, and set a completion deadline. Any delay needs a temporary mitigation and an expiration date. 4. Make Suspicious Requests Easy to Verify Phishing awareness should teach a reliable response—not depend on spotting poor spelling. A polished message can still be malicious. When an unexpected message asks you to sign in, open an attachment, install software, or grant remote access: Pause. Urgency is a reason to verify, not bypass normal safeguards. Use a known route. Open the service through your usual bookmark or app instead of the supplied link. Confirm separately. Contact the sender using a number or channel you already trust. Report quickly. If you already clicked, tell your IT contact immediately. The FTC’s small-business cybersecurity resources provide practical guidance on phishing and related threats. Apply the same caution to unsolicited support calls and alarming browser pop-ups. Businesses should combine training with email filtering, malicious-site blocking, and restrictions on risky attachments. Make reporting simple and non-punitive; employees should not have to decide whether an incident is serious before asking for help. 5. Limit Damage and Make Security Alerts Actionable Least privilege means giving people and applications only the access they need. Use a standard account for everyday work and separate administrator credentials for administrative tasks. Review shared folders so one compromised account cannot modify every business file. Businesses should also separate guest devices, employee computers, sensitive servers, and backup administration where practical. Network segmentation only helps when rules actually restrict traffic between those areas. Keep antimalware protection active and updated. Endpoint detection and response, or EDR, can add investigation and containment capabilities, but buying a license is not the same as having someone respond. Ask your IT provider: Who receives serious alerts after hours, and who can isolate an affected device? Protect important system logs and monitor changes to administrator accounts, backup settings, and security controls. Windows: Consider Controlled Folder Access Microsoft’s Controlled folder access can block untrusted applications from changing protected files. It requires Microsoft Defender Antivirus as the primary antivirus application, with real-time protection enabled. In Windows Security, open Virus & threat protection , select Manage ransomware protection , and review Controlled folder access and protected folders. Tradeoff: Legitimate applications may need explicit approval. Businesses should evaluate compatibility in Audit Mode before enforcement; Audit Mode records activity but does not block it. This feature supplements backups—it does not replace them. 6. Prepare for the Day Prevention Fails Keep response instructions and emergency contacts accessible without your normal email or computers. Decide who can disconnect systems, how people will communicate, and which services must recover first. If you suspect active ransomware, the CISA response guidance supports these immediate priorities: Isolate affected devices. Disconnect Ethernet and Wi-Fi and notify IT immediately. Avoid shutdown when isolation is possible. Powering off can destroy evidence in memory. If network disconnection is impossible, shutdown may be necessary to limit spread. Use a separate, trusted communication channel. Do not assume company email is safe. Preserve evidence. Retain ransom notes and relevant logs; avoid wiping systems before responders assess them. Coordinate recovery. Address the compromise and validate recovery systems before reconnecting them. Businesses should involve their incident-response provider, insurer where applicable, and legal counsel to assess data exposure and notification obligations. In the United States, report the incident through your local FBI field office or the Internet Crime Complaint Center. The FBI does not support paying a ransom ; payment does not guarantee recovery. Your Ransomware-Prevention Checklist For each item, record an owner and the last verification date. “We think so” is not a completed check. ☐ Important files have an isolated backup, and a restoration test succeeded. ☐ Backup retention, deletion protection, and recovery credentials are understood. ☐ Important accounts enforce MFA, preferably phishing-resistant. ☐ Devices receive supported security updates. ☐ Unnecessary remote access and administrator privileges are removed. ☐ Device protection is active, and serious alerts reach a responder. ☐ Staff know how to verify unusual requests and report mistakes. ☐ Response instructions, contacts, and recovery priorities are available offline. Make Your Next Step Verifiable Ransomware prevention is not a promise that nothing will go wrong. It is a disciplined effort to reduce the chance of compromise, limit the damage, and recover with confidence. Start today: secure your primary email account, check your update status, and restore a file from backup. If you run a business, assign the remaining checklist items to named owners. Demonstrated protection matters more than assumed protection. ## Could Someone Hack a Private Equity Firm From Its Lobby? - URL: https://bartmcd.com/blog/private-equity-lobby-cybersecurity-risks - Published: 2026-09-28 A private equity firm’s lobby should make visitors feel welcome. It should not make their devices trusted. Yes, a lobby can become the starting point for a cyberattack when physical access leads to excessive network or application access. But sitting in reception, joining guest Wi-Fi, or receiving a network address does not establish that a firm has been compromised. The real question is whether an unauthorized person can cross a security boundary—and whether anyone would notice. This is a new, evidence-based analysis, not a reconstruction of the unavailable original article or an account of a verified engagement. For private equity leaders, the stakes extend beyond office technology: confidential acquisition plans, investor information, diligence materials, and payment workflows may all depend on those boundaries holding. How a Lobby Could Become an Entry Point Consider this hypothetical scenario : a visitor arrives for a scheduled meeting and connects a laptop to an accessible conference-room socket. The connection places the device on a network with broader access than intended. A reachable internal application has a separate authorization weakness. Together, those failures expose a designated test document that the visitor should never be able to read. No single step should be confused with the entire incident. A useful assessment distinguishes: Physical access: The person reached reception or another permitted area. Network access: The device obtained connectivity. Unauthorized reachability: The device contacted a service that should have been isolated. Unauthorized resource access: The person accessed a file, application, or function without permission. This distinction prevents exaggerated breach claims while preserving the significance of failed controls. NIST’s Zero Trust Architecture makes the underlying principle clear: physical or network location alone should not establish trust. The CISA and NSA advisory on common misconfigurations likewise identifies inadequate segmentation as a condition that can enable movement between systems. Permission to enter the office must never become blanket permission to access the business. Five Defenses That Keep Visitor Access Limited 1. Make Physical Access Deliberate Confirm the visitor’s host, define escort requirements, and give reception a reliable escalation contact. Lock communications rooms and network cabinets. Keep sensitive printouts and screens away from public view. These are operational controls, not reasons to turn reception into a checkpoint. A predictable process is more sustainable than expecting one receptionist to challenge every exception without support. NIST SP 800-171 Revision 3 provides useful physical-access control references, including visitor supervision and access records. Its scope concerns controlled unclassified information; citing it does not mean every private equity firm is subject to its requirements. 2. Prove That Guest Connectivity Is Separate Ordinary guest access should provide internet connectivity, not general access to employee devices, file services, or administrative interfaces. A different Wi-Fi name or VLAN is not proof of isolation. Traffic restrictions must enforce the policy. Test both wireless connections and visitor-accessible wired ports. Validate that designated internal services are unreachable unless a documented exception permits access. Repeat validation after material network changes. Meeting-room displays and visitor printing create practical exceptions. Prefer narrowly scoped access to those services over broad connectivity between guest and corporate networks. If an exception requires opening substantial internal access, reconsider the service’s design. 3. Control Accessible Wired Ports Inventory lobby sockets, conference-room docks, and other accessible connections. Disable unused ports. For necessary corporate connections, evaluate 802.1X network access control , using certificate-based EAP-TLS where appropriate to authenticate devices before granting access. This requires more than a switch setting. Certificate issuance, renewal, revocation, endpoint configuration, and authentication-service availability all matter. Cisco’s EAP-TLS implementation guidance illustrates certificate-revocation checking; implementation must match the deployed environment. Pilot enforcement before broad rollout. Define what happens to unknown devices and during authentication outages, rather than allowing an undocumented fallback to grant unrestricted access. For printers or other devices requiring MAC Authentication Bypass, restrict permissions carefully. Cisco cautions that MAC-based authentication is not strong authentication . It is an exception mechanism, not equivalent to certificate-based identity. 4. Protect Applications Independently Assume a network boundary could fail. Sensitive applications must still enforce identity and authorization. Use phishing-resistant multifactor authentication where supported. Apply least privilege to files, applications, and administrative functions. Separate everyday accounts from administrative accounts. Use device-aware access policies where appropriate. Review access to investment committee materials, investor records, and payment workflows. Follow the firm’s actual dependencies, including cloud services and service-provider connections; do not assume everything sits on the office network. CISA’s MFA guidance prioritizes phishing-resistant methods. Build usable enrollment and recovery procedures, and remember that MFA does not repair an unauthenticated service or excessive file permissions. 5. Make Detection Actionable Ask the security team to demonstrate how it would investigate an unfamiliar device on a visitor-area port, repeated network-authentication failures, or guest traffic attempting to reach restricted services. Useful evidence may span switches, wireless controllers, identity systems, endpoints, and visitor records. Correlate it under appropriate privacy, access, and retention policies. CISA’s visibility and hardening guidance emphasizes logging and defensive visibility. The tradeoff is operational: collecting more data helps only when responders can use it. Every significant alert needs an owner and an escalation path. How to Test the Lobby Safely Commission an authorized assessment, not an informal experiment. Use written rules of engagement based on NIST SP 800-115 . Define permitted locations and systems, whether social engineering is allowed, test windows, emergency contacts, stop conditions, and evidence handling. Exclude landlord, building-management, and other third-party systems unless their owners have explicitly authorized testing. A tenant cannot grant permission to test infrastructure it does not control. Turn the scope into observable acceptance tests: Unknown device: A visitor-accessible corporate port denies or restricts it according to policy. Guest isolation: Connections to designated internal test services are blocked unless explicitly permitted. Visitor procedure: Requests to move beyond reception trigger host verification and required escorting. Application authorization: An unauthorized account cannot open a synthetic sensitive document. Detection: An approved test event reaches the responsible responder with usable evidence. Use synthetic records rather than genuine investor documents. Report connectivity, reachability, and unauthorized access separately. Assign each confirmed weakness an owner, a deadline, and a retest requirement. If an Unknown Device Is Discovered Treat discovery as a potential incident—not proof that information was stolen. Notify the security lead and have authorized responders contain the connection. Record the location and relevant timestamps, preserve available logs, and investigate what the device actually reached or accessed. Do not wipe or repurpose the device before responders assess its evidentiary value. Coordinate facilities, IT, security, legal, and compliance. NIST SP 800-61 Revision 3 provides the current incident-response framework for integrating preparation, detection, response, and recovery into risk management. A Current U.S. Compliance Consideration For covered institutions, including SEC-registered investment advisers, amended Regulation S-P requires written incident-response policies and procedures and addresses customer notification involving sensitive customer information. The SEC’s compliance guide lists compliance dates of December 3, 2025, for larger entities and June 3, 2026, for smaller entities. Both have passed as of September 28, 2026. Not every private equity entity, record, or security event has identical obligations. Counsel should determine applicability and notification requirements from the actual facts. Private Equity Lobby-Security Checklist Review this checklist jointly with facilities, IT, security, and compliance. Require evidence, not simply assurances. ☐ Visitors have confirmed hosts and clear escort requirements. ☐ Reception has a reliable escalation contact. ☐ Network equipment, screens, and sensitive documents are protected. ☐ Visitor-accessible ports are inventoried; unused ports are disabled. ☐ Guest isolation has been tested across wired and wireless access. ☐ Unknown-device and authentication-outage policies are documented. ☐ Authentication exceptions have narrowly restricted permissions. ☐ Sensitive applications independently enforce authentication and authorization. ☐ Responders can retrieve relevant network, identity, and physical-access records. ☐ A test alert reaches a named owner. ☐ Assessment authorization and evidence-preservation procedures are documented. ☐ Findings have remediation owners, deadlines, and successful retests. The Bottom Line: Test the Boundary A welcoming lobby and a secure firm are compatible. The objective is not to distrust every visitor; it is to prevent visitor access from silently becoming business access. Schedule a joint review with facilities and security, authorize a controlled assessment, and bring the results to leadership. Ask one decisive question: can an untrusted visitor reach something they should not—and can the firm prove its answer? ## Office 365 for Hedge Funds and Private Equity: A Practical Microsoft 365 Guide - URL: https://bartmcd.com/blog/office-365-hedge-funds-private-equity-guide - Published: 2026-09-28 A deal team needs to share diligence files with outside counsel. Investor relations receives revised banking instructions. A departing analyst’s mailbox contains records compliance must preserve. These are not simply technology tasks: they connect collaboration, cybersecurity, fraud prevention, and regulatory obligations. Microsoft 365 can be a strong platform for hedge funds and private equity managers—but the subscription is only the starting point. Success depends on selecting the right capabilities, configuring them around investment workflows, and proving that controls work. For firms evaluating “Office 365 for hedge funds and private equity,” the practical question is not whether Microsoft hosts email securely. It is whether the proposed environment meets the manager’s specific operating requirements. 1. Choose Licenses After Defining Requirements Office 365 and Microsoft 365 remain distinct product families. Microsoft 365 enterprise plans combine productivity services with additional management and security capabilities; exact entitlements vary. Teams availability also varies by subscription. Require precise product names—not simply “E3”—in every proposal. Microsoft’s plan documentation provides the starting point. Microsoft 365 Business Premium: A candidate for firms within its 300-user limit, with Entra ID P1, Intune Plan 1, Defender for Business, and Defender for Office 365 Plan 1. Microsoft 365 E3 with additions: An enterprise foundation when specific security and compliance capabilities will be purchased separately. Microsoft 365 E5: Worth evaluating for advanced security, investigation, and compliance requirements—not a substitute for skilled operation. Business Premium with additional suites: Eligible firms can evaluate Microsoft’s Defender and Purview suite options . Require a control-to-license schedule identifying entitlements, covered users, guest and shared-mailbox treatment, implementation costs, and recurring management. Purview licensing differs across email DLP, Teams-message DLP, endpoint DLP, and advanced records management. Check the feature-level requirements ; portal visibility does not establish entitlement. 2. Secure Identity, Devices, and Payment Workflows First Make authentication resilient Prioritize phishing-resistant authentication for administrators, investment professionals, and employees handling investor information or payments. Microsoft supports enforcement through Conditional Access authentication strengths and recommends testing policies in Report-only mode before enforcement . Inventory identities and applications, register appropriate credentials, pilot policies, investigate failures, and enforce in stages. Establish protected emergency-access accounts and test recovery procedures. A strong sign-in policy can be undermined by a weak help-desk reset process. Control endpoints and email Define device requirements for encryption, patching, endpoint protection, and screen locking. Test sensitive-document access from unmanaged devices. Personal-device rules should specify what employees may access and what the firm can remove when employment ends. Configure SPF, DKIM, and DMARC after identifying legitimate senders, including investor-relations platforms. Evaluate Defender’s Standard and Strict preset security policies , including impersonation protection and recipient coverage. Preset policies take precedence over custom policies, so test exceptions carefully. Technology cannot independently validate a changed bank account. Require dual approval and verification through a previously established contact route. The FBI’s business email compromise guidance recommends independently verifying payment and account changes. Never authorize a capital-call, distribution, acquisition, or vendor-payment change solely because an email appears authentic. 3. Design Collaboration Around Funds and Deals A hedge fund’s research library and a private equity transaction workspace need different access models. Separate internal research, investor relations, investment committee materials, individual deals, and portfolio-company collaboration. Assign each workspace a business owner. For sensitive material, disable anonymous sharing, use authenticated named recipients, and review access at deal milestones. SharePoint settings operate at both organization and site levels; the more restrictive setting applies. Microsoft’s external-sharing guidance explains these boundaries. Practical test: Sign in as outside counsel and confirm that the account can open the intended diligence folder—but not unrelated transactions or internal committee documents. Test actual access, not just group names. Start with a manageable classification scheme, such as Public, Internal, Confidential, and Restricted. Test sensitivity labels and DLP against investor tax documents and restricted research. For competitive sale processes, compare SharePoint with a specialist virtual data room on bidder separation, watermarking, Q&A, download controls, and closing archives. Keep specialist tools where requirements justify them. 4. Separate Recordkeeping, Audit Logs, and Recovery These controls answer different questions: What must we preserve? What happened? How quickly can we restore operations? Records retention For advisers subject to Advisers Act Rule 204-2 , many required records must be retained for at least five years from the end of the fiscal year of the last entry, with the first two years in an appropriate office. Other categories have different provisions. Have compliance counsel approve record categories, retention periods and start events, systems of record, preservation requirements, and deletion rules. Do not assume the manager, broker-dealer affiliates, and portfolio companies have identical obligations. Microsoft Purview retention policies and labels require workload-specific design. Teams messages and linked files can have different retention settings. Test retrieval across email, Teams, SharePoint, OneDrive, and departed employees’ accounts. Address off-platform communications separately. Investigation and restoration Microsoft documents a default 180-day retention period for Audit Standard . Audit Premium provides a one-year default for specified workloads and appropriately licensed users—not every event or guest. Validate audit coverage and retention before an incident. Retention is not a complete recovery strategy. Evaluate Microsoft 365 Backup alongside alternatives for workload coverage, administrative separation, export options, and recovery objectives. Demonstrate restoration of a mailbox and representative deal workspace, including usable content and permissions. 5. Operationalize Regulation S-P The SEC’s amended Regulation S-P applies to covered institutions, including SEC-registered investment advisers. Its compliance dates—December 3, 2025, for larger entities and June 3, 2026, for smaller entities—have passed as of September 28, 2026. Under the final rule , required customer notification generally must occur as soon as practicable and within 30 days after awareness of qualifying unauthorized access or use, subject to conditions and exceptions. Service-provider oversight procedures must address provider notice as soon as possible and within 72 hours after awareness of a qualifying breach. That is not a universal 72-hour SEC-reporting deadline . Have counsel confirm applicability. Exercise a compromised investor-relations mailbox scenario: preserve evidence, identify affected information, escalate to providers, and make documented notification decisions. 6. Review Permissions Before Enabling Copilot Microsoft states that Microsoft 365 Copilot respects existing content permissions and that prompts, responses, and Microsoft Graph data are not used to train foundation models. Its privacy documentation also addresses agents, web search, and third-party models. The central risk is straightforward: AI does not fix excessive access. Review deal-room, investor, and research permissions first. Approve use cases, examine connector and agent permissions, define interaction retention, and require human verification of investment, legal, and investor-facing output. Pilot with representative users before broad deployment. 7. Implement in Phases and Require Evidence Begin with an inventory of users, devices, applications, records, and external collaborators. Assign responsibilities across technology, compliance, operations, investment leadership, and service providers. Next, pilot authentication, device controls, sharing, and email protection. Include traveling employees and external advisers. During migration, validate mailbox contents, file permissions, records retrieval, and representative Excel models, macros, and add-ins. Define rollback criteria before retiring existing systems. Before acceptance, complete a restore, records-production exercise, employee-exit test, and incident simulation. Then assign ongoing owners for alerts, access reviews, policy exceptions, and vendor escalation. Compare total operating costs, including monitoring, archiving, backup, support, training, and exit assistance—not just subscription prices. Microsoft 365 Acceptance Checklist Require an owner and evidence for each item: Applicable entities, obligations, and retention schedules are approved. Required controls map to licenses and accountable operators. Phishing-resistant authentication and emergency access are tested. Device rules, email protection, and independent payment verification work. Sensitive workspaces have owners and tested guest-access boundaries. Labels and DLP work against realistic fund workflows. Required messages, files, and departed-user records are retrievable. Audit logs support the firm’s investigation requirements. Restores meet documented recovery objectives. Incident escalation, notification decisions, and AI access are reviewed. Build an Environment the Firm Can Defend The best Microsoft 365 configuration is not necessarily the most expensive subscription. It is the environment your firm can explain, operate, and test. Before your next purchase or renewal, bring technology, compliance, and operations together to complete the checklist. Request demonstrations of external-access controls, records retrieval, recovery, and incident response. Evidence—not a promise of being “secure” or “compliant”—should determine whether the platform is ready for your firm. ## Private Equity vs. Hedge Funds: Which Is Harder to Secure? - URL: https://bartmcd.com/blog/private-equity-vs-hedge-funds-cybersecurity - Published: 2026-09-28 Current as of September 28, 2026. Consider two cybersecurity incidents: ransomware stops production at a private equity portfolio company, while compromised credentials leave a hedge fund unable to trust its trading data. Both demand urgent action. But they expose different security challenges: coordinating protection across businesses versus preserving trustworthy operations under time pressure. Private equity can be harder to secure across an entire portfolio; a trading-dependent hedge fund can be harder to protect against time-critical disruption. Neither is inherently harder in every case. This is an operational comparison, not a statistical ranking. Here, “secure” means protecting against cyber threats—not obtaining a job or attracting investment. The answer starts with defining responsibility, dependencies, and acceptable downtime. Start With an Apples-to-Apples Comparison Comparing a PE manager and all its portfolio companies with a hedge fund manager’s office technology produces a misleading result. Separate three security scopes: The investment manager: Employees, identities, devices, email, investor information, research, and finance. Fund operations and providers: Administrators, investor portals, banking relationships, and outsourced technology. Portfolio companies: Operating businesses with their own technology, employees, management, and obligations. The SEC’s guidance on starting a private fund explains the operating-model differences. Its private equity overview also recognizes both controlling and minority investments. Security oversight must reflect actual authority—not assumed control. At the manager-only level, complexity, staffing, outsourcing, and control maturity can matter more than the fund label. Private Equity: The Hard Part Is Consistency Across Different Businesses A portfolio-wide security program must accommodate different technology stacks, budgets, leadership teams, and operational priorities. A professional-services company and an industrial manufacturer should share security expectations, but not necessarily identical implementations. Build security into the investment lifecycle Before acquisition, request evidence—not just questionnaire answers—of identity protection, recovery testing, significant incidents, unsupported systems, and unresolved findings. Identify dependencies on the seller’s technology and include remediation costs in ownership planning. Before connecting networks or sharing administrative access, decide which connections are necessary, who can approve them, and how an incident will be contained. These practices apply the lifecycle approach in NIST’s cybersecurity supply-chain risk management guide ; they are recommendations, not a mandatory acquisition standard. Practical example: If an acquisition depends on the seller’s identity system, separation becomes a security workstream. Assign ownership for migrating accounts, removing seller access, and testing continuity before the transition service ends. Standardize outcomes without creating shared weaknesses Set common requirements for protected identities, monitored activity, recoverable systems, and accountable owners. Track exceptions and remediation deadlines by company. Centralized services can improve visibility and purchasing efficiency, but shared privileged accounts or unrestricted connectivity can spread an incident. Standardize controls while preserving appropriate separation. For industrial businesses, add an operational-technology assessment. CISA’s OT guidance highlights unnecessary internet exposure and default passwords—risks an office-IT review may miss. Hedge Funds: The Hard Part Can Be Trustworthy Recovery A hedge fund may have fewer operating entities to oversee but depend heavily on connected workflows for research, trading, risk monitoring, reconciliation, and investor servicing. Not every strategy is latency-sensitive; recovery requirements must follow the actual business model. Availability is only part of the problem. A system that restarts with inaccurate positions or altered instructions is not safely recovered. Confidentiality also matters when research or proprietary models are involved. Practical example: Suppose an order-management platform becomes unavailable while the integrity of recent transactions is uncertain. Restoring access is insufficient. The firm needs a defined process for verifying transactions, reconciling positions, and authorizing resumed activity. Leadership should decide in advance: Who can authorize containment that interrupts trading? Which independent records can verify positions and transactions? What happens if a critical provider is also unavailable? Which activities must remain paused until data integrity is established? The tradeoff is real: rapid restoration reduces downtime, but premature resumption can compound damage. NIST’s incident-response guidance supports integrating recovery with broader business risk decisions. The Controls Both Types of Firm Need The priorities overlap. What changes is where each control must operate and how its effectiveness is demonstrated. Protect identities. Require multifactor authentication, prioritizing phishing-resistant methods for email, remote access, and privileged accounts. Remove unnecessary privileges and stale access. CISA explains why MFA methods differ in strength . Available MFA is a useful starting point, not a reason to stop improving. Verify payments outside email. Independently confirm new or changed banking instructions through established contact details. Add separate approval for sensitive transactions. For an acquisition payment or distribution, call a known number—not one supplied in the change request. The FBI recommends secondary-channel verification . Prove recovery works. Protect backups from ordinary administrative compromise and test restoration of complete business workflows, including data integrity. A successful backup job does not demonstrate successful recovery. The CISA #StopRansomware Guide also emphasizes inventory, logging, and least privilege. Manage provider dependencies. Record each critical provider’s access, data holdings, incident contacts, recovery commitments, and exit arrangements. Match assurance work to criticality. A questionnaire alone cannot establish whether a provider supports your recovery requirements. Connect monitoring to action. Know who reviews alerts, who can disable compromised access, and who has containment authority outside business hours. Logs without an operational response process offer limited protection. Security should be measured by evidence that critical controls work—not by the number of tools purchased or policies approved. The U.S. Regulatory Position in September 2026 Regulation S-P compliance dates have passed The SEC’s amended Regulation S-P applies to covered institutions, including SEC-registered investment advisers. According to the SEC compliance guide , compliance dates were December 3, 2025, for larger entities and June 3, 2026, for smaller entities. Applicability depends on the entity and information involved—not the PE or hedge fund label. Covered institutions need written incident-response procedures and service-provider oversight. Two requirements in the final rule should not be confused: Provider notification: Oversight policies must be reasonably designed to ensure providers notify the institution as soon as possible, no later than 72 hours after becoming aware of a breach resulting in unauthorized access to a customer-information system they maintain. Individual notification: Where required, notice must occur as soon as practicable, no later than 30 days after awareness that unauthorized access to or use of customer information occurred or was reasonably likely to have occurred. Exceptions and a limited delay mechanism apply. These are not universal deadlines for every incident or recipient. A withdrawn proposal is not an operative rule The SEC withdrew its proposed adviser and fund cybersecurity-risk-management rules effective June 17, 2025. That did not withdraw the separate Regulation S-P amendments. Counsel should map applicable notification obligations into the response plan; this discussion is not entity-specific legal advice. A Practical 90-Day Improvement Plan Use this management sequence—not a regulatory timetable—to turn comparison into action: Days 1–30: Define scope, accountable owners, critical workflows, and dependencies. Produce a prioritized risk register. Days 31–60: Address the highest-risk identity, payment, recovery, and provider gaps. Record test results, exceptions, and remediation owners. Days 61–90: Exercise a realistic incident. For PE, test portfolio-company containment and escalation. For a trading-dependent hedge fund, test disrupted trading and uncertain position integrity. Use NIST Cybersecurity Framework 2.0 to organize outcomes, then report unresolved risks and funding decisions to leadership. Leadership Security Checklist Require evidence for each answer; this checklist is a discussion tool, not a security certification. Have we separated manager, provider, and portfolio-company responsibilities? Does every critical workflow and unresolved risk have an accountable owner? Are critical accounts protected with strong MFA and limited privileges? Are critical assets inventoried and meaningful alerts investigated? Are payment changes independently verified? Have we restored critical workflows and checked data integrity? Are provider escalation contacts and recovery assumptions tested? Can decision-makers authorize containment without improvising authority? Are legal notification triggers and decision records built into response procedures? The Bottom Line: Secure the Operating Model, Not the Label Private equity’s portfolio-wide challenge is breadth and coordination. A trading-dependent hedge fund’s challenge can be recovery speed and operational integrity. Either becomes harder when responsibilities are unclear or controls remain untested. Start with one critical workflow this month. Map its identities, systems, providers, payment controls, and recovery decisions. Test it, assign the gaps, and bring the results to leadership. That evidence will tell you more about your security priorities than the fund label ever could. ## The Four Dimensions of Cybersecurity That Really Matter - URL: https://bartmcd.com/blog/four-dimensions-of-cybersecurity - Published: 2026-09-28 A suspicious payment request arrives in finance. The email looks legitimate, the deadline sounds urgent, and the sender appears to be a trusted supplier. Whether money leaves the business depends on more than an email filter. It depends on what the employee knows, which verification procedure applies, what the systems enforce, and whether leadership allows anyone to bypass the rules. That is why an effective cybersecurity program needs four dimensions: people, processes, technology, and governance. Each addresses a different question: People: Can employees and specialists recognize problems and act appropriately? Processes: Is essential security work repeatable, assigned, and tested? Technology: Are safeguards configured, maintained, and monitored? Governance: Who sets priorities, funds improvements, and accepts remaining risk? This is a practical organizing model, not an official four-part framework. NIST’s Cybersecurity Framework 2.0 defines six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Use those functions to check coverage across all four dimensions, especially the response and recovery capabilities that prevention-focused programs can overlook. 1. People: Make Secure Behavior Practical People need more than instructions to “be careful.” They need role-specific knowledge, usable safeguards, and permission to stop a questionable transaction—even when the request appears to come from an executive. NIST’s cybersecurity and privacy learning guidance emphasizes behavior change and evaluating learning effectiveness. Translate that into everyday work: Teach by responsibility. Finance teams should practice payment verification; administrators need secure access and recovery procedures; managers need clear escalation duties. Make reporting easy. Provide a straightforward route for suspicious messages, unexpected authentication prompts, lost devices, and accidental disclosures. Rehearse the next action. Ask people whom they would contact and what they would do—not simply whether they can identify a phishing email. Encourage early reporting. A person who reports a mistake promptly gives responders an opportunity to limit damage. Avoid incentives that encourage concealment. For payment changes, establish a concrete rule: verify the request through a previously established contact or independently obtained phone number. Do not use contact details supplied in the questionable message. This follows FBI business email compromise guidance . The tradeoff: Training competes with working time. Prioritize short, relevant exercises over identical lessons for everyone. Measure whether people can complete the secure workflow, not just whether they attended training. 2. Processes: Make Security Repeatable Under Pressure A policy describes an expectation. A process explains who does what, when, and how completion is verified. Without that distinction, important work depends on memory and individual initiative. Start with the operational foundations reflected in NIST’s Small Business Quick-Start Guide : Inventory critical services and data. Identify owners, applications, devices, cloud services, and dependencies. Include approved AI services that handle business information. Manage access throughout employment. Define approval, role changes, periodic review, and prompt removal when someone leaves. Prioritize and verify remediation. Consider active exploitation, internet exposure, business importance, and available mitigations—not severity scores alone. Document incident response and recovery. Assign reporting, containment, investigation, communication, restoration, and business-approval responsibilities. NIST SP 800-61 Revision 3 integrates incident response into broader cybersecurity risk management. Preparation is not separate from response: inventories, access controls, provider agreements, and communication plans determine what responders can accomplish. Test those connections with a tabletop exercise. If corporate email becomes unavailable, how will the team communicate? Who can isolate a critical system? Who preserves evidence? Who coordinates customers, counsel, insurers, and service providers? What must be verified before operations resume? The tradeoff: Excessive documentation becomes difficult to maintain and use. Keep essential procedures concise, accessible during an outage, and supported by technical runbooks where needed. An exercise should produce assigned corrective actions and retests—not merely a completed calendar appointment. 3. Technology: Buy Outcomes, Not Product Counts Security tools matter, but purchasing them is not evidence that they work. Every important safeguard needs an owner, a defined scope, maintenance, and a way to verify effectiveness. Strengthen identity first Prioritize phishing-resistant multifactor authentication for administrator, email, and remote-access accounts, then expand coverage. CISA recommends phishing-resistant MFA , including appropriately configured FIDO2/WebAuthn authentication. Not all MFA provides equivalent protection. NIST’s digital identity guidance explains that manually entered one-time codes are not phishing-resistant. Where stronger authentication cannot be deployed immediately, use available MFA while planning migration. Test enrollment and account recovery so a weak reset procedure does not undermine strong sign-in protection. Cover prevention, detection, and recovery Reduce exposure: Maintain software, remove unnecessary services, restrict administrative privileges, and protect sensitive data. Monitor meaningful activity: Collect relevant identity, endpoint, and cloud logs. Ensure alerts reach someone authorized to investigate and act. Protect recovery: Separate backup administration from everyday access, protect copies against deletion, and test restoration of a business service. CISA’s ransomware guidance recommends offline, encrypted backups and regular availability and integrity testing. Immutable storage can help, but configuration, retention costs, and administrative access require attention. A successful backup job does not prove that applications, configurations, and dependencies can be restored together. Backups support recovery. They do not undo stolen data. The tradeoff: Another monitoring product can add alerts without adding response capacity. Before purchasing, require a deployment plan, coverage target, response procedure, and effectiveness test. 4. Governance: Give Risk an Accountable Owner Governance connects technical decisions to business consequences. Leadership does not need to select every security setting. It does need to decide what must be protected, how much disruption is tolerable, and which risks require investment. NIST CSF 2.0 treats governance as a core function covering risk strategy, responsibilities, policy, oversight, and supply-chain risk. Put those principles into a short, maintained risk register. For each significant risk, document: The business service, information, or obligation at stake. The accountable business owner and planned treatment. The resources, deadline, and evidence needed to demonstrate improvement. Any accepted residual risk, with approval and a review date. Include critical providers. A cloud or managed-service contract does not automatically settle who configures access, reviews alerts, preserves investigation records, or restores data. Document those responsibilities and rehearse the handoffs. Apply the same discipline to AI adoption: identify approved tools, permitted data, accountable owners, and limits on connections to business systems. AI creates additional security decisions, not a reason to abandon existing accountability. The tradeoff: Scrutiny should match exposure. A provider holding sensitive customer information or running a critical service warrants deeper review than a low-impact supplier. Review evidence of control effectiveness, not questionnaires alone. How the Dimensions Work Together—and Where to Start Return to the hypothetical supplier-payment request. The employee recognizes the need for verification. The process requires an independent callback and appropriate approval. Technology restricts payment-system access and records changes. Governance makes clear that urgency and seniority do not override verification. No single layer guarantees prevention. Together, they reduce dependence on any one person or safeguard. Do not divide effort equally across the four dimensions. Start with the business’s most consequential risks and weakest dependencies. For a finance-heavy organization, that may mean payment verification and identity protection. For a service business, recovery capability may be urgent. Address active compromise or an exposed, exploitable system immediately rather than waiting for a broader improvement project. Choose a small set of priorities, assign owners, implement the controls, and test the result. Use the findings to determine the next investment. A Four-Dimension Cybersecurity Checklist For each item, record an owner, supporting evidence, unresolved gaps, and the next review date. Treat this as an operating review—not a certification. People Employees can demonstrate how to report a security concern. Exercises reflect job responsibilities and lead to improvements. Payment-detail changes receive independent verification. Processes Critical services, data, assets, and dependencies have named owners. Access changes and vulnerability fixes have verified completion records. Incident procedures have been exercised, including alternate communications. Technology High-risk accounts have phishing-resistant MFA or documented interim controls. Important alerts reach a responder with authority to act. Protected backups have passed a meaningful service-restoration test. Governance Significant risks and exceptions have owners and review dates. Critical-provider security and recovery responsibilities are documented. Leadership reviews evidence and funds corrective action. Make the Next Improvement Verifiable Cybersecurity is not just employee awareness, a policy library, or a collection of tools. It is an operating discipline supported by accountable decisions. Bring your business and technical owners together and ask: Can people act? Do procedures work? Are safeguards operating? Does someone own the remaining risk? Then select one consequential gap. Give it an owner, a deadline, and a test that demonstrates improvement. That is how the four dimensions become a stronger cybersecurity program rather than another planning exercise. ## 5 Best Practices to Prepare Your Firm for Cybersecurity Compliance Regulations in 2026 - URL: https://bartmcd.com/blog/cybersecurity-compliance-2026-best-practices - Published: 2026-09-28 Updated September 28, 2026 A firm can have a cybersecurity policy, a security provider and a folder of assessment reports—and still struggle to answer a regulator’s basic question: Can you demonstrate that your controls work? Preparing for cybersecurity compliance requires more than buying technology or updating policy language. It means connecting legal obligations to operational controls, accountable people and reliable evidence. For firms revisiting their 2023 planning, the regulatory landscape has changed. These five practices provide a current roadmap, particularly for U.S. financial-services businesses. Confirm applicability with qualified counsel; requirements depend on your activities, registrations, jurisdictions and exemptions. 1. Determine What Applies Before Building Your Compliance Plan Start with your legal entities and business activities—not a generic compliance checklist. Similar businesses can have different obligations because they operate under different registrations or licenses. Separate enacted requirements from outdated proposals The SEC withdrew its proposed cybersecurity risk-management rules for investment advisers and funds in 2025. Do not treat that proposal’s reporting framework as an enacted requirement. Other requirements, however, have reached their compliance dates: SEC Regulation S-P: Amendments address incident response, customer notification, service-provider oversight and recordkeeping for covered institutions. The compliance dates were December 3, 2025, for larger entities and June 3, 2026, for smaller entities. Both have passed. New York DFS Part 500: Covered entities must assess applicable requirements and exemptions. The implementation schedule reached expanded multifactor authentication and asset-inventory requirements on November 1, 2025, subject to applicable exceptions and exemptions. FTC Safeguards Rule: Financial institutions within FTC jurisdiction need a written information-security program. The limited exemptions for institutions maintaining information on fewer than 5,000 consumers are not a blanket exemption. SEC public-company rules: Covered public reporting companies have separate cybersecurity disclosure obligations , distinct from Regulation S-P. Create an applicability register recording each entity, requirement, applicability rationale, exemption, deadline, owner and required evidence. Track contractual and insurance conditions separately from legal requirements. Practical example: An organization with multiple regulated subsidiaries should assess each entity separately rather than assume one groupwide determination covers everything. Deliverable: A counsel-reviewed register with accountable owners and a review schedule. An incomplete register makes even a well-executed program unreliable. 2. Prioritize Controls Around Actual Risk A framework provides structure; it does not determine your legal obligations. NIST’s Cybersecurity Framework 2.0 organizational profiles offer a useful way to compare current capabilities with target outcomes and prioritize gaps. The framework is voluntary, not a compliance certification. Map critical services, then verify protection Inventory systems, cloud applications, sensitive data and providers. For each critical service, identify its owner, privileged users, data locations and recovery dependencies. Then prioritize: Access security: Verify MFA coverage, particularly for administrators and remote access. Favor phishing-resistant MFA , with workable enrollment and recovery procedures. Least privilege: Remove unnecessary access and review permissions when responsibilities change or people leave. Vulnerability management: Prioritize weaknesses using exposure, exploitation risk and business impact. Detection: Collect useful logs and assign responsibility for investigating alerts, including outside business hours. Recovery: Maintain protected backups and test restoration. CISA recommends offline, encrypted backups and regular recovery testing . Train employees to recognize suspicious requests and report them through a clear channel. Technical protection and human response should reinforce each other. Practical example: “MFA purchased” is not completion. Required accounts enrolled, exceptions reviewed and account recovery tested is a defensible completion standard. Tradeoff: Security changes can disrupt operations. Pilot where appropriate, but give exceptions an owner, compensating protection and expiration date. Internal risk acceptance cannot waive a mandatory requirement. Deliverable: A prioritized remediation plan with owners, deadlines and verification criteria. 3. Treat Vendor Oversight as an Ongoing Responsibility Outsourcing technology does not eliminate your firm’s oversight responsibilities. Concentrate attention on providers that hold sensitive information, administer systems or support critical operations. NYDFS’s third-party risk guidance emphasizes risk-based due diligence, contractual protections and ongoing monitoring. An onboarding questionnaire alone is insufficient. Review assurance-report scope, exceptions and controls your firm must operate. Evaluate subcontractors, incident cooperation, recovery capabilities and exit options. For AI services, assess permitted data use, retention and whether firm information may train models. Make incident coordination explicit Under amended Regulation S-P , covered institutions’ policies and procedures must be reasonably designed to ensure providers notify them as soon as possible, but no later than 72 hours after awareness of a breach resulting in unauthorized access to a customer information system maintained by the provider. The final rule does not impose the proposal’s specific written-contract requirement for that provision. Nevertheless, documenting notification contacts, evidence preservation and investigation cooperation in contracts can strengthen execution. Tradeoff: Large providers may reject bespoke terms. Document gaps and consider limiting data exposure, narrowing access or choosing an alternative. Deliverable: A risk-tiered vendor inventory, current review records and tested escalation contacts. 4. Build Incident Response Around Distinct Reporting Triggers A policy that says “report breaches within 72 hours” is too blunt. Different obligations have different triggers, recipients and clocks. Regulation S-P customer notification: When required, notify affected individuals as soon as practicable, no later than 30 days after awareness that unauthorized access to or use of customer information occurred or was reasonably likely. The rule includes a reasonable-investigation exception tied to whether sensitive customer information has been, or is reasonably likely to be, used in a manner causing substantial harm or inconvenience. NYDFS notification: Notify DFS as promptly as possible, no later than 72 hours after determining that a qualifying cybersecurity incident occurred. Separate extortion-payment requirements include notice within 24 hours and an explanation within 30 days of payment under Part 500 . FTC notification: Notify the FTC as soon as possible, no later than 30 days after discovery of a notification event involving unauthorized acquisition of at least 500 consumers’ unencrypted information. Compromised encryption keys and the rule’s presumption concerning unauthorized access matter. SEC public-company disclosure: Domestic registrants generally file Form 8-K Item 1.05 within four business days after determining materiality—not discovery. That determination must occur without unreasonable delay; limited disclosure-delay provisions exist. These summaries are not a complete reporting inventory. State breach laws and contractual obligations may also apply. Practical example: Exercise a compromised-email scenario involving suspected customer-data theft. Bring together leadership, IT, legal, compliance and relevant providers. Record when facts became known, who authorized containment and who evaluated each notification obligation. Tradeoff: Waiting for forensic certainty can conflict with deadlines. Design the process for timely decisions based on available facts, followed by documented updates. Deliverable: A tested response plan, reporting matrix, contact list and exercise-remediation log. 5. Make Evidence and Leadership Review Routine A policy describes intended behavior. Evidence shows what happened. For each material control, retain its requirement, owner, configuration or review record, test result, exception and remediation deadline. For example, an access-review policy should connect to an actual account list, documented decisions and tickets showing unnecessary access was removed. Give leadership decision-useful measures: overdue high-risk findings, unprotected accounts, critical-provider issues, failed restoration tests and expired exceptions. Counting completed documents is not the same as measuring protection. For NYDFS-covered entities subject to the requirement, the annual submission due April 15 is either a certification of material compliance for the prior calendar year or an acknowledgment of noncompliance. Supporting records must be retained for five years. Do not turn a known gap into an unsupported certification. Tradeoff: Collecting everything creates noise and cost. Preserve evidence that demonstrates scope, operation and outcomes while satisfying retention requirements. Deliverable: A maintained evidence index and leadership-reviewed improvement plan. Cybersecurity Compliance Readiness Checklist Use this as an operational work plan—not a legal safe harbor or an extension of an expired deadline. Confirm covered entities, applicable rules and exemptions. Separate enacted requirements from proposals and voluntary guidance. Assign executive accountability and control owners. Inventory critical systems, sensitive data and providers. Verify MFA coverage and remove unnecessary access. Prioritize vulnerabilities and test critical-service restoration. Review provider notification arrangements and escalation contacts. Document separate customer, regulator and investor reporting decisions. Exercise incident response and track corrective actions. Maintain control evidence and escalate unresolved requirements. Review progress with leadership and reassess after significant changes. Build a Program You Can Demonstrate Effective compliance preparation answers four questions: What applies? Who owns it? Does it work? Can we demonstrate that? Start with a leadership review of your applicability register and highest-risk gaps. Then test a critical control and an incident-reporting scenario. The objective is not a larger policy library. It is a security program that protects the business, meets applicable obligations and produces evidence when it matters. ## Lost Laptops, Lost Data: What to Do Now—and How to Protect Yourself Next Time - URL: https://bartmcd.com/blog/lost-laptop-protect-data-and-recover-files - Published: 2026-09-28 You reach for your laptop, and it is not there. Whether it disappeared from an airport lounge, a car, or your own office, the immediate concern goes beyond replacing the hardware: What could someone access, and which files can you recover? A missing laptop creates three separate problems: Missing hardware: Can you locate or recover the device safely? Exposed information: Could someone read local files or use signed-in accounts? Inaccessible files: Do usable copies exist somewhere else? Each requires a different response. Tracking helps find hardware. Encryption and account controls protect information. Backups restore access to files. Encryption protects the information you carry. Backups protect your ability to recover it. Neither replaces the other. Start With Reporting and Containment If the laptop belongs to your employer—or contains work information—contact IT or security immediately. Do not wait until you are certain it was stolen. The FTC recommends immediate reporting of potential security incidents , including lost laptops. Record the last known location, approximate time of loss, serial number or asset identifier, and whether the laptop was shut down, sleeping, locked, or unlocked. Note sensitive files, connected accounts, encryption status, and available backups. Preserve relevant messages and screenshots. Contact the location’s lost-and-found service. If theft is suspected, report it to local law enforcement and your insurer as appropriate. Share location information with police; do not confront someone yourself. For a work device, coordinate further actions with IT. An unplanned reset or erasure could interfere with evidence preservation or an organized response. Locate and Lock the Laptop Use a trusted phone or computer. Recovery tools generally must have been configured before the loss. A location pin is useful, but it is not proof that the laptop is secure. Windows For supported personal devices, follow Microsoft’s device-location instructions to sign in to your devices dashboard, select Find My Device , choose the laptop, and select Find . Use Lock if available. Microsoft’s requirements include previously enabled Find My Device, enabled location, and a personal Microsoft account with administrator privileges. Work-managed laptops may use separate IT tools. Microsoft’s consumer location and locking feature is not a remote-wipe service. Mac If Find My Mac was enabled, open Find My on another Apple device or use iCloud Find Devices . Select the Mac and activate Lost Mode , or Lost Mac on the website. Apple explains that a Mac must be powered on and connected to the internet to receive lock or erase commands. Offline location may still be available. Seeing the Mac on a map does not mean a protective command has completed. Chromebook and Google Accounts Use Google’s account controls to secure access from a missing Chromebook. For Windows and Mac laptops, use the operating system’s recovery tools separately. Google’s phone-finding feature does not provide general laptop tracking. Secure Accounts, Not Just the Device A laptop may contain active email sessions, cloud storage connections, saved passwords, and access to business applications. A locked screen does not resolve every account risk. Prioritize primary email and work identity accounts, followed by your password manager, cloud storage, financial services, and other sensitive accounts. Change potentially exposed passwords and use each service’s security controls to revoke relevant sessions. Password changes and session revocation are different actions. As Microsoft’s access-revocation guidance explains, applications may maintain their own sessions, and revocation is not necessarily immediate everywhere. For Google, open Security & sign-in → Your devices → Manage all devices , select the missing device or session, and choose Sign out . Review all relevant sessions if several share the same device name, following Google’s instructions . Enable multifactor authentication where available, preferably phishing-resistant methods. MFA strengthens future sign-ins; it does not automatically terminate existing access. For work accounts, ask IT to review application sessions and any exposed credentials or access keys. Assess Exposure Before Deciding to Erase A login password is not the same as full-drive encryption. BitLocker and FileVault help protect stored information against unauthorized access, including attempts to bypass the normal login process. But encryption should not be treated as protection against someone using an already unlocked session. Establish: Encryption status: Was protection actually active, rather than merely required by policy? Device state: Was it shut down, sleeping, locked, or unlocked? Recovery credentials: Could someone obtain the encryption recovery key? Data scope: Which customer records, personal documents, downloaded files, or other sensitive information were stored locally? For example, an encrypted, shut-down laptop presents a different risk from an unlocked laptop with an open payroll application. Neither scenario should be assessed solely by the hardware’s replacement cost. The Remote-Wipe Tradeoff Erasure can protect information, but it may also destroy the only copy of an unbacked-up file. Consider data sensitivity, backup availability, encryption, and evidence-preservation requirements. For work devices, leave authorization to the incident-response team. Pending is not completed. An offline device may not receive an erase command. Tracking may end. Apple’s lost-Mac guidance warns that erasure ends Find My location capability. Keep Activation Lock intact. Do not remove a missing Mac from Find My just to clean up your device list. Removal disables that protection. Management actions differ. Administrators must verify wipe settings ; some enterprise options preserve user data. For businesses, involve security and legal counsel in notification decisions. The FTC’s breach-response guidance emphasizes investigating exposure and applicable obligations. Encryption is important evidence, not a universal exemption from reporting requirements. Recover Files From Copies You Already Have From a trusted replacement device, check existing backups, cloud storage, shared workspaces, and other authorized copies. Do not assume everything on the missing laptop was synchronized. Find the newest successful backup and verify which folders it includes. Restore important files and open them to confirm they work. Compare versions and modification dates. Identify files created or changed after the last recoverable copy. For Macs, Time Machine can restore files and earlier versions . Cloud services may offer version history or deleted-file recovery, subject to their retention rules and your subscription. Synchronization is not necessarily an independent backup. For example, documents in a synchronized folder may be recoverable, while a project saved only in Downloads may be gone. Do not delete cloud files as an improvised remote wipe. OneDrive deletions can propagate between cloud storage and synchronized computers , damaging your recovery copy without reliably removing files from an offline laptop. If a file existed only on the missing device and the device never returns, recovery may be impossible. Make the Next Loss Less Damaging Verify Encryption and Recovery Access On supported Windows devices, check Settings → Privacy & security → Device encryption . Availability and automatic activation depend on hardware, Windows edition, and account setup; verify the actual setting . On a Mac, check System Settings → Privacy & Security → FileVault . Apple silicon and T2-equipped Macs already encrypt storage, but FileVault adds protection tied to login credentials . Store recovery credentials securely somewhere accessible without the laptop—not solely on its drive or in its carrying case. For higher-risk Windows environments, IT should evaluate startup authentication and hibernation rather than assuming sleep provides equivalent protection. Build Recovery Around Real Work CISA recommends encryption and backups . Keep external backups separate from the laptop and disconnect them when not in use. Test restoration, not just backup completion. Choose backup frequency according to how much recent work you can afford to lose. Reduce unnecessary sensitive local files, enable permitted recovery tools, and maintain an accessible reporting procedure. These controls work best before an emergency. Lost-Laptop Response Checklist Report work-related loss immediately. Record location, serial number, device state, and actions taken. Use previously enabled location and lock tools. Report suspected theft; avoid confrontation. Change exposed passwords and revoke relevant sessions. Verify encryption and identify affected information. Authorize erasure carefully and check completion. Locate backups and test file recovery. Protect More Than the Hardware A missing laptop should not automatically mean exposed information or permanently lost work. The strongest preparation combines verified encryption, controlled account access, and tested backups. Take action today: confirm encryption, locate your recovery credentials, and restore one important file from backup. If the laptop is already missing, begin with reporting and containment—not a replacement purchase. ## IT and Cybersecurity Teams Need to Work Together: A Practical Guide - URL: https://bartmcd.com/blog/it-cybersecurity-team-collaboration-guide - Published: 2026-09-28 Consider a familiar operational dilemma: security identifies an actively exploited vulnerability in a business-critical system. IT knows the update could disrupt an application with limited rollback options. The business needs the service available. Everyone has a legitimate concern, but nobody has agreed on who makes the decision. This is where cybersecurity becomes a management problem, not just a technical one. Finding a vulnerability does not fix it. Keeping a system running does not make its risk acceptable. IT and cybersecurity teams need to work together because dependable business services require both operational reliability and effective protection. The solution is not necessarily a reporting-line change or another meeting. It is a shared operating model: clear ownership, coordinated priorities, tested response procedures, and explicit decisions about risk. Start With a Shared Business Objective IT typically emphasizes service delivery, availability, performance, and support. Cybersecurity emphasizes preventing, detecting, and responding to threats. Those priorities overlap, but they can create friction when teams are measured separately. If IT is rewarded only for uptime, disruptive security updates become difficult to justify. If security is rewarded only for closing findings, operational consequences can receive too little attention. NIST’s Cybersecurity Framework 2.0 connects cybersecurity governance to organizational objectives and calls for established responsibilities and authorities. It does not prescribe a single organizational chart. The shared goal is dependable business services with risks the organization understands, assigns, and manages. Collaboration does not mean eliminating independent challenge. Security should retain an escalation path when operational decisions leave significant exposure unresolved. Make Responsibilities Explicit—Including Risk Acceptance For each critical service, distinguish who implements a safeguard, who verifies it, and who can accept the remaining risk. A practical starting model is: IT: Maintains infrastructure and service dependencies; tests and deploys changes; operates backups; restores services. Cybersecurity: Defines protection requirements; evaluates threats and exposure; validates safeguards; leads or supports investigations under the incident plan. Business owners: Identify service criticality, approve business access needs, and establish acceptable disruption and recovery targets. Authorized leadership: Resolves competing priorities, funds necessary work, and approves consequential risk exceptions. Assign named owners rather than relying on department labels. Include cloud providers, managed service providers, and other partners: a contract does not automatically establish who acts during an emergency. In smaller organizations, one person may hold several roles. Document those roles anyway, and arrange separate review for significant exceptions where feasible. Stop treating silence as approval A deferred security fix should become a documented, time-limited exception—not an aging ticket with no decision. Record the owner, business rationale, exposure, compensating safeguards, authorized approval, expiration date, and review triggers. Risk acceptance should be visible to someone empowered to make that business decision. Build One Shared View of Critical Services Both teams need more than a device inventory. They need to understand how technology supports business operations. Start with one important service and record its business and technical owners, supporting systems, sensitive data, external exposure, identity dependencies, providers, monitoring, and recovery arrangements. Include software-as-a-service applications: someone must own their configuration, access removal, logging, and recovery limitations. For example, restoring a customer portal may require its identity provider, database, network services, and third-party integrations. A server list alone will not reveal whether the business can complete a customer transaction. Expand the inventory from a validated service map, rather than waiting for a perfect enterprise-wide catalog. Turn Vulnerability Reports Into Coordinated Remediation Security handing IT a scanner report is not a complete remediation process. NIST’s enterprise patch-management guidance treats patching as preventive maintenance and includes identification, prioritization, installation, and verification. Use the CISA Known Exploited Vulnerabilities catalog as an input to prioritization, alongside asset exposure, business impact, and existing safeguards. A severity score alone does not establish your organization’s urgency. Create one tracked workflow: Confirm: Identify affected assets and accountable owners. Prioritize: Assess exploitation evidence, reachability, privileges, and service importance. Choose: Patch, apply a validated mitigation, restrict exposure, or retire the system. Execute: Plan testing, deployment, rollback, communication, and escalation. Verify: Confirm the change took effect and retain evidence before closing the work. Suppose an exposed application cannot be patched without an outage. The joint decision might involve temporarily restricting access while testing an emergency update. Any mitigation must be validated against the actual vulnerability; “behind a firewall” is not automatically sufficient. The tradeoff is change risk versus exposure risk. Normal maintenance windows should not automatically override urgent threats, but urgency should not erase dependency checks or rollback planning. Design Access and Monitoring Together Make stronger authentication supportable CISA’s #StopRansomware Guide recommends phishing-resistant multifactor authentication. Deploying it requires security requirements, IT compatibility testing, service-desk preparation, and business input. Test enrollment, lost authenticators, account recovery, and emergency administration. Otherwise, support procedures can become the weak point in an otherwise strong control. Coordinate joiner, mover, and leaver processes so access changes follow business changes promptly. Collect logs for defined purposes Joint government logging guidance emphasizes approved policy, centralized access and correlation, secure storage, and threat-relevant detection. For each important source, agree on required events, collection ownership, alert investigation, access restrictions, retention, and detection of collection failures. Security cannot investigate records that IT assumes someone else is collecting. More logging is not automatically better. Balance investigation needs against cost, query performance, privacy, and retention obligations. Test whether an analyst can answer a real question—such as which resources a compromised administrator accessed. Rehearse Incident Decisions and Business Recovery NIST SP 800-61 Revision 3 integrates incident response into broader cybersecurity risk management. Effective response depends on coordinated responsibilities across technical teams, leadership, and external parties. Agree on authority before the emergency Use a compromised-administrator scenario to test who declares an incident, leads coordination, disables accounts, isolates systems, preserves evidence, and approves shutting down a critical service. Include legal, communications, and relevant providers. Establish an alternate communication channel if normal email or collaboration systems are unavailable. Preauthorize appropriate containment actions within clear boundaries. Fast containment may interrupt operations; delayed containment may expand damage. Those decisions need an escalation path, not improvised negotiations. Restore a usable service, not just a backup CISA recommends offline, encrypted backups and regular recovery testing. IT should restore systems and dependencies; security should assess whether the compromise has been addressed; business owners should validate essential transactions. Agree on recovery-time and acceptable-data-loss targets, then test them. Record elapsed time, missing data, and failed dependencies. A successful backup job does not prove recoverability, and a restarted server does not prove safe restoration. Measure Shared Outcomes and Start Small A joint dashboard should make unresolved decisions visible, not reward activity counts. Useful measures include: Ownership coverage: The proportion of critical services with named business and technical owners. Exposure: Applicable known-exploited vulnerabilities still unresolved, including their age and mitigation status. Execution quality: Verified remediations and security changes that cause service disruption. Resilience: Recovery exercises meeting agreed targets and overdue corrective actions. Governance: Expired exceptions and decisions awaiting authorized approval. Define scope and denominators so trends remain meaningful. Review priorities through a shared work queue that includes operational constraints and required resources. A suggested 90-day rollout is to establish ownership and map one service first; connect remediation, access, and monitoring workflows next; then run an incident exercise and restoration test. This is an adaptable implementation sequence, not a mandated timeline or a reason to delay urgent fixes. IT and Cybersecurity Collaboration Checklist Critical services have named business and technical owners. Implementation, verification, escalation, and risk-acceptance authority are documented. Both teams use a shared inventory and prioritized work queue. Remediation includes testing, rollback planning, and verified closure. Exceptions have safeguards, approval, and expiration dates. Authentication changes include support and recovery procedures. Logging has collection, investigation, and retention owners. Incident plans define containment authority and alternate communications. Relevant providers participate in response and recovery planning. Recovery tests include security assessment and business validation. Shared measures track reliability as well as risk reduction. Exercise findings become assigned, tracked corrective work. Make Collaboration Visible in Completed Work IT and cybersecurity do not need identical responsibilities. They need connected decisions and accountability for a shared business outcome. Start this week: select one critical service, bring its IT, security, and business owners together, and identify its most important unresolved risk. Assign the next action, the decision-maker, and the evidence required for closure. That is how collaboration moves from an organizational aspiration to an operating discipline. ## Can AI Crack 51% of Passwords in Under a Minute? What PassGAN Really Shows - URL: https://bartmcd.com/blog/passgan-ai-password-cracking-51-percent-claim - Published: 2026-09-28 A headline claiming that artificial intelligence can crack half of all passwords in seconds makes account security sound hopeless. It also leaves out the details that matter most: Which passwords? Tested how? Against what defenses? Home Security Heroes, now redirecting readers to Security Hero, reported that the AI-based password-guessing tool PassGAN could crack 51% of common passwords in less than a minute . That is a publisher-reported benchmark—not evidence that attackers can compromise 51% of today’s online accounts in that time. The useful lesson is not that AI has defeated cryptography. It is that predictable, reused passwords remain dangerous. Understanding what the benchmark measures helps you choose protections that address the actual risks. What Did the PassGAN Study Actually Report? The publisher’s study page reported the following results for common passwords: Less than one minute: 51% cracked. Less than one hour: 65% cracked. Less than one day: 71% cracked. Less than one month: 81% cracked. Its methodology describes a RockYou-derived dataset of 15,680,000 passwords used for training and testing, excluding passwords shorter than four or longer than 18 characters. It calls the timing metric “estimated prediction time.” Those qualifications matter. A collection of previously leaked passwords is not a representative sample of every password used today. Excluding longer passwords also limits what the results can establish about long, randomly generated credentials. The published methodology does not provide hardware specifications, a password-hashing configuration, a reproducible timing procedure, or a clear explanation of training/test separation. Without those details, readers cannot independently validate the timing claim or confidently apply it to their accounts. The page’s title mentioning 2026, while its findings remain labeled 2023, does not establish a fresh benchmark. A percentage and a stopwatch are not enough to measure account security. The dataset, attack conditions, and authentication defenses determine what the result means. What Is PassGAN—and What Does AI Actually Do? PassGAN uses a generative adversarial network , or GAN, to learn patterns in leaked passwords and generate likely guesses. The original research was first submitted in September 2017; PassGAN was not a new invention in 2023. Traditional guessing tools use dictionaries and transformation rules. PassGAN learns patterns from examples, potentially producing useful guesses that complement conventional methods. But each candidate still needs to be tested against the target. AI improves guessing; it does not bypass cryptography. There is also a separate statistic to distinguish: the research paper reported matching 51%–73% more passwords when combining PassGAN and HashCat output than with HashCat alone. That relative improvement is not the same as cracking 51% of passwords within one minute. Why a Cracked Password Is Not Necessarily a Compromised Account Different attacks encounter different defenses. Treating them as interchangeable makes the headline more frightening—and less useful. Offline cracking If attackers steal password hashes, they can test guesses on their own computers without a website’s login rate limits. Speed depends on hardware, the hashing algorithm, and its configured cost. As OWASP explains , purpose-built password hashing makes each guess more expensive. Online guessing Attackers submitting guesses to a live login page face rate limits, monitoring, and potentially multifactor authentication. Finding the correct password may still leave them unable to complete authentication. Offline estimates cannot simply be translated into online account-takeover times. Credential stuffing Sometimes no cracking is necessary. Attackers try credentials stolen from one service against another. For example, reusing a shopping-site password for email can turn an unrelated breach into an email-account threat. Password uniqueness directly addresses this risk. Phishing and malware A convincing fake login page can capture a long password. Malware can steal credentials or sessions. Password strength protects against guessing, not every route into an account. What You Should Do Now 1. Secure your email and other high-impact accounts first Your primary email often controls password resets elsewhere. Protect it before working through less consequential accounts, then prioritize your password manager, financial accounts, and administrative access. Check recovery addresses and phone numbers as well as the login method. 2. Generate a different random password for every account For accounts that still require passwords, use a password manager to generate and store independent passwords. Aim for at least 15 characters, and longer where practical . Avoid variations built from the same word, season, company name, or predictable suffix. If you must memorize a password, use a long passphrase made from independently selected words rather than a familiar quotation. Length helps, but predictable construction still matters. Never copy a published example into a real account. NIST recommends password managers and choosing one that supports MFA. The tradeoff is concentration: the manager becomes an especially important account. Protect its login, secure recovery information, and understand how you will regain access after losing a device. 3. Prefer passkeys where available Passkeys replace shared passwords with cryptographic credentials tied to the legitimate service. They resist phishing because a look-alike website cannot use the credential intended for the real site. A device PIN or biometric can authorize their use. Synced passkeys offer convenient access across supported devices, but require understanding the provider’s account security and recovery process. Device-bound passkeys remain on a particular device or security key, making a backup authenticator especially important. Before replacing a phone or removing an older login method, confirm backup access. As the FIDO Alliance’s deployment guidance emphasizes, recovery planning belongs alongside enrollment. 4. Add MFA wherever passwords remain CISA recommends moving toward phishing-resistant MFA , such as appropriately configured FIDO authentication. Authenticator-app codes still add protection, but manually entered codes can be relayed through a phishing site. All MFA methods are not equivalent. 5. Replace exposed passwords—not just aging ones Change passwords when they are weak, reused, exposed, or associated with suspicious activity. Routine changes that merely replace one predictable suffix with another do little to address the underlying problem. What Businesses and Website Owners Should Change User education cannot compensate for weak authentication design. The final NIST SP 800-63B-4 guidance, published July 31, 2025 , provides a stronger baseline for systems within its scope: Require at least 15 characters for password-only authentication. Passwords used as part of MFA may have an eight-character minimum. Permit a maximum password length of at least 64 characters . Screen new passwords against common and compromised values. Do not impose mandatory character-mixture rules or routine periodic password changes; require changes when there is evidence of compromise. These are system requirements, not guarantees that every password meeting a length threshold is safe. Protect stored credentials. OWASP recommends purpose-built password hashing, including Argon2id with a minimum configuration of 19 MiB memory, two iterations, and parallelism of one. Use unique salts and benchmark stronger settings against operational capacity. Higher costs impede attackers but also consume legitimate server resources. Defend authentication and recovery together. Combine rate limiting, MFA, suspicious-login detection, and session controls. Do not rely solely on IP blocking against distributed attacks. Give users visibility into active sessions and a way to revoke them. Recovery procedures must not become an easy route around stronger login protections. If You Suspect an Account Is Already Compromised Do not wait to establish whether AI was involved. From a trusted device, follow the provider’s official recovery process. The FTC recommends changing the password, signing out other sessions, strengthening authentication, and checking recovery information. For email, remove forwarding rules you did not create. Check potentially affected devices for malware, and replace the exposed password anywhere else it was reused. Changing one account does not invalidate the same credential on another service. Your Account-Security Checklist Secure your primary email account first. Replace reused passwords with independently generated ones. Use long passwords and protect your password manager with MFA. Enable passkeys or phishing-resistant MFA where supported. Arrange backup access before changing devices. Review recovery settings and unfamiliar sessions. Act on compromise alerts rather than waiting for a scheduled password change. The Bottom Line: Address the Risk, Not Just the Headline PassGAN illustrates how machine learning can improve password guessing. It does not establish that half of all accounts are instantly accessible or that cryptography has become obsolete. Start with your primary email today: eliminate password reuse, enable a passkey or strong MFA, and verify recovery access. Then extend those protections to your other important accounts. That layered approach addresses AI-assisted guessing—and the attacks that never need to guess a password at all. ## How to Stop Wire Transfer Fraud: Prevention and Emergency Response - URL: https://bartmcd.com/blog/stop-wire-transfer-fraud-prevention-emergency-response - Published: 2026-09-28 A convincing invoice, a familiar email thread, and a deadline can be enough to send a legitimate payment to a criminal’s account. Wire transfer fraud succeeds when trust replaces verification—not just when someone clicks a malicious link. If you have already sent a suspicious wire, contact the sending bank immediately. If you have not, pause the payment and independently verify the instructions. For businesses, homebuyers, and individuals, the core safeguard is the same: confirm where the money is going through a trusted channel established outside the payment request. Already Sent the Money? Act Immediately 1. Call your bank’s fraud or wire-transfer team Use the number in your banking app, on your statement, or another independently verified source—not contact details in the suspicious message. Explain whether someone accessed your account without permission or deceived you into authorizing the wire. That distinction can affect the bank’s investigation and applicable protections. Ask the bank to: Stop the wire if it has not been released. Attempt an urgent recall or recovery if it has. Contact the receiving institution about the suspected fraud. Provide a case number and follow-up instructions. IC3’s business email compromise guidance also recommends asking about a Hold Harmless Letter or Letter of Indemnity. Let the bank guide any required documentation. If you used a money-transfer company instead, contact that provider immediately and request cancellation or a refund. 2. Report the fraud and preserve evidence File a report through the FBI’s Internet Crime Complaint Center . Gather the transfer date, amount, currency, transaction reference, beneficiary details, sending and receiving banks, and a timeline. Preserve original emails, attachments, messages, receipts, and relevant account records. Do not delay the bank call while assembling a perfect report. Financial recovery, reporting, and account security should proceed in parallel when possible. 3. Contain account compromise and avoid recovery scams If email or banking access may be compromised, involve your IT team or security provider immediately. Use a trusted communication channel for incident coordination. Be wary of anyone promising guaranteed recovery for an upfront fee. The FTC warns that recovery scammers target people who have already lost money , sometimes impersonating government agencies or legitimate organizations. Understand What You Are Trying to Stop In business email compromise, or BEC, criminals impersonate an executive, vendor, attorney, or settlement professional. They may use a lookalike address or take over a real mailbox, allowing them to insert fraudulent instructions into an existing conversation. The FBI identifies vendor payments and real estate transactions as common targets . Warning signs include changed bank details, unexpected beneficiaries, secrecy, and pressure to bypass approval. These warrant investigation, but their absence does not prove a payment is safe. Grammar is not a reliable defense. The FBI warns that criminals use generative AI to improve messages and create convincing audio and video impersonations. A familiar voice should not override payment controls. Verify Payment Instructions Independently Establish trusted contacts before money is due Record a verified contact and telephone number when a vendor relationship or transaction begins. Before sending a wire, call that person using the established number. Confirm the payment’s purpose, beneficiary, receiving bank, and account instructions. Replying to the same email is not independent verification. Neither is calling a new number supplied in that email. An incoming call—even with a familiar caller ID—should not replace your own callback to a trusted number. For example: A supplier sends an invoice announcing a new bank account. Instead of using the invoice’s phone number, accounts payable calls the supplier contact already on file. The payment remains on hold until the change is verified and separately approved. Treat every bank-detail change as a new authorization Do not overwrite saved beneficiary information simply because an email requests it. A practical workflow is to hold the change, verify it through the established contact, document the confirmed instructions, and obtain separate approval before use. Record who verified the details, which trusted number they called, when verification occurred, and who approved release. Protect that record because it contains sensitive financial information. If the contact is unavailable, pause. Establish backup contacts in advance rather than improvising under deadline pressure. Separate preparation from approval For businesses, have one person prepare the wire and another approve it. Apply separation to beneficiary changes as well. The second reviewer must examine the verification evidence—not merely trust the preparer. This implements the FBI’s recommendation for independent verification and secondary sign-off . Ask your bank about separate user permissions, dual approval, transfer limits, beneficiary controls, and transaction alerts. Availability varies. The tradeoff: Verification adds time and staffing requirements. Reduce disruption with scheduled payment windows and designated alternates, not informal exceptions for urgent requests or senior executives. Urgency is a reason to follow the verification process—not a reason to suspend it. Protect Accounts Without Confusing Login Security With Payment Safety Require multifactor authentication, or MFA, for email, banking, administrative access, and other supported payment systems. CISA recommends prioritizing phishing-resistant MFA ; FIDO/WebAuthn-based options provide that protection where supported. Plan enrollment, backup authenticators, and secure recovery procedures. Keep two questions separate: Authentication: Is this person entitled to access the account? Payment verification: Is this recipient and transaction legitimate? MFA helps prevent account takeover. It does not stop an authorized employee from approving fraudulent instructions. Similarly, two approvers can both be deceived if neither independently verifies the destination. Investigate unexpected forwarding, missing messages, unfamiliar inbox rules, or unauthorized authentication methods. For Microsoft 365, Microsoft’s compromise-response procedure includes disabling affected accounts during investigation, revoking sessions, reviewing authentication methods and application permissions, removing malicious rules, and examining logs. A password reset alone is not a complete response. Train employees with realistic payment-change scenarios and give them explicit authority to stop questionable transactions. Reporting a concern should be easier than making an exception. Special Precautions for Homebuyers and Individuals Before closing, identify trusted representatives at your title or settlement company and agree on how to verify wiring instructions. Save their contact information separately from email. The CFPB recommends establishing trusted contacts and independently confirming account information . Immediately before wiring, call the agreed number and confirm the beneficiary and account details. If a last-minute message changes the destination, stop—even if delaying payment could affect the closing schedule. For example, an email claiming that the settlement company’s bank is “undergoing maintenance” does not justify sending closing funds to a replacement account. Resolve the discrepancy with your established representative. Individuals making other high-value payments can use the same callback process. Someone else’s deadline is not evidence that their instructions are authentic. Can a Fraudulent Wire Be Reversed? A recall request is not a guaranteed reversal. The Federal Reserve describes Fedwire settlement as immediate, final, and irrevocable . Banks and authorities may still attempt to recover fraud proceeds, but a completed wire cannot simply be undone on demand. Rights depend on the transfer. For covered consumer remittances sent abroad, federal protections generally include a 30-minute cancellation opportunity after payment, unless funds have already been picked up or deposited into the recipient’s account. The CFPB explains these remittance protections ; they are not a universal cancellation window for domestic business wires. Ask your provider about your specific transaction. Report suspected fraud even if time has passed. Your Wire Transfer Fraud Checklist Before releasing a payment ☐ Confirm the payment’s purpose and intended recipient. ☐ Verify instructions using a previously established, trusted contact. ☐ Confirm beneficiary, bank, and account details—not just the amount. ☐ Independently verify any banking change before updating saved records. ☐ Document verification and complete required separate approvals. ☐ Stop unresolved discrepancies; do not let urgency override controls. If fraud is suspected ☐ Call the sending institution immediately. ☐ Request a stop, recall, or recovery attempt and obtain a case number. ☐ Submit an IC3 report with accurate transaction information. ☐ Preserve original communications and payment records. ☐ Involve IT or security if account compromise is possible. ☐ Reject unsolicited recovery guarantees and upfront-fee offers. Make Verification Routine Stopping wire transfer fraud requires secure accounts, independent payment verification, and disciplined approval—not one supposedly foolproof tool. Before your next wire, establish trusted contacts, confirm your bank’s controls, and put this checklist into the payment workflow. If money has already gone to a suspected scammer, make the bank call now. ## Detect Phishing 101: How to Spot a Scam Before You Click - URL: https://bartmcd.com/blog/detect-phishing-how-to-spot-scams-before-you-click - Published: 2026-09-28 An email says your account will be suspended. A text demands a small delivery fee. A supplier sends updated banking instructions inside an existing conversation. Each request could look routine—and each could be phishing. Phishing uses deceptive messages, websites, or conversations to persuade you to disclose information, grant access, install harmful software, or send money. It reaches people through email, texts, messaging apps, and phone calls. The safest response is to verify the request somewhere else. Open the organization’s app, use a trusted bookmark, or call a number you already know. Do not let a suspicious message supply both the problem and the supposed solution. 1. Start With the Request, Not the Appearance Before studying the logo or grammar, ask: What is this message trying to make me do? The FTC’s phishing guidance identifies familiar stories: suspicious account activity, payment problems, unfamiliar invoices, and requests to confirm personal information. Slow down when a message asks you to: Enter a password or disclose a sign-in verification code. Send money, buy gift cards, or change banking details. Release sensitive employee, customer, or financial records. Open an unexpected attachment, install software, or run commands. Keep the request secret or bypass normal approvals. Urgency alone does not prove fraud. But urgency combined with an unusual request deserves independent verification. Do not rely on spelling mistakes. The FBI warns that criminals use generative AI to create more convincing messages and reduce language errors. Polished writing, accurate job titles, and familiar branding are not authentication. 2. Inspect the Sender and Destination Check the actual email address Expand the sender details. A display name such as “Payroll” or a colleague’s name tells you little. Look for misspelled domains, unfamiliar addresses, and unexpected reply-to addresses. However, a legitimate address is not proof of safety. Attackers can compromise real accounts and insert fraudulent requests into genuine conversations. The FBI’s business email compromise guidance recommends independently verifying payment changes and other sensitive requests. Read links carefully—without visiting them On a computer, hovering over a link can reveal its destination. The following illustrative addresses use reserved example domains: https://login.example.com/ has “login” as a subdomain of example.com. https://example.com.attacker.example/ belongs under attacker.example, not example.com. https://attacker.example/example.com/login places the familiar name in the path, not the destination’s domain. A familiar name somewhere in an address is not enough. Shortened links and legitimate tracking services can also obscure destinations, so unfamiliarity alone does not settle the question. HTTPS does not mean trustworthy. It encrypts the connection; it does not establish that the operator is honest. Chromium’s security team explains this distinction . If a destination is difficult to inspect, especially on a phone, stop decoding it. Open the service independently instead. 3. Recognize Traps Beyond Ordinary Links Unexpected attachments and shared documents An invoice or shared document may contain harmful software—or simply lead to a fake sign-in page. Confirm that you expected the file before opening it. If a document unexpectedly demands your email password, stop and contact the sender through an established channel. QR codes A QR code is another way to deliver a link. The FTC warns that scammers hide harmful destinations in QR codes . For an unexpected delivery or account notice, use the official app rather than scanning the message’s code. Fake CAPTCHA and repair instructions Stop if a webpage asks you to paste commands into Windows Run, PowerShell, or a terminal to prove you are human or fix an error. Microsoft documents this technique as ClickFix : attackers persuade the visitor to execute the harmful command themselves. 4. Verify Through a Separate, Trusted Channel Microsoft recommends contacting the organization independently rather than using suspicious links—even when the apparent sender is someone you know. Bank alert: Open your banking app or call the number on your card. Account suspension: Navigate to the service using a trusted bookmark and check account notifications. Supplier payment change: Call a previously verified contact, not the new number in the email. Unusual request from your manager: Confirm through an established number or in person. Replying to the same email is not independent verification: the attacker may control that conversation. A familiar voice is not conclusive either; AI can imitate voices. Initiate contact through a trusted route. You do not have to prove a message is malicious before choosing a safer way to handle its request. Verification adds friction. Reserve the strongest checks for high-consequence actions: payments, account access, sensitive records, and changes to established procedures. 5. Use Security Tools Without Treating Them as Guarantees Email filtering, browser warnings, and updated software reduce exposure, but no single tool catches everything. Conversely, an “unverified sender” warning does not automatically establish fraud. Evaluate the request as well as the indicators. Enable multifactor authentication, and prefer passkeys or FIDO2 security keys where supported. NIST explains that manually entered one-time codes are not phishing-resistant : attackers can trick you into providing a code and relay it to the legitimate service. Passkeys and FIDO2 security keys bind authentication to the legitimate service. They do not prevent every scam, such as a fraudulent payment request. Never disclose a sign-in code to an unexpected caller or approve a login prompt you did not initiate. For organizations, combine training with filtering, phishing-resistant authentication, clear payment controls, and easy reporting. Employees should not be the only defense. 6. Report Suspicious Messages For work or school accounts, use the organization’s designated reporting button or contact security. If you interacted with the message, explain exactly what happened. Avoid forwarding it casually to colleagues. Gmail on a computer: Open the message without following links or attachments, select More next to Reply, then Report phishing. See Cornell IT’s Gmail reporting instructions . Supported Outlook interfaces: Select the message, then Report and Report phishing. See Microsoft’s reporting instructions . Workplace controls may differ; follow your organization’s procedure. U.S. text messages: Forward phishing texts to 7726, which spells SPAM, as recommended in the FTC’s reporting guidance . U.S. fraud reports: Use ReportFraud.ftc.gov ; report internet crime, including business email compromise, to IC3.gov . After reporting, delete the message unless your security team asks you to retain it. 7. If You Already Clicked, Respond to What Happened Stop interacting. Clicking does not automatically mean your account is compromised, but entering information, granting access, or running software changes the response. You only opened the page Close it. Do not accept notifications, download files, or continue “verification.” Report the message. On a work device, tell IT about any unexpected downloads or browser behavior. You entered credentials, shared a code, or approved access From a trusted device, go directly to the legitimate service. Change the exposed password and any reused passwords. Revoke unfamiliar sessions and connected applications; review recovery details and recent security activity. For email, check forwarding rules and filters. Google’s compromised-account guidance provides a useful recovery model. Notify workplace IT immediately if relevant. You downloaded or ran something Do not open a downloaded file. If you ran software or commands, contact IT immediately for a managed device. For a personal device, update security software and run a scan; seek qualified help if compromise is suspected. Avoid changing passwords on a potentially compromised device. You sent money or disclosed identity information Contact your bank or payment provider immediately and request fraud assistance, including a recall if available. Recovery is not guaranteed, but speed matters. For exposed identity information in the United States, use IdentityTheft.gov for tailored steps. Your Practical Phishing Checklist Pause: Is pressure pushing me to skip normal checks? Question: Was I expecting this request? Inspect: Does the actual sender or destination raise concerns? Protect: Does this involve money, credentials, sensitive data, or software? Verify elsewhere: Can I use a trusted app, bookmark, or established contact? Report: Have I used the appropriate reporting channel? Respond: Have I explained what I clicked, entered, downloaded, approved, or paid? Make Independent Verification a Habit Detecting phishing is not a test of who can spot the most typos. It is a repeatable decision process: examine the request, verify independently, and report concerns promptly. Take action today: enable phishing-resistant authentication where available, locate your reporting tools, and establish a callback rule for payment changes. The goal is not perfect suspicion. It is making the safer action your default. ## Protecting Your Privacy: How to Prevent Unwanted Tracking by Loved Ones - URL: https://bartmcd.com/blog/prevent-unwanted-location-tracking-by-loved-ones - Published: 2026-09-28 Location sharing should be a choice, not a condition of trust. When a partner, former partner, or relative knows where you have been without your permission, the explanation may be ordinary technology used inappropriately: a shared account, family-location app, vehicle service, or tracker in your belongings. Regaining privacy means reviewing those access points—not simply turning off your phone’s location setting. The first priority, however, is making changes without increasing your risk. There is no universal “stop tracking” switch. Start with personal safety, then work through accounts, apps, devices, and your surroundings. 1. Put Safety Before Technical Changes If you fear retaliation, do not immediately delete suspicious apps, remove trackers, or confront the person. Lost access can be noticeable even when a service sends no notification. The NNEDV Safety Net technology safety plan recommends considering how an abusive person might respond before changing technology. Use a safer device—ideally one the person has never accessed—to seek help. Private browsing does not make a monitored device safe. When safe, document incidents, messages, account alerts, and tracker notifications. Store evidence somewhere the person cannot access, not in a shared photo library or cloud account. In immediate danger in the United States, call 911. For domestic-violence support, call 800-799-7233 , text START to 88788 , or contact the National Domestic Violence Hotline . The Hotline warns that internet activity can be monitored and cannot be completely erased. Outside the United States, use local emergency and survivor-support services. 2. Review Deliberate Location Sharing iPhone: Start With Safety Check and Find My On an iPhone running iOS 16 or later, open Settings → Privacy & Security → Safety Check . You need to be signed in to an Apple Account with two-factor authentication. Manage Sharing & Access lets you review people, apps, connected devices, and account security. Emergency Reset quickly stops sharing covered by Safety Check and guides you through security settings. Apple explains the options in its Safety Check guide . Screen Time or device management may restrict some controls. Third-party accounts and other devices still require separate review. For a targeted change, open Find My → People → select the person → Stop Sharing My Location . Under Me , review Notifications About You for arrival or departure alerts. Turning off Share My Location stops sharing with everyone. Apple cautions that people may notice your location disappearing; earlier operating systems may also send a Messages notification. Sharing with people is separate from lost-device protection—do not disable useful device-recovery features unnecessarily. Google Maps and Google Location Sharing In Google Maps on Android, tap your profile picture → Location sharing → select the person → Stop . Review shared links and active trip-progress sharing, too. Hiding someone from your map does not stop them seeing you. Google Location Sharing is account- and device-specific and operates through several services, including Find Hub and Family Link. Check every relevant account and device; supervised accounts have different controls. Life360 and Other Family-Location Apps In Life360, open Settings → Location Sharing and turn sharing off for each relevant Circle. According to Life360’s guidance , members see “Location Sharing Paused.” Pausing does not delete previous history, and Check In, SOS, or enabled Crash Detection can still share location in specified circumstances. 3. Secure the Accounts Behind the Tracking Someone with account access may not need tracking software. For example, stopping Google Maps sharing will not remove a former partner’s access to your email or other account data. When safe, use a trusted device to: Secure primary accounts: Change exposed or reused passwords, starting with email and your Apple or Google account. Review sessions: Remove signed-in devices and sessions you no longer authorize. Check recovery methods: Remove recovery addresses, phone numbers, or authentication methods controlled by someone else. Inspect indirect access: Review third-party connections, email forwarding rules, and mailbox delegation. Google’s compromised-account guidance covers these checks. Password changes alone are not a complete cleanup. Avoid signing newly secured accounts into a device you suspect is monitored; doing so could expose the new credentials. 4. Inspect Permissions and Suspected Stalkerware Reduce Unnecessary App Access On iPhone, review Settings → Privacy & Security → Location Services . On Android, look under Settings → Location → App location permissions ; menus vary by manufacturer. Review apps with continuous access. Where appropriate, choose access only while using the app, ask each time, or deny access. Google’s permission guide explains available controls. Approximate location still reveals an area, and restrictions may disrupt navigation or intentional safety check-ins. On iPhone, also inspect Settings → General → VPN & Device Management . An unfamiliar profile deserves investigation, but work or school management is not automatically malicious. Removing a profile can remove associated settings, apps, and data. Do Not Rush to Reset a Suspected Monitored Phone Stalkerware secretly monitors a device. The FTC warns that investigating or removing it could alert an abusive person. Battery drain or unusual behavior alone does not establish that stalkerware is present. Seek assistance from another device and preserve evidence before making changes. A replacement phone with an account the person cannot access may be an option. A factory reset may remove stalkerware, but it does not fix compromised accounts or external trackers. If resetting is appropriate, preserve essential files separately and reinstall needed apps from official stores. The FTC cautions that restoring apps from a backup could reinstall stalkerware. Use a private screen-lock passcode and keep software updated. 5. Check for AirTags and Other Physical Trackers Unwanted-tracker alerts are useful, but they do not detect every tracking method. iPhone: Check Settings → Notifications → Tracking Notifications . Follow Apple’s required settings , including Bluetooth, Location Services, and relevant system-location settings. Airplane Mode must be off; compatible non-Apple tracker alerts require iOS 17.5 or later. Android: Open Settings → Safety & emergency → Unknown tracker alerts . Use Scan now for a manual check. Older versions may place this under Google settings. If an alert appears, save screenshots of the map and device information when safe. Use available sound or finding tools, check relevant belongings, and record the identifier or serial number. A borrowed item can trigger an alert; an alert does not establish who placed it. Turning off your phone’s Bluetooth or enabling Airplane Mode does not disable a separate tracker. Other devices may continue relaying its location. Google also warns that disabling some trackers can affect evidence linking them to an owner. Consider safety and evidence preservation before following disabling instructions. Review intentionally shared trackers, too: Apple suppresses unwanted-tracking notifications for an AirTag while you belong to its sharing group. 6. Look Beyond Your Phone Connected cars: Review vehicle-app accounts and authorized users. A former partner’s app access may remain after you change phones. Ask the manufacturer about removing access; consider professional inspection for suspected hidden devices. NNEDV’s connected-car guidance also addresses indirect clues such as toll and service records. Family phone plans: Ask the carrier which location services are active, who can manage them, and what account changes might reveal. Smart homes: Review cameras, doorbells, locks, and shared administrators. Leaving a household account does not stop its owner operating cameras. Social information: Avoid real-time location posts and ask trusted contacts not to disclose your whereabouts. Photo backgrounds, shared calendars, and receipts can reveal locations without a tracking app. Your Practical Privacy Checklist ☐ Assess retaliation risk and identify a safer device for support. ☐ Preserve evidence outside shared accounts. ☐ Review location sharing across every account, device, and group. ☐ Check passwords, sessions, recovery details, and authentication methods. ☐ Review app permissions and unfamiliar management profiles. ☐ Check tracker alerts and intentionally shared trackers. ☐ Review vehicle, carrier, smart-home, and social access. ☐ Reopen settings to verify changes and retain useful safety protections. Take the Safest Next Step You do not need to prove malicious intent to want privacy. If sharing is genuinely voluntary, consider a narrower arrangement: a check-in message or temporary journey sharing rather than permanent access. Choose one safe next step today. That may be reviewing an account—or contacting an advocate before touching any settings. You do not owe anyone a confrontation that puts you at risk. ## Why Do Clients Call Us? Turning IT and Cybersecurity Problems Into Clear Business Decisions - URL: https://bartmcd.com/blog/it-cybersecurity-advice-clear-business-decisions - Published: 2026-09-28 An application keeps failing. A customer asks for proof of security controls. An employee reports a suspicious login. Or a leadership team wants to adopt AI without exposing sensitive information. These are different problems, but they lead to the same question: Do we have the expertise, capacity, and accountability to handle this well? That is the most useful way to approach “Why do clients call us?” For a business considering an IT or cybersecurity adviser, the value should extend beyond fixing technology. The engagement should restore reliable operations, clarify responsibilities, make risk understandable, and support better decisions. A productive call turns uncertainty into a defined problem, an accountable owner, and a practical next step. Six Reasons to Contact an IT and Cybersecurity Adviser 1. Technology problems are disrupting business operations Recurring outages, unreliable remote access, and slow applications are business problems before they are technical problems. Start by describing the work that cannot happen. For example, if an accounting team cannot issue invoices, “the system is slow” is not a sufficient problem statement. Explain which workflow is affected, when the disruption occurs, who depends on it, and what has already been tried. Ask the adviser to separate immediate restoration from root-cause remediation . A workaround may get invoices moving today without resolving the underlying issue. Tradeoff: Faster restoration can justify a temporary fix, but only with documented limitations, an owner, and a plan to replace it. Define support hours and escalation procedures, and distinguish response commitments from resolution targets. 2. You cannot confidently explain your cyber risk You do not need a breach to justify a call. An inability to answer basic questions is a reason to investigate: What systems matter most? Where is sensitive data stored? Who has privileged access? Can critical services be restored? The NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide provides a foundation for discussing inventories, access controls, multifactor authentication, software updates, and tested backups. Request an evidence-based assessment that connects weaknesses to business consequences. “Backups completed” is less useful than knowing whether the right data can be restored within the business’s required timeframe. Tradeoff: A comprehensive assessment provides breadth; a focused review of critical systems can deliver faster direction. Either should produce prioritized actions—not an undifferentiated vulnerability list. 3. Something suspicious has happened A suspected incident is not a routine sales inquiry. Unauthorized account activity, unexpected encryption, or signs of data theft require prompt triage through an established response contact or verified channel. Record what was observed, when it occurred, which systems may be involved, and what actions have already been taken. If email may be compromised, use a separate, trusted communication channel. Do not send passwords or sensitive evidence through an ordinary contact form. Ask the response lead to coordinate containment, evidence preservation, recovery, and communications. Avoid independently wiping or rebuilding affected systems before receiving direction. NIST’s SP 800-61 Revision 3 integrates incident response into ongoing cybersecurity risk management, rather than treating it solely as an emergency procedure. Tradeoff: Restoring service quickly matters, but premature restoration can destroy evidence or reintroduce compromised systems. Establish decision authority and involve legal counsel when notification obligations may apply. 4. Your internal team needs additional capacity or expertise The choice is not simply “hire internally” or “outsource everything.” An internal team may understand the business exceptionally well while needing specialized security expertise, after-hours coverage, or help delivering a major project. Define the missing capability first. Then evaluate internal hiring, a shared delivery model, or broader managed services. Document who handles routine support, monitoring, incident escalation, change approval, and executive reporting. External support also introduces risk. Providers may receive extensive access to customer systems. NSA and CISA guidance on managed service providers emphasizes evaluating provider security and maintaining visibility into provider activity. Tradeoff: Outsourcing can expand capability, but the business still needs an internal owner for priorities, oversight, and risk decisions. 5. A customer, insurer, or regulator wants evidence A security questionnaire or contractual requirement can expose uncertainty about what the business actually does—and what it can prove. Bring the specific request. Ask the adviser to separate implemented controls with supporting evidence, documentation gaps, operational weaknesses, and questions requiring legal or specialist interpretation. The FTC’s cybersecurity guidance for businesses explains that NIST CSF 2.0 is flexible, voluntary guidance. Using a framework does not automatically satisfy every applicable legal, regulatory, or contractual obligation. Tradeoff: Better documentation may help meet a deadline, but it cannot substitute for functioning controls. Never describe planned safeguards as already implemented. 6. You are planning a significant technology change A cloud migration, acquisition, provider transition, or AI deployment deserves scrutiny before contracts are signed and access is granted. Consider an AI assistant proposed for internal document analysis. The decision is not only whether its answers are useful. It also involves which documents it can access, how the vendor retains or uses submitted information, and who checks outputs before consequential decisions. CIS Control 15: Service Provider Management recommends evaluating providers that handle sensitive data or support critical systems and processes. Ask for a dependency review, access design, success criteria, rollback plan, and exit requirements. For AI, include approved uses and human review expectations. Tradeoff: A limited pilot can test value sooner while restricting exposure. It should have explicit boundaries—not become an uncontrolled production rollout. What Should a Useful Engagement Deliver? The first conversation should produce clarity, not pressure to buy a predetermined package. Before approving substantial work, request a written summary covering: The business problem: What is happening, who is affected, and why it matters. The scope: Included systems, users, locations, dependencies, and exclusions. The evidence: What is known, what remains uncertain, and what needs validation. The action plan: Immediate stabilization, prioritized improvements, owners, and target dates. The commercial terms: Fees, assumptions, separately charged work, and approval requirements. The success measures: How both parties will determine whether the situation improved. Measures should match the problem. For reliability, track recurring disruptions and their business impact. For recovery, test restoration against agreed requirements. For access security, verify that unnecessary privileges have been removed. Joint government guidance for MSPs and their customers recommends transparent contractual responsibilities, including purchased services and incident-response arrangements. Ambiguity during procurement can become an operational failure during an emergency. How to Evaluate the Adviser, Not Just the Proposal Distinguish strategic advice, day-to-day IT support, security monitoring, and emergency response. One provider may offer all four, but one contract may not include them all. Ask how the provider secures privileged access, records its activity, manages subcontractors, and notifies customers of incidents affecting its services. Request an explanation of how access is revoked and data returned or deleted when the relationship ends. CISA’s risk guidance for MSP customers supports documenting requirements and service expectations rather than assuming coverage. Warning signs include absolute security guarantees, unclear exclusions, product recommendations before discovery, and resistance to explaining security responsibilities. A credible adviser should make uncertainty visible and explain alternatives—including situations where the business should retain the work internally. Before-You-Call Checklist Prepare what you can, but do not delay reporting a suspected incident to complete this list. □ Write a short description of the problem and its business impact. □ Identify affected services, users, locations, and important deadlines. □ Record symptoms, relevant dates, and previous troubleshooting or response actions. □ Name the internal decision-maker and technical contact. □ Gather relevant contracts, service commitments, and external requirements. □ Describe the outcome you need and how you would recognize improvement. □ Separate urgent containment or restoration from longer-term improvement. □ Prepare questions about scope, fees, coverage, escalation, and responsibility. □ Ask how sensitive information can be shared securely; do not include credentials in an initial inquiry. Make the Call About the Decision You Need to Make The strongest reason to contact an IT or cybersecurity adviser is not that you need another tool. It is that a business-critical question needs a clearer answer. Choose the issue creating the most uncertainty today. Write down its impact, identify the person responsible, and arrange the appropriate conversation—emergency response when necessary, structured discovery otherwise. Judge the advice by three questions: What matters most? Who owns the next step? How will we know things have improved? Those answers are the foundation of a useful engagement. ## Brilliance in the Basics #4: Endpoint Protection - URL: https://bartmcd.com/blog/endpoint-protection-basics-for-small-businesses - Published: 2026-09-28 Imagine an employee’s laptop blocks a suspicious download. That is a useful security win—but it leaves important questions unanswered. Is the operating system current? Did the same file reach another device? Who reviews the alert? Could the business recover if the next attack succeeded? Endpoint protection is not simply installing antivirus. It is keeping devices secure, detecting suspicious activity, and making sure someone can respond. For individuals and small businesses, the fundamentals matter more than collecting security products: know your devices, maintain their defenses, investigate warnings, and prepare to recover. What Is Endpoint Protection? An endpoint is a device that accesses or processes information: a laptop, desktop, smartphone, tablet, or server. Protection needs vary by device, but the objective stays consistent—reduce opportunities for compromise and limit the damage when prevention fails. Three terms help clarify what you are buying: Antivirus or anti-malware: Detects, blocks, or removes malicious software. This is a foundational prevention layer. Endpoint detection and response, or EDR: Collects device activity, identifies suspicious behavior, and supports investigation and containment. Managed detection and response, or MDR: Adds a service team to investigate and respond to threats. Coverage and response authority depend on the agreement. Microsoft’s EDR documentation illustrates the distinction between blocking malware and investigating an attack. More visibility helps only when someone acts on it. The most important endpoint-security buying question is not “How many threats can this detect?” It is “Who will act on a serious alert?” 1. Know Which Devices You Are Protecting You cannot verify protection on equipment you have forgotten. Start with an inventory that includes office computers, remote laptops, servers, and personal devices authorized to handle business information. CIS Controls treats asset inventory and management as foundational safeguards. Record enough information to make decisions: Device name, owner, and business purpose. Operating system and whether it still receives security updates. Security software or management service. Last successful update and management check-in. Approved exceptions, their owners, and review dates. Compare that inventory with your security dashboard. For example, a contractor’s laptop might access company files without appearing in your management console. That gap needs an explicit decision—not an assumption that somebody else is handling it. Supported software matters independently of antivirus. Windows 10’s ordinary support ended on October 14, 2025. If devices remain on Windows 10, verify their applicable Extended Security Updates enrollment and migration plan. Consumer and commercial programs have different requirements. Microsoft explains why continued Defender protection does not replace operating-system security updates . 2. Verify the Defenses Already on Your Devices Built-in security can provide a useful foundation. Whether it is sufficient depends on the device, the information it accesses, and your monitoring needs. Windows Open Windows Security → Virus & threat protection . If Microsoft Defender Antivirus is your active provider, review its settings, confirm real-time protection is enabled, check protection updates, and examine Protection history. Review cloud-delivered protection and tamper protection as well. To identify the registered provider, use Windows Security → Settings → Manage providers . On managed devices, follow IT policy rather than trying to override settings. Microsoft documents supported antivirus compatibility arrangements ; do not install competing real-time antivirus engines unless the vendors support that configuration. Mac macOS includes Gatekeeper, notarization, and XProtect. These help assess downloaded software and detect or remediate malware. Keep macOS and its security updates current, and do not bypass warnings merely to make an unfamiliar installer run. Apple’s malware-protection guidance explains these layers. A business may still need centralized visibility and response. Built-in protection and organization-wide monitoring solve different problems. Android, iPhone, and iPad On Android devices with Google Play, open Play Store → profile icon → Play Protect → Settings and confirm app scanning is enabled. Google recommends keeping Play Protect on . On iPhone and iPad, app sandboxing prevents third-party security apps from inspecting the device like desktop antivirus. Prioritize supported software, automatic updates, strong device passcodes, and appropriate business management. Evaluate mobile security products by their actual capabilities, not an “antivirus” label. 3. Make Protection a Routine, Not a Purchase Enable automatic operating-system and application updates wherever practical. Include browsers, document readers, and other frequently used software. Plan required restarts; an update waiting indefinitely for a reboot is not a completed maintenance task. For businesses, central management helps answer questions that individual installations cannot: Which devices stopped checking in? Which have outdated protection? Where has a policy been disabled? CIS recommends centrally managed anti-malware and automatic updates, along with behavior-based protections where available. Use standard user accounts for everyday work, reserving administrative privileges for tasks that require them. Keep device firewalls enabled. Document security exclusions and review them rather than letting temporary workarounds become permanent blind spots. Test stronger restrictions before broad deployment. For example, Windows Controlled Folder Access can help prevent unauthorized changes to protected files, but a legitimate business application may need an allowance. Microsoft’s Windows Security guidance explains the feature. Prefer narrow, reviewed allowances over excluding entire folders from scanning. 4. Choose Tools You Can Operate For an individual, maintained built-in protection may be a reasonable baseline. A business needs to consider shared policies, sensitive data, contractual requirements, and response coverage—not just whether malware scanning is available. Before buying EDR or an MDR service, ask: Does it support every operating system and server type we use? How does it identify missing, outdated, or unhealthy devices? Which protections work offline, and which require connectivity? Who investigates serious alerts outside business hours? Can the provider isolate a device, or only recommend action? Which capabilities require additional licenses? Visibility has privacy implications. EDR can collect process, network, login, and file activity. Establish what is collected, where it is stored, who can access it, and how long it is retained. For personal devices, agree on boundaries before enrollment; a company-issued device may be the cleaner solution. Automation also has operational consequences. Isolating a compromised laptop can limit damage, but isolating a critical server can interrupt business. Define authorization and escalation rules. If internal staff cannot reliably investigate alerts, NIST’s small-business guidance recommends considering outside monitoring support. 5. Protect Accounts, Data, and Recovery Endpoint software cannot compensate for every stolen password, unsafe permission, or missing backup. Maintain the supporting safeguards: Multifactor authentication: Protect email, business applications, and administrative accounts; prefer phishing-resistant options where supported. Least privilege: Give people only the access their work requires. Full-disk encryption: Protect data on lost or stolen devices, and securely retain recovery keys. Encryption does not stop malware operating in an unlocked session. Protected backups: Maintain recovery copies that an infected everyday device cannot readily alter or delete. A synchronized folder is not automatically a resilient backup: unwanted changes may synchronize too. CISA’s ransomware guidance recommends offline, encrypted backups and regular recovery testing. A successful restore is stronger evidence than a successful backup notification. 6. Decide What Happens When an Alert Appears Not every blocked file signals a major incident. But credible compromise needs a defined response: Report: Contact the designated responder using the established procedure. Contain: Disconnect affected network connections or have an authorized administrator isolate the device. Preserve: Record the alert, device, time, and actions taken. Avoid wiping or casually rebooting before responders assess the situation. Recover: Investigate the scope, address the cause, and restore from verified clean sources before reconnecting. For ransomware, CISA advises powering down affected devices if they cannot be disconnected from the network, while noting that shutdown loses volatile evidence. Follow the incident plan and responder direction rather than improvising. Endpoint Protection Checklist Use this checklist for your next device review: ☐ Every authorized device has an owner and inventory record. ☐ Operating systems and applications are supported and updated. ☐ Appropriate device protections are active and healthy. ☐ Business devices check in to management where applicable. ☐ Exceptions and exclusions have approval and review dates. ☐ Administrative access is limited and device encryption is enabled. ☐ Someone owns serious alerts and after-hours escalation. ☐ Employees know how to report suspicious activity. ☐ Responders understand containment and evidence preservation. ☐ Protected backups have passed a restore test. The Bottom Line: Verify, Assign, and Test Brilliance in the basics means making essential protections dependable. Know your devices, verify their defenses, assign responsibility for alerts, and test recovery. Start with your inventory and security dashboard. Find the gaps between them, give each gap an owner, and set a completion date. The goal is not more installed software. It is fewer unprotected devices—and a response that works when prevention does not. ## Still Using the Same Three Passwords From Five Years Ago? Here’s How to Break the Habit - URL: https://bartmcd.com/blog/stop-reusing-passwords-secure-your-accounts - Published: 2026-09-28 You probably know the routine: one familiar password for important accounts, another for shopping, and a third with an extra number or symbol when a website demands something different. It feels manageable—until a breach at one service puts several accounts at risk. The solution is not to memorize dozens of complicated replacements. It is to stop making your memory responsible for every login. A password is not automatically unsafe because it is five years old. Reuse, predictability, and exposure are the more important issues. The practical path forward is to use passkeys where available, a password manager for passwords you still need, and multifactor authentication to strengthen password-based access. Why Reusing Three Passwords Creates More Than Three Risks When attackers obtain a username and password from one service, they can test that combination elsewhere. This attack is called credential stuffing . Password reuse turns an isolated breach into an opportunity to access unrelated accounts. Imagine that your shopping account and primary email share a password. If that credential is stolen from the retailer, an attacker might use it to enter your inbox. From there, password-reset messages could provide access to other services. Your email is not just another account; it is often a recovery channel for your digital life. Small variations offer little reassurance. Adding a year, changing capitalization, or replacing a letter with a symbol does not create a reliably independent password. The Federal Trade Commission recommends changing reused and similar passwords when a password is exposed. Should you change passwords just because they are old? Not necessarily. NIST’s digital identity guidance rejects mandatory periodic password changes while requiring changes when there is evidence of compromise. A long, unique password does not become weak simply because its birthday passes. Replace passwords that are reused, predictable, exposed, or similar to a compromised password. For work accounts, follow your organization’s procedures rather than bypassing its requirements. The goal is not constant password rotation. It is preventing one stolen credential from opening multiple doors. Start With the Accounts That Can Unlock Everything Else You do not need to fix every account in one sitting. Start with the accounts whose loss would cause the greatest damage: Primary email: Protect the inbox that receives password-reset messages. Password manager and credential-sync accounts: These protect access to your other credentials. Financial and sensitive accounts: Prioritize banking, payments, healthcare, and important personal records. Work and school accounts: Follow approved security and recovery procedures. Remaining accounts: Continue through shopping, social media, subscriptions, and older services. This is a practical starting order, not an inflexible rule. An actively compromised account needs immediate attention. Choose a Password Manager You Will Actually Use A password manager generates and stores unique passwords, removing the need to remember each one. The UK’s National Cyber Security Centre recommends password managers as a practical way to improve account security. Choose an approach that fits how you work: Built-in browser or device manager: Convenient, but confirm that credentials are accessible across your devices and browsers. Third-party manager: Useful across mixed platforms; compare compatibility, cost, sharing controls, and recovery options. Local-only manager: Keeps the database off a synchronization service, but makes backups and multi-device access more your responsibility. Before committing, examine encryption, security updates, MFA support, recovery procedures, and export options. The NCSC’s password-manager buying guide explains these considerations. Is keeping everything in one place risky? Yes, a vault concentrates valuable information. That tradeoff deserves attention, not dismissal. NCSC nevertheless concludes that the benefits outweigh the risks. Protect the vault with a strong, unique primary password and MFA where supported. Understand recovery before you need it. Keep essential recovery material somewhere secure that remains accessible if you cannot open the vault. Be careful when migrating: password exports may be unencrypted. Do not leave them in Downloads, email, or cloud storage after the transfer. Replace Reused Passwords With Generated Ones For accounts that still require passwords, use long, random, unique credentials . CISA recommends at least 16 characters and a different password for every account. Use this repeatable workflow: Open the service’s legitimate app or website directly. Find its password-change settings. Generate a password in your manager that meets the service’s requirements. Submit the change to the service and update the matching vault entry. Confirm that the saved credential works. Editing a password-manager entry does not change the password at the website. Both must match. This simple distinction prevents frustrating lockouts during a cleanup. For a password you must memorize, such as your vault’s primary password, consider a long passphrase made from randomly selected, unrelated words. Avoid quotations, personal facts, and published examples. A familiar phrase is easier to remember, but it may also be easier to predict. Add MFA—and Prefer Phishing-Resistant Options Multifactor authentication adds another kind of proof beyond a password. The FTC recommends enabling it , particularly for sensitive accounts. The available methods are not equally protective: FIDO security keys and passkeys: Support phishing-resistant authentication because authentication is bound to the legitimate service. Authenticator-app codes: Avoid phone-number takeover risks associated with text messages, but manually entered codes can still be phished. Text-message codes: Better than no second factor when that is the only option, but vulnerable to attacks such as SIM swapping. Look for “two-factor authentication,” “two-step verification,” or “multifactor authentication” in security settings. Save recovery codes securely, and never approve an unexpected sign-in prompt. MFA is an additional layer, not permission to reuse passwords. It also does not eliminate risks from malware, stolen sessions, or weak account-recovery processes. Use Passkeys Where Available, With a Recovery Plan A passkey uses cryptographic keys instead of a password you type. You typically authorize its use with your device’s fingerprint reader, face recognition, or PIN. The FIDO Alliance explains that passkeys are unique to each service and designed to resist phishing . For example, a counterfeit login page can trick you into entering a password. A passkey is designed not to authenticate you to that imitation site. Understand where your passkeys live: Synced passkeys can become available across devices through a provider. Protect that provider account and understand its recovery process. Device-bound passkeys remain on a particular device or security key. Plan for loss or failure, including a backup authenticator where supported. Only create passkeys on devices you control and trust. Google warns that someone able to unlock your device may be able to access your account . Its guidance also notes that adding a passkey does not automatically remove password sign-in. Keep any remaining password unique. Test the new sign-in method and confirm recovery options before removing an existing method. If a Password Has Already Leaked, Act Beyond the Reset Replace the exposed password and every reused or similar version elsewhere. Do not simply add another digit. If someone accessed the account, use the provider’s official recovery process from a trusted device. Following the FTC’s account-recovery guidance , also: Sign out other sessions using the service’s controls. Review MFA and recovery email addresses and phone numbers. Remove email-forwarding rules you did not create. Warn contacts if the account sent fraudulent messages. If malware is suspected, update security software, scan, and remove detected threats before proceeding with recovery. Report work-account incidents promptly through your organization’s security process. Your Password-Cleanup Checklist ☐ Identify reused, similar, weak, and exposed passwords. ☐ Secure primary email and other high-impact accounts first. ☐ Choose a password manager and understand its recovery process. ☐ Protect the vault and credential-sync accounts. ☐ Generate a different strong password for each account. ☐ Enable MFA for password-based sign-ins. ☐ Add passkeys where supported. ☐ Test recovery options for a lost phone or security key. ☐ Respond promptly to security alerts. ☐ Schedule another cleanup session—not automatic password rotation. Retire the Habit, Not Just the Passwords Replacing three old passwords with three new ones preserves the underlying problem. Better security comes from a system that makes uniqueness easy and limits the damage from any single compromise. Start today with your primary email. Give it a unique credential, enable the strongest authentication available, and verify recovery. Then repeat that process for your next most important account. You do not need a better memory. You need a safer routine. ## Brilliance in the Basics #2: Diverse Passwords for Every Account - URL: https://bartmcd.com/blog/unique-passwords-for-every-account - Published: 2026-09-28 A retailer you used once suffers a breach. An attacker obtains your email address and password, then tries that combination against your email, banking, and work accounts. If you reused the password, a problem at one business can become a problem across your digital life. This is why password diversity matters. Every account that uses a password needs its own independently generated password. Not a familiar phrase with a different number. Not one password for shopping and another shared across everything important. The practical solution is not better memorization. It is a repeatable system: use a password manager, replace reused credentials, enable multifactor authentication, and adopt passkeys where available. What “Diverse Passwords” Actually Means Diversity means independence: knowing one password should not help someone predict another. Attackers routinely test stolen credentials against other services, an attack commonly called credential stuffing . NIST’s authentication guidance identifies password reuse as the condition that makes this attack possible. Consider this pattern: RiverTrail!Email26 RiverTrail!Shopping26 RiverTrail!Bank26 These are illustrations, not passwords to use. They differ, but they share an obvious recipe. Once one is exposed, the others become easier to guess. Research into reused and modified passwords shows why predictable transformations are not a reliable defense. A complex password reused across accounts creates a shared point of failure. Independent passwords help contain the damage. Uniqueness does not prevent phishing, malware, or every account takeover. It prevents a stolen password from automatically becoming a key to unrelated accounts. Make Passwords Long, Random, and Unique For everyday use, instruct your password manager to generate at least 16 characters wherever the service permits . CISA recommends long, random, unique passwords and offers a passphrase of five to seven unrelated words as another option in its strong-password guidance . For a password you must remember, such as a vault’s primary password, use randomly selected words rather than a quotation, personal story, or familiar expression. Never adopt a password example published in an article. Current standards also distinguish system requirements from personal recommendations. NIST SP 800-63B-4 requires covered verifiers to set a minimum of 15 characters for passwords used as the sole authentication factor. Passwords used only within multifactor authentication may have an eight-character minimum. That exception is not a recommendation to shorten your passwords. NIST also rejects mandatory character-mixture rules and routine password changes without evidence of compromise. If a website requires symbols or capitals, let your generator comply. Do not confuse decorating a predictable password with making it strong. A Practical Plan to Eliminate Password Reuse 1. Choose a manager that fits your actual devices A browser’s built-in manager or a dedicated password-management app can make unique passwords manageable. The right choice should work reliably across the devices and browsers you use. For work accounts, follow your employer’s approved approach. Compare encryption, MFA support, recovery options, security updates, portability, and secure sharing. The UK National Cyber Security Centre’s password-manager buyers guide provides a useful evaluation framework. The tradeoff is concentration: a manager holds valuable credentials in one place. Protect its login with a strong, unique password or its supported stronger authentication method, enable MFA where offered, and understand recovery before filling the vault. Keep essential recovery materials somewhere secure that does not depend entirely on opening that same vault. If you migrate managers, treat exports carefully. Some contain readable, unprotected passwords. Follow the provider’s migration instructions, avoid unnecessary copies, and remove temporary exports when finished. 2. Prioritize accounts that control other accounts First secure the manager you will use. Then work through accounts in a risk-based order: Primary email: inbox access may allow an attacker to reset passwords elsewhere. Device and synchronization accounts: these may control access to stored credentials and recovery services. Financial and sensitive accounts: banking, payments, healthcare, and accounts holding important documents. Work accounts: coordinate changes with organizational requirements. Everything else: shopping, social media, subscriptions, and forgotten services. This is a suggested workflow, not a universal ranking. An actively compromised account takes priority. The FTC’s account-recovery guidance explains why protecting email is especially important. 3. Change the password at the service Editing a password-manager entry does not change the account’s password. The service must accept the new credential. Open the official app or navigate directly to the service’s website. Find its password-change settings. Generate an independent password that meets its requirements. Submit the change and confirm that the service accepts it. Save the accepted password in the correct vault entry. Confirm that the saved credential works before moving on. Check the account name and website address when saving. Duplicate entries and outdated credentials can turn a straightforward cleanup into a lockout problem. 4. Use warnings as a work list If your manager flags reused, weak, or exposed passwords, work through those findings. Saving an existing reused password improves convenience; replacing it resolves the reuse. Do not limit the cleanup to exact duplicates. Replace passwords built from the same recognizable formula, too. For accounts you no longer need, consider closing them through the provider’s official process. Add MFA—and Understand Where Passkeys Fit Unique passwords limit one kind of exposure. Multifactor authentication adds another layer when a password is stolen. Look under security settings for “multifactor authentication,” “two-factor authentication,” or “two-step verification.” CISA recommends phishing-resistant MFA where available. Security keys and appropriately implemented passkeys provide stronger phishing protection than methods that require typing a code. Authenticator-app codes remain useful, but attackers can trick people into entering them on fraudulent sites. SMS has additional weaknesses, though it is generally better than password-only access. Passkeys replace typed passwords with cryptographic credentials tied to a service. You typically approve their use through a device PIN or biometric check. According to the FIDO Alliance’s passkey guidance , the main deployment choices involve different convenience and recovery considerations: Synced passkeys: available across supported devices through a provider. Protect that provider account and understand its recovery process. Device-bound passkeys: remain on a particular device, including a security key. Arrange a supported backup or recovery method before relying on one device. Before replacing a phone or computer, check how you will retain access. If an account keeps a password as a fallback, that password still needs to be unique. Also secure recovery email, phone numbers, and backup codes; stronger sign-in does not eliminate recovery risk. If a Password Is Exposed, Break the Connection Do not add a digit to an exposed password. Replace it with an independently generated one, then replace it everywhere else it was reused. Address predictable variations as well. If someone has taken over the account, use the provider’s recovery process. From a trusted device: Change the password and sign out other sessions where supported. Review recovery contact details and enrolled authentication methods. Enable or restore MFA. Check email forwarding rules and messages the attacker may have sent. The FTC recommends these post-compromise checks because changing a password alone may leave other access routes intact. If you suspect malware, address it before entering replacement credentials on the affected device. Your Diverse-Password Checklist Every password-based account has an independently generated password. Passwords contain at least 16 characters wherever supported. No accounts rely on variations of a shared phrase. A password manager stores current, verified credentials. The manager’s login and recovery arrangements are protected. Primary email has a unique password and MFA. Reused, weak, and exposed-password warnings have been reviewed. Passkeys or phishing-resistant MFA are enabled where practical. Recovery details are current, and backup methods are accessible securely. Make the Basics Repeatable Password diversity is not a test of memory or creativity. It is a way to stop one compromised credential from spreading trouble across your accounts. Start today with your primary email: replace any reused password, enable MFA, and verify recovery options. Then work through the remaining accounts using the same process. The objective is not a collection of clever passwords. It is a sustainable system in which every account has its own protection. ## Press & Media: Bart McDonough - URL: https://bartmcd.com/blog/bart-mcdonough-press-media - Published: 2026-09-28 Reporting on artificial intelligence and cybersecurity means separating meaningful change from marketing claims—and translating technical complexity into decisions people can understand. For journalists, producers, and event organizers, the right conversation starts with a clear question, relevant expertise, and reliable background information. Bart McDonough is an entrepreneur, AI and cybersecurity strategist, author, keynote speaker, and the founder and former CEO of Agio. This resource brings together media contacts, biographical information, selected coverage, books, and suggested interview topics to help you prepare a focused request and verify information before publication. Media Inquiries and Speaking Requests For interviews, written commentary, or background-conversation requests, email contact@bartmcd.com , the contact address published on Bart’s official website . For keynote and event inquiries, email speaking@bartmcd.com , listed on his speaking page . Confirm availability and arrangements directly. A useful initial request includes: Who you are: Your name, outlet or organization, role, and contact information. The story or session: Your proposed angle, intended audience, and questions you want to explore. The deadline: Include the date, time, and time zone. The format: Live, recorded, written Q&A, or a requested background conversation. The schedule: Expected duration and proposed interview or event dates. Supporting materials: Any biography, headshot, book image, or other asset you need. Suggested subject line: Media inquiry: [Outlet] — [Topic] — deadline [Date, time zone] For speaking requests, also include the event location, audience size and roles, session format, recording plans, and budget. These details help clarify fit; they are suggested briefing information, not stated booking requirements. Practical example: Rather than requesting a general interview about AI, explain that your story examines how business leaders evaluate employee use of generative AI. Identify whether you need discussion of data privacy, governance, implementation, or all three. Background for Journalists and Producers Short Biography Bart McDonough is an entrepreneur, AI and cybersecurity strategist, author, and keynote speaker. He founded Agio and formerly served as its CEO. He is the author of Cyber Smart: Five Habits to Protect Your Family, Money, and Identity from Cyber Criminals and Cyber Guardians: Empowering Board Members for Effective Cybersecurity . His work addresses technology leadership, personal digital safety, organizational cybersecurity oversight, and the relationship between AI, privacy, and trust. See his official biography for background. Using Current Titles Accurately Older interviews and biographies may identify McDonough as Agio’s CEO. Netrio’s May 21, 2025 acquisition announcement identifies him as Agio’s founder and CEO at that time. That historical description should not automatically become a present-day broadcast introduction. For new coverage or event materials, confirm current affiliations and the preferred introduction directly. Distinguish a role held when a statement was made from a role held when your story is published. Suggested Interview and Event Topics The following angles align with subjects described on Bart’s speaking page . They are proposed editorial questions, not quotations, confirmed session titles, or promises of availability. Boardroom Cybersecurity Question to explore: What evidence should directors request to understand whether an organization can withstand a cyber incident? A useful discussion can move beyond technical dashboards to business disruption, recovery readiness, accountability, and third-party dependencies. For a board audience, focus on oversight decisions rather than asking directors to act as security engineers. AI, Privacy, and Trust Question to explore: How should leaders weigh AI’s potential benefits against privacy and security risks? Make the discussion concrete by choosing a workflow, such as summarizing internal documents or drafting customer communications. That creates room to examine what information enters a system, who can access it, and where human review remains necessary. Security Culture and Everyday Behavior Question to explore: How can organizations make secure behavior easier without placing all responsibility on employees? This angle connects leadership, usable processes, and employee education. For consumer coverage, a related discussion can explore how families turn security advice into repeatable habits rather than an overwhelming list of warnings. Digital Transformation and Technology Leadership Question to explore: Which questions should an organization resolve before moving critical work to cloud services or adopting AI-enabled tools? Useful follow-ups include ownership, access controls, vendor dependencies, and continuity planning. The central tradeoff is not simply innovation versus caution: it is how to pursue useful change while making risks and responsibilities explicit. Selected Coverage and Company Announcements These resources offer starting points for reporting and interview preparation. They are selected background materials, not an exhaustive appearance history or a list of recent interviews. Netrio’s Acquisition of Agio Company announcement — May 21, 2025. Netrio announced its acquisition of Agio, describing Agio’s financial-services focus and the addition of cybersecurity expertise and an AI-powered IT delivery platform. The release includes comments from McDonough and provides primary-source context for the transaction. Read the acquisition announcement . Treat it as a company-issued release, not independent editorial coverage. Use the original release’s May 21 date when citing it. Yale School of Management Community Reporting Yale News — April 27, 2022. Yale reported on executive MBA students supporting Ukrainian refugees, including McDonough’s participation and assistance with a platform connecting refugees with volunteers offering career support. Read the Yale News article . It documents historical involvement; it does not establish the initiative’s current status. Interviews, Broadcasts, and Podcasts The official press and appearances index collects links to interviews, articles, broadcasts, podcasts, and talks. Use it to discover relevant material, then consult the original publisher or recording to verify dates, wording, and context before quoting. Books for Interview Preparation Cyber Smart Cyber Smart: Five Habits to Protect Your Family, Money, and Identity from Cyber Criminals focuses on personal and family digital security. Wiley’s book information describes an accessible approach to safer online habits and protecting accounts, identity, and money. Suggested angle: How can people prioritize practical protections without feeling they must become cybersecurity specialists? Cyber Guardians Cyber Guardians: Empowering Board Members for Effective Cybersecurity addresses directors’ cybersecurity oversight responsibilities, including risk assessment and incident preparation and response. Consult the publisher’s book information for details. Suggested angle: What should boards ask management that a compliance report alone cannot answer? Use both books as background reading. Verify current laws, incident details, threat claims, and product instructions separately rather than treating a book as continuously updated operational guidance. Choose the Right Interview Format The format should support the story’s purpose and production constraints: Written Q&A: Useful when precise terminology matters. Allow time for clarification and follow-up questions; written exchanges offer less spontaneous discussion. Recorded audio or video: Useful for accessible explanations and conversational follow-ups. Clarify the expected length, recording arrangements, and intended use of excerpts or promotional clips. Live interview: Useful for timely discussion, but leaves less room to correct ambiguity. Keep the scope focused and distinguish established facts from unanswered questions. Keynote or panel: Useful for developing a theme with an audience. Define the desired outcome, audience knowledge, and whether the setting is educational, editorial, or promotional. For breaking-news requests, share the source material and specific questions in advance where possible. General expertise should not be mistaken for firsthand knowledge of a particular incident. Agree on attribution and recording terms before the conversation. A request for background discussion does not itself establish mutually understood terms, and background material should not automatically be treated as quotable. Media Materials and Publication Checklist Request current headshots, biographies, book covers, and clips directly. Ask for the preferred credit and permitted use; an asset’s presence online is not permission to republish it. Confirm the spelling of Bart McDonough’s name and preferred introduction. Verify current titles and affiliations. Check publication dates against original sources. Distinguish company announcements from independent reporting. Review original recordings before quoting interviews. Preserve the context of historical statements. Recheck statistics, legal claims, and technical instructions. Confirm image credits and reuse permissions. Clarify recording, attribution, and excerpting arrangements. Include deadlines and time zones in scheduling correspondence. Start With the Question Your Audience Needs Answered The strongest AI and cybersecurity coverage connects expertise to a specific audience need. Start with the decision, concern, or misconception your story should address, then choose the format that makes the answer most useful. Send your angle, audience, and deadline to contact@bartmcd.com . For keynotes and events, contact speaking@bartmcd.com with the session goals and event details. ## Internet Explorer Zero-Day CVE-2018-8653: What Happened and What to Do Now - URL: https://bartmcd.com/blog/internet-explorer-cve-2018-8653-what-to-do - Published: 2026-09-28 Updated September 28, 2026 An old Internet Explorer vulnerability appearing in a security scan can create two equally unhelpful reactions: panic over a “zero-day,” or dismissal because nobody uses Internet Explorer anymore. CVE-2018-8653 calls for neither. It calls for verification. CVE-2018-8653 is a remote-code-execution vulnerability in Internet Explorer’s scripting engine that attackers exploited before Microsoft released an emergency security update on December 19, 2018. It is a historical zero-day, not a newly discovered, unpatched vulnerability in 2026. Microsoft’s release announcement confirmed targeted attacks. For someone investigating a legacy computer, inherited application, or scanner finding, the practical questions are straightforward: Does the affected component exist? Has the applicable fix—or a replacement update—been installed? And does the system still receive security updates? What Was CVE-2018-8653? The vulnerability involved incorrect handling of objects in memory by Internet Explorer’s scripting engine. CERT/CC identified the affected component as JScript . Successful exploitation could let an attacker execute arbitrary code with the current user’s privileges. A user running with administrative rights therefore faced greater potential consequences than a standard user. In a web-based scenario, an attacker could lure someone to a specially crafted page. But the exposure was not necessarily limited to opening the standalone browser. CERT/CC’s vulnerability note explains that applications embedding Internet Explorer or its scripting engine could also provide an attack route, including documents containing embedded IE scripting content. That does not mean every document or application was vulnerable. The affected component and a usable execution path had to be present. Was it actually exploited? Yes. Microsoft reported targeted exploitation in December 2018. CISA later added CVE-2018-8653 to its Known Exploited Vulnerabilities catalog on November 3, 2021, with an instruction to apply vendor updates. That catalog date is not the discovery date. Likewise, the listing confirms historical exploitation; it does not, by itself, establish a new attack campaign in September 2026. Retiring a browser is not the same as verifying that its underlying components are patched. Which Systems and Updates Were Involved? The Microsoft-authored CVE record lists historical combinations including: Internet Explorer 9: Windows Server 2008 SP2. Internet Explorer 10: Windows Server 2012. Internet Explorer 11: Windows 7 SP1, Windows 8.1, Windows RT 8.1, several Windows 10 releases through version 1809, and specified Windows Server releases. This is a summary, not a universal installation guide. Exact operating-system versions, architectures, and servicing branches matter. Embedded equipment also requires separate assessment through the manufacturer’s supported servicing process. There was no single patch for every system Historical update identifiers include KB4483187 for multiple older Windows configurations and KB4483235 for Windows 10 version 1809. Microsoft’s KB4483235 documentation identifies the resulting OS build as 17763.195. These identifiers help investigate old records. They are not instructions to install an eight-year-old package indiscriminately. Later updates can supersede the original fix; the Microsoft Update Catalog entry documents replacement updates for a historical KB4483187 package. The absence of the original KB number is not sufficient evidence that a system remains vulnerable. Conversely, a browser migration is not sufficient evidence that the vulnerability was fixed. How to Investigate and Remediate a Finding Today 1. Establish support status before chasing a patch Record the Windows edition, version, build, architecture, and relevant application dependencies. Then confirm whether that installation still receives security updates. Regular support for Windows 10 version 22H2 ended on October 14, 2025 . Eligible devices need applicable Extended Security Updates enrollment to continue receiving covered updates. LTSC and LTSB releases have separate lifecycle rules; consult Microsoft’s Windows release information rather than assuming every Windows 10 installation has the same deadline. A machine can be fixed against this particular CVE and still be unsafe because its operating system no longer receives routine security maintenance. 2. Apply the correct updates through an approved channel On a supported, individually managed device, use Windows Update. Windows 11 places it under Settings → Windows Update ; Windows 10 uses Settings → Update & Security → Windows Update . Follow Microsoft’s Windows Update guidance , complete required restarts, and investigate installation failures. For organization-managed devices, follow IT’s deployment process. For older systems, check package applicability and prerequisites, including servicing-stack requirements. Do not download replacement DLLs or “repair tools” from unofficial sites. 3. Validate the scanner’s evidence Review the detected operating system, component version, patch evidence, and assessment method. Compare those details with Microsoft’s affected-product record and applicable update supersedence. After servicing and restarting, reassess the device—using authenticated checks where available—and retain the evidence supporting closure. Practical example: A scanner flags a legacy server because KB4483187 is missing. The administrator identifies a later applicable update that supersedes it and verifies successful installation. The finding should be resolved through that evidence and a follow-up assessment, not by forcing an obsolete package onto the server. 4. Address systems that cannot be updated If an application prevents immediate migration, document the business dependency and assign an accountable owner. Consider network segmentation, restricted outbound access, least-privilege accounts, and additional monitoring while replacement work proceeds. These measures reduce exposure but do not repair the vulnerability. They also impose operational costs: tighter access can disrupt integrations, while additional monitoring requires someone to investigate alerts. Treat them as temporary controls with a review date, not permanent substitutes for supported software. Does Internet Explorer Retirement Eliminate the Risk? No—not automatically. Microsoft retired the IE11 desktop application on certain Windows 10 versions on June 15, 2022, and permanently disabled it on certain versions through an Edge update on February 14, 2023. The IE11 retirement FAQ explains the scope and exceptions. Microsoft Edge’s IE mode uses the IE11 Trident/MSHTML engine for legacy sites, while modern sites use Chromium. That does not establish that every IE-mode installation is vulnerable to CVE-2018-8653. It means browser migration and Windows component patching are separate responsibilities. Use IE mode as a managed transition Microsoft commits to supporting IE mode through at least 2029 on supported operating systems . That qualification matters: it does not extend every old Windows installation’s support lifecycle. Modernize the application: Removes its IE dependency but requires development, testing, and migration work. Use managed IE mode temporarily: Preserves compatibility but retains legacy technology and requires controlled site selection and continued servicing. Leave unsupported systems unchanged: Avoids immediate disruption but provides no dependable ongoing security-maintenance strategy. Practical example: An internal finance portal requires IE-specific behavior. Rather than allowing unrestricted legacy browsing, IT can configure an administrator-managed Enterprise Mode Site List for that portal, keep ordinary browsing in modern Edge, and assign the application owner a migration deadline. A current protection limitation Microsoft’s November 4, 2025 SmartScreen deprecation notice states that SmartScreen is no longer active in IE/IE-mode scenarios on Windows 11 following the relevant updates. It remains available in modern Edge and Windows Shell. Do not assume an IE-mode tab has the same protections as a normal Edge tab. Restrict IE mode to approved legacy applications, not untrusted public websites. This limitation is separate from CVE-2018-8653. Should You Use the Historical JScript Workaround? Not as today’s default remediation. The historical workaround restricted access to jscript.dll . CERT/CC warned that this could disrupt standalone .JS scripts and dependent functionality. Prefer the applicable security update. If an old workaround remains deployed, have an administrator review its scope and documented rollback procedure. Broadly changing system-file permissions can introduce new problems without establishing that the underlying vulnerability is resolved. CVE-2018-8653 Remediation Checklist Record Windows edition, version, build, and architecture. Confirm current support or applicable security-update entitlement. Inventory IE-dependent applications and embedded components. Verify the applicable fix or a superseding update. Complete required restarts and resolve update failures. Reassess scanner findings and retain closure evidence. Restrict IE mode to approved, centrally managed applications. Review historical scripting-engine workarounds before changing permissions. Assign an owner and migration deadline to remaining legacy dependencies. The Bottom Line: Verify the Fix, Then Reduce the Dependency CVE-2018-8653 was a real, exploited vulnerability with an emergency fix released in December 2018. Today, the right response is neither alarm over an old headline nor confidence based on a missing browser shortcut. Start with the flagged asset: verify remediation, confirm supported Windows servicing, and identify the application dependencies keeping legacy technology alive. Then turn those dependencies into an owned migration plan. Closing this CVE matters; preventing unsupported components from becoming tomorrow’s exposure matters just as much. ## The Truth About Public Wi-Fi: What’s Safe, What Isn’t, and When to Use a VPN - URL: https://bartmcd.com/blog/public-wifi-safety-risks-when-to-use-vpn - Published: 2026-09-28 You open your laptop at an airport and see several free Wi-Fi networks. One looks official. Another has a stronger signal. You need to check email, send a document, and perhaps pay a bill. Is connecting a reasonable decision—or an unnecessary gamble? Public Wi-Fi is not automatically dangerous, and joining it does not automatically expose your passwords. Modern encryption has changed the equation. The Federal Trade Commission says public Wi-Fi is usually safe because most websites encrypt the information traveling between your device and their servers. But encryption does not make a fake network legitimate or a fraudulent website trustworthy. The practical question is not simply whether public Wi-Fi is safe. It is what you are doing, what protections are working, and what consequences a mistake could have. What Can Other People See on Public Wi-Fi? When you connect to a legitimate website using HTTPS , your browser encrypts the information exchanged with that site. An ordinary observer on the local network cannot read your passwords, messages, submitted forms, or the specific page paths inside that protected connection. This protection works even when you do not trust the Wi-Fi network, as the Electronic Frontier Foundation explains in its encryption guidance . For example, someone sharing the café’s network cannot simply read your banking password from a correctly secured HTTPS connection. The old warning that everyone nearby can see everything you do online is misleading. However, different observers have different visibility: The network operator can observe connection timing, traffic volume, destination IP addresses, and often the domains you contact. Domain visibility depends on protections beyond HTTPS. Other hotspot users do not automatically have the operator’s visibility, but poorly configured networks and exposed device services can create opportunities for interference. The website itself receives the information you submit. HTTPS does not prevent that website from tracking you or misusing your data. An encrypted connection protects information in transit. It does not prove the destination deserves your trust. The Public Wi-Fi Risks That Still Matter Fake networks and misleading sign-in pages Attackers can create hotspots that resemble a hotel, airport, or coffee shop’s network. Confirm the exact network name with staff rather than choosing the most plausible option. That reduces mistakes, but names can be copied; it is not proof of ownership. The Australian Cyber Security Centre recommends verifying public networks and limiting automatic connections . A Wi-Fi password is not a guarantee either. It controls access, but does not establish who operates the network. Likewise, a welcome screen asking you to accept terms or enter a room number is an access mechanism—not evidence that everything afterward is safe. Stop if a hotspot unexpectedly asks you to install software, a certificate, or a device-management profile. Apple warns that malicious downloads can include configuration profiles that affect device settings. Independently verify unusual requirements before proceeding. Phishing, HTTP, and ignored security warnings A fake banking page can use HTTPS. Open sensitive services through a trusted bookmark or official app, and check the actual domain before entering credentials. A familiar logo proves nothing. Do not submit sensitive information through an unencrypted HTTP page. If your browser displays a certificate or connection-security warning, stop rather than clicking through. A captive portal may complicate connecting, but that is not a reason to bypass a warning on your bank or email site. Unnecessary device exposure File sharing, network discovery, and outdated software create risks that HTTPS cannot fix. Keep your operating system, browser, and apps updated. Disable unnecessary sharing and keep your firewall enabled. Do You Need a VPN on Public Wi-Fi? Not for every routine browsing session. Widespread HTTPS has made VPNs less necessary for ordinary public Wi-Fi use, according to the EFF’s VPN guidance . A properly configured VPN encrypts traffic carried through its tunnel between your device and the VPN server. This reduces what the local network can observe and protects tunneled traffic over that portion of its journey. Beyond the VPN server, HTTPS still matters. A VPN is particularly useful when your employer requires one, you need access to company resources, or you want additional privacy from the hotspot operator. But understand the tradeoffs: You shift trust. The VPN provider may gain visibility that the local network loses. Review its ownership, privacy practices, and permissions. Coverage varies. A browser-only service or split-tunnel configuration may leave some traffic outside the VPN. Performance can suffer. Routing traffic through another server can add latency, and some networks restrict VPN connections. It is not anonymity or fraud protection. Websites can identify you when you sign in, and a VPN cannot make a phishing page safe. For work, use the organization’s approved connection method. For personal use, buy a VPN to solve a specific privacy problem—not because every coffee-shop visit requires a subscription. When Is a Mobile Hotspot the Better Choice? Your own cellular connection or password-protected mobile hotspot is a sensible conservative choice when the network is uncertain or the work is sensitive. It removes the venue’s Wi-Fi infrastructure from your connection, though it does not eliminate phishing, device compromise, or carrier visibility. The NSA recommends personal or corporate hotspots instead of public Wi-Fi in guidance aimed at national-security and defense-sector teleworkers. That does not contradict the FTC’s consumer advice: the audiences and consequences of compromise differ. Reading the news on HTTPS is different from administering company systems or transferring confidential client records. For banking, HTTPS protects a correctly secured connection, but switching to cellular is a reasonable extra precaution if you cannot confidently identify the hotspot. Hotspots consume battery and mobile data, and tethering limits depend on your plan. Use a strong hotspot password, turn it off afterward, and remember that cellular access does not cancel workplace VPN requirements. Settings Worth Checking Before Your Next Trip Chrome: Open Settings → Privacy and security → Security → Always use secure connections. This HTTPS-first setting upgrades connections and can warn before loading sites without HTTPS. Windows 11: Under Settings → Network & internet → Wi-Fi, open the connected network’s properties and select the Public network profile . “Public” is the protective choice: “Private” enables discovery and sharing intended for trusted networks. Keep the firewall on. iPhone and iPad: Under Settings → Wi-Fi, tap the information button beside the network and review Private Wi-Fi Address . Keep it enabled on compatible networks to reduce tracking through your device’s Wi-Fi hardware address. It does not replace HTTPS. All devices: Review automatic joining and forget public networks you no longer need. Setting names can vary by software version. Also remember that Incognito mode is not network privacy . It limits what Chrome retains locally after your session; it does not hide your activity from websites or the organizations operating your connection. Your Public Wi-Fi Checklist Before connecting Update your device, browser, and apps. Use unique passwords and enable multifactor authentication. Confirm the network name with the venue. Decide whether the task calls for cellular access or an approved VPN. While connected Check website domains and use HTTPS. Do not bypass certificate warnings or install unfamiliar software or profiles. Keep the firewall enabled and unnecessary sharing disabled. Follow workplace rules for sensitive information and remote access. When finished Disconnect and forget networks you do not expect to use again. Turn off your personal hotspot if you used one. What to Do If Something Seems Wrong Disconnect from the suspicious hotspot and forget it. An unfamiliar network or warning is a reason for caution—not proof that an account was stolen. If you entered credentials on a suspected phishing page, use a trusted device and connection to change the password, sign out other sessions, enable multifactor authentication, and check recovery details. For email, review forwarding rules too. Follow the FTC’s account-recovery guidance if access has been lost. If you installed suspicious software or a profile, seek appropriate device-security assistance. For a work-managed device, contact IT promptly rather than improvising changes. The Bottom Line: Match Protection to the Stakes Public Wi-Fi is neither automatically unsafe nor worthy of blind trust. HTTPS makes routine use substantially safer, while fake networks, phishing, exposed devices, and sensitive work still require judgment. Before your next connection, check your settings, verify the network, and choose the connection method that fits the task. Respect security warnings, follow workplace requirements, and switch to cellular when uncertainty or consequences justify it. Those habits matter more than fear—or any single security product. ## Why Are Institutional Investors Embracing the Cloud and Stronger Cyber Controls Now? - URL: https://bartmcd.com/blog/why-institutional-investors-adopt-cloud-cyber-controls - Published: 2026-09-28 An investment team can tolerate a delayed software upgrade. It may not be able to tolerate losing access to portfolio exposures during a volatile market—or discovering that compromised credentials exposed confidential investor information. That distinction explains why cloud adoption and cybersecurity belong in the same conversation. Cloud services can improve investment capabilities, but stronger controls are what make those capabilities dependable. For pension funds, endowments and the managers they evaluate, the objective is not modernization for its own sake. It is better access to data, more adaptable operations and demonstrable resilience. As of September 2026, AI governance, regulatory requirements and third-party dependencies make that conversation especially urgent. The question is no longer simply whether to use the cloud. It is which activities benefit—and what evidence shows they can operate securely. What Is Driving the Shift Now? Investment workloads need flexibility Research, risk analysis and reporting can create uneven demand for computing resources. Cloud services allow organizations to obtain capacity when needed rather than build every capability internally. FINRA’s cloud-computing report describes securities-industry applications including intensive analytics, database modernization and automated workflows. Consider a hypothetical manager running additional portfolio stress tests during market turbulence. Temporary cloud capacity could support that work without a permanent infrastructure expansion. The benefit depends on data availability, configuration and spending controls—not merely access to more servers. These capabilities are established, not new in 2026. Their relevance grows when investment organizations need to integrate more information and change workflows without lengthy infrastructure projects. AI increases the value—and exposure—of accessible data FINRA’s 2026 Annual Regulatory Oversight Report discusses generative AI uses such as information retrieval and internal efficiency, alongside accuracy, privacy, supervision and agent-related risks. Those observations concern FINRA member firms, not every institutional investor. The practical lesson is broader: evaluate AI, cloud services and data permissions together. An internal research assistant may be useful, but it should not gain access to restricted deal documents simply because they share a storage environment with approved research. Establish what an AI service can read, retain and do, and where human approval is required. AI does not inherently require public-cloud deployment. Operational accountability has become more concrete The SEC’s amended Regulation S-P requires covered institutions to maintain incident-response policies and address notification and recordkeeping requirements. Its compliance dates—December 3, 2025, for larger entities and June 3, 2026, for smaller entities—have passed. The SEC’s compliance guide explains two important timing provisions: Customer notification: Generally, affected individuals must be notified as soon as practicable, no later than 30 days after awareness that unauthorized access to or use of customer information occurred or is reasonably likely to have occurred. Exceptions include specified findings from a reasonable investigation concerning sensitive information and likely substantial harm or inconvenience. Provider notification: Oversight policies must be reasonably designed to ensure providers notify the institution as soon as possible, within 72 hours of awareness of a breach resulting in unauthorized access to a customer-information system they maintain. This is not a blanket deadline for reporting every incident to the SEC. In the EU, DORA has applied since January 17, 2025, addressing ICT risk, incident reporting, resilience testing and third-party oversight for entities within its scope. “Institutional investor” is not a single regulatory category. Requirements depend on the entity, registration, jurisdiction and activity. Compliance counsel should map obligations accordingly; neither framework makes cloud migration itself the goal. Cloud Changes Responsibility; It Does Not Remove It A provider may secure physical infrastructure while the investment organization remains responsible for identities, data permissions and application configuration. The boundaries vary by service. For example, AWS’s shared-responsibility model explains that customers using virtual machines retain responsibility for guest operating-system patches, installed applications and security-group configuration. Managed services shift some duties, but do not eliminate customer accountability. Before migration, assign an owner for access administration, configuration, encryption decisions, logging, incident response and recovery. Include software-as-a-service platforms in this exercise—not just infrastructure accounts. A provider’s security credentials are evidence about the provider. They are not proof that your deployment is secure. The Tradeoffs Investment Leaders Should Evaluate The U.S. Treasury’s financial-sector cloud report examines both adoption opportunities and operational challenges. A credible business case addresses the following: Total cost: Compare infrastructure spending with migration, integration, staffing, security, data transfer and ongoing support. Flexible capacity also needs budgets and shutdown controls for unused resources. Workload fit: Latency-sensitive trading, legacy dependencies or data-location requirements may favor on-premises or hybrid arrangements. Choose the architecture around the activity. Concentration: Several applications can depend on the same underlying cloud or identity provider. Different vendor names do not necessarily mean independent failure paths. Portability: Proprietary managed services can accelerate development while making exit harder. Assess data export, application dependencies and transition assistance before signing. Adding a second cloud is not automatically the answer. It introduces additional skills, configurations and monitoring requirements. First determine which failure you need to survive and whether the proposed design actually separates those dependencies. What Stronger Cyber Controls Look Like in Practice Protect identities and sensitive workflows Require multifactor authentication, prioritizing phishing-resistant methods for administrators and sensitive services. Apply least privilege, remove unnecessary access and review service accounts as well as human users. Account recovery must not become an easy bypass. CISA’s identity-management guidance provides a practical foundation. For example, access to investor records should not automatically permit changes to payment instructions. Technical permissions and independent approval procedures should reinforce each other. Make suspicious activity visible—and actionable Collect relevant logs across cloud services, endpoints and critical applications. Prioritize privileged sign-ins, permission changes and unusual access to sensitive information. Assign responsibility for investigation and escalation, including outside business hours where critical activities require it. CISA’s logging guidance emphasizes collection and review. A dashboard without an accountable responder is not an effective detection capability. Test recovery as a business capability Maintain protected backups and test restoration, consistent with CISA’s ransomware guidance . Define a recovery-time objective: how quickly service must return. Define a recovery-point objective: how much data loss, measured in time, is acceptable. Then test the whole workflow. Restoring a portfolio database is insufficient if staff cannot authenticate, obtain market data or generate required reports. High availability and recoverable backups solve different problems; both need deliberate design. Oversee vendors throughout the relationship Maintain an inventory of critical providers and material subcontractor dependencies. Review incident cooperation, notification arrangements, data handling and termination procedures. Exercise a provider outage rather than assuming contractual availability guarantees will preserve operations. Allocators should request proportionate evidence from managers: recent recovery-test results, unresolved significant findings and remediation status. A useful question is: Which investment and client-service activities can continue if your critical provider fails, and what test supports that answer? A Practical 90-Day Starting Plan This is an illustrative sequence, not a regulatory deadline or a promise that every gap can be closed within 90 days. Days 1–30: Establish the baseline. Map critical activities, data, systems and dependencies. Assign business owners and applicable obligations. Organize gaps using NIST Cybersecurity Framework 2.0 : Govern, Identify, Protect, Detect, Respond and Recover. Days 31–60: Reduce priority exposures. Address weak authentication, excessive privileges, missing logs and vulnerable backup arrangements. Confirm provider incident contacts and document exceptions. Days 61–90: Test and decide. Restore a representative critical service and exercise vendor disruption. Use the findings to approve, narrow or postpone proposed migrations. Escalate unresolved risks to accountable leadership. Cloud and Cybersecurity Readiness Checklist Use these questions as a management review tool, not a compliance certification: Does every critical service have a business owner and documented dependencies? Does each migration have a measurable business case and full-cost estimate? Are provider and customer responsibilities documented? Are sensitive data locations, access rights and AI uses approved? Are privileged accounts protected with strong MFA and limited permissions? Are security logs protected, reviewed and tied to escalation procedures? Have recovery tests met business-defined time and data-loss objectives? Are provider notification, investigation and cooperation arrangements understood? Do continuity and exit plans address shared underlying dependencies? Do claims made to boards and investors match current evidence? The Bottom Line: Modernize for Capability, Verify for Resilience Institutional investors have compelling reasons to embrace cloud services: flexible computing, accessible data and faster access to useful technology. Stronger cybersecurity is the necessary counterpart because outsourcing infrastructure changes risk without transferring all responsibility. Start with one critical investment workflow. Map its dependencies, verify its controls and test its recovery. Then use that evidence—not provider branding or industry momentum—to guide the next investment in technology. ## Digital Value Is in the Eye of the Beholder - URL: https://bartmcd.com/blog/digital-asset-value-cybersecurity-priorities - Published: 2026-09-28 A family recording might have no resale market and still be irreplaceable. A free email account might control access to your financial life. A routine customer spreadsheet might become a serious liability in the wrong hands. Purchase price tells us very little about what these digital assets are worth—or how carefully we should protect them. Digital value depends on perspective: what information means to its owner, what other people rely on it for, and what someone could accomplish by stealing, changing, or misusing it. Understanding those differences is the foundation of practical cybersecurity, whether you are protecting a household or leading a business. Why Digital Value Is Bigger Than Market Value Here, “digital assets” means information, accounts, software, and services—not cryptocurrency investments. Their value often comes from consequences rather than a price tag. Personal value: Photographs, correspondence, and recordings can preserve memories that cannot be recreated. Operational value: Scheduling, payroll, and order-management systems keep work moving. Losing access can disrupt an entire organization. Access value: Email accounts, password managers, and administrative accounts can unlock other resources. Privacy value: Medical, financial, and identity information matters to the people it describes, even when someone else stores it. Trust value: A familiar account or established business identity can make fraudulent requests appear credible. Criminals evaluate these assets differently. They do not need to care about your photographs to exploit your desire to recover them. They do not need your entire customer database if one compromised account enables a convincing payment request. The FTC explains that a compromised email account can enable password resets elsewhere and fraudulent messages to contacts. The inbox’s subscription cost is irrelevant to that leverage. The right security question is not simply “What is this worth?” It is “What happens if someone else controls it?” Assess Value Through Consequences The NIST Cybersecurity Framework 2.0 supports risk-based prioritization rather than identical protection for everything. You can apply that principle without building a complicated financial model. Start with a short inventory List the accounts, information, and services you would most regret losing control of. Households should consider primary email, financial accounts, cloud storage, and important documents. Businesses should include critical applications, customer records, administrative accounts, and essential service providers. For each asset, record where it resides, who manages it, who has access, what depends on it, and how you would recover it. NIST’s small-business quick-start guide provides a useful foundation for identifying assets and business priorities. Separate the ways things can go wrong Exposure: What if someone reads or copies the information? Alteration: What if someone changes it without detection? Unavailability: What stops working if access disappears? Misuse: What could someone do while impersonating the owner? Consider a hypothetical supplier-payment record. Exposure could reveal confidential commercial information. Alteration could redirect a payment. Unavailability could delay legitimate transactions. Each consequence calls for different safeguards. Classify assets as critical, important, or replaceable, and write down why. For businesses, identify who accepts any remaining risk. Avoid false precision: a clear explanation of potential harm is more useful than an unsupported dollar estimate. Match Protection to the Kind of Value at Risk Protect accounts that control other accounts Give particular attention to primary email, password managers, cloud administration, and business identity systems. Their compromise can create problems well beyond the original account. Use strong, unique passwords wherever passwords remain necessary, supported by a password manager. Enable multifactor authentication. For sensitive accounts, prefer phishing-resistant options such as FIDO/WebAuthn security keys or supported passkeys. NIST explains why phishing-resistant authentication offers stronger protection against fraudulent sign-in sites than manually entered codes. The tradeoff: stronger authentication requires workable recovery. Confirm recovery contacts, understand the provider’s recovery process, and securely store recovery codes where they remain accessible if the account is locked. Where supported, consider a backup authenticator. Do not keep your only recovery method inside the account it must recover. Authentication is not a complete defense. It cannot prevent every deceptive request, malicious download, or misuse of an already compromised device. Back up what cannot be recreated For irreplaceable information, recovery deserves as much attention as prevention. CISA’s #StopRansomware Guide recommends offline, encrypted backups of critical data and regular testing of backup availability and integrity. Synchronization alone does not guarantee independent recovery. Microsoft documents that OneDrive synchronizes additions, changes, and deletions between local folders and the cloud. Version history and deleted-file recovery may help, but understand their limits before relying on them. Practical step: restore representative files to a separate location and confirm they open. Businesses should also test whether restored applications, permissions, and dependencies support actual work. Decide how much recent data you could lose and how long you could operate without the service. The tradeoff: offline backups require regular handling; managed backup services require careful configuration and access protection. Neither approach works reliably if nobody tests restoration. Backups also do not undo the exposure of stolen information. Reduce information that creates more liability than benefit A business may value an old customer file for convenience while the customer values its confidentiality. Both perspectives belong in the decision to keep it. The FTC’s guidance on protecting personal information recommends collecting and retaining sensitive information only for legitimate needs, limiting access, and disposing of information securely when those needs end. Review shared folders, public links, dormant accounts, and employee permissions. Give people the access their work requires—not unrestricted access by default. Households can apply the same principle to shared albums, document links, and connected apps. The tradeoff: shorter retention and narrower permissions can reduce exposure, but they must support legitimate work and applicable retention obligations. Do not delete records subject to legal holds or other requirements. Protect integrity and maintain basic safeguards Some assets are most dangerous when altered rather than stolen. For payment instructions, require verification through a known, independent channel before accepting changes. For sensitive business records, use appropriate approval workflows and change logs. Keep supported software updated, enable device locks, and use encryption for sensitive information. The FTC’s small-business cybersecurity resources outline these foundational protections. Prioritization determines where to add stronger controls and more rigorous testing. It does not justify abandoning basic security elsewhere. Plan for Losing Control Before It Happens A recovery plan should remain usable when the account, device, or service you normally depend on is unavailable. For households, document how to reach official account-recovery processes and where authorized family members can find essential recovery information. Balance emergency access against privacy; sharing every password is not the only option. After an email compromise, the FTC recommends recovering the account through the provider, changing the password, signing out other sessions, enabling two-factor authentication, checking recovery details and forwarding rules, and warning contacts about fraudulent messages. Businesses need named response leaders, accessible contact details, continuity arrangements, and criteria for involving security specialists, legal counsel, insurers, and affected parties. Test those arrangements. A plan stored only inside an inaccessible system is not a practical recovery resource. Your Digital-Value Checklist Use this checklist as a working review, not a guarantee of security. List your most important accounts, information, and services. Identify who owns each asset and who depends on it. Assess exposure, alteration, unavailability, and misuse separately. Prioritize accounts that control access to other resources. Use unique passwords and enable phishing-resistant authentication where available. Verify recovery information and secure backup authentication methods. Keep protected backups and test restoration. Understand synchronization, deletion, and recovery limits. Remove unnecessary access and review sensitive-data retention. Document response responsibilities and update the plan when circumstances change. Protect Consequences, Not Price Tags Digital value is in the eye of the beholder—but effective protection considers more than one beholder. Your priorities, other people’s privacy, operational dependencies, and opportunities for criminal misuse all matter. Start with three actions: identify the account that controls your other accounts, test recovery of something irreplaceable, and remove one unnecessary source of exposure. You do not need to price every digital possession. You need to understand what you cannot afford to lose control of—and make that understanding visible in how you protect it. ## SEC Warns About Vendor Payments: How to Prevent Payment-Redirection Fraud - URL: https://bartmcd.com/blog/sec-vendor-payment-redirection-fraud-prevention - Published: 2026-09-28 A legitimate invoice can still lead to a fraudulent payment. The purchase may be authorized, the amount correct, and the supplier familiar. But if someone changes the destination account, your business can pay the criminal while still owing the vendor. Consider a hypothetical example: Accounts payable receives an email in an existing supplier conversation announcing new banking instructions. The message references a real invoice and arrives shortly before payment is due. An employee updates the vendor record and releases the funds. Only later does the supplier ask why its invoice remains unpaid. That is the control failure behind the SEC’s warning about vendor-payment fraud. The warning dates to 2018, but its lesson remains current: approving an invoice and approving where the money goes are separate decisions. A credible message can initiate a payment-change request. It should not be the only evidence that authorizes the change. What the SEC Actually Warned About On October 16, 2018 , the SEC announced an investigative report examining nine public companies that fell victim to business email compromise, or BEC. Together, they lost nearly $100 million. Each lost at least $1 million, and most of the money was not recovered. The SEC brought no charges against those companies or their personnel in the investigations, according to its announcement . The schemes involved criminals impersonating executives or vendors. In the vendor cases, attackers compromised suppliers’ email accounts and inserted fraudulent payment instructions into legitimate business communications. The SEC’s investigative report emphasized existing internal-accounting-control obligations under Section 13(b)(2)(B) of the Securities Exchange Act. Controls needed to account for cyber-enabled fraud and operate effectively—not simply exist in a policy document. This was not a new rule requiring every business to follow one prescribed callback procedure. The legal discussion concerned covered public issuers. Private businesses can nevertheless apply the same operational lesson: payment controls must withstand convincing impersonation. Why Vendor-Payment Fraud Remains a Current Risk The FBI’s 2025 IC3 Annual Report records 24,768 BEC complaints and approximately $3.05 billion in reported losses. Those figures cover BEC broadly, not only vendor-payment fraud, and reflect complaints received rather than every incident that occurred. The threat extends beyond poorly written messages from unfamiliar addresses. The FBI’s BEC guidance describes look-alike addresses and compromised accounts that make requests appear legitimate. Its 2025 report also describes AI-generated messages and voice cloning used in BEC. A polished email or familiar-sounding voice is not sufficient proof of authorization. Nor is switching from wires to ACH a complete solution. FinCEN’s BEC advisory documents multiple payment methods. The central question remains whether the intended supplier controls the destination account. A Practical Process for Verifying Vendor Banking Changes The following workflow is a recommended control design, not a claim that the SEC mandates each step. 1. Separate Payment-Destination Approval From Invoice Approval Require a distinct review for new vendor banking details and changes to existing instructions. Cover account numbers, routing numbers, beneficiary names, payment methods, and remittance addresses. Protect changes to vendor contact information, too: a criminal who replaces the verification number can undermine the next callback. During onboarding, establish authorized contacts and backup contacts through independently validated channels. Do not let an email attachment automatically update the vendor master record. 2. Verify Through a Previously Established Channel Call an authorized vendor representative using a number already held in a trusted record—not one supplied solely in the change request, attachment, or new signature block. Confirm both that the vendor requested the change and the specific destination details. The FBI recommends using previously known telephone numbers to verify payment changes. Replying to the same email thread is not independent verification if an attacker controls that mailbox. For example, if a supplier announces both a new bank account and a new phone number, do not use the new number to validate the new account. Reach the existing contact or another previously established representative. If neither is available, leave the change pending and escalate internally. 3. Make the Second Approval Meaningful A second authorized person should review the verification evidence and destination details before approving the change. Two people reading the same fraudulent email do not provide two independent checks. Separate vendor-record maintenance from payment release where practical. In a small business, an owner or authorized manager can review banking changes before the bookkeeper uses them. That is a practical compensating measure, not a substitute for every benefit of full separation of duties. 4. Preserve Evidence and Test the Process Keep a restricted-access record of the original request, the contact reached, the source of the callback number, the details confirmed, the verification date, and the independent approver. Record any exception and its authorization. Avoid spreading sensitive banking information through unnecessary email copies. Periodically sample completed changes. Did verification happen before payment? Was the callback number independent of the request? Did the approver examine evidence? The SEC’s report shows why these questions matter: documented procedures did not prevent losses when employees misunderstood or failed to follow them. Technology Helps, but It Does Not Authorize a Payment Protect business email, finance systems, and vendor portals with multifactor authentication. CISA recommends aiming for phishing-resistant MFA . Prioritize administrators and employees who handle payments or sensitive information. Also restrict who can change vendor records and monitor unusual account activity. Where supported, configure workflows that prevent one person from changing banking details and immediately releasing a payment. Account security and transaction authorization solve different problems. MFA can reduce account takeover risk, but it cannot prove that a supplier’s request is legitimate—especially when the supplier’s own account has been compromised. Likewise, a small test payment only demonstrates that funds can reach an account; it does not independently establish who controls it. Manage Friction Without Creating a Bypass Verification adds work. Design that work explicitly rather than expecting employees to improvise under pressure. Urgent payments: Maintain backup vendor contacts and a documented escalation route. Urgency should accelerate review, not eliminate it. High transaction volumes: Concentrate additional scrutiny on onboarding and destination changes while preserving ordinary invoice controls for established payments. Small teams: Use owner or manager review and retain evidence of that review. Executive pressure: Apply verification regardless of seniority and explicitly authorize employees to pause suspicious instructions. Payment deadlines: Explain verification requirements to vendors during onboarding so a legitimate banking change does not become a last-minute surprise. These are implementation choices, not a regulatory safe harbor. Their value depends on whether they operate consistently. What to Do If Money Has Already Been Sent Contact the Bank Immediately Call your financial institution’s fraud team and request an urgent recall or reversal and coordination with the receiving institution. Ask what documentation, including any indemnification paperwork, is required. Do not wait for the internal investigation to finish. The FBI’s recovery guidance emphasizes prompt action. Procedures vary by institution and payment method, and a recall request does not guarantee recovery. Report, Preserve, and Contain File a complaint with the FBI’s Internet Crime Complaint Center . Preserve original emails, headers, invoices, payment confirmations, recipient banking details, and a timeline. Contact the vendor through a trusted channel, pause related payment changes, and involve finance leadership, security, counsel, and your insurer as appropriate. Have authorized responders investigate whether your email environment, the vendor’s, or both were compromised. For Microsoft 365, Microsoft’s response guidance includes resetting credentials, revoking sessions, reviewing MFA methods and application consent, and checking forwarding and inbox rules. A password reset alone is not a complete response. Vendor-Payment Verification Checklist Use this suggested checklist for new or changed payment instructions: Has the invoice and underlying purchase been approved? Has the payment destination been reviewed separately? Was the vendor contact independently validated during onboarding? For a change, was verification completed through a previously established contact? Was the callback number independent of the change request? Did an authorized vendor representative confirm the destination details? Did a second authorized person review the verification evidence? Are the request, verification, and approval recorded securely? Were urgency and executive pressure prevented from bypassing controls? Do employees know how to pause payment and reach the bank’s fraud team? Make the Destination a Separate Decision The lasting lesson of the SEC’s warning is not to distrust every supplier. It is to avoid confusing a persuasive communication with payment authorization. This week, assign an owner to vendor-payment verification and review a sample of recent banking changes. Confirm that independent verification and meaningful approval happened before money moved. If the process depends on someone noticing a suspicious email, strengthen the process—not just the training. ## 5 Growing Cyber Risks Facing Hedge Fund and Private Equity Firms - URL: https://bartmcd.com/blog/5-cyber-risks-hedge-funds-private-equity - Published: 2026-09-28 Imagine a deal closing in two hours. Revised wiring instructions arrive inside a familiar email conversation. A voice message that sounds like a senior partner urges finance to proceed. The documents look right. The deadline is real. The payment request is fraudulent. For hedge fund and private equity firms, cybersecurity is inseparable from how money moves, investment decisions are made, and confidential information is shared. Defenses must protect those business processes—not just the technology supporting them. As of September 28, 2026, five risks deserve particular attention: payment fraud, account takeover, ransomware and operational interruption, third-party exposure, and confidential-data leakage through AI and connected applications. These are practical priorities, not a statistical ranking of attacks against private funds; the government sources below describe broader threats. 1. Payment Fraud and AI-Assisted Impersonation Business email compromise targets trust and payment authority. Attackers may impersonate an executive, compromise an administrator’s mailbox, or insert revised bank details into a legitimate transaction. AI-generated messages and cloned voices can make those requests more convincing. The FBI’s 2025 IC3 report recorded approximately $3.05 billion in reported business email compromise losses. That figure covers IC3 complaints broadly, not investment firms specifically. For fund managers, vulnerable moments include capital calls, distributions, redemptions, acquisition payments, and changes to vendor banking information. Make verification part of the transaction Verify new beneficiaries and changed bank details independently. Use a previously established contact channel, never a number supplied in the request. Separate responsibilities. Payment preparation, beneficiary changes, and final approval should not rest with one person. Require meaningful second approval. The approver must check underlying authorization, not simply trust the first employee. Reject urgency as an exception. A convincing voice or executive title is not proof of identity. Tradeoff: Verification adds friction. Establish contacts and escalation procedures with banks, administrators, and investors before closing day. If funds have already moved, contact the sending institution immediately to request recovery action and report to IC3, following FBI guidance . Do not wait for the internal investigation to finish. 2. Account Takeover and Weak Identity Recovery Multifactor authentication is essential, but “we have MFA” is not a complete answer. Authentication methods differ, and account-recovery procedures can undermine otherwise strong protection. Consider an attacker impersonating a traveling partner who has lost a phone. If the help desk enrolls a replacement authentication method based on a persuasive call, the attacker may gain legitimate-looking access without defeating the original control. Protect recovery as carefully as login Prioritize CISA-recommended phishing-resistant MFA , such as appropriately deployed security keys or passkeys, for email, identity administration, and remote access. Require strong identity verification for password resets, MFA changes, and recovery requests—including requests from executives. Use separate administrative accounts, restrict privileges, and promptly remove obsolete employee and provider access. Monitor suspicious sign-ins and authentication changes, with a named responder responsible for investigation. Tradeoff: Stronger authentication requires enrollment support and a workable lost-device process. Pilot the approach and test emergency access before broad deployment. Leadership test: Ask the internal or outsourced help desk to demonstrate how it would recover a partner’s account without allowing urgency to bypass verification. 3. Ransomware, Data Theft, and Operational Interruption Ransomware is not just an encryption problem. Attackers may steal investor records, research, or deal documents and threaten publication. Restoring systems does not undo that exposure. A hedge fund should test losing access to position and reconciliation systems. A private equity manager should test losing its deal repository during a closing. Portfolio companies need recovery priorities based on their own operations—not assumptions inherited from the management firm. Test business recovery, not just backups Maintain protected backups, including offline or appropriately isolated immutable copies, and separate backup administration from ordinary production access. Prioritize remediation of known exploited vulnerabilities, particularly on internet-facing systems. Use segmentation and endpoint monitoring to limit and detect an attacker’s movement. Restore a complete critical workflow, including identity services, configurations, and vendor dependencies. The CISA #StopRansomware Guide provides prevention, response, and recovery guidance. Translate that guidance into two business decisions: how long a process can remain unavailable and how much recent data the firm can afford to lose. Tradeoff: Faster recovery generally costs more. Prioritize by business impact rather than demanding identical recovery arrangements for every application. A successful file restore is not proof that the firm can resume trading support, complete a closing, or deliver investor reporting. 4. Third-Party Concentration and Portfolio-Company Exposure Administrators, managed IT providers, cloud platforms, and data rooms extend a firm’s operating environment. A provider outage can interrupt operations; compromised provider access can create a route into the firm. NIST’s 2026 supplier due-diligence guide emphasizes supplier resilience, foundational security practices, and supply-chain dependencies. A completed questionnaire alone cannot establish those capabilities. Follow access and dependencies Rank vendors by privileges, sensitive data held, operational importance, and difficulty of replacement. Review relevant evidence: assessment scope, unresolved findings, recovery-test results, and incident procedures. Identify critical subcontractors and infrastructure shared across apparently separate providers. Establish incident contacts, cooperation expectations, and usable data-export arrangements before an emergency. For private equity, assess portfolio-company connections separately. Before linking an acquisition to shared systems, review privileged accounts, remote-access tools, exposed services, backup recoverability, and unresolved incidents. Put remediation owners, costs, and deadlines into the integration plan. Tradeoff: Centralizing providers can improve consistency while increasing concentration risk. Test how critical work would continue if the common provider—or its underlying platform—became unavailable. 5. Confidential-Data Leakage Through AI and Connected Applications An employee may paste a confidential investment memo into an unapproved assistant. An approved assistant may inherit excessive access to shared repositories. Either situation can expose information beyond its intended audience. Another concern is indirect prompt injection : malicious instructions embedded in documents or other material an AI application processes. The NIST Generative AI Risk Management Profile addresses this alongside privacy and information-security risks. Approve bounded uses, not unrestricted access Approve specific products, use cases, and configurations rather than treating all AI tools alike. Define restrictions for investor information, nonpublic deal material, and proprietary research. Verify contractual terms and actual settings for retention, training use, deletion, and access. Limit connectors and repository permissions to what each task requires. Test malicious document instructions and require human authorization before consequential external actions or confidential disclosures. Tradeoff: A blanket ban may push usage out of sight; unrestricted adoption creates unnecessary exposure. Start with lower-sensitivity workflows, assign an accountable owner, and expand only after reviewing permissions and testing results. Regulatory Readiness: Separate Current Rules From Old Proposals For U.S. managers, counsel should assess obligations separately for the adviser, funds, and portfolio companies. A “hedge fund” or “private equity” label does not, by itself, establish regulatory coverage. The SEC’s Regulation S-P amendments had compliance dates of December 3, 2025, for larger covered entities and June 3, 2026, for smaller covered entities. Both have passed. Covered institutions include SEC-registered investment advisers. The amendments require written incident-response policies and procedures. Under the final rule , covered institutions generally must notify affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice must occur as soon as practicable, no later than 30 days after the institution becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The reasonable-investigation exception applies when the institution determines that sensitive customer information has not been, and is not reasonably likely to be, used in a manner resulting in substantial harm or inconvenience. The rule also permits specified delays based on an Attorney General determination concerning national security or public safety. The final rule also requires service-provider oversight procedures reasonably designed to ensure notice to the institution as soon as possible, within 72 hours of provider awareness of a qualifying breach. This is provider-to-institution notice, not a universal SEC reporting deadline. The separate 2022 adviser-and-fund cybersecurity proposal was withdrawn effective June 17, 2025 . Do not treat it as an adopted requirement. A Practical 90-Day Leadership Checklist This is an implementation sequence, not a regulatory timetable. Assign each action an owner and require evidence of completion. First 30 days: Establish visibility COO: Map critical payments, systems, data, and providers; document dependencies. CFO: Test beneficiary-change verification and record exceptions. IT/security: Inventory privileged access and test account recovery. CCO and counsel: Create an entity-specific incident-notification matrix. Days 31–60: Validate critical controls IT/security: Close critical MFA and remote-access gaps; document remaining exceptions. Operations: Restore a critical workflow and measure recovery against business requirements. Vendor owners and operating partners: Review critical providers and portfolio connections. Security and compliance: Inventory AI tools, connectors, and approved uses. Days 61–90: Exercise decisions Incident team: Exercise payment fraud and a vendor-related breach; record decisions and gaps. Managing partners: Review unresolved risks, fund remediation, and assign deadlines. Make Cybersecurity Demonstrable The objective is not a longer list of security products. It is evidence that payments are verified, account recovery resists impersonation, critical work can resume, dependencies are understood, and confidential information stays within approved boundaries. At the next leadership meeting, choose one critical payment workflow and one critical operating workflow. Ask their owners to demonstrate the controls and recovery process. Turn every untested assumption into an assigned action. This article provides operational guidance, not entity-specific legal advice. ## Cybersecurity: The Business Discipline Behind Trust - URL: https://bartmcd.com/blog/cybersecurity-business-discipline-behind-trust - Published: 2026-01-30 Cybersecurity is often treated like an IT problem—buy the right tools, check the right boxes, pass the audit. In practice, it’s closer to a business discipline : how an organization protects revenue, operations, client confidence, and brand reputation in a world where disruption is cheap and constant. I’ve seen the same pattern play out across industries. A firm invests in “best-in-class” security products, but a single misconfiguration, an untrained employee, or a vendor exposure becomes the entry point. The lesson is consistent: strong security is not one control—it’s an operating model that combines people, process, and technology with clear ownership. Cybersecurity isn’t about being unhackable. It’s about being resilient: reducing the chance of impact and minimizing damage when something inevitably gets through. What Cybersecurity Really Covers (And Why It’s Bigger Than “Preventing Hacks”) Cybersecurity is the set of strategies, controls, and practices used to protect systems, networks, applications, and data from unauthorized access, disruption, or destruction. But modern cybersecurity is also about: Operational resilience: keeping the business running during an incident Risk management: prioritizing what matters most and accepting what’s reasonable Trust: demonstrating reliability to customers, partners, regulators, and insurers Decision-making: knowing where to invest and what tradeoffs you’re making The most mature organizations stop asking, “Are we secure?” and start asking, “ Are we secure enough for our risk tolerance—and can we prove it? ” The Modern Threat Landscape: What You’re Actually Defending Against Threats evolve, but the fundamentals don’t: attackers follow the easiest path to money, leverage, or disruption. Today, that usually means exploiting identity, configuration, and human behavior—not “Hollywood hacking.” Ransomware and Extortion (Now a Business Model) Ransomware has matured into an ecosystem: initial access brokers, affiliate operators, data-leak sites, and negotiation playbooks. Many incidents now include data theft + extortion even if systems aren’t fully encrypted. Phishing, Social Engineering, and Business Email Compromise (BEC) Social engineering remains a top driver of real-world losses because it targets the most flexible “system” in any organization: people. BEC attacks often bypass malware entirely and exploit workflows like invoice approvals, wire transfers, and vendor changes. Identity Attacks: The New Perimeter As organizations move to SaaS and cloud platforms, attackers target: Weak authentication (no MFA, poor password hygiene) Token theft and session hijacking Over-permissioned accounts and service principals Stale accounts and unmanaged access paths Supply Chain and Vendor Risk Your security posture includes the third parties you depend on—managed service providers, SaaS tools, cloud platforms, payroll providers, and niche vendors. A vendor doesn’t have to be “breached” to create impact; a misconfiguration, insecure integration, or compromised admin account may be enough. Insider Risk (Malicious or Accidental) Not every incident is an external attacker. Data exposure often comes from misrouted email, overshared cloud folders, poor role design, or departing employees with lingering access. Core Principles: The Cybersecurity Fundamentals That Don’t Change Security gets complicated fast, so it helps to anchor on fundamentals that hold up across technologies and trends. 1) Reduce Attack Surface Every exposed service, unused account, and over-permissioned role is a liability. Reduce what’s reachable, what’s allowed, and what’s trusted by default. 2) Assume Breach “Assume breach” doesn’t mean paranoia—it means designing systems so that when something fails, it fails safely. It drives investments in detection, containment, and recovery. 3) Layer Controls (Defense in Depth) No single tool is “the answer.” Mature security stacks combine preventive controls, detective controls, and response controls—so each layer compensates for the others. 4) Make Security Measurable If you can’t measure progress, you can’t manage it. Metrics don’t need to be perfect, but they must be consistent and tied to business outcomes. A Practical Cybersecurity Program: People, Process, Technology The most effective security programs aren’t the most expensive—they’re the most consistent. Here’s what that looks like in practice. People: Build a Security Culture, Not a Poster Security awareness isn’t about scaring employees; it’s about enabling good decisions under pressure. Role-based training: finance, HR, engineers, executives have different risks Phishing resilience: simulations tied to coaching, not shame Clear reporting: “If you see something, here’s exactly what to do” Executive participation: culture changes when leadership takes it seriously Process: Repeatable, Auditable, and Owned Good security processes are lightweight and consistent. The core processes most organizations need include: Asset inventory: know what you have (devices, apps, cloud workloads, data stores) Vulnerability management: patching with prioritization and proof Access management: onboarding/offboarding, periodic reviews, least privilege Change management: changes are where misconfigurations are born Vendor risk management: due diligence, contract clauses, continuous review Incident response: playbooks, escalation paths, tabletop exercises Technology: Controls That Actually Reduce Risk Tools matter—but only when they’re properly configured, integrated, and owned. High-impact investments commonly include: Identity security: MFA, conditional access, privileged access management (PAM) Endpoint protection: EDR with centralized monitoring and response playbooks Email security: phishing defense, domain protections (SPF/DKIM/DMARC) Network segmentation: reduce lateral movement and contain incidents Backups: immutable/offline options, tested restores, defined RPO/RTO Logging and detection: SIEM/SOAR or managed detection and response (MDR) Data protection: encryption, DLP where it’s realistic, strong key management Frameworks That Help You Prioritize (Without Drowning in Theory) Frameworks are useful when they drive decisions, not paperwork. Two of the most practical: NIST Cybersecurity Framework (CSF) NIST CSF helps organize a program around five functions: Identify, Protect, Detect, Respond, Recover . It’s a strong way to spot gaps (for example, heavy “Protect,” weak “Recover”). CIS Controls The CIS Controls provide a prioritized list of safeguards that map well to real-world attacks. They’re especially helpful for organizations that need a “what to do next” roadmap. A framework isn’t the goal. The goal is reducing risk in a way your organization can sustain. Zero Trust: A Useful Strategy When Done Pragmatically Zero Trust is frequently misunderstood as a product. It’s not. It’s a design approach: never trust, always verify , and continuously evaluate access based on identity, device health, context, and risk. A practical Zero Trust approach typically starts with: Strong MFA everywhere (including admins and third parties) Least privilege and removal of standing admin rights Device trust (managed endpoints, encryption, posture checks) Segmentation between critical systems and the rest of the environment Cloud and SaaS Security: Where Most Organizations Are Exposed Cloud doesn’t eliminate security work; it shifts it. In SaaS and public cloud, your biggest risks often come from: Misconfigurations: overly permissive storage, weak tenant settings Identity sprawl: too many admins, too many apps with persistent access Shadow IT: unsanctioned tools storing business data Limited visibility: insufficient logs, unclear ownership of alerts Practical cloud security improvements include baseline configurations, centralized logging, access reviews, and continuous posture management. AI and Cybersecurity: A Force Multiplier—for Both Sides AI is accelerating cybersecurity in two directions at once. How Attackers Use AI More convincing phishing: better writing, localization, and personalization Faster reconnaissance: automating research on targets and vendors Deepfake-enabled fraud: voice/video impersonation to approve payments or access How Defenders Use AI Improved detection: anomaly detection across logs and identities Faster triage: summarizing alerts and correlating events Security copilots: accelerating investigations and playbook execution The key is governance. If you’re adopting AI internally, treat it like any other system that touches sensitive data: define allowed use cases, protect data, control access, and log activity. Incident Response: The Difference Between a Bad Day and a Business-Ending Event Most organizations don’t fail because they get attacked. They fail because they’re unprepared to respond. A strong incident response capability includes: Clear roles: who declares an incident, who communicates, who makes decisions Playbooks: ransomware, BEC, data loss, insider threat, cloud compromise Legal and compliance readiness: breach notification, evidence preservation Communication plans: internal updates, customers, regulators, media Tabletop exercises: practice under pressure before it’s real Also: test restores. Backups that haven’t been restored are not a recovery strategy—they’re a hopeful assumption. What Executives and Boards Should Ask (To Cut Through Noise) Leaders don’t need to become security engineers, but they do need a reliable way to govern risk. Useful questions include: What are our crown jewels? Which systems and data would cripple operations if compromised? How do we prevent and detect identity compromise? (MFA, conditional access, PAM, monitoring) How fast can we recover? Proven RPO/RTO based on real restore tests What’s our exposure through vendors? Who has access to what, and how is it controlled? Are we improving? Trend lines on patching, phishing, privileged access, and response time Common Cybersecurity Mistakes (And How to Avoid Them) Buying tools without owners: every control needs a responsible team and a process Confusing compliance with security: audits don’t equal readiness Ignoring identity: the perimeter moved—security must follow Over-privileging: convenience becomes breach amplification No tested recovery plan: backups without restore testing are a liability One-time projects: security is continuous operations, not a finish line A Practical 90-Day Cybersecurity Plan If you need momentum quickly, focus on high-leverage fundamentals: Week 1–2: Confirm asset inventory, critical systems, and business priorities Week 2–4: Enforce MFA everywhere; remove shared accounts; lock down admin access Week 3–6: Establish patching SLAs and vulnerability prioritization; fix critical exposures Week 4–8: Validate backups with real restore tests; define RPO/RTO Week 6–10: Centralize logging and alerting; ensure 24/7 coverage via internal team or MDR Week 8–12: Run a tabletop exercise; finalize incident response playbooks and communications This approach doesn’t require perfection. It requires discipline and consistent execution. Conclusion: Security Is a Competitive Advantage When You Treat It Like One Cybersecurity is ultimately about protecting the outcomes your business cares about: revenue continuity, client trust, and the ability to operate without disruption. The organizations that win aren’t the ones with the most products—they’re the ones with clear priorities, strong identity controls, practiced response, and measurable resilience . If you want to strengthen your cybersecurity posture, start with a candid assessment of your crown jewels, identity pathways, recovery capability, and vendor exposure—then build a roadmap your team can actually sustain. Call to action: Schedule a cybersecurity posture review and a tabletop exercise within the next 30 days. If you do only those two things, you’ll immediately reduce uncertainty, reveal hidden gaps, and create a plan you can execute with confidence. ## AI Isn’t Magic—It’s Leverage (and Liability) at Scale - URL: https://bartmcd.com/blog/ai-isnt-magic-its-leverage-and-liability-at-scale - Published: 2026-01-29 Artificial intelligence has crossed the threshold from “interesting” to “inevitable.” In boardrooms, it’s pitched as a productivity revolution. In engineering teams, it’s becoming the default interface for software development, analytics, and customer support. And in cybersecurity, it’s both a force multiplier for defenders and a weapon for attackers. The problem isn’t whether AI works—it’s whether your organization is prepared for what working at AI speed actually means: faster decisions, faster automation, and faster mistakes. The winners won’t be the companies that “use AI.” They’ll be the ones that operationalize it responsibly, secure it by design, and measure outcomes like any other mission-critical system. AI is not a tool you buy. It’s a capability you build—and a risk you must govern. What AI Really Is (and Why That Matters) “AI” is an umbrella term. When leaders treat it like a single product category, they make bad decisions—buying the wrong solutions, underfunding the right controls, and expecting outcomes that the technology can’t reliably deliver. The AI landscape in plain terms Machine Learning (ML): Systems that learn patterns from data to make predictions or classifications (fraud detection, demand forecasting, anomaly detection). Deep Learning: A subset of ML using neural networks—excellent for vision, speech, and complex pattern recognition. Generative AI (GenAI): Models that produce new content (text, code, images, audio, video) based on learned patterns. Large Language Models (LLMs): GenAI trained on large corpora to generate and reason over language; increasingly used as interfaces to data and workflows. AI Agents: LLM-powered systems that can plan and execute multi-step tasks by calling tools (APIs, databases, ticketing systems), sometimes with autonomy. Why definitions matter operationally Different AI types require different controls. A predictive model in a controlled pipeline is not the same risk as an LLM connected to internal systems. If you don’t distinguish them, you won’t know what to secure, what to monitor, or what to approve. Where AI Creates Real Business Value AI value typically shows up in one of three ways: efficiency, better decisions, or new capabilities. The most successful implementations focus on workflows—not novelty. High-impact use cases you can operationalize Customer support acceleration: Drafting responses, summarizing cases, suggesting next actions—while keeping humans accountable for final output. Software engineering productivity: Code generation, test creation, documentation, and code review support—paired with secure development guardrails. Knowledge management: Search and synthesis across policies, contracts, runbooks, and internal wikis using retrieval-augmented generation (RAG). Finance and operations: Invoice processing, anomaly detection, forecasting, and variance explanations. Cybersecurity operations: Alert triage, incident summarization, automated enrichment, playbook assistance, and faster reporting. The pattern behind successful AI programs Organizations that see durable ROI tend to: Start with a measurable business problem (cycle time, cost per ticket, false positive rate). Deploy AI into a controlled workflow (not open-ended chat without governance). Instrument outcomes and iterate (quality, speed, risk). Train the business on how to use it safely—because “usage” is a security control. The AI Lifecycle: Think Like an Operator, Not a Shopper AI systems are not “set and forget.” They drift, they break, and they can be manipulated. Treat them like production infrastructure with an explicit lifecycle. A practical AI lifecycle Data: Collection, labeling, governance, retention, and access control. Model: Selection or training, evaluation, safety testing, and documentation. Deployment: Integration into applications, identity controls, logging, rate limiting, and segmentation. Monitoring: Performance, cost, security signals, toxicity, bias, drift, and incident response. Change management: Versioning models/prompts, approving new data sources, and updating controls. The Hard Truth: AI Expands Your Attack Surface Every major tech shift creates new security problems. AI is no different—it just moves faster and touches more data. If you connect AI to internal systems, you’re effectively building a new control plane for your business. Attackers know that. Common AI-specific security threats Prompt injection: Malicious instructions embedded in text (emails, documents, web pages) that manipulate an AI system into leaking data or taking unsafe actions. Data leakage: Sensitive information pasted into public tools, or exposed through poorly designed retrieval systems and logs. Model inversion and extraction: Attempts to infer training data or replicate proprietary model behavior. Data poisoning: Corrupting training or retrieval data so the model produces incorrect or unsafe outputs. Tool abuse in agents: If an agent can call APIs, attackers will try to get it to call the wrong ones, with the wrong parameters, at the wrong time. Shadow AI: Employees using unapproved tools because they’re convenient—creating unmanaged risk and compliance exposure. AI doesn’t just add risk—it changes the nature of it Traditional security focused on preventing access. AI forces you to also control behavior : what the system is allowed to do, what it is allowed to see, and how it is allowed to respond—even when the input is adversarial. If your AI can “do things,” then your prompt is effectively an attack surface—and your permissions model is the real perimeter. The Reliability Problem: Hallucinations, Bias, and Overconfidence Even when AI isn’t under attack, it can still create operational risk. Generative models can produce confident outputs that are wrong, incomplete, or legally problematic. Key reliability risks leaders must plan for Hallucinations: Fabricated facts, citations, or steps—especially dangerous in legal, finance, healthcare, or security workflows. Bias and unfair outcomes: Models can amplify historical patterns in data, creating reputational and compliance risk. Inconsistent results: Small prompt changes can produce materially different answers. False sense of certainty: Users trust fluent language, even when accuracy is low. How to reduce reliability risk Constrain outputs with grounded data: Use RAG or curated knowledge bases for factual workflows. Require citations and verification steps: Make the model show its sources and confidence signals. Human-in-the-loop controls: Define where humans must approve actions or outputs. Use model choice intentionally: Not every workflow needs the most powerful model—often a smaller, cheaper, more controllable option is better. Governance: The Difference Between AI Adoption and AI Accidents Governance is not bureaucracy. It’s how you scale safely. If you don’t set rules, your employees will—and those rules will be inconsistent, undocumented, and impossible to audit. What an AI governance program should include Acceptable use policy: What tools are approved, what data is prohibited, and what requires review. Data classification mapped to AI: Clear guidance on what can be used in prompts, training, and retrieval systems. Vendor and model risk review: Security posture, training data claims, retention policies, and incident response commitments. Model/prompt change control: Versioning, approvals, and rollback capability. Auditability: Logging for prompts, outputs, tool calls, data access, and administrative actions (aligned with privacy requirements). Red-teaming and testing: Ongoing adversarial testing for prompt injection, data leakage, and unsafe tool use. Compliance is catching up fast Regulatory expectations vary by region and industry, but the direction is consistent: more accountability, more transparency, and stronger controls around sensitive data and automated decision-making. Even where regulations are still forming, your customers and partners will increasingly demand proof that you can govern AI responsibly. How to Deploy AI Securely: Practical Controls That Work If you only remember one thing, remember this: security for AI is mostly about identity, data boundaries, and monitoring . Fancy model discussions don’t matter if your retrieval system can pull confidential documents or your agent can approve actions without oversight. Core security controls for AI systems Identity and access management (IAM): Least privilege for users, services, and agents; role-based access tied to job function. Segmentation: Separate environments for experimentation, staging, and production; isolate AI services from high-risk systems. Data loss prevention (DLP): Prevent sensitive data from entering unapproved AI tools; enforce policy at endpoints and browsers where possible. Retrieval security: Strict permissions on document sources; filter results by user entitlements; avoid “global search” across sensitive repositories. Prompt hygiene and guardrails: Input filtering, system prompts that define boundaries, and output validation for sensitive workflows. Tool call controls for agents: Allowlist tools, validate parameters, require confirmations for risky actions, and implement transaction limits. Monitoring and anomaly detection: Watch for unusual query volume, repeated sensitive requests, and unexpected tool usage. Incident response for AI: Define what constitutes an AI incident (data exposure, unsafe action, integrity failure) and how to contain it. Design principle: assume hostile inputs Any AI system that consumes external content—emails, tickets, web pages, documents—must be designed as if that content is adversarial. That’s not pessimism; it’s realistic threat modeling. A 90-Day AI Playbook for Leaders Most organizations don’t need a year-long AI strategy deck. They need a 90-day plan that reduces risk and creates momentum with measurable outcomes. Days 1–30: Establish control and visibility Inventory AI usage (approved and shadow AI). Publish an AI acceptable use policy tied to data classification. Pick 1–2 low-risk, high-value use cases (internal knowledge, ticket summarization). Set logging and monitoring requirements before expanding access. Days 31–60: Pilot with guardrails Deploy a controlled pilot with a defined workflow and human review. Implement DLP controls and retrieval permissions. Run red-team exercises focused on prompt injection and data leakage. Train users on safe prompting and what not to share. Days 61–90: Scale what works and formalize governance Measure ROI (time saved, quality improvements, reduced errors) and risk signals. Expand to additional teams with the same guardrails and playbooks. Create an AI review board (security, legal, compliance, operations, business owners). Document model and prompt versioning, approvals, and rollback procedures. How to Measure AI ROI Without Fooling Yourself AI can look successful because it’s impressive in a demo. Operational success requires measurement tied to business outcomes and risk reduction. Metrics that actually matter Cycle time: Time to resolve tickets, write reports, complete workflows. Quality: Error rates, rework rates, customer satisfaction, escalation frequency. Cost: Cost per interaction, compute spend per team, licensing efficiency. Risk: DLP incidents, policy violations, security findings, number of high-risk outputs caught by controls. Adoption with compliance: Usage within approved tools versus shadow AI leakage. What’s Next: Agents, Multimodal AI, and the Coming Governance Gap We’re moving from AI that answers questions to AI that takes actions. Multimodal systems will process text, images, audio, and video together—expanding use cases and risks. AI agents will increasingly operate inside business systems. That’s powerful, but it also means mistakes (or malicious manipulation) can translate into real-world outcomes: financial transfers, data changes, approvals, and customer communications. The organizations that thrive will be those that treat AI the way they treat any other critical capability: they define controls, test continuously, and build resilience. Conclusion: Build AI Like You Build Trust AI is here to stay, and the competitive gap between organizations that operationalize it responsibly and those that “experiment forever” will widen quickly. The opportunity is real: faster operations, better decisions, and stronger security outcomes when used correctly. But the downside is equally real: data leakage, automation errors, compliance exposure, and new paths for attackers. The mandate is clear: adopt AI with discipline. Start with a measurable use case, secure the data paths, govern access and behavior, and monitor outcomes continuously. Don’t ask, “Can we use AI?” Ask, “Can we control it, measure it, and defend it?” If you want to move beyond pilots and build an AI program that’s secure, compliant, and operationally effective, start with an AI usage inventory, implement an acceptable use policy tied to data classification, and run a controlled pilot with real monitoring. Then scale—only after you can prove you’re getting value without creating avoidable risk. ## Cybersecurity: Building Digital Resilience in an Era of Constant Disruption - URL: https://bartmcd.com/blog/cybersecurity-building-digital-resilience-constant-disruption - Published: 2026-01-28 Cybersecurity has shifted from being a “technology problem” to a core business discipline. I’ve watched this evolution play out across boardrooms and server rooms: the organizations that treat security as a bolt-on cost center end up reacting to crises, while the organizations that treat security as a resilience program move faster, innovate safely, and recover with confidence when something goes wrong. Today’s threat environment isn’t defined by a single villain or technique. It’s defined by scale, automation, and complexity—cloud adoption, remote work, third-party dependencies, and AI-powered attacks all compound the challenge. The good news is that a strong cybersecurity program is achievable. It requires clarity on risk, disciplined execution, and a culture that makes secure behavior the default—not the exception. Cybersecurity isn’t about preventing every incident. It’s about reducing likelihood, limiting blast radius, and recovering quickly—without losing trust. What Cybersecurity Really Means (Beyond Tools) At its core, cybersecurity is the practice of protecting systems, networks, applications, and data from unauthorized access, disruption, or destruction. But the most effective programs go further: they align security controls to business priorities and continuously adapt as the business changes. The CIA Triad—and Why It Still Matters Confidentiality: Preventing unauthorized access to sensitive information. Integrity: Ensuring data is accurate and hasn’t been tampered with. Availability: Keeping systems and data accessible when needed. Most organizations instinctively focus on confidentiality—often because a breach is visible and reputationally damaging. But integrity and availability are just as critical. A ransomware event is an availability crisis. A subtle manipulation of financial data is an integrity crisis. Real security addresses all three. Today’s Threat Landscape: What’s Actually Hurting Organizations Attackers follow opportunity and profit. They exploit misconfigurations, weak identity controls, unpatched systems, and human behavior. The tactics change, but the underlying patterns are remarkably consistent. 1) Ransomware and Extortion Ransomware has matured into a business model. Modern campaigns often include data theft before encryption, followed by extortion threats to publish data or pressure customers and partners. Initial access frequently comes from phishing, credential theft, or exposed remote services. Attackers seek privilege escalation and lateral movement to maximize impact. Backups are increasingly targeted—because recovery is the enemy of ransom payments. 2) Business Email Compromise (BEC) BEC is one of the most financially damaging categories of cybercrime because it bypasses malware and targets process. If your payment workflows and approvals are weak, BEC can look like “normal business.” Executive impersonation, invoice fraud, wire diversion, payroll rerouting Often enabled by stolen credentials and lack of strong authentication 3) Supply Chain and Third-Party Risk Your security posture is not just your controls—it’s also the controls of your vendors, MSPs, SaaS providers, and integration partners. Third-party compromises can turn a trusted connection into a breach path. 4) Cloud Misconfigurations and Identity Sprawl Cloud environments are powerful, but they introduce new failure modes: overly permissive roles, exposed storage, unmanaged secrets, and fragmented identity systems. In many cases, the “breach” is simply a misconfiguration paired with weak monitoring. 5) Insider Risk (Malicious or Accidental) Not every insider incident is malicious. Many are the result of rushed decisions, unclear policies, or overly broad access. A strong program reduces the chance of accidents and detects malicious activity quickly. The Business Case: Cybersecurity as Risk Management Security leaders earn credibility when they speak in business terms: risk, downtime, revenue impact, regulatory exposure, customer trust, and operational resilience. The goal isn’t to “secure everything equally.” The goal is to identify what matters most and protect it proportionally. Start With a Clear Risk Model Identify critical assets: crown-jewel data, revenue systems, operational platforms, and customer-facing services. Map threats: what could realistically compromise those assets? Measure impact: financial loss, downtime, safety concerns, regulatory penalties, brand damage. Prioritize controls: align investment to business-critical risk reduction. Use Frameworks to Drive Consistency Frameworks help avoid ad hoc security. They provide a common language and a structured path for maturity. NIST Cybersecurity Framework (CSF): Identify, Protect, Detect, Respond, Recover. ISO 27001: a management system approach to security governance and controls. CIS Controls: pragmatic, prioritized safeguards that map well to real-world attacks. The Modern Security Program: What “Good” Looks Like There is no single product that “solves” cybersecurity. Strong programs are built as a set of capabilities that work together. If you want a practical blueprint, focus on these pillars. 1) Identity and Access Management (IAM): The New Perimeter In a cloud-first, remote world, identity is the control plane. If an attacker gets valid credentials, many traditional defenses become irrelevant. Require phishing-resistant MFA for privileged users and high-risk systems (where feasible). Enforce least privilege with role-based access and just-in-time elevation for admins. Centralize identity and reduce “shadow accounts” across SaaS applications. Monitor for impossible travel, anomalous logins, and token abuse. 2) Endpoint and Device Security Endpoints remain a primary entry point. The goal is to reduce compromise likelihood and detect malicious behavior quickly. EDR/XDR for behavioral detection and rapid containment Hardening baselines and continuous configuration management Asset inventory so you can protect what you actually have Patch management with clear SLAs for critical vulnerabilities 3) Network Security and Segmentation Segmentation limits blast radius. When attackers can move laterally without friction, incidents become catastrophes. Segment critical systems (finance, backups, OT/ICS, domain controllers, sensitive databases) Adopt Zero Trust principles: verify explicitly, least privilege access, assume breach Secure remote access and reduce exposed services on the public internet 4) Data Security: Know Where It Is, Control How It Moves Data protection is often where strategy meets reality. You can’t protect what you can’t find. Data classification aligned to business sensitivity Encryption in transit and at rest for sensitive data DLP and SaaS controls to reduce accidental exposure Key management and secret management for cloud-native environments 5) Security Monitoring and Detection Engineering Security operations should be built around outcomes: rapid detection, clear triage, and decisive containment. Collecting logs without a plan to use them is a tax, not a defense. Centralize telemetry (SIEM and/or modern detection platforms) Prioritize high-signal detections tied to likely attack paths Automate response where it’s safe (disable accounts, isolate devices, block known malicious indicators) Test detections through tabletop exercises and purple-team activities 6) Secure Software and Cloud Engineering (DevSecOps) Security must match the speed of software delivery. That means shifting left—without slowing teams down. Threat modeling for critical applications SAST/DAST and dependency scanning integrated into CI/CD Infrastructure as Code (IaC) scanning for cloud misconfigurations Secrets detection to prevent credential leakage in repositories 7) Governance, Policies, and Security Culture Policies should enable the business, not suffocate it. The most effective policies are short, clear, and enforced through technology whenever possible. Security awareness that’s role-based (finance, executives, developers, help desk) Clear escalation paths so employees report suspicious activity quickly Management accountability for risk acceptance and remediation timelines Incident Response: Assume It Will Happen The fastest way to reduce breach impact is to be ready before the breach. An incident response program is not a binder on a shelf—it’s a practiced capability. What Strong Incident Response Includes Defined roles: IT, security, legal, communications, finance, leadership Runbooks: ransomware, BEC, lost device, data exposure, cloud credential compromise Forensic readiness: logging retention, time synchronization, evidence handling Decision frameworks: shutdown criteria, isolation steps, external notifications Tabletop exercises: at least 2–4 times per year for meaningful readiness Backups: Your Last Line of Defense Must Be Protected Immutable backups or write-once controls where possible Offline or isolated copies for critical systems Routine restore testing (a backup you can’t restore is not a backup) Metrics That Matter: How to Know If You’re Improving Security maturity requires measurement. The best metrics connect operational reality to business risk. MTTD/MTTR: mean time to detect and respond Patch SLA compliance: especially for critical vulnerabilities on internet-facing systems MFA coverage: percent of users and admins with strong authentication Privilege reduction: number of standing admin accounts and access reviews completed Phishing resilience: reporting rates and repeat-click trends (not just “failure rates”) Backup recovery time: verified RTO/RPO against business requirements AI and Cybersecurity: Acceleration on Both Sides AI is amplifying cybersecurity—both for defenders and attackers. Attackers use AI to scale social engineering, generate convincing lures, and accelerate reconnaissance. Defenders use AI to summarize alerts, detect anomalies, and automate triage. But AI does not replace fundamentals. Where AI Helps Security Teams Today Alert enrichment and summarization to reduce analyst fatigue Anomaly detection across identity, endpoint, and network telemetry Security copilots for faster investigation and response workflows New Risks: Securing AI Systems Themselves Data leakage: sensitive inputs to AI tools and shadow AI usage Prompt injection and model manipulation: especially in AI-integrated applications Supply chain risk: third-party models, plugins, and dependencies Governance gaps: unclear ownership, logging, and acceptable use policies If your organization is adopting AI, treat it like any other critical system: define acceptable use, secure the data flows, log activity, and test for abuse cases. A Practical 90-Day Cybersecurity Plan Many organizations don’t need a dramatic overhaul—they need a focused sequence. If you want traction quickly, prioritize controls that reduce common breach paths and speed up containment. Days 1–30: Stabilize the Basics Inventory assets and accounts (devices, servers, cloud tenants, SaaS apps) Enforce MFA for email, VPN, admin access, and key business applications Lock down admin privileges and implement access reviews Verify backups and perform at least one restore test Days 31–60: Improve Detection and Resilience Deploy or tune EDR and ensure it’s monitored Centralize logs for identity, endpoints, and critical systems Segment critical systems and restrict lateral movement paths Run a ransomware tabletop exercise and refine runbooks Days 61–90: Reduce Structural Risk Implement secure configuration baselines and patch SLAs Harden cloud IAM and reduce over-permissioned roles Review third-party risk for critical vendors and tighten contract requirements Launch role-based security training for high-risk teams (finance, IT, executives) Conclusion: Cybersecurity Is a Leadership Discipline Cybersecurity isn’t won by buying one more tool. It’s won by building a system of accountability, hardening the paths attackers actually use, and practicing response until it’s second nature. The organizations that succeed are the ones that treat security as a core capability—integrated into IT operations, software delivery, vendor management, and executive decision-making. The real objective is resilience: reduce the probability of an incident, minimize damage when it happens, and restore operations quickly while maintaining trust with customers, regulators, and employees. Action beats anxiety. Pick a plan, measure progress, and make cybersecurity part of how your organization runs—not a project you “finish.” If you want to strengthen your cybersecurity posture, start by identifying your top five business-critical systems, mapping the most likely attack paths to each, and aligning a 90-day improvement plan around identity, backups, detection, and segmentation. Then commit to quarterly reviews—because cybersecurity is not a destination. It’s an operating model. ## Artificial Intelligence: What It Is, Why It Matters, and How to Use It Safely - URL: https://bartmcd.com/blog/artificial-intelligence-what-it-is-and-use-it-safely - Published: 2026-01-27 AI has moved from “interesting technology” to “operating system for modern business.” In the last few years—especially with the rise of generative AI—leaders have watched productivity jump in pockets of the organization while risk, confusion, and hype surged right alongside it. I’ve spent my career at the intersection of technology, security, and operational execution. The pattern is familiar: when a capability gets powerful enough, it doesn’t stay in innovation labs. It spreads—fast. The winners aren’t the companies with the flashiest demos. They’re the ones that build AI into their workflows with discipline: clear use cases, controlled data, measurable outcomes, and security baked in from day one. AI is not a project. It’s a capability—and like every capability, it needs governance, guardrails, and a roadmap. What AI Actually Is (and What It Isn’t) Artificial intelligence is a broad umbrella for techniques that enable software to perform tasks that typically require human judgment—recognizing patterns, generating content, making predictions, and optimizing decisions. AI vs. Machine Learning vs. Deep Learning AI : The umbrella term—systems that mimic or augment human reasoning and decision-making. Machine Learning (ML) : A subset of AI where systems learn patterns from data to make predictions or classifications (e.g., fraud detection, demand forecasting). Deep Learning : A subset of ML using neural networks with many layers, often powering image recognition, speech processing, and large language models. Generative AI: A Shift in How Work Gets Done Generative AI (GenAI) refers to models that create new content—text, code, images, audio—based on patterns learned from training data. This matters because it changes the interface to work. Instead of navigating dozens of tools, users can increasingly “ask” for outcomes and refine them conversationally. But GenAI also introduces a new class of risk: it can produce convincing output that is wrong, biased, sensitive, or insecure—at machine speed. How Modern AI Systems Work (In Plain English) Most AI systems follow a lifecycle that looks simple on slides but gets complex in practice: Data : Collect, clean, and govern information. Bad data yields bad outcomes—and sometimes regulatory exposure. Training : A model learns patterns from data. With large models, training may be done by a vendor; your organization often focuses on tuning and implementation. Inference : The model produces an output—classification, prediction, recommendation, or generated content. Feedback loop : Humans validate, correct, and improve results. This is where accuracy, safety, and trust are won or lost. The Two Questions Every Leader Should Ask What decision or workflow are we improving? If the answer is vague, the initiative will drift. What data touches the model, and where does the output go? That’s the security and compliance map—whether you draw it or not. Where AI Delivers Real Value The most successful AI programs don’t start with technology. They start with measurable outcomes and constrained scope. In practice, AI value tends to land in four buckets: 1) Productivity and Knowledge Work Acceleration Drafting emails, policies, proposals, and client communications Summarizing meetings and extracting action items Creating first-pass analyses from structured and unstructured data Actionable takeaway: Start with internal copilots in low-risk environments, and measure time saved per role before scaling. 2) Decision Support and Forecasting Demand forecasting and supply chain optimization Customer churn prediction Financial planning support and anomaly detection Actionable takeaway: Pair model outputs with human sign-off and build “reason codes” (explainability) into the workflow. 3) Customer Experience and Revenue Enablement Intelligent chat and support routing Personalized content and recommendations Sales enablement: call summaries, objection handling, account research Actionable takeaway: Restrict what customer-facing AI is allowed to say, and implement escalation paths for edge cases. 4) Security, Risk, and Operational Resilience Threat detection and alert triage Phishing analysis and simulation improvements Policy mapping and compliance evidence collection Actionable takeaway: Use AI to reduce noise, not to eliminate human judgment. If your SOC is drowning, start by automating enrichment and prioritization. The Other Side of the Coin: AI Risk Isn’t Theoretical AI introduces risk in three ways: it can expose data, it can produce unreliable output, and it can be weaponized by adversaries. If you’re responsible for a business, assume all three will happen unless you design controls proactively. Key Risk Categories Leaders Should Manage Data leakage : Sensitive information pasted into public tools, copied into prompts, or included in training data unintentionally. Hallucinations and accuracy failures : Confident output that is wrong—dangerous in legal, medical, financial, and security contexts. Bias and unfair outcomes : AI reflecting or amplifying biases in training data or decision logic. IP and copyright ambiguity : Unclear provenance of generated content, code, or imagery. Model and supply-chain risk : Vulnerabilities in third-party models, plugins, integrations, and data pipelines. Regulatory exposure : Evolving global rules around privacy, transparency, and automated decision-making. AI and Cybersecurity: The Arms Race Has Accelerated From a cybersecurity standpoint, AI is both a defensive force multiplier and an attacker’s productivity tool. The same capabilities that help your team summarize incidents can help a criminal write phishing lures, generate malware variants, or scale social engineering. How Attackers Use AI More convincing phishing : Better grammar, personalization, and rapid iteration Deepfakes and voice cloning : Business email compromise and executive impersonation Reconnaissance at scale : Faster profiling of targets using public data Automation : Scaling exploit attempts and social engineering campaigns How Defenders Should Use AI Triage and prioritization : Reduce alert fatigue by ranking incidents by risk Faster investigations : Summarize logs, correlate events, generate timelines Detection engineering : Assist in rule creation and mapping to frameworks Security awareness : Create realistic simulations and tailored training Non-Negotiable Security Controls for AI Adoption Data classification + usage policy : Define what can and cannot be entered into AI tools. Approved toolchain : Provide a sanctioned AI environment; don’t force employees to “shadow AI” with consumer tools. Access controls : Least privilege for prompts, connectors, and data sources. Auditability : Log prompts, outputs, and data access where feasible. Human-in-the-loop : Especially for financial, legal, HR, and security decisions. Vendor due diligence : Understand data retention, training use, and breach response terms. Governance: The Missing Layer in Most AI Programs The biggest mistake I see is treating AI like a set of tools instead of a managed capability. Governance isn’t bureaucracy—it’s what allows speed without creating tomorrow’s crisis. What “Good” AI Governance Looks Like AI use-case intake : A lightweight process to approve and prioritize deployments. Risk tiering : Not every AI use case needs the same scrutiny. A marketing assistant is not the same as a lending model. Model accountability : Named owners for performance, safety, and drift. Policies that map to reality : Clear, teachable rules employees can actually follow. Ongoing monitoring : Accuracy, bias, security events, and operational impact. A Practical Roadmap to Implement AI in Your Organization If you want AI to drive outcomes—not experiments—use a structured approach. Step 1: Pick Use Cases That Are High-Value and Low-Regret High frequency tasks (many hours spent) Clear success metrics (time saved, error rate reduction, faster cycle time) Constrained data exposure (avoid regulated data early) Step 2: Build a “Secure AI Sandbox” Approved models/tools with enterprise controls Restricted connectors and curated knowledge sources Clear boundaries for sensitive data and retention Step 3: Measure What Matters Efficiency : Time saved per workflow Quality : Error rates, rework volume, customer satisfaction Risk : Policy violations, data exposure events, audit findings Step 4: Train the Workforce (Beyond “Prompt Tips”) How to validate output and spot hallucinations What information must never be used in prompts How to cite sources and preserve provenance How to escalate edge cases and suspected tool misuse Step 5: Scale with Governance, Not Guesswork Once you prove value in a few workflows, expand through a repeatable pattern: use-case template, risk tiering, security review, pilot, metrics, and controlled rollout. The Future of AI: What to Watch AI will keep improving, but the real shift is architectural: AI is becoming embedded in every application and workflow. Agentic AI : Systems that can execute multi-step tasks across tools (powerful, but increases blast radius). Multimodal AI : Models that understand and generate text, images, audio, and video—raising both productivity and fraud risk. Private and edge AI : More inference happening closer to data sources, improving privacy and latency. Stronger regulation and standards : Expect more requirements around transparency, auditability, and data handling. Conclusion: Lead With Outcomes, Guardrails, and Accountability AI is here to stay, and it will reshape how every organization operates. But “adopting AI” isn’t the goal. The goal is to deliver better outcomes—faster, safer, and at scale—without creating new, invisible risk. Start with focused use cases. Build a secure environment employees want to use. Measure impact. Put governance in place early. And treat AI as a strategic capability that requires ownership—just like cybersecurity, finance, or operations. Call to action: If you’re planning AI adoption (or already seeing shadow AI in your organization), conduct a 30-day AI readiness assessment: inventory tools in use, classify data exposure paths, pick three high-value low-risk use cases, and define the guardrails before you scale. That one month of discipline will save you a year of cleanup. ## Cybersecurity Today: How to Build Real Resilience in a World That Won’t Slow Down - URL: https://bartmcd.com/blog/cybersecurity-today-building-real-resilience - Published: 2026-01-26 Cybersecurity used to be a technology problem. Today, it’s a leadership problem, a business continuity problem, and—more often than not—a trust problem. I’ve spent my career helping organizations reduce risk in the real world: legacy systems, budget constraints, complex vendor ecosystems, remote work, cloud migration, M&A activity, and a threat landscape that evolves faster than most operating models can keep up. The lesson is consistent: cybersecurity isn’t about buying tools—it’s about building capability . This article lays out a practical, comprehensive approach to cybersecurity: what’s changed, what actually works, and how to build a program that’s defensible to customers, insurers, regulators, and your board. Security isn’t a product. It’s a posture—earned through discipline, visibility, and repeatable execution. The Modern Threat Landscape (And Why It Keeps Winning) Attackers don’t need to “hack” in the Hollywood sense. They look for the fastest path to impact: credential theft, misconfigurations, exposed remote access, weak vendor controls, and users who can be socially engineered under pressure. What’s driving today’s risk Ransomware as a business model : Initial access brokers, affiliate programs, extortion playbooks, and double/triple extortion are now standard. Identity is the new perimeter : Cloud, SaaS, remote work, and APIs mean your “network” matters less than who can authenticate and what they can do. Supply chain and vendor exposure : Third parties often hold your data, your access, or both. AI accelerates both offense and defense : Phishing is more convincing, malware development is faster, and attackers can scale social engineering. Defenders can also use AI to improve detection and triage—if it’s implemented responsibly. Operational complexity : Hybrid cloud, multiple endpoint types, shadow IT, and rapid deployment cycles create security blind spots. The hard truth: most breaches are “known issues” The majority of incidents trace back to fundamentals: Unprotected or poorly protected admin accounts Weak or reused passwords Missing MFA Unpatched systems and exposed services Inadequate logging and monitoring Over-permissioned users and service accounts That’s not bad news—it’s direction. If you invest in the right basics with consistency, you immediately reduce real risk. Cybersecurity Fundamentals: The Controls That Move the Needle If you want cybersecurity that holds up under pressure, focus on a few pillars and execute them exceptionally well. Everything else is an enhancement. 1) Identity and Access Management (IAM): Start Here Identity is where attackers live once they get a foothold. Strong IAM reduces both breach likelihood and blast radius. Enforce MFA everywhere (especially email, VPN, remote access, and admin tools). Prefer phishing-resistant methods (FIDO2/WebAuthn) for privileged roles. Centralize identity and reduce credential sprawl across SaaS tools. Least privilege by default : Users should not be local admins, and access should be role-based and time-bound. Privileged Access Management (PAM) : Vault admin credentials, rotate them, and require approvals for elevated access. Conditional access : Use device posture, geo-velocity, and risk-based policies to block suspicious sign-ins. 2) Endpoint and Server Security: Assume Every Device Is Targeted Endpoints remain a primary execution point for ransomware and credential theft. EDR/XDR with 24/7 monitoring where possible Patch management with measurable SLAs (e.g., critical vulnerabilities remediated within days, not months) Application control for high-risk environments (reduce what can run) Hardening baselines (CIS benchmarks are a solid starting point) Disk encryption and secure device configuration for remote workforces 3) Email and Collaboration Security: The Primary Attack Channel Email remains the most cost-effective attack vector because it targets humans—your most important system and your most variable one. Secure email gateway and advanced phishing protection DMARC, DKIM, SPF to reduce spoofing and brand impersonation Attachment and link detonation or sandboxing Policies for external forwarding and suspicious inbox rules 4) Network and Cloud Security: Reduce Exposure, Increase Segmentation Perimeter-only thinking fails in cloud and hybrid environments. You need layered containment. Zero Trust principles : verify explicitly, use least privilege, assume breach Segment critical assets : isolate backups, admin tools, and crown-jewel systems Secure remote access : eliminate exposed RDP, restrict VPN, and monitor administrative sessions Cloud posture management : continuously assess misconfigurations and risky permissions API security and secrets management for modern applications 5) Logging, Monitoring, and Detection: You Can’t Defend What You Can’t See Many organizations don’t fail because they lack tools; they fail because they lack visibility and a reliable process to act on what they see. Centralize logs (SIEM or managed detection platform) Prioritize high-value data sources : identity logs, EDR telemetry, email logs, firewall/cloud audit logs Alert tuning to reduce noise and focus on high-confidence detections Defined escalation paths and incident ownership 6) Backups and Recovery: Your Last Line of Defense Against Ransomware Backups are not a checkbox. They are a recovery system—and they must be built to withstand attack. Immutable or write-once backups (attackers target backup systems first) Offline or isolated copies for critical data Regular restore testing (a backup you can’t restore is not a backup) Documented RTO/RPO aligned to business priorities If your recovery plan hasn’t been tested under pressure, it’s a document—not a capability. The Human Side: Culture, Training, and Execution Under Stress Security awareness training isn’t about making people “smarter.” It’s about making secure behavior easier than insecure behavior. What effective security training looks like Short, frequent training that fits real workflows Role-based modules for executives, finance, IT, developers, and customer-facing teams Phishing simulations that teach, not punish Clear reporting paths : one-click reporting and rapid feedback loops Security as a business process Cybersecurity becomes sustainable when it’s embedded into operational rhythms: New hire and offboarding processes Change management and approvals Vendor onboarding and periodic reviews Quarterly access reviews for sensitive systems Regular tabletop exercises for incidents Ransomware Readiness: How to Reduce Likelihood and Limit Damage Ransomware isn’t just encryption anymore; it’s extortion, disruption, and reputational leverage. The goal is to prevent it where possible and contain it when prevention fails. High-impact ransomware defenses Remove local admin rights for standard users Protect privileged accounts with PAM and phishing-resistant MFA Block common lateral movement paths through segmentation and hardening Harden Active Directory (or your identity provider) as a top-tier asset Secure and isolate backups , then test restores Maintain an incident response retainer if your risk profile demands it Third-Party and Supply Chain Risk: Your Attack Surface Isn’t Just Yours Vendors, MSPs, SaaS platforms, and integration partners are now part of your security boundary. The goal isn’t to eliminate third-party risk—it’s to manage it intelligently. A practical third-party risk approach Tier vendors based on data sensitivity and access level Require security basics : MFA, encryption, incident notification, logging, and vulnerability management Contract for accountability : SLAs for incident response, audit rights, and breach disclosure timelines Monitor continuously where feasible (not just annual questionnaires) AI and Cybersecurity: Opportunity, Risk, and Responsible Use AI changes cybersecurity in two ways: it amplifies attacker capability, and it can dramatically improve defender speed—if used with discipline. How attackers use AI More persuasive phishing and business email compromise attempts Faster reconnaissance and content generation for social engineering Automation of low-skill attack steps , increasing volume and targeting How defenders should use AI Triage and prioritization : reduce time spent on false positives Threat hunting assistance : summarize events and suggest next investigative steps Policy and control validation : identify misconfigurations and risky access patterns The governance most organizations miss AI security is not just about tools. It’s about controlling data exposure and preventing accidental leakage through prompts, plugins, and integrations. Define approved AI use cases by role and data classification Prevent sensitive data entry into unapproved AI systems Track and audit AI access where possible Secure your AI supply chain : models, datasets, and third-party components AI doesn’t replace security fundamentals—it magnifies the consequences of ignoring them. Incident Response: Plan Like You’ll Need It (Because You Will) An incident response plan shouldn’t be written to impress auditors. It should be written for the worst day of your year—when people are stressed, information is incomplete, and decisions must be made quickly. What to include in a workable incident response program Clear roles and authority : who declares an incident, who talks to customers, who engages legal Communication templates : internal updates, customer notifications, regulatory language Evidence preservation : logging retention, endpoint isolation steps, chain-of-custody basics Tabletop exercises : ransomware, BEC, insider threat, vendor breach The first 60 minutes matter In many real incidents, early actions determine the outcome: Contain the affected identity or endpoint Preserve logs and volatile evidence Confirm backup integrity Block known malicious IPs/domains if identified Engage the right experts early (IR, legal, cyber insurance, communications) Governance, Risk, and Compliance: Turning Security Into an управably Managed Program Good governance ensures cybersecurity is prioritized, funded, measured, and improved over time. Compliance frameworks don’t guarantee security, but they can provide structure and common language. Common frameworks that help NIST CSF : strong for program structure and maturity CIS Controls : practical technical control guidance ISO 27001 : management system approach with auditability SOC 2 : trust-based reporting often required by customers Metrics that executives and boards actually need Security metrics should answer: “Are we reducing risk?” and “Can we withstand disruption?” Consider: MFA coverage across critical systems and privileged accounts Patch compliance against defined SLAs Endpoint coverage (EDR installed, healthy, and monitored) Mean time to detect/respond for high-severity events Backup restore success rate and time-to-recover for key services Phishing reporting rate and repeat-click trends (measured constructively) A Practical 90-Day Cybersecurity Roadmap If you’re trying to build momentum quickly, focus on actions that reduce real risk and create operational clarity. Days 0–30: Stabilize and get visibility Enforce MFA for email, remote access, and admin accounts Confirm backups are isolated/immutable and perform at least one restore test Deploy or validate EDR on all endpoints and servers Inventory critical assets: identity provider, email, key SaaS, crown-jewel data Establish incident response ownership and escalation paths Days 31–60: Reduce attack paths Remove local admin rights and implement least privilege Harden identity: conditional access, admin separation, risky sign-in alerts Patch critical vulnerabilities with measurable SLAs Segment key systems and isolate management interfaces Implement DMARC and improve email protections Days 61–90: Operationalize and measure Centralize logging for identity, endpoints, and cloud audit sources Run a tabletop exercise (ransomware + BEC are a strong starting pair) Formalize vendor risk tiers and minimum security requirements Create a quarterly security scorecard for leadership Document a 12-month security roadmap aligned to business goals Conclusion: Cybersecurity Is a Capability—Build It Like One The organizations that handle cybersecurity well aren’t the ones with the most tools. They’re the ones that execute fundamentals consistently , invest in visibility, and treat response readiness as a core business function. If you want to improve security in a way that customers, insurers, regulators, and your leadership team will respect, focus on building repeatable capability across identity, endpoints, backups, monitoring, and incident response—and then measure it. Cybersecurity resilience isn’t about avoiding every incident. It’s about ensuring incidents don’t become existential events. Call to action: If you’re ready to move from ad hoc security efforts to a disciplined program, start with a 90-day plan: lock down identity, validate recovery, and build detection and response muscle. Once the fundamentals are solid, you can scale governance, mature controls, and use AI responsibly to increase speed without increasing risk. ## Cybersecurity in 2026: How to Protect What Matters Without Slowing the Business - URL: https://bartmcd.com/blog/cybersecurity-2026-protect-without-slowing-business - Published: 2026-01-23 Cybersecurity used to be a technology problem—patch the servers, deploy antivirus, and hope for the best. Today it’s a business survival discipline . Your attack surface includes cloud platforms, SaaS apps, remote endpoints, third-party vendors, identities, APIs, and now AI systems that can create, transform, and distribute data at machine speed. I’ve spent my career building and operating security programs in the real world—where uptime matters, people are busy, and budgets compete with every other priority. The lesson is simple: the best security strategy is the one your organization can execute consistently . This article lays out a comprehensive, practical approach to cybersecurity that reduces risk, improves resilience, and supports growth. Cybersecurity isn’t about being unhackable. It’s about making compromise difficult, detecting it quickly, and recovering fast—without turning the business into a bureaucracy. What Cybersecurity Actually Means (and What It Doesn’t) Cybersecurity is the practice of protecting systems, networks, applications, and data from unauthorized access, disruption, or destruction. But it’s not a single tool, and it’s not a “project” you finish. Cybersecurity is a set of capabilities that must work together: Prevention: reduce the likelihood of compromise (hardening, patching, access controls). Detection: identify suspicious activity quickly (logging, monitoring, alerting). Response: contain and eradicate threats (incident playbooks, forensics). Recovery: restore operations and data (backups, DR, business continuity). Governance: align security with business risk (policies, metrics, accountability). The Modern Threat Landscape: What You’re Up Against Threats aren’t just “hackers.” They include organized crime, nation-state actors, insider risks, competitors, opportunists, and automated bots. What’s changed is the efficiency of attacks : attackers can scan, exploit, and monetize at scale. Ransomware and Extortion (Now a Business Model) Ransomware has matured into an ecosystem with affiliates, help desks, and double- or triple-extortion tactics. The goal isn’t just to encrypt files—it’s to disrupt operations and pressure leadership with data leaks and regulatory exposure. Common entry points: stolen credentials, unpatched VPNs, exposed RDP, phishing, and vendor access. Common failure modes: weak MFA, poor segmentation, inadequate logging, and untested backups. Identity Attacks: The New Perimeter As organizations moved to cloud and SaaS, the perimeter shifted from networks to identity . Attackers know that if they can compromise an identity (or bypass MFA), they can walk through legitimate doors. Credential stuffing and password reuse MFA fatigue/push bombing Token theft and session hijacking Privilege escalation inside cloud environments Supply Chain and Third-Party Risk Your security posture is partially inherited from your vendors—managed service providers, SaaS platforms, payment processors, contractors, and software dependencies. A single compromised vendor account can become your incident. AI-Accelerated Social Engineering AI has dramatically increased the quality and speed of social engineering—phishing, business email compromise (BEC), deepfake voice calls, and convincingly written impersonations. The playbooks are familiar; the execution is faster and more believable. Start with Risk: The Only Sustainable Way to Prioritize Security teams fail when they try to “boil the ocean.” The strongest programs anchor decisions to risk —what you’re protecting, from whom, and what happens if you fail. Define What Matters Most Every organization should identify its “crown jewels,” typically including: Customer data and regulated data (PII, PHI, PCI) Financial systems and payment workflows Intellectual property Operational systems that impact uptime and service delivery Identity systems (SSO, directory services, privileged access) Translate Cyber Risk into Business Language Leadership doesn’t need more vulnerability counts—they need clarity on exposure and impact. Effective risk conversations include: Likelihood: how probable is the scenario in your industry and environment? Impact: downtime, revenue loss, regulatory penalties, customer churn, reputational harm. Time-to-detect and time-to-recover: how long until you notice, and how fast can you restore? A Practical Security Framework: Build the Fundamentals First You don’t need to invent a framework. Use established models like NIST CSF, CIS Controls, or ISO 27001—and implement them pragmatically. In most environments, the biggest wins come from basic controls done exceptionally well . 1) Asset and Exposure Management You can’t defend what you can’t see. Maintain an accurate inventory of endpoints, servers, cloud resources, and SaaS apps. Continuously scan for exposed services, misconfigurations, and unknown assets. Classify data and map where it lives (especially across SaaS and file sharing). 2) Vulnerability and Patch Management (with Real SLAs) Patching isn’t glamorous, but it stops a large percentage of real-world intrusions. Set risk-based patch SLAs (e.g., critical internet-facing vulnerabilities within 72 hours). Prioritize by exploitability, exposure, and business criticality—not just CVSS. Include third-party apps, firmware, and cloud images in your patch strategy. 3) Identity, Access, and Privilege: Where Breaches Usually Begin Identity security is the highest-leverage investment most organizations can make. Enforce phishing-resistant MFA where possible (FIDO2/WebAuthn) for admins and high-risk users. Adopt least privilege and remove standing admin rights from daily accounts. Use Privileged Access Management (PAM) or at minimum separate admin accounts and strong controls. Implement conditional access policies (device posture, geo, impossible travel, risk scoring). Regularly review and certify access—especially for financial and data systems. 4) Endpoint and Email Security: Still the Front Lines Most attacks still touch endpoints and inboxes. Deploy EDR/XDR with centralized visibility and clear response procedures. Harden endpoints: disable macros where feasible, enforce disk encryption, control USB usage. Strengthen email: SPF/DKIM/DMARC, safe links/attachments, impersonation protection. Standardize secure configurations using benchmarks (e.g., CIS). 5) Network and Cloud Security: Segment, Monitor, and Assume Exposure Flat networks and overly permissive cloud roles are a gift to attackers. Segment critical systems and restrict east-west traffic. Adopt Zero Trust principles : verify explicitly, use least privilege, assume breach. Harden cloud identity and roles; avoid wildcard permissions and unmanaged keys. Log cloud control plane activity and secure storage access paths. 6) Logging, Detection, and Security Operations Prevention will fail. Detection determines whether that failure becomes a headline. Centralize logs (SIEM or managed detection) across identity, endpoints, email, servers, and cloud. Prioritize a small set of high-confidence detections: admin privilege changes, impossible travel, suspicious OAuth consent, mass file access, new persistence mechanisms. Define escalation paths and response SLAs—alerts without action are noise. 7) Data Protection: Minimize, Encrypt, and Control Sharing Data breaches are often the most expensive incidents because of notification, legal, and reputational fallout. Reduce data retention and eliminate “data junk drawers.” Encrypt data at rest and in transit, and manage keys with clear ownership. Use DLP selectively for high-risk data flows, not as a blunt instrument. Control external sharing in file collaboration platforms with clear policies and auditing. Incident Response and Resilience: Your Real Competitive Advantage Organizations that recover quickly win trust. The ones that improvise under pressure lose time, money, and credibility. Build an Incident Response Plan You Can Actually Use An effective plan is short, role-based, and practiced. It should answer: Who declares an incident and who leads it? How do you communicate internally and externally (including customers and regulators)? How do you preserve evidence and engage legal counsel? When do you isolate systems, disable accounts, or block traffic? How do you work with insurers and third-party responders? Backups That Survive Ransomware Many organizations have “backups” that fail when they need them most. Build for ransomware reality: Keep immutable or write-once backups. Separate backup credentials from production credentials. Test restores regularly—measure RTO/RPO, not just backup success rates. Document restore order: identity first, then core infrastructure, then business apps. The Human Layer: Training That Changes Behavior Security awareness fails when it’s generic, infrequent, and punitive. It succeeds when it’s relevant and reinforced. Train for real scenarios: BEC, invoice fraud, credential theft, sensitive data sharing. Use short, frequent sessions and targeted simulations. Teach verification habits: call-back procedures, out-of-band confirmation, and approval workflows. Create a culture where reporting is rewarded—fast reporting limits damage. Governance, Compliance, and Metrics: Proving Control Without Theater Compliance can be valuable—but only if it drives real control maturity rather than checkbox behavior. A mature program aligns governance with business objectives and measures what matters. Metrics Leadership Can Act On MFA coverage: percent of users and admins with strong MFA. Patch performance: time to remediate critical vulnerabilities by exposure category. EDR coverage: percent of endpoints reporting and protected. Security event readiness: mean time to detect (MTTD) and mean time to respond (MTTR). Backup recoverability: last tested restore date and achieved RTO/RPO. Third-party risk: critical vendor assessment completion and remediation tracking. Cybersecurity and AI: Opportunity, Risk, and Guardrails AI can dramatically improve security operations—faster triage, better correlation, smarter automation. But it also expands risk. How AI Helps Defenders Automating alert enrichment and prioritization Detecting anomalous behavior across identities and endpoints Speeding up incident response with guided playbooks Improving secure coding and vulnerability discovery How AI Increases Risk More convincing phishing and impersonation Faster vulnerability exploitation and reconnaissance Data leakage through unsanctioned AI tools Model and prompt risks (exfiltration, poisoning, unsafe outputs) Practical AI Security Guardrails Define what data can and cannot be used in AI tools. Use enterprise AI offerings with contractual protections and auditability. Log and monitor AI tool usage where possible. Implement approval workflows for AI-generated customer-facing or regulated outputs. What “Good” Looks Like: A 90-Day Security Upgrade Plan If you want momentum without chaos, focus on a few high-impact moves: Days 1–30: inventory assets, enforce MFA for all users (phishing-resistant for admins), close obvious exposures, validate backups, and centralize critical logs. Days 31–60: establish patch SLAs, deploy/validate EDR coverage, implement conditional access, remove standing admin rights, and tighten SaaS sharing controls. Days 61–90: run an incident response tabletop, test restores to meet RTO/RPO, segment critical systems, implement vendor risk reviews for top suppliers, and publish leadership metrics. Conclusion: Cybersecurity Is a Leadership Decision Cybersecurity isn’t won by a single tool, a single audit, or a single department. It’s won through consistent execution —clear priorities, disciplined operations, and a culture that treats security as part of how the business runs. If you take only one action, take this: commit to resilience . Assume something will break, and build the detection, response, and recovery muscle to keep your organization moving forward. If you want help turning cybersecurity from a list of tools into a business-ready program, start by mapping your crown jewels, validating recoverability, and tightening identity controls—then build out from there. Call to action: If you’d like a practical assessment of your current posture—focused on the controls that actually stop real attacks—bring your asset inventory, identity setup, and backup strategy to the table. We’ll identify the fastest path to measurable risk reduction and operational resilience. ## Artificial Intelligence: What It Is, Why It Matters, and How to Use It Safely - URL: https://bartmcd.com/blog/artificial-intelligence-what-it-is-why-it-matters-safe-use - Published: 2026-01-22 Artificial intelligence is no longer a futuristic concept—it’s an operational reality reshaping how companies compete, defend themselves, and serve customers. In boardrooms, it’s discussed as a growth engine. In IT and security teams, it’s equally discussed as a new attack surface. And for most employees, it’s quickly becoming a daily tool—sometimes sanctioned, often not. What makes this moment different from previous technology waves is the speed of adoption. Generative AI tools can be deployed in days, not quarters. That acceleration is the opportunity and the risk. The organizations that win will be the ones that implement AI with clear outcomes, governed data, and security controls that assume the technology will be used—whether you approve it or not. AI is not a project. It’s a capability. Treat it like electricity: plan for broad adoption, manage it centrally, and secure it everywhere. What AI Actually Is (And What It Isn’t) “AI” is an umbrella term that covers several families of techniques. Understanding the categories matters, because the risks, costs, and best-fit use cases differ. Core AI Categories You’ll Encounter Machine Learning (ML): Models learn patterns from data to make predictions or decisions (fraud detection, churn prediction, anomaly detection). Deep Learning: ML using neural networks, typically requiring more data and compute (image recognition, speech, advanced detection). Natural Language Processing (NLP): Systems that understand and generate language (search, classification, summarization). Generative AI (GenAI): Models that generate text, code, images, and more (chatbots, content, software assistance, drafting, analysis). The Most Common Misconceptions AI is not “smart” in the human sense. It predicts likely outputs from patterns; it doesn’t “understand” truth the way people do. AI is not automatically accurate. It can be confidently wrong, especially outside its training context or when fed weak inputs. AI is not a substitute for leadership. It can accelerate execution, but it cannot define strategy, ethics, or accountability. Why AI Is Transformational for Business AI’s impact is often described in terms of productivity. That’s true—but incomplete. The bigger story is that AI changes the cost and speed of decision-making, personalization, and automation. It moves capabilities that were once “expert-only” into the hands of every employee. Where AI Delivers Real Value Operational efficiency: Automating repetitive tasks, accelerating reporting, reducing manual review, improving throughput. Customer experience: Faster response times, personalized interactions, smarter routing, better self-service. Revenue growth: Improved targeting, pricing optimization, sales enablement, faster proposal generation. Risk reduction: Anomaly detection, better monitoring, faster triage, improved compliance workflows. Engineering velocity: Code assistance, test generation, documentation, and debugging support. The Practical Reality: AI Works Best as “Copilot,” Not “Autopilot” In most organizations, the highest ROI comes from AI that augments skilled people rather than replacing them. Think of AI as a force multiplier: it reduces time-to-first-draft, helps explore options, and flags issues earlier. Humans still need to validate, approve, and own outcomes. The AI Stack: How AI Is Actually Built and Deployed To govern and secure AI, you need a simple mental model of what’s under the hood. AI isn’t one tool—it’s an ecosystem of data, models, infrastructure, and processes. Key Components Data: Your internal documents, customer data, logs, tickets, and knowledge bases. Data quality is the ceiling on AI quality. Models: Foundation models (large pretrained) and/or custom models fine-tuned for your use cases. Retrieval (RAG): A common approach that grounds model responses in your trusted content without retraining the model. Applications: Chat interfaces, copilots, workflow automations, embedded AI in business apps. Infrastructure: Cloud services, GPUs, model hosting, and monitoring. Controls: Identity, access management, logging, data loss prevention, and policy enforcement. Build vs. Buy: The Decision That Defines Your Risk Most companies should not start by building models from scratch. Start by buying proven platforms and integrating them safely. Customization should be driven by business advantage and data sensitivity, not hype. AI in Cybersecurity: A Double-Edged Sword As someone who’s lived in managed services and security operations, I’ll be direct: AI is both a defensive advantage and an offensive accelerant. Attackers are using it to scale phishing, write malware variants faster, and automate reconnaissance. Defenders are using it to triage alerts, detect anomalies, and reduce response time. How AI Helps Defenders Threat detection: Identifying abnormal behavior patterns across endpoints, identities, and networks. Alert triage: Summarizing incidents, correlating events, and reducing analyst fatigue. Phishing defense: Better classification, smarter user coaching, and quicker remediation. Security automation: Assisting in playbook execution and response workflows (with human approval). How AI Helps Attackers Highly targeted phishing: Better language, personalization, and realism at scale. Social engineering: Deepfake audio/video and convincing impersonation. Exploit development assistance: Faster iteration and adaptation of attack techniques. Automation: Scanning, enumeration, and payload variation become cheaper and faster. If AI makes your business faster, it also makes your adversary faster. Your security strategy has to assume accelerated threat cycles. The Real Risks: What Can Go Wrong With AI AI risk isn’t theoretical. It shows up as data exposure, compliance failures, reputational damage, and operational decisions made on flawed outputs. The good news is that most AI risk is manageable if you treat AI like an enterprise system, not a novelty. Top AI Risk Categories Data leakage: Sensitive data copied into public tools or mishandled in prompts and uploads. Hallucinations and inaccuracies: Confidently incorrect outputs used in customer-facing or regulated workflows. Bias and unfair outcomes: Models reflecting historical inequities or flawed proxies in training data. IP and copyright exposure: Unclear provenance of training data or generated content reuse. Model and supply-chain risk: Vulnerabilities in AI vendors, plugins, model updates, or integrations. Prompt injection: Attackers manipulating model instructions to bypass controls or exfiltrate data. Over-automation: Removing human judgment in processes that require accountability and context. Governance: How to Adopt AI Without Losing Control AI governance shouldn’t be a bureaucratic blocker. Done correctly, it’s an enablement layer: clear rules, fast approvals, and guardrails that let teams innovate without creating hidden risk. What Effective AI Governance Looks Like Clear policy: What tools are approved, what data is prohibited, and what workflows require review. Data classification enforcement: Align AI usage with your existing data sensitivity levels. Vendor standards: Security reviews, contractual controls, and visibility into data handling. Human-in-the-loop controls: Required validation for customer-facing, regulated, or high-impact decisions. Logging and monitoring: Audit trails for prompts, outputs, access, and downstream actions. Model evaluation: Testing for accuracy, bias, toxicity, and failure modes before production rollout. A Simple Rule That Works If a human is accountable for the outcome, a human must be able to understand, challenge, and override the AI’s recommendation. That’s not a technical standard—it’s a leadership standard. A Practical Roadmap to Implement AI in Your Organization Most AI initiatives fail for predictable reasons: vague goals, unready data, unclear ownership, and uncontrolled tool sprawl. The remedy is a staged approach with measurable outcomes. Step 1: Start With Use Cases That Have Measurable ROI Support ticket summarization and draft responses Internal knowledge search across policies, procedures, and runbooks Sales enablement: proposal drafts, call summaries, account research Security operations: alert summarization, investigation assistance Step 2: Choose the Right Architecture (Often RAG First) For many businesses, retrieval-augmented generation (RAG) is the safest early pattern: it grounds responses in your approved content while reducing the need to fine-tune or train a model on sensitive data. Step 3: Put Guardrails in Place Before Broad Rollout Identity and access controls: Tie AI access to roles and least privilege. Data loss prevention: Prevent sensitive fields from being pasted or uploaded. Approved tool list: Make the secure option the easy option. Training: Teach employees what not to share and how to validate outputs. Step 4: Operationalize It Metrics: Time saved, resolution speed, quality scores, customer satisfaction, reduction in rework. Feedback loops: Capture where AI is wrong and why; improve prompts, retrieval sources, and policies. Change management: Update workflows and job expectations, not just tooling. How Leaders Should Think About AI: Strategy, People, and Culture AI adoption is less about technology and more about organizational behavior. If you don’t provide a secure and productive way to use AI, teams will do it anyway—without controls. Leadership Priorities That Separate Winners from Everyone Else Define outcomes: Tie AI to business goals, not experimentation theater. Invest in data: Clean, governed, well-labeled data is the real competitive moat. Upskill broadly: Make AI literacy a baseline competency, like security awareness. Secure by design: Treat AI like any other enterprise system with access controls, monitoring, and vendor management. Set ethical boundaries: Be explicit about what you will not automate or outsource to a model. The Near Future of AI: What to Watch AI will continue to become more embedded, less visible, and more autonomous in narrow domains. The organizations that prepare now will benefit from compounding advantages. Trends Likely to Matter Most Agentic workflows: AI that executes multi-step tasks across tools (with both productivity upside and control risk). Model commoditization: Differentiation shifts from the model to your data, process design, and governance. Regulatory pressure: Increased requirements for transparency, risk management, and accountability. Security arms race: Faster, more automated attacks and more automated defense. Conclusion: Adopt AI Like You Mean It—With Speed and Control AI is already changing how work gets done. The only real question is whether your organization will adopt it intentionally—with governance, security, and measurable outcomes—or accidentally through shadow usage and inconsistent practices. If you want AI to create value, focus on three fundamentals: choose the right use cases , protect and govern your data , and build security into the workflow from day one. AI will reward organizations that are decisive and disciplined. Move fast—but don’t move blind. The best AI strategy is one that accelerates the business while reducing risk. Call to action: If you’re evaluating AI initiatives this quarter, start by inventorying where AI is already being used, define your top 3 high-ROI use cases, and implement a basic AI governance and security policy before you scale. The companies that operationalize AI responsibly now will set the pace for their industries later. ## Cybersecurity in 2026: How to Build Resilience When Attacks Are Inevitable - URL: https://bartmcd.com/blog/cybersecurity-2026-building-resilience-when-attacks-inevitable - Published: 2026-01-21 Cybersecurity used to be about “keeping bad guys out.” Today it’s about staying in business when—inevitably—something goes wrong. I’ve spent my career helping organizations protect themselves, recover quickly, and reduce the blast radius of incidents that can’t be fully prevented. The companies that do this well don’t rely on a single tool or a single team. They build a program: governance, architecture, operations, and culture working together. The challenge is that cybersecurity has never been more complex. You’re defending cloud workloads, SaaS applications, remote endpoints, third-party integrations, and an expanding attack surface shaped by AI—while still running the business, hitting growth targets, and meeting regulatory expectations. Modern cybersecurity isn’t about perfect defense. It’s about measurable risk reduction and operational resilience. The Current Threat Landscape: What’s Actually Hitting Organizations The threats are familiar, but the speed and scale are not. Attackers are better funded, more automated, and increasingly patient. The “big three” patterns I see driving real-world incidents are: Ransomware and extortion : Encryption is only part of the story. Data theft and public pressure are often the real leverage. Identity-based attacks : Credential theft, MFA fatigue, token theft, and session hijacking are now primary paths in. Third-party exposure : Vendors, MSPs, SaaS apps, and integrations can create indirect access you didn’t intend to grant. Why “We Have Security Tools” Is Not the Same as “We’re Secure” Many organizations have invested heavily in tools—but still struggle with outcomes. That’s because tools don’t create security; process and accountability do. If alerts aren’t triaged, if vulnerabilities aren’t prioritized, if access isn’t reviewed, and if backups aren’t tested, the toolset becomes shelfware. Cybersecurity as a Business Problem: Start with Risk The most effective security leaders translate technical threats into business risk: revenue interruption, legal exposure, customer churn, operational downtime, and reputational damage. A mature program answers three questions continuously: What are we protecting? (crown jewels, critical processes, regulated data) What could realistically happen? (top threat scenarios and likely attack paths) What is our plan when it does? (containment, recovery, communications) Define “Crown Jewels” and Map the Attack Paths Start with the assets that would create existential pain if compromised. Then map how an attacker would get to them: identity → endpoint → SaaS → privilege escalation → data access. This exercise often reveals that the weakest link isn’t a firewall—it’s a legacy service account, a misconfigured cloud permission, or an unmonitored admin path. The Core Pillars of a Modern Cybersecurity Program Cybersecurity is not a single initiative. It’s a set of capabilities that work together. Here are the pillars that consistently produce better outcomes. 1) Governance: Clarify Ownership, Funding, and Decision Rights Security fails quietly when it has no executive sponsor and no defined authority. Governance establishes: Clear accountability : Who owns risk decisions—IT, security, business leadership? Policies that match reality : Enforceable, practical, and tied to business operations. Budget aligned to risk : Funding based on what matters most, not what’s loudest. If nobody can say “yes,” and nobody can say “no,” security becomes theater. 2) Identity and Access: The New Perimeter Identity is where most breaches begin. Treat it like critical infrastructure. Strong MFA everywhere , prioritizing phishing-resistant options for admins and high-risk users. Least privilege by default , with role-based access and periodic access reviews. Privileged Access Management (PAM) for admin accounts, service accounts, and cloud roles. Conditional access policies that evaluate device health, location, risk signals, and session behavior. 3) Endpoint Security: Assume Devices Will Be Targeted Laptops and servers are where attackers execute. Endpoint visibility and response matter as much as prevention. EDR/XDR with a real response process (not just detection). Hardening standards for workstations and servers, including baseline configuration and application control where feasible. Patch and vulnerability management that prioritizes exploited vulnerabilities and internet-facing exposure. 4) Network and Segmentation: Reduce Blast Radius Many organizations still operate as if internal networks are trustworthy. They’re not. Segmentation is one of the fastest ways to reduce incident impact. Segment critical systems (finance, backups, identity infrastructure, production workloads). Limit lateral movement using firewall policies, micro-segmentation where appropriate, and tight admin pathways. Monitor egress for unusual data transfers and command-and-control patterns. 5) Cloud and SaaS Security: Fix Misconfigurations and Over-Permissioning Cloud incidents often come down to three issues: misconfigurations, excessive permissions, and lack of monitoring. The solution isn’t “cloud is insecure”—it’s cloud needs discipline . Secure-by-default templates and infrastructure-as-code with guardrails. Cloud posture management to identify risky configurations and drift. Logging and visibility that’s actually retained, searchable, and monitored. 6) Application Security: Protect What You Build and Integrate Applications and APIs are a direct line to data. Security needs to be embedded into the build process. Secure SDLC with code scanning, dependency checks, and threat modeling for critical apps. API security with authentication, authorization, rate limiting, and monitoring for abuse. Third-party library governance to manage supply-chain risk. 7) Data Security: Control Access, Movement, and Recovery Data protection is not just encryption. It’s knowing where sensitive data lives, who can access it, and how you recover it. Data classification that’s simple enough to use and meaningful enough to drive controls. DLP where it matters (email, endpoints, and key SaaS platforms), tuned to reduce noise. Backups designed for ransomware : immutable, segmented, monitored, and tested for restore. 8) Security Operations: Detection Is Only Valuable If Response Works A strong SOC capability—internal, outsourced, or hybrid—requires more than dashboards. It needs discipline: Use-case driven monitoring based on real threats to your environment. Playbooks and escalation paths so incidents don’t stall in ambiguity. Regular tuning to reduce false positives and focus analysts on high-signal events. Incident Response and Business Continuity: Plan Like You Mean It Most organizations don’t fail because they got attacked—they fail because they couldn’t respond . Incident response and continuity planning should be built and rehearsed before a crisis. What a Practical Incident Response Plan Includes Roles and responsibilities across IT, security, legal, HR, and leadership. Decision thresholds for containment actions that may disrupt operations. Evidence preservation guidance to support investigations and legal needs. Communications plans for employees, customers, regulators, and partners. Tabletop Exercises: The Cheapest Way to Discover the Gaps A tabletop exercise forces reality to show up: outdated contact lists, unclear authority, missing logs, untested restores, and vendor dependencies nobody documented. Run at least two per year—one focused on ransomware, one on identity compromise or SaaS data exposure. If you’ve never practiced a crisis, you don’t have a plan—you have a document. Human Risk: Make Security Training Actually Work People aren’t the problem; they’re the environment. The goal is not to shame employees—it’s to reduce risky outcomes through design and reinforcement. Role-based training (finance, developers, executives, IT admins) instead of one-size-fits-all videos. Phishing simulations used as coaching tools, not punishment. Just-in-time prompts (e.g., warnings for external emails, risky links, or unusual file sharing). Third-Party and Supply Chain Risk: Trust, but Verify Vendors extend your attack surface. The right approach is to scale diligence based on access and impact. Tier vendors by the data they handle and the systems they can reach. Contract for security : incident notification timelines, audit rights, logging expectations, and minimum controls. Continuously reassess critical vendors—especially those with privileged access or integration pathways. AI and Cybersecurity: Opportunity and Risk AI can dramatically improve security operations—correlating signals, accelerating investigations, and helping teams triage faster. But it also lowers the cost of attack, enabling more convincing phishing, faster reconnaissance, and scalable social engineering. Where AI Helps Defenders (When Used Responsibly) Faster triage of alerts with contextual enrichment and summarization. Improved detection engineering through pattern analysis and anomaly spotting. Security automation for containment actions like isolating endpoints or disabling compromised accounts. Where AI Creates New Exposure Prompt injection and data leakage through poorly governed AI tools. Shadow AI as employees use unsanctioned tools with sensitive data. Synthetic identity and impersonation attacks that target help desks and finance workflows. A Practical AI Security Policy (That People Will Follow) Define approved tools and prohibited data types. Require business justification for AI integrations and plugins. Log and review usage for sensitive workflows. Metrics That Matter: Prove Progress Without Drowning in Numbers Security metrics should inform decisions, not just fill slides. Focus on a handful that connect to risk reduction: Time to detect and contain (MTTD/MTTC) for priority incident types Patch velocity for exploited and high-risk vulnerabilities Backup recoverability : successful restore tests and recovery time performance Identity hygiene : MFA coverage, privileged account counts, stale accounts removed Phishing resilience : reporting rate and repeat-click reduction (not just click rates) A 90-Day Cybersecurity Roadmap You Can Execute If you need traction quickly, focus on the controls that reduce the most common incident paths. Days 1–30: Stabilize the Foundation Inventory critical systems and define crown jewels Enable strong MFA for admins and remote access immediately Confirm backups are segmented and run at least one restore test Establish incident response roles and escalation paths Days 31–60: Reduce Exposure Deploy or tune EDR and central logging for priority systems Address top exploited vulnerabilities and internet-facing risks Implement conditional access and begin access reviews Segment critical systems and restrict admin pathways Days 61–90: Operationalize and Measure Run a ransomware tabletop and a SaaS compromise tabletop Build high-signal detection use cases and playbooks Launch role-based training for high-risk teams (finance, execs, IT) Define a security scorecard with 5–7 metrics tied to business risk Conclusion: Build Security That Holds Up Under Pressure Cybersecurity is no longer a niche technical discipline—it’s a leadership function. The organizations that outperform are the ones that treat security as a program, invest in resilience, and measure what matters. They assume compromise is possible, build controls that reduce the odds, and prepare to respond decisively when it happens. The goal isn’t to eliminate risk. The goal is to control it—so a security incident doesn’t become a business-ending event. Call to action: If you want to strengthen your cybersecurity posture this quarter, start with a crown-jewel workshop, validate recoverability with a real restore test, and harden identity (MFA, least privilege, and privileged access). Those three moves alone can dramatically change your risk profile—and they create the foundation for everything else. ## AI Isn’t Magic—It’s Leverage - URL: https://bartmcd.com/blog/ai-isnt-magic-its-leverage - Published: 2026-01-20 Artificial intelligence has become one of the most overloaded terms in modern business. Depending on who you ask, AI is either a revolutionary force that will reinvent every industry—or a black box that can’t be trusted with anything important. In reality, AI is neither magic nor menace by default. It’s leverage: a powerful set of techniques that can amplify good decisions, accelerate outcomes, and scale expertise—or just as easily magnify bad assumptions, weak governance, and poor security. I’ve spent my career operating at the intersection of technology, business risk, and cybersecurity. That vantage point leads to a practical conclusion: if you want AI to create durable value, you need to understand what it is, how it actually works, where it fails, and how to deploy it with the same rigor you apply to finance, compliance, and security. AI doesn’t replace accountability. It redistributes it—across data, models, vendors, employees, and leadership. What AI Actually Is (And Why It Matters) At its core, AI is a collection of methods that allow computers to perform tasks that typically require human intelligence—recognizing patterns, interpreting language, generating content, making predictions, and optimizing decisions. The key word is “methods,” not “mind.” Most AI systems don’t “understand” the world the way humans do. They learn statistical relationships from data and use those relationships to make outputs that look intelligent. Three Practical Categories of AI in the Real World Predictive AI : Forecasts outcomes (fraud likelihood, demand planning, churn risk). Generative AI : Creates new content (text, code, images, audio) based on patterns learned from large datasets. Agentic AI : Executes multi-step tasks (planning, tool use, workflows) with varying degrees of autonomy. Most organizations will use all three—often at the same time. A customer support system might predict escalation risk, generate a draft response, and then trigger workflow actions to route tickets or update records. How AI Works—Without the Hype Understanding AI at a functional level doesn’t require a PhD, but it does require clarity. Most modern AI systems are built from four building blocks: data, models, compute, and feedback loops. Data: The Foundation That Decides the Ceiling AI systems learn from data. If your data is incomplete, biased, poorly labeled, or not representative of the real world, your AI outcomes won’t be either. In practice, the biggest limiter of AI value isn’t the model—it’s data readiness. Quality : Accuracy, completeness, timeliness. Governance : Ownership, access controls, lineage, retention. Relevance : Data must match the context of the decision you’re automating. Models: Pattern Engines, Not Truth Machines Machine learning models are trained to minimize error on historical examples. Large language models (LLMs) predict the next token in a sequence based on learned patterns. That’s why LLMs can be remarkably fluent—and also confidently wrong. They’re optimized for plausibility, not truth. If you treat AI output as “the answer” instead of “a draft,” you will eventually operationalize an error. Compute: The Cost and Capacity Factor Compute power determines how quickly models can be trained and how efficiently they can run in production. As organizations adopt AI, compute becomes a budgeting and architecture conversation—not just an engineering detail. Feedback Loops: The Difference Between a Demo and a System AI in production requires continuous measurement and improvement. This means monitoring accuracy, drift, user behavior, and adversarial activity. The moment you deploy a model, the world changes around it—and your data changes with it. The Business Case for AI: Where It Creates Real Value AI creates value when it reduces time-to-decision, increases consistency, improves accuracy, or scales expertise across the organization. But not every process is a good fit. High-ROI Use Cases You Can Operationalize Customer support : Summarization, suggested responses, knowledge retrieval, ticket triage. Sales and marketing : Personalization, content drafts, lead scoring, call analytics. Finance and operations : Invoice processing, anomaly detection, forecasting, reconciliation. Software development : Code assistance, test generation, documentation, vulnerability scanning support. Cybersecurity : Alert enrichment, incident summarization, detection engineering acceleration, phishing analysis. The Most Common AI Mistake: Automating the Wrong Thing Organizations often try to apply AI where process design is broken. If your workflow is unclear, your data definitions are inconsistent, or your policies are ambiguous, AI will scale the chaos. The best AI deployments start with process clarity and measurable outcomes. AI Risks: What Can Go Wrong (And Usually Does) Every powerful technology comes with failure modes. AI’s failure modes are unique because they blend technical issues with legal, ethical, and reputational consequences. Accuracy and “Hallucinations” Generative models can produce incorrect information in a highly convincing format. The risk isn’t just misinformation—it’s misplaced trust . When errors are presented confidently, teams stop verifying. Bias and Disparate Impact AI can replicate and amplify historical bias embedded in training data. This is especially critical in hiring, lending, healthcare, and any domain where decisions affect people’s livelihoods. Privacy and Data Exposure AI tools can inadvertently expose sensitive data through prompt inputs, training processes, logging, or third-party integrations. If employees paste confidential data into public tools, you have created an untracked data exfiltration channel. IP and Copyright Ambiguity Generative AI can create content that resembles protected material. Organizations must clarify ownership, licensing, and acceptable use—especially for marketing assets, training data, and code. Over-Reliance and Skill Atrophy When teams defer judgment to machines, critical thinking degrades. You don’t want an organization that can’t operate when the model is down—or when outputs don’t match reality. AI and Cybersecurity: The Double-Edged Sword AI is reshaping cybersecurity on both sides of the fight. Defenders can triage faster and respond more consistently. Attackers can scale social engineering, automate reconnaissance, and generate convincing lures. How AI Helps Defenders Faster triage : Summarize alerts, correlate signals, and prioritize incidents. Analyst augmentation : Draft detection logic, propose remediation steps, generate executive summaries. Threat intelligence processing : Turn large volumes of unstructured intel into actionable insights. Security awareness at scale : Personalized training content and simulated phishing improvements. How AI Helps Attackers Phishing at scale : More believable emails, messages, and scripts tailored to the target. Deepfakes and voice cloning : Fraud and social engineering with higher credibility. Faster malware iteration : Enhanced code generation and obfuscation support. Reconnaissance automation : Rapid profiling of employees, vendors, and systems using public data. The New Baseline: Assume AI-Enhanced Threats If your security strategy assumes yesterday’s attacker capability, you’re already behind. AI accelerates the speed and volume of attacks. That means your defenses must improve in detection, identity controls, segmentation, incident response readiness, and employee training. AI doesn’t eliminate the need for security fundamentals. It raises the cost of ignoring them. Responsible AI: Governance That Actually Works Responsible AI is not a PR slogan. It’s operational discipline: clear policies, measurable controls, and accountability. If you can’t explain how your AI system makes decisions—or what data it touches—you don’t have an AI strategy. You have a liability. What Responsible AI Looks Like in Practice Defined use policies : What tools are allowed, what data can be used, and what cannot. Model risk classification : Tier systems based on impact (e.g., low-risk content drafts vs. high-risk financial decisions). Human-in-the-loop controls : Required reviews for sensitive outputs and decisions. Auditability : Logging, versioning, and traceability of prompts, outputs, and approvals where appropriate. Security by design : Access controls, encryption, vendor assessments, and incident response plans for AI systems. Vendor Reality: You’re Still Accountable Most organizations will consume AI through third-party platforms. That doesn’t outsource risk. You still need to evaluate: Data handling : Is your data used for training? How is it stored? Who can access it? Controls : Logging, retention, admin controls, and integration security. Compliance alignment : Industry requirements, privacy obligations, and contractual protections. How to Build an AI Strategy That Survives Reality An AI strategy should not start with tools. It should start with outcomes, constraints, and operating model changes. Step 1: Identify Decisions Worth Augmenting Look for decisions that are frequent, time-sensitive, or inconsistent across teams. The best candidates have measurable success criteria and clear guardrails. Step 2: Prepare Your Data and Process Before you deploy a model, standardize definitions, fix broken handoffs, and implement data governance. This is where most AI initiatives win or lose. Step 3: Start Narrow, Prove Value, Then Scale Successful AI programs begin with constrained pilots that deliver measurable improvements. Then they expand with training, controls, and documentation—not with uncontrolled enthusiasm. Step 4: Define Operating Guardrails What requires human approval? What data is prohibited? How will you monitor performance and drift? How will you respond if the model fails—or is attacked? Step 5: Train People, Not Just Models AI adoption is a workforce transformation. Teams need practical training on prompting, verification, data handling, and escalation paths—especially in regulated or high-risk environments. The Next Phase of AI: What to Watch AI is moving from “chatbots that answer questions” to systems that take actions. That shift will create opportunity—and risk. Agents and orchestration : AI that uses tools (email, databases, ticketing) to complete workflows. Smaller, specialized models : Domain-specific models optimized for cost, privacy, and accuracy. On-device and private AI : More processing in controlled environments to reduce exposure. Regulation and enforcement : Increased scrutiny on transparency, data usage, and high-impact decisions. AI security as a discipline : Model hardening, prompt injection defenses, and supply chain controls becoming standard. Conclusion: AI Value Requires Discipline AI can absolutely transform how your organization operates—but only if you approach it with the same seriousness you’d apply to any core capability. That means selecting the right use cases, strengthening data foundations, building governance, and embedding security from day one. The organizations that win with AI won’t be the ones that adopt the most tools. They’ll be the ones that align AI to business outcomes, manage risk proactively, and scale responsibly . AI is leverage. If you’re intentional, it amplifies performance. If you’re careless, it amplifies risk. Call to action: If you’re evaluating AI initiatives this quarter, start with a simple exercise: list your top five decisions that drive revenue, risk, or customer experience—and assess where AI can assist with clear guardrails and measurable impact. Then build from there, with security and governance as part of the design, not an afterthought. ## Cybersecurity: How to Protect Your Business in a World That Never Stops Attacking - URL: https://bartmcd.com/blog/cybersecurity-protect-your-business-from-modern-attacks - Published: 2026-01-16 Cybersecurity used to be a technology problem. Today, it’s a business survival problem. Every organization—regardless of size or industry—runs on systems that are constantly probed, targeted, and exploited. The attacker doesn’t need to be smarter than you. They just need one weak password, one unpatched server, one distracted employee, or one vendor with access they shouldn’t have. Cybersecurity isn’t about building an impenetrable fortress. It’s about reducing risk, limiting blast radius, and recovering fast—because incidents are inevitable. This article breaks down what modern cybersecurity really means, how threats are evolving, and what practical steps leaders can take to measurably improve resilience—without drowning in tools, jargon, or fear. The Modern Threat Landscape: What You’re Actually Up Against Attackers have changed. They’re faster, better organized, and increasingly automated. And they’re not just “hackers” in the old sense. They’re criminal businesses with help desks, subscription models, and profit targets. Ransomware: A Business Model, Not an Event Ransomware isn’t just about encrypting files anymore. It’s commonly a multi-stage operation: Initial access: phishing, stolen credentials, exposed RDP/VPN, or third-party compromise Privilege escalation: gaining admin rights and disabling security controls Lateral movement: spreading to high-value systems (backup infrastructure is a favorite target) Exfiltration: stealing sensitive data for extortion leverage Encryption and disruption: stopping operations to force urgency Extortion: threatening public release, regulatory exposure, or customer notification The most costly part often isn’t the ransom—it’s downtime, recovery, reputational damage, legal exposure, and loss of customer trust. Business Email Compromise (BEC): Low-Tech, High-Impact BEC remains one of the highest ROI crimes on the planet. Attackers don’t need malware if they can manipulate people and processes. They impersonate executives or vendors They redirect payments via “updated wiring instructions” They exploit weak approval workflows and email-only verification If your payment process relies on “the email looks right,” you don’t have a process—you have a vulnerability. Cloud and Identity Attacks: The New Perimeter The shift to cloud services didn’t remove risk; it redistributed it. Identity has become the control plane for everything—email, storage, infrastructure, SaaS apps, and remote work. Stolen credentials and session tokens bypass traditional defenses Misconfigurations expose data publicly or grant excessive permissions Compromised admin accounts can dismantle logging, security policies, and backups in minutes Supply Chain and Vendor Risk: Your Weakest Link Might Not Be Yours Vendors often have privileged access, shared credentials, or network pathways into critical systems. Attackers love this because it scales: one compromise can unlock many targets. Vendor security isn’t a checkbox. It’s part of your security boundary. What “Good” Cybersecurity Looks Like: A Business-First Definition The goal of cybersecurity isn’t to “stop all attacks.” The goal is to ensure the business can operate safely under attack conditions. A practical definition of strong cybersecurity includes: Prevention: reduce the likelihood of compromise Detection: find intrusions quickly (before damage spreads) Response: contain, eradicate, and communicate effectively Recovery: restore systems and data within business-defined timeframes Governance: clear ownership, measurable risk management, and accountability Security maturity isn’t measured by how many tools you own. It’s measured by how fast you detect and how well you recover. The Foundations: People, Process, and Technology (In That Order) People: The Most Targeted Attack Surface Humans are not the problem—untrained humans in high-friction workflows are the problem. Most incidents begin with confusion, urgency, or routine behavior exploited at scale. Practical improvements: Role-based security training: finance teams need BEC training; developers need secure coding; executives need crisis readiness Phishing simulations with coaching: train behavior, not fear Clear reporting paths: one-click “report suspicious” and a culture that rewards early reporting Process: Security That Works When People Are Busy The best security controls are the ones that survive real life: deadlines, turnover, emergencies, acquisitions, and vendor pressure. Processes that materially reduce risk: Change management: track what changes, who approved it, and how it’s validated Access reviews: remove stale accounts and over-privileged access (especially admin and vendor access) Secure payment procedures: out-of-band verification for bank changes and high-dollar approvals Patch and vulnerability management: define SLAs based on severity and exposure Technology: The Right Controls, Properly Integrated Tools matter, but only when they are configured correctly, monitored consistently, and aligned to business priorities. Core technology controls most organizations need: Multi-factor authentication (MFA): everywhere, especially email and admin access Endpoint protection + EDR: prevention and rapid detection/response on laptops and servers Email security: anti-phishing, sandboxing, and domain protections (SPF/DKIM/DMARC) Centralized logging: SIEM or managed detection so alerts become action Network segmentation: limit lateral movement and protect critical assets Backups designed for attack: immutable/offline options, separate credentials, routine restore testing Secure configuration baselines: hardened endpoints and servers, enforced via policy Zero Trust: A Practical Approach (Not a Marketing Slogan) Zero Trust is often misunderstood. It doesn’t mean “trust no one.” It means assume breach and continuously verify access based on identity, device health, context, and least privilege. What Zero Trust Looks Like in Practice Strong identity controls: MFA, conditional access, and robust session management Least privilege: users and systems only get what they need, for as long as they need it Micro-segmentation: reduce pathways between systems Continuous monitoring: detect abnormal behavior and respond quickly If you can’t confidently answer “Who has access to what, and why?” you don’t have Zero Trust—you have hope. Cyber Risk Management: Treat Security Like Enterprise Risk Cybersecurity becomes manageable when it’s framed as risk: likelihood, impact, and the controls that reduce both. Start With Your Crown Jewels Every organization has a small set of assets that, if compromised, create existential damage: Customer data and regulated information Financial systems and payment workflows Production infrastructure and operational technology Identity systems (email, directory, SSO) Backups and recovery platforms Map your cybersecurity program to protect these first. Security that ignores business priorities becomes expensive theater. Use a Framework to Create Clarity Frameworks help translate security into a repeatable program. Many organizations align to: NIST Cybersecurity Framework (CSF): Identify, Protect, Detect, Respond, Recover CIS Controls: prioritized technical and operational controls ISO 27001: governance-driven security management systems The framework is not the goal. The goal is to create consistency, accountability, and measurable progress. Incident Response: Your Plan Matters More Than Your Panic When an incident happens, speed and coordination drive the outcome. The worst time to discover your backup doesn’t restore—or your leadership team doesn’t know who decides what—is during a live breach. Your Incident Response Plan Should Answer These Questions Who declares an incident? Who leads response? (IT, security, outside IR firm) How do you communicate internally? (assume email may be compromised) When do legal and cyber insurance engage? How do you preserve evidence? What triggers customer, regulator, or law enforcement notification? What are your recovery objectives? (RTO/RPO aligned to the business) Run Tabletop Exercises—Before You Need Them Tabletops aren’t theater. Done right, they surface the hidden gaps that cause real-world failures: unclear decision rights, outdated vendor contacts, missing logs, shaky restore procedures, and broken escalation paths. If you haven’t rehearsed a ransomware scenario, you’re planning to improvise under maximum stress. Measuring Cybersecurity: Metrics Leaders Can Actually Use Executives don’t need more dashboards. They need signals that link security work to risk reduction and operational readiness. High-value metrics include: MFA coverage: percentage of users/apps protected (especially admin and remote access) Patch compliance: time to remediate critical vulnerabilities on internet-facing assets EDR coverage: endpoints reporting and protected Mean time to detect (MTTD) and mean time to respond (MTTR): speed matters Backup recoverability: successful restore tests and time to restore critical systems Phishing resilience: reporting rates and repeat click rates (with coaching outcomes) Privileged access hygiene: number of admin accounts, stale accounts, and exception timelines AI and Cybersecurity: Opportunity, Risk, and Reality AI is changing cybersecurity on both sides of the fight. How Defenders Can Use AI Responsibly Alert triage and enrichment: reduce noise and speed analysis Behavioral detection: identify anomalies across endpoints, identity, and network activity Automated response: isolate devices, disable accounts, and contain threats faster AI can improve performance, but it doesn’t replace accountability. You still need clear escalation, evidence, and human judgment—especially when business operations are at stake. How Attackers Use AI More convincing phishing: fewer grammar mistakes, better personalization Faster reconnaissance: summarizing leaked data and targeting high-value individuals Scalable social engineering: automating outreach across multiple channels The practical takeaway: assume higher-volume, more believable attacks—and invest accordingly in identity controls, workflow verification, and rapid detection. A Practical Cybersecurity Roadmap (What to Do Next) If you want a clear path forward, focus on the actions that reliably reduce risk across industries. The First 30–60 Days: Stabilize the Basics Enforce MFA for email, VPN, admin accounts, and critical SaaS Validate backups with real restore tests; protect backup systems with separate credentials Deploy or tune EDR and ensure coverage reporting is accurate Close obvious external exposures (unused RDP, outdated VPN appliances, internet-facing admin panels) Implement out-of-band verification for payment changes to reduce BEC risk The Next 90–180 Days: Build Repeatable Security Operations Establish vulnerability management SLAs and reporting Centralize logs and define incident escalation paths Reduce privileged accounts; implement just-in-time or time-bound admin access where possible Segment critical systems and tighten vendor access Run an incident response tabletop focused on ransomware and BEC Ongoing: Align Security With Business Strategy Create a security roadmap tied to business priorities and risk Perform regular access reviews and vendor risk assessments Measure progress with a small set of meaningful metrics Invest in culture: training, reporting, and leadership alignment Conclusion: Cybersecurity Is a Leadership Discipline Cybersecurity is no longer a back-office IT function. It’s a leadership discipline that touches operations, finance, legal, customer trust, and brand reputation. The organizations that fare best aren’t the ones with the most tools—they’re the ones with clear priorities, hardened fundamentals, practiced response, and the ability to recover quickly when something goes wrong. Build a security program that assumes incidents will happen—and prove, with evidence, that you can withstand them. Call to action: If you haven’t recently tested your backups, validated MFA coverage, reviewed privileged access, and walked your leadership team through a ransomware tabletop, make those your next moves. Cyber risk doesn’t wait for perfect timing—and the best time to prepare is before you’re forced to. ## AI in the Real World: How to Capture Value Without Creating New Risk - URL: https://bartmcd.com/blog/ai-in-the-real-world-capture-value-without-new-risk - Published: 2026-01-15 Artificial intelligence has moved from “interesting experiment” to “board-level expectation” in record time. I’ve watched this pattern play out repeatedly: a leadership team sees competitors announcing AI initiatives, employees start using public tools on their own, and suddenly the organization is “doing AI”—just not intentionally, securely, or measurably. The opportunity is real. AI can reduce cycle times, improve decision-making, strengthen security operations, and unlock new products. But it also introduces a new risk surface: sensitive data exposure, model manipulation, compliance pitfalls, and an acceleration of social engineering that even well-trained teams struggle to detect. AI isn’t a strategy. It’s a capability. The strategy is how you apply it to measurable outcomes—while controlling risk as aggressively as you pursue ROI. What We Actually Mean by “AI” in 2026 Three practical categories that matter “AI” is used as a catch-all, but most business and security decisions get clearer when you separate it into three buckets: Predictive AI (Machine Learning): Models that forecast outcomes—fraud detection, churn prediction, anomaly detection, demand planning. Generative AI: Models that produce content—text, code, images, voice—used for drafting, summarizing, searching, and automating knowledge work. Agentic AI (AI agents): Systems that can plan and take actions across tools—opening tickets, querying systems, generating reports, and orchestrating workflows with human oversight. The key shift: AI is now an interface In many organizations, generative AI has become a new “front door” to systems and data. Instead of learning complex applications, users ask questions in natural language. That’s powerful—but it also means your controls need to follow the user intent, not just the application boundary. Where AI Creates Real Business Value (Beyond the Hype) 1) Productivity that shows up on the P&L AI can compress time-consuming work: drafting first versions, summarizing long threads, extracting requirements, generating test cases, and accelerating analysis. The organizations that see material impact treat AI as a workflow redesign, not a shiny add-on. Customer support: Faster resolution with guided responses and knowledge retrieval. Sales and marketing: Better research, personalization, and content iteration—when brand and compliance guardrails are enforced. Finance and legal: Document summarization, contract review support, policy comparisons, and audit preparation. 2) Better decisions with less noise Predictive AI shines when you have clear outcomes, consistent data, and the discipline to measure performance. It can help teams prioritize what matters—especially in environments overwhelmed by alerts, tickets, and dashboards. Risk scoring: Prioritizing vulnerabilities and third-party risk based on real exposure. Operations: Forecasting demand and identifying bottlenecks early. Fraud: Detecting anomalies across large volumes of transactions and user behavior. 3) Security leverage in a world of escalating threats In cybersecurity, AI can be a force multiplier—if it’s implemented with skepticism and instrumentation. Used well, it improves triage, accelerates investigations, and reduces burnout. Security operations: Alert enrichment, correlation, and guided investigation paths. Threat intelligence: Faster analysis of campaigns, indicators, and TTPs. Identity and access: Anomaly detection for account behavior and access patterns. The Modern AI Stack: What You’re Actually Building Think in layers, not tools AI projects fail when organizations jump straight to the model and skip the foundation. A durable AI capability looks more like a product stack than a single application: Data layer: Data sources, classification, lineage, retention, and access controls. Model layer: Commercial LLMs, open-source models, traditional ML models—selected based on risk and use case. Knowledge layer (RAG): Retrieval-Augmented Generation to ground outputs in your approved internal content. Orchestration layer: Prompt management, tool calling, agent workflows, and routing logic. Application layer: The user experience—chat, copilots, embedded assistants, APIs. Governance/LLMOps layer: Logging, evaluation, monitoring, access control, and policy enforcement. RAG vs. fine-tuning: the decision most teams get wrong Many organizations assume they must “train” a model on their data. In reality: RAG is often the safest and fastest path for enterprise knowledge use cases because you can control what sources are allowed, keep content current, and reduce the risk of unintentionally embedding sensitive information into model weights. Fine-tuning can be valuable for style, format, classification, or specialized behavior—but it increases governance complexity and requires disciplined evaluation. The New AI Risk Surface: What Keeps CISOs Up at Night 1) Data leakage (intentional and accidental) Employees paste sensitive information into public tools. Vendors log prompts. Browser plugins capture content. The risk is rarely “the AI went rogue”—it’s basic data handling failures at machine speed. 2) Prompt injection and tool misuse When AI systems can call tools (email, ticketing, file access), adversaries can manipulate inputs to override instructions or exfiltrate data. This is not theoretical—prompt injection is now a core application security problem. 3) Hallucinations that look confident Generative AI can produce plausible but incorrect outputs. In regulated workflows—finance, healthcare, legal, security—“confidently wrong” is often more dangerous than “I don’t know.” 4) Model supply chain risk Using third-party models, datasets, and libraries introduces a familiar problem in a new form: dependencies you didn’t validate, updated without notice, and governed by terms you didn’t negotiate. 5) AI-accelerated social engineering Deepfake voice, video, and highly tailored phishing campaigns are now cheap. Traditional awareness training helps, but it’s no longer sufficient by itself—verification workflows and technical controls must close the gap. Governance That Enables AI (Instead of Blocking It) Start with a simple policy structure Most organizations need a practical AI policy framework that people can follow under pressure. At minimum: Approved tools list: Which AI tools are allowed, for what purpose, and under what conditions. Data handling rules: What data can be used (and what cannot), mapped to your classification scheme. Human review requirements: Where a person must validate outputs before use (customer-facing, financial, legal, security actions). Logging and retention: What gets logged, who can access logs, and how long records are retained. Vendor standards: Security requirements, contractual protections, and audit rights. Use established frameworks to avoid reinventing the wheel You don’t need a 200-page governance manual to start, but you do need a backbone. Strong references include: NIST AI Risk Management Framework (AI RMF): Practical for identifying, measuring, and managing AI risks. ISO/IEC 42001: An AI management system approach for governance and continuous improvement. EU AI Act (and emerging global regulation): Especially relevant if you operate internationally or build AI-enabled products. Security Controls for AI Systems: A Practical Checklist Protect data and access first Identity and access management: SSO, least privilege, and role-based access to AI tools and data connectors. DLP and data classification: Prevent sensitive data from entering unapproved prompts or being returned to unauthorized users. Network controls: Restrict outbound connections for AI workloads; monitor egress for unusual patterns. Secure connectors: Treat integrations (SharePoint, Google Drive, Slack, ticketing systems) as high-risk pathways. Design for adversarial inputs Prompt injection defenses: Input sanitization, instruction hierarchy, and explicit separation of data from instructions. Tool-use guardrails: Require confirmations for sensitive actions, limit scopes, and enforce allowlists. Output filtering: Block sensitive content, unsafe instructions, and disallowed disclosures. Operate it like a production system Logging and observability: Track prompts, retrieval sources, tool calls, and output decisions (with privacy-aware handling). Evaluation and regression testing: Validate quality, safety, and security before and after updates. Red teaming: Test for jailbreaks, data exfiltration, policy bypass, and harmful outputs. Incident response: Define what an “AI incident” is and how you contain it (revoking connectors, rotating keys, disabling tool calls, pausing deployments). If your AI system can access sensitive data or take action in other systems, it’s not a chatbot. It’s a privileged application—and it deserves the same rigor as any production platform. How to Roll Out AI in 90 Days Without Losing Control Days 0–30: Align, inventory, and set the rules Define 3–5 measurable use cases tied to business outcomes. Inventory current AI usage (including “shadow AI”). Publish an approved tools list and data-handling policy. Pick an evaluation approach: quality metrics, security tests, and human review checkpoints. Days 31–60: Pilot with guardrails Launch 1–2 pilots with clear owners and success criteria. Implement RAG with approved knowledge sources. Enable logging, access controls, and DLP. Run adversarial testing (prompt injection, sensitive data exposure, unsafe outputs). Days 61–90: Scale what works, shut down what doesn’t Expand to additional teams based on results, not enthusiasm. Harden integrations and refine tool-use permissions. Create repeatable onboarding: templates, patterns, and controls. Report outcomes in business language (time saved, tickets reduced, faster close rates, fewer incidents). Measuring AI Success: Metrics That Matter Business metrics Cycle time reduction: Time-to-resolution, time-to-first-draft, time-to-decision. Cost-to-serve: Support cost per ticket, analyst hours per investigation. Quality outcomes: Fewer errors, fewer escalations, improved customer satisfaction. Risk and control metrics Sensitive data events: DLP triggers, policy violations, blocked prompts. Model reliability: Hallucination rates in critical workflows, retrieval accuracy for RAG. Security findings: Red team success rates, jailbreak resistance, connector misconfigurations. What’s Next: The Direction AI Is Headed Three trends are shaping the next wave of adoption: Multimodal AI: Systems that reason across text, images, audio, and video—powerful for support, fraud detection, and investigations. On-device and private AI: More inference happening locally or in isolated environments to reduce data exposure and cost. Agentic workflows: AI systems that can execute tasks end-to-end—creating enormous efficiency, and an urgent need for permissioning, auditing, and containment. The winners won’t be the organizations with the most AI tools. They’ll be the ones that build repeatable, secure, measurable AI capabilities. Conclusion: Build AI Like You Build Trust AI is already changing how work gets done—and how attacks are executed. The question isn’t whether your organization will use AI. It’s whether you’ll deploy it with discipline: grounded in real use cases, governed by clear rules, and defended like the high-impact system it is. Your next step: identify where AI can create measurable value in the next 90 days, then put the guardrails in place before you scale. If you want help assessing your current AI exposure, selecting the right architecture (RAG vs. fine-tuning vs. private deployment), or building an AI governance and security program that enables innovation safely, now is the time to do it—before shadow adoption makes the decisions for you. ## Cybersecurity in 2026: A Practical Playbook for Defending Modern Organizations - URL: https://bartmcd.com/blog/cybersecurity-2026-practical-playbook-modern-defense - Published: 2026-01-14 Cybersecurity used to be a technology problem—firewalls, antivirus, and a hope that attackers would move on to someone else. Today it’s a business reality. Every organization is a software company in disguise, every employee is a potential entry point, and every vendor is part of your attack surface. Meanwhile, artificial intelligence has lowered the cost of creating convincing lures and accelerated how quickly adversaries can iterate on attack paths. I’ve spent a career helping leadership teams navigate this reality: translating risk into operational decisions, building security programs that don’t collapse under their own complexity, and responding when “unlikely” becomes “already happening.” The good news is that effective cybersecurity is achievable—not through perfection, but through clarity, consistency, and the discipline to prioritize what actually reduces risk. Cybersecurity isn’t about stopping every attack. It’s about preventing the attacks that matter, detecting what gets through, and recovering fast enough that the business doesn’t break. What Cybersecurity Really Is (and What It Isn’t) Cybersecurity is the set of practices, controls, and behaviors that protect the confidentiality, integrity, and availability of your systems and data. It’s also the capability to operate through failure—because failure is inevitable. That includes preventing breaches, but just as importantly, limiting blast radius, spotting issues early, and restoring operations quickly. What cybersecurity is not A product you buy once and forget (tools without process become expensive shelfware). A compliance checkbox (compliance can be a baseline, but it’s rarely a full defense). An IT-only responsibility (security is a business function with technical execution). The Threat Landscape: What’s Actually Hitting Organizations Most successful breaches aren’t movie-style “hacks.” They’re the predictable result of exposed credentials, unpatched systems, over-permissioned access, weak vendor controls, and the absence of monitoring that can catch an intrusion before it becomes a headline. Ransomware and extortion: downtime is the weapon Ransomware has matured into a business model. Attackers often steal data first, then encrypt systems, then pressure leadership with deadlines, reputational threats, and regulatory exposure. The true damage is often operational disruption: missed revenue, broken logistics, delayed patient care, or halted manufacturing. Identity-based attacks: passwords are the soft underbelly Credentials are the easiest way in. Phishing, credential stuffing, token theft, and MFA fatigue attacks are effective because they exploit human behavior and gaps in identity controls. If an attacker can log in like a user, many environments will treat them like a user. Supply chain and vendor risk: your security is only as strong as your dependencies Modern organizations rely on SaaS platforms, MSPs, contractors, payment providers, and specialized applications. Attackers know this. They target the weakest link, then pivot into better-defended environments through trusted connections. Cloud misconfigurations: the “open door” problem Cloud doesn’t eliminate risk—it changes it. Misconfigured storage, overly permissive identity roles, and exposed services create silent vulnerabilities. The cloud is powerful, but it’s also unforgiving: one bad setting can become global exposure. AI-driven social engineering: scale and realism AI has improved phishing quality, increased personalization, and lowered the time it takes to generate convincing messages, scripts, and content. That raises the baseline: your defenses must assume attackers can craft better lures faster than ever. The Core Principles of an Effective Cybersecurity Program Strong security programs share a few traits: they focus on what materially reduces risk, they’re operationally sustainable, and they’re measurable. You don’t need a thousand controls—you need the right controls implemented consistently. 1) Assume compromise and design for resilience If you assume attackers will eventually get in, you build differently: you segment, you monitor, you limit privileges, and you ensure you can restore operations quickly. This mindset turns security from “hoping nothing happens” into “ensuring we can survive what happens.” 2) Protect what matters most Not all systems are equal. Identify your crown jewels: customer data, regulated data, financial systems, production environments, intellectual property, and the systems that keep the business running. Then design security around those assets first. 3) Reduce attack surface relentlessly Remove unused accounts, applications, and services. Harden configurations and standardize builds. Patch aggressively where exploitation is likely. Limit inbound exposure to only what is necessary. 4) Make detection and response a first-class capability Prevention fails. Your ability to detect and respond determines whether an incident becomes a disruption or a disaster. This requires logging, alerting, skilled analysis, and rehearsed action—not just tools. Zero Trust: A Useful Strategy When Done Practically Zero Trust is often misunderstood as a product. It’s a strategy: never trust, always verify , and continuously evaluate access based on identity, device health, and context. Practical Zero Trust building blocks Strong identity controls : SSO, phishing-resistant MFA, conditional access. Least privilege : role-based access, just-in-time elevation, periodic access reviews. Device trust : managed endpoints, encryption, EDR, posture checks. Network segmentation : limit lateral movement; isolate critical systems. Continuous monitoring : detect anomalies and risky access patterns. The Human Factor: Security Culture Without the Blame Game People are not the weakest link—they’re the most targeted link. The organizations that do well treat employees as part of the defense system, not as liabilities to punish. Security awareness that actually works Train for decisions , not trivia: “What should I do next?” beats “What is ransomware?” Make reporting easy : one-click phish reporting, fast feedback loops. Reward good behavior : reinforce reporting and safe escalation. Target training : finance, HR, and executives face different attack patterns. Executive and board engagement Cybersecurity becomes effective when leadership treats it as risk management, not IT overhead. Boards don’t need packet captures; they need clarity on business impact, risk trends, and what the organization is doing about it. If leadership only hears about security when something breaks, you don’t have a program—you have a panic button. The Controls That Consistently Reduce Real-World Risk If you’re looking for the highest return on security investment, focus on fundamentals that stop common intrusions and reduce blast radius. Identity and access management (IAM) Phishing-resistant MFA for privileged users and sensitive systems (FIDO2/WebAuthn where feasible). Disable legacy authentication and reduce reliance on passwords. Privileged access management (PAM) or at least separate admin accounts with tight controls. Regular access reviews and rapid offboarding. Endpoint security and hardening EDR with tuned policies and active monitoring. Application control where possible, especially for high-risk endpoints. Encrypt devices and enforce screen locks and OS baselines. Patch management with SLAs based on risk and exposure. Email and collaboration security Anti-phishing protections tuned for impersonation and business email compromise. DMARC/SPF/DKIM to reduce spoofing. External sender tagging and rules to prevent auto-forwarding to personal addresses. Network and cloud security Segment critical systems and restrict east-west traffic. Secure remote access with VPN alternatives where appropriate, and enforce device posture. Cloud security posture management : eliminate public storage exposure, tighten identity roles. Infrastructure as code and policy guardrails to prevent misconfiguration at scale. Backup and recovery: the difference between an incident and a catastrophe Backups are not a checkbox. They are an operational capability. Immutable or offline backups to resist ransomware. Test restores routinely, not annually. Prioritize recovery : know what must come back first to run the business. Document dependencies : many “restores” fail because upstream services weren’t considered. Incident Response: Build the Muscle Before You Need It In the middle of an incident, you don’t rise to the occasion—you fall to the level of your preparation. A mature incident response (IR) program reduces downtime, limits data loss, and keeps decision-making rational under pressure. Your incident response plan should answer these questions Who is in charge (and who is backup)? How do we declare an incident and escalate? How do we preserve evidence and coordinate with counsel? How do we communicate internally, to customers, and to regulators? What systems do we isolate first? What is our ransomware decision framework? Tabletop exercises: the highest-value rehearsal Run tabletop exercises at least twice a year, including executives. Practice scenarios like ransomware, vendor compromise, and payroll fraud. The goal isn’t to “pass”—it’s to discover gaps while the stakes are low. Governance, Risk, and Compliance: Make It Work for the Business Security programs succeed when they align with business objectives and are expressed in measurable risk. That’s where governance helps: setting standards, defining accountability, and funding the right priorities. Frameworks that help structure the program NIST Cybersecurity Framework (CSF) : an excellent way to organize outcomes and maturity. CIS Controls : practical, prioritized control recommendations. ISO 27001 : strong for building an auditable information security management system. Metrics that leadership should actually care about Time to detect and time to contain incidents. Patch SLAs compliance for critical vulnerabilities. MFA coverage and privileged account inventory accuracy. Backup restore success rate and recovery time objectives (RTOs). Phishing reporting rate (a positive signal) versus just click rate. AI and Cybersecurity: Opportunity and Risk AI can improve security operations—if you deploy it with guardrails. It can also increase risk if you allow sensitive data to leak into prompts, accept hallucinated outputs as truth, or automate decisions without verification. Where AI helps defensively Alert triage : summarizing events, clustering similar incidents, reducing analyst fatigue. Threat hunting : accelerating hypothesis testing across large log sets. Security education : tailoring training to roles and observed risks. How to use AI safely in security programs Define data boundaries : what can and cannot be shared with AI tools. Require human verification for high-impact actions (account lockouts, firewall changes, isolation). Log and audit AI usage where possible for investigation and compliance. Test for prompt injection and model manipulation in customer-facing AI workflows. A Practical 90-Day Cybersecurity Plan If you need to move from intention to execution, here’s a realistic 90-day sequence I’ve seen work across industries. Days 1–30: Stabilize Inventory critical systems, admin accounts, and external exposures. Enforce MFA broadly (prioritize email, VPN/remote access, and admins). Confirm backups: immutable/offline capability and a tested restore. Deploy or validate EDR coverage and ensure alerts are monitored. Days 31–60: Reduce blast radius Implement least privilege and remove dormant accounts. Segment critical systems and restrict lateral movement paths. Improve email protections (DMARC, impersonation rules, anti-forwarding controls). Create an incident response plan and run a tabletop exercise. Days 61–90: Operationalize and measure Stand up repeatable vulnerability management with SLAs. Define security metrics and reporting cadence to executives/board. Formalize vendor risk review for key providers. Establish a roadmap aligned to a framework (NIST CSF or CIS Controls). Conclusion: Security That Lets the Business Move Faster The goal of cybersecurity isn’t to slow the business down. Done right, it creates confidence—confidence that you can adopt new technology, work with new partners, and serve customers without betting the company on hope. The winning approach is practical: protect the critical assets, harden identity, monitor relentlessly, rehearse response, and build resilience through tested recovery. Cybersecurity is leadership under uncertainty: clear priorities, disciplined execution, and the ability to recover when reality doesn’t follow the plan. Call to action: If you’re ready to strengthen your security posture, start with a candid assessment of your top business risks and your ability to detect, respond, and recover. Then build a 90-day plan with measurable outcomes—and execute it with the same rigor you apply to revenue and operations. ## Artificial Intelligence: What It Is, Why It Matters, and How to Use It Responsibly - URL: https://bartmcd.com/blog/artificial-intelligence-what-it-is-why-it-matters - Published: 2026-01-13 Artificial intelligence isn’t “coming.” It’s already embedded in how we search, shop, hire, diagnose, trade, and defend. The organizations winning right now aren’t the ones with the flashiest demos—they’re the ones turning AI into repeatable, governed capability: clear use cases, measurable outcomes, secure data, and disciplined execution. In my work across cybersecurity and enterprise operations, I’ve seen the same pattern play out: AI can be a force multiplier, but it can also multiply risk when it’s bolted on without strategy, controls, and accountability. This article breaks down what AI really is, where it delivers value, what can go wrong, and how leaders can adopt it with confidence. What AI Actually Is (and What It Isn’t) At its core, AI is a set of techniques that enable software to perform tasks that typically require human judgment —recognizing patterns, generating content, making predictions, and taking actions in complex environments. A practical definition AI systems learn from data (or simulate learning through rules and reasoning) to produce outputs such as classifications, forecasts, recommendations, or generated content. The “intelligence” isn’t magic—it’s math, statistics, and engineering wrapped in software. AI is not a single technology When people say “AI,” they may mean: Machine Learning (ML): Models trained on data to make predictions or decisions. Deep Learning: ML using neural networks, often for vision, speech, and language. Natural Language Processing (NLP): Understanding and generating human language. Generative AI: Producing text, images, code, and more (often using large language models). Automation + AI: Workflows that trigger actions based on AI outputs. The biggest misconception: “AI is always right” AI doesn’t “know” truth. It produces outputs that are statistically likely given its training and inputs. That means it can be brilliant one moment and confidently wrong the next—especially when asked to operate outside the conditions it was designed for. AI should be treated like a powerful junior analyst: fast, tireless, and often insightful—but requiring oversight, context, and guardrails. How Modern AI Works: A Leader’s View You don’t need to be a data scientist to lead AI initiatives, but you do need a working mental model of how these systems behave. Training vs. inference Training: The model learns patterns from data. This is where bias can be introduced, privacy can be violated, and intellectual property can leak if not controlled. Inference: The trained model generates outputs in real time—answering questions, scoring risk, flagging anomalies, or drafting content. Why data quality matters more than model choice Most AI failures are data failures. If your data is incomplete, inconsistent, or untrusted, your AI output will be too. “Garbage in, garbage out” becomes “garbage at scale.” What makes generative AI different Generative AI doesn’t just analyze data—it creates new content based on patterns it learned. That’s why it’s so useful for drafting and summarizing, and also why it can hallucinate, fabricate citations, or inadvertently reproduce sensitive material. Where AI Delivers Real Business Value The best AI investments don’t start with tools—they start with business friction. The question isn’t “Where can we use AI?” It’s “Where are we losing time, money, or trust, and what decision or workflow can AI improve?” High-impact use cases Customer support: Faster resolution via triage, summarization, suggested responses, and self-service. Operations: Document processing, invoice matching, forecasting, and anomaly detection. Sales and marketing: Personalization, content drafts, lead scoring, pipeline insights. Software engineering: Code suggestions, test generation, documentation, and security review assistance. Risk and compliance: Policy mapping, control evidence collection, and continuous monitoring. Cybersecurity: Detection enrichment, alert triage, threat hunting assistance, and phishing analysis. The best first projects Early wins should be: Low-to-moderate risk: Minimal regulatory exposure and limited impact if the model makes a mistake. Measurable: Time saved, accuracy improved, backlog reduced, revenue protected. Workflow-native: Embedded where people already work (ticketing, CRM, collaboration tools). Human-in-the-loop: AI proposes; humans approve—at least until performance is proven. AI and Cybersecurity: The Opportunity and the Threat AI has become a dual-use capability—powering defenders and attackers simultaneously. The organizations that thrive will be the ones that assume this reality and engineer for it. How AI helps defenders Signal amplification: Prioritize the alerts that matter by correlating context across systems. Faster investigation: Summarize incidents, extract IOCs, and suggest next steps. Threat intelligence: Translate, categorize, and map threats to frameworks more efficiently. Secure coding support: Help developers identify common vulnerabilities earlier. How AI helps attackers Social engineering at scale: Polished phishing, deepfake voice/video, tailored scams. Recon and exploitation: Faster research, scripting, and vulnerability chaining. Malware development: Assistance writing obfuscated code and automating variations. The new security mandate: protect the model, protect the data, protect the workflow AI expands your attack surface. It introduces new risks like prompt injection, data leakage through model inputs, insecure plugins/tools, and supply chain exposure via third-party AI services. If you wouldn’t paste it into a public website, don’t paste it into an AI prompt —unless you’ve implemented controls that make that safe. Key Risks Leaders Must Address AI risk isn’t theoretical. It shows up as bad decisions, compliance issues, reputational damage, and security events. The good news: most of it is manageable with the right governance and engineering. 1) Hallucinations and overconfidence Generative models can produce plausible but incorrect outputs. In regulated or high-stakes environments, unchecked hallucinations can become operational defects. 2) Data privacy and confidentiality AI systems frequently touch sensitive data—customer records, financial information, intellectual property, and internal strategy. Without proper controls, that data can leak to vendors, logs, or other users. 3) Bias and fairness Models trained on historical data can inherit historical inequities. This is especially important in hiring, lending, underwriting, and healthcare. 4) Intellectual property and provenance Leaders need to answer: Who owns the output? What data trained the system? Can we prove we have the rights to use it? These questions matter for content, code, and product design. 5) Model and supply chain risk AI solutions often rely on third-party models, APIs, and plugins. Each dependency is a potential breach point and a governance responsibility. A Practical Framework for Responsible AI Adoption Responsible AI isn’t a policy document. It’s a set of operational habits—embedded in procurement, security, legal review, engineering, and day-to-day use. Step 1: Start with a use-case inventory List where AI is already being used (including “shadow AI”). Identify the data being shared and the business process impacted. Rank by risk: low, medium, high. Step 2: Define governance and accountability Executive sponsor: Owns outcomes and funding. Business owner: Owns workflow performance and user adoption. Security: Owns threat modeling, controls, monitoring. Legal/compliance: Owns privacy, regulatory alignment, contracts. IT/data: Owns integration, data quality, and access controls. Step 3: Build security and privacy in by default Data minimization: Share only what’s needed to complete the task. Access control: Enforce least privilege for prompts, tools, and outputs. Logging and auditing: Track prompts, responses, and downstream actions—securely. Vendor due diligence: Understand retention, training use, and breach obligations. Segmentation: Keep sensitive workflows away from untrusted connectors/plugins. Step 4: Establish evaluation and testing AI outputs must be tested like any other critical system: Accuracy and reliability: Measure performance against real-world scenarios. Safety testing: Attempt prompt injection, data exfiltration, and misuse cases. Bias testing: Evaluate disparate impact where applicable. Drift monitoring: Watch for degradation as data and usage changes. Step 5: Train people, not just models AI literacy is now a baseline business skill. Users should know: What data is safe to share (and what isn’t). How to verify outputs, especially facts, numbers, and citations. How to use AI to improve thinking—not replace it. When to escalate questionable results or suspicious behavior. AI Strategy: What Mature Organizations Do Differently AI becomes transformative when it’s treated as a platform capability rather than a collection of experiments. They focus on decisions and workflows The highest ROI often comes from accelerating decisions: fraud review, incident response, quote approvals, contract analysis, and customer escalations. They invest in data foundations Clean, governed, well-labeled data beats a “better model” almost every time. Mature teams invest in: Data cataloging and lineage Data access governance Master data management Clear retention and classification policies They operationalize AI with guardrails That means defined human oversight, documented acceptable use, and continuous monitoring—especially when AI triggers actions automatically. The Future of AI: What to Watch Next AI is moving from generating content to executing tasks . The next wave will be “agentic” systems that can plan, call tools, and take multi-step actions across applications. That will unlock major productivity gains—but also introduces new failure modes and security concerns. Near-term trends that will shape adoption AI agents in enterprise tools: Automated triage, scheduling, purchasing, and remediation. Smaller, specialized models: More efficient and easier to control for specific tasks. On-prem and private AI: Increased demand driven by privacy, sovereignty, and IP concerns. Regulation and auditability: More requirements around transparency, data use, and accountability. The organizations that win with AI won’t be the ones who move fastest. They’ll be the ones who move deliberately—building trust, security, and measurable outcomes into every deployment. Conclusion: Make AI a Capability, Not a Gamble AI can reduce costs, accelerate execution, and strengthen security—if you treat it like any other enterprise-grade system: define the goal, control the inputs, test the outputs, and monitor what happens in the real world. If you want to make AI practical and safe inside your organization, start with three moves this week: Identify one high-friction workflow where AI can save time without introducing critical risk. Set a clear policy for data handling in AI tools—what’s allowed, what’s prohibited, and why. Assign ownership across business, security, and compliance so adoption doesn’t outpace governance. Call to action: If you’d like, share your industry, size, and top three processes you want to improve, and I’ll outline a prioritized AI roadmap—including recommended use cases, guardrails, and a simple measurement plan to prove ROI. ## Cybersecurity in 2026: What’s Changed, What Hasn’t, and What to Do About It - URL: https://bartmcd.com/blog/cybersecurity-in-2026-whats-changed-and-what-to-do - Published: 2026-01-12 Cybersecurity used to be a technology problem: firewalls, antivirus, and a few rules about passwords. Today it’s a business survival discipline —because attackers don’t need to “break in” when they can log in, impersonate your executives, exploit a vendor, or pressure your team into paying a ransom. I’ve spent my career watching security evolve from perimeter defense to an always-on contest of adaptation. The organizations that consistently outperform aren’t the ones with the most tools—they’re the ones with the clearest priorities, the best operational habits, and the discipline to treat security like a core function of the business. Cybersecurity isn’t about being unhackable. It’s about being resilient: reducing the odds of a breach and minimizing the blast radius when one happens. The Modern Threat Landscape: How Attacks Really Happen Now Most breaches follow predictable patterns. The specific malware family may change, but the path to impact is remarkably consistent: Identity compromise (phishing, credential stuffing, MFA fatigue, session hijacking) Exploitation of exposed systems (unpatched VPNs, remote management tools, edge devices) Supply chain and third-party access (vendors, MSPs, SaaS integrations, stolen API keys) Misconfiguration (cloud storage exposure, overly permissive IAM, open admin consoles) Insider risk (malicious or simply rushed, overwhelmed, or untrained employees) Ransomware Is Still the Headline—but It’s Not Just Encryption Ransomware groups have shifted from “encrypt and extort” to multi-stage business disruption : Data theft first (exfiltration creates leverage even if backups work) Operational impact (targeting critical systems and backups, not just endpoints) Reputation pressure (leak sites, customer notifications, regulatory exposure) If your plan is “we’ll restore from backup,” you have a plan for last decade’s ransomware. Attackers Are Running a Business, Too Cybercrime is efficient because it’s industrialized. Access brokers sell footholds, specialists escalate privileges, and affiliates deploy ransomware. This division of labor means: Attacks scale quickly across industries Even mid-sized organizations are targets Dwell time shrinks—attacks move from compromise to impact faster than many teams can detect Core Principles: The Cybersecurity Fundamentals That Still Win Cybersecurity can feel overwhelming because the tooling landscape is noisy. When I advise leadership teams, I bring it back to fundamentals that consistently reduce risk—regardless of industry. 1) Assume Compromise: Design for Containment Assume an attacker will eventually get a credential, a laptop will be lost, or a system will be misconfigured. Your job is to prevent a single mistake from becoming a company-wide event. Segment networks to limit lateral movement Separate administrative privileges from daily user accounts Protect “crown jewels” (systems and data that would cripple the business if compromised) 2) Identity Is the New Perimeter In cloud and hybrid environments, the attacker’s fastest path is typically through identity. Strong identity security is now table stakes. Phishing-resistant MFA (FIDO2/WebAuthn, passkeys) for admins and high-risk roles Conditional access based on device posture, location, and risk signals Least privilege with just-in-time elevation for administrative tasks Continuous monitoring for anomalous sign-ins and impossible travel 3) Patch What Matters—Fast “Patch everything immediately” is not realistic. But “we’ll get to it later” is how breaches happen. The winning approach is disciplined prioritization: Maintain a real asset inventory (you can’t patch what you don’t know you have) Exploitability-based patching (internet-facing and known-exploited vulnerabilities first) Fix the repeat offenders (VPNs, edge devices, remote access tools, identity systems) 4) Logging and Detection: If You Can’t See It, You Can’t Stop It Many organizations buy detection tools but fail to operationalize them. The goal isn’t “more logs.” The goal is useful signal with defined response actions. Centralize critical logs (identity, endpoints, email, cloud control plane, key servers) Define alert thresholds and ownership (who responds, how fast, using what playbook) Test detection with real scenarios (phishing, token theft, ransomware behavior) Zero Trust: A Strategy, Not a Product “Zero Trust” is often misunderstood as a tool you can buy. In practice, it’s a security operating model : Never trust, always verify (every access request is evaluated) Assume breach (design for containment and rapid response) Least privilege (minimize access paths and privileges) What Zero Trust Looks Like in the Real World Device compliance is required to access sensitive apps Admin access is time-bound and audited High-risk actions trigger step-up authentication Workloads authenticate to each other with short-lived credentials The practical win is reducing the likelihood that one compromised identity becomes an organization-wide compromise. Cloud Security: Shared Responsibility, Frequently Misunderstood Cloud providers secure the infrastructure. You still own security for your data, identities, configurations, and access controls. Most cloud incidents come down to: Over-permissioned IAM Public exposure (storage buckets, databases, management ports) Weak secrets management (API keys in code repos, long-lived tokens) Inadequate monitoring of cloud control plane activity Cloud Security Controls That Pay Off Quickly Baseline configurations (policy-as-code, secure templates, guardrails) Centralized IAM with least privilege and role-based access Secrets management (vaulting, rotation, short-lived credentials) Cloud-native logging with alerting for risky actions (privilege escalation, key creation, logging disabled) AI and Cybersecurity: Force Multiplier for Both Sides AI is changing cybersecurity in two directions at once: it helps defenders scale, and it helps attackers craft more believable, higher-volume attacks. How Attackers Use AI More convincing phishing (tone, grammar, context, personalization) Deepfakes and voice cloning to pressure finance teams and executives Faster reconnaissance (summarizing leaked data, mapping org structures, identifying targets) How Defenders Should Use AI (Safely) Triage and prioritization (summarize incidents, correlate signals, reduce noise) Security copilots for analysts (query generation, investigation assistance, playbook guidance) Policy and control validation (identify misconfigurations, drift, and risky permissions) AI doesn’t replace security leadership. It replaces guesswork—if you feed it clean data, define clear objectives, and put guardrails around what it can do. AI Governance: The Security Controls Most Organizations Haven’t Caught Up To If your teams are using AI tools, you need to treat them like any other system that touches sensitive data: Data classification rules (what can and cannot go into AI tools) Vendor risk review (data retention, training use, access controls, audit logs) Identity and access controls (SSO, MFA, least privilege) Monitoring for sensitive data leakage Building a Cybersecurity Program That Actually Works Security programs fail for predictable reasons: they chase compliance instead of risk, buy tools without operationalizing them, or ignore the human and process components. A program that works is built on clarity, coverage, and cadence . Start With a Risk-Based Model You don’t secure everything equally. Identify the few things that matter most: Critical business processes (revenue, customer delivery, operations) Sensitive data (customer data, IP, financial data, regulated records) Critical systems (identity, email, ERP, payment, production systems) Then align controls to those priorities. Use a Framework to Stay Coherent Frameworks help translate cybersecurity into governance and accountability. Two common anchors: NIST Cybersecurity Framework (CSF) : Identify, Protect, Detect, Respond, Recover CIS Controls : a prioritized set of practical safeguards The best use of a framework isn’t as paperwork—it’s as a roadmap for phased improvement. Operational Cadence: Security Is a Habit Strong security is the result of disciplined routines: Weekly : patch prioritization, vulnerability review, phishing and impersonation monitoring Monthly : access reviews for privileged roles, backup restore tests, tabletop exercises Quarterly : incident response simulation, third-party risk review, logging coverage assessment Annually : full business continuity and disaster recovery validation Incident Response: Plan for the Day You Don’t Want to Have When an incident occurs, time and clarity matter more than perfection. The organizations that recover fastest have already answered the hard questions. Your Incident Response Plan Must Include These Elements Roles and decision authority (who can shut down systems, who talks to customers, who engages legal) Communications plan (internal, external, regulators, customers, press) Forensics readiness (log retention, endpoint visibility, evidence handling) Ransomware decision framework (pre-defined criteria, legal considerations, insurer coordination) Recovery sequence (what comes back first, and what must be verified before it’s trusted) Backups: The Most Common “We Thought We Had It” Failure Backups only help if they are protected and restorable under pressure: Immutable or offline backups to resist ransomware tampering Separate credentials for backup administration Regular restore testing for critical systems, not just file recovery Security Culture: The Invisible Control That Drives Outcomes You can’t tool your way out of a culture problem. Most real-world compromises exploit human behavior: urgency, trust, fatigue, and ambiguity. What Security Awareness Should Really Look Like Role-based training (finance, HR, engineers, executives face different threats) Short, frequent drills (phishing simulations with coaching, not shaming) Clear reporting paths (“If you see something, here’s exactly what to do”) Executive participation (culture follows what leadership visibly prioritizes) The goal isn’t perfect behavior. The goal is fast detection—people reporting suspicious activity before it becomes impact. Metrics That Matter: How Leaders Should Measure Cybersecurity Security metrics often fall into the trap of counting activity (tickets, alerts, scans) instead of measuring reduction in risk. Better questions include: How quickly can we detect and contain an identity compromise? What percentage of critical assets are covered by EDR, logging, and patch SLAs? How many privileged accounts exist, and how often are they used? How long does it take to restore critical systems from backups? What is our third-party exposure for critical vendors? Metrics should drive decisions: staffing, tooling, process changes, and investment priorities. A Practical 90-Day Cybersecurity Action Plan If you want a focused way to materially improve security without boiling the ocean, these steps create outsized impact quickly: Days 1–30: Stabilize the Basics Enforce phishing-resistant MFA for admins and critical apps Inventory critical assets and confirm patch ownership Lock down email: DMARC , anti-impersonation controls, external sender tagging Validate backups: immutability/offline copy + first restore test Days 31–60: Improve Visibility and Containment Centralize logging for identity, endpoints, and cloud control plane Deploy/validate EDR coverage for all endpoints and key servers Reduce privilege: remove standing admin where possible; implement just-in-time elevation Segment critical systems or restrict access paths (especially admin interfaces) Days 61–90: Operationalize and Test Run an incident response tabletop (ransomware + identity compromise) Conduct a targeted third-party review for your top vendors Establish recurring cadence: patch SLAs, access reviews, restore tests Define executive-level security metrics and review them monthly Conclusion: Cybersecurity Is a Leadership Advantage The organizations that treat cybersecurity as a strategic capability—rather than an IT tax—recover faster, earn more customer trust, and make better technology decisions. The path forward is not a bigger stack of tools. It’s clarity about what matters , disciplined execution of fundamentals, and a culture where security is operationalized every day. If you want to strengthen your cybersecurity posture, start with a single question: “If we were compromised tomorrow, what would fail first?” Then build your program around preventing that failure—and recovering quickly if prevention isn’t enough. Call to action: Align your leadership team on your crown jewels, validate identity protections and backups this month, and schedule an incident response exercise within the next 30 days. The best time to prepare is before you’re forced to improvise. ## Cybersecurity: The Business-Critical Discipline That Keeps Evolving - URL: https://bartmcd.com/blog/cybersecurity-business-critical-discipline-keeps-evolving - Published: 2026-01-09 Cybersecurity used to be a back-office concern—something you “had IT handle” while the business focused on growth. That era is over. Today, cybersecurity is a core operating function that touches revenue, reputation, legal exposure, customer trust, and even your ability to stay in business after a bad day. I’ve watched organizations build impressive security programs and still get blindsided—not because they didn’t buy enough tools, but because they didn’t align security with how the business actually runs. Modern cybersecurity is not a product you purchase; it’s a system you build: people, process, technology, and governance working together. Cybersecurity isn’t about being unhackable. It’s about reducing risk, limiting blast radius, and recovering fast when something inevitably breaks through. Why Cybersecurity Matters More Than Ever Most organizations are now “software organizations,” even if they don’t sell software. Your customer data, financial operations, HR processes, supply chain, and intellectual property live in a mix of cloud services, endpoints, identity systems, APIs, and third-party platforms. Attackers know that. Cybersecurity has become harder for three reasons: The attack surface is larger (cloud, SaaS, remote work, mobile, APIs, third parties). Attackers are faster and more professional (ransomware-as-a-service, initial-access brokers, automation). The cost of failure is higher (regulatory scrutiny, business interruption, reputational damage). The Modern Threat Landscape: What You’re Up Against Ransomware and Extortion Ransomware isn’t just encryption anymore. It’s extortion. Attackers steal data first, then threaten public release, customer notification, or regulatory exposure. They’re also targeting backups, hypervisors, and identity systems to make recovery painful. Business Email Compromise (BEC) and Payment Fraud BEC remains one of the most profitable, least technical attacks. It exploits human trust and weak processes—changing bank details, intercepting invoices, and manipulating approval workflows. Supply Chain and Third-Party Risk Your security posture is now tightly coupled to vendors: MSPs, payroll processors, accounting platforms, SSO providers, marketing tools, and niche SaaS applications. One compromised vendor account can become your incident. Cloud Misconfigurations and Identity Abuse In cloud environments, attackers don’t “break in” as much as they log in . Weak identity controls, poor permission hygiene, exposed credentials, and overly permissive service accounts are common entry points. Insider Risk (Malicious and Accidental) Not all incidents are external. Mis-sent files, improper sharing permissions, and careless data handling are frequent causes of exposure. Malicious insiders are less common but more damaging when they occur. Cybersecurity Fundamentals That Still Win Every year we see new threats, new tools, and new buzzwords. Yet the fundamentals are what consistently prevent incidents or reduce impact. If you’re overwhelmed, start here. 1) Asset Visibility: Know What You Have You can’t protect what you can’t see. That includes endpoints, servers, cloud workloads, SaaS applications, identities, and data repositories. Maintain an accurate inventory of devices and cloud assets. Discover “shadow IT” (unsanctioned SaaS and integrations). Classify critical systems and crown-jewel data. 2) Patch and Vulnerability Management: Reduce Known Exposure Most successful attacks exploit known weaknesses—unpatched systems, outdated software, exposed services. Vulnerability scanning is easy; disciplined remediation is the hard part. Prioritize based on exploitability and business impact , not just CVSS scores. Set patch SLAs by severity (for example: critical within 7 days). Include third-party apps, firmware, and internet-facing services. 3) Backups and Recovery: Your “Get Out of Jail” Card Backups are only valuable if they’re protected and tested. Too many organizations learn during an incident that their backups are incomplete, corrupted, or accessible to attackers. Use immutable or write-once storage where possible. Separate backup credentials from daily admin accounts. Test restores regularly and measure recovery time. 4) Network and Endpoint Hardening Harden endpoints and servers so an initial compromise doesn’t become full-domain control. Implement endpoint detection and response (EDR) with 24/7 monitoring. Disable legacy authentication protocols where feasible. Remove local admin rights for standard users. Segment networks to limit lateral movement. Identity Is the New Perimeter In a SaaS-first world, identity is where the real control lives. If an attacker gets valid credentials—especially with weak MFA or excessive privileges—traditional defenses won’t matter. Core Identity Controls Enforce phishing-resistant MFA for admins and high-risk users (FIDO2/WebAuthn where possible). Centralize identity with SSO and consistent policy enforcement. Apply least privilege : remove standing admin rights and use just-in-time elevation. Monitor impossible travel and anomalous logins . Secure service accounts and API keys with rotation and scoped permissions. If you fix only one thing this quarter, fix identity. It’s the fastest path to reducing the most common forms of compromise. Zero Trust: What It Is (and What It Isn’t) Zero Trust is often misunderstood as a product. It’s a strategy: never trust, always verify , and assume breach. The goal is to make every access decision context-aware and to limit damage when something goes wrong. Practical Zero Trust Moves Require strong authentication for every critical system. Continuously evaluate device health (managed, patched, encrypted). Implement conditional access policies (location, risk, device posture). Segment access to sensitive systems and data repositories. Log and correlate identity, endpoint, and cloud events. Cloud and SaaS Security: Where Most Businesses Actually Live Cloud doesn’t eliminate security responsibilities—it changes them. You’re responsible for your data, identities, configurations, and access controls, even when the infrastructure is “managed.” Common Cloud/SaaS Failure Points Overly permissive sharing settings (public links, broad external access). Misconfigured storage and exposed services. Excessive admin roles and too many global administrators. Weak logging and retention (no visibility when something happens). What Strong Cloud Security Looks Like Baseline configurations (CIS benchmarks) and continuous drift detection. Centralized logging with meaningful alerting and clear response playbooks. Data loss prevention (DLP) where sensitive data is shared externally. Vendor access reviews and app consent governance. Security Operations: Detection and Response That Actually Works Prevention is necessary, but it’s not sufficient. You need the ability to detect abnormal behavior quickly and respond decisively. What to Measure in Security Operations MTTD (Mean Time to Detect): how quickly you identify an incident. MTTR (Mean Time to Respond/Recover): how quickly you contain and restore. Coverage : which systems and logs are actually monitored. Signal quality : alerts that lead to action, not noise. The Minimum Viable Incident Response Capability Documented incident response plan with clear roles and escalation paths. Pre-staged access to logs, forensics tools, and key vendor contacts. Tabletop exercises at least twice a year (ransomware and BEC are good starts). Communications plan: internal, customer, legal, insurer, and PR readiness. In a real incident, you won’t rise to the occasion—you’ll fall back to your preparation. The Human Layer: Training, Culture, and Process Controls Security awareness training gets a bad reputation because it’s often treated as a compliance checkbox. Done well, it creates a culture where people recognize risk and report issues early. Where Training Helps Most Phishing and credential theft recognition. Secure handling of sensitive data and customer information. Executive assistants and finance teams: higher exposure to payment fraud. Developers and IT admins: privileged access and configuration risk. Process Controls That Prevent Expensive Mistakes Out-of-band verification for wire transfers and bank detail changes. Dual approval for high-risk financial actions. Standardized onboarding/offboarding with rapid access removal. Access reviews for critical systems on a defined schedule. AI and Cybersecurity: Opportunity and Risk AI is changing cybersecurity on both sides. Defenders can triage alerts faster, detect anomalies, and automate routine response. Attackers can generate more convincing phishing, automate reconnaissance, and scale social engineering. How to Use AI Responsibly in Security Use AI to augment analysts, not replace judgment. Protect sensitive data: know what gets sent to third-party models and where it’s stored. Set governance: approved tools, acceptable use, and access controls. Validate outputs: AI can be wrong, and security decisions have real consequences. Building a Cybersecurity Program: A Practical Roadmap A strong program is not defined by the number of tools you own. It’s defined by resilience: the ability to prevent common attacks, detect anomalies, and recover quickly. If you need a structured approach, start with this sequence. Step 1: Establish Your Risk Baseline Identify critical business processes and crown-jewel data. Map top risks: ransomware, BEC, insider exposure, vendor compromise. Align to a framework (NIST CSF, ISO 27001) to avoid gaps. Step 2: Fix the High-Impact Controls First Phishing-resistant MFA for admins and remote access. EDR with 24/7 monitoring and defined response playbooks. Immutable backups with tested restores. Patch SLAs and remediation accountability. Step 3: Operationalize and Measure Create a security cadence: weekly reviews, monthly metrics, quarterly risk updates. Track coverage and gaps: endpoints, cloud logs, SaaS audit trails. Run tabletop exercises and turn lessons into budgeted projects. Step 4: Harden the Business, Not Just IT Embed controls into finance workflows to stop fraud. Improve vendor governance and third-party access. Build security into procurement, onboarding, and change management. Conclusion: Cybersecurity Is a Leadership Issue Cybersecurity success isn’t about fear—it’s about readiness. The organizations that handle incidents well are the ones that planned for disruption, invested in fundamentals, and built muscle memory through practice. If you want your security program to hold up under pressure, focus on what consistently moves the needle: identity security, fast detection and response, recoverable backups, disciplined patching, and business-aligned controls that prevent costly human error. Action step: In the next 30 days, run a ransomware tabletop exercise and an audit of administrator accounts and MFA. If either reveals gaps—and it usually does—prioritize remediation before you invest in more tools. Cybersecurity is never “done,” but it can be managed. Build the system, measure what matters, and treat resilience as a competitive advantage. ## AI in 2026: From Buzzword to Business-Critical Capability - URL: https://bartmcd.com/blog/ai-in-2026-from-buzzword-to-business-critical-capability - Published: 2026-01-08 Artificial intelligence has crossed a threshold. For most organizations, the question is no longer “Should we explore AI?”—it’s “How do we adopt AI safely, strategically, and at scale without creating new risk?” I’ve watched the same pattern repeat across industries: leaders rush to deploy a chatbot, celebrate a quick win, then discover they’ve accidentally introduced data exposure, compliance gaps, and inconsistent outcomes that erode trust. AI can absolutely deliver meaningful competitive advantage. But it isn’t magic, and it isn’t plug-and-play—especially when you factor in cybersecurity, privacy, and operational resilience. Done right, AI becomes a force multiplier for your people. Done wrong, it becomes a high-speed way to automate mistakes. AI success isn’t about having the most advanced model. It’s about building a repeatable system for delivering outcomes—securely, responsibly, and measurably. What AI Is—and What It Isn’t AI, Machine Learning, Deep Learning, and Generative AI “AI” is an umbrella term. Clarifying the categories helps teams align expectations and choose the right tools: Artificial Intelligence (AI): Systems that perform tasks associated with human intelligence—reasoning, pattern recognition, planning, language understanding. Machine Learning (ML): AI that learns patterns from data to make predictions or decisions (e.g., forecasting, classification). Deep Learning: A subset of ML using neural networks with many layers, often powering vision and language breakthroughs. Generative AI (GenAI): Models that generate new content—text, code, images, audio—based on learned patterns. Large language models (LLMs) are the most visible example. Where AI Excels—and Where It Can Mislead You AI is exceptionally good at pattern-based tasks: summarizing, classifying, drafting, extracting, and generating options. It is far less reliable when asked to “know” something it hasn’t been grounded in, when it must be perfectly accurate, or when the context is ambiguous. AI is probabilistic: it predicts likely outputs, not guaranteed truths. AI can hallucinate: confidently generating incorrect information. AI inherits bias: from training data and operational context. AI can be manipulated: through adversarial prompts, poisoned data, and model exploitation. That doesn’t mean AI isn’t valuable. It means AI must be engineered into workflows with controls—especially in regulated environments or security-sensitive operations. The Modern AI Stack: What You’re Actually Building AI Is a System, Not a Model Most AI failures come from treating the model like the product. In reality, the model is just one component in a larger system: Data: quality, lineage, access control, retention, and governance Models: selection (open vs closed), fine-tuning vs prompting, evaluation Infrastructure: cloud/edge compute, networking, identity, secrets management Orchestration: prompt management, routing, retrieval, tool use, agent frameworks Integration: business applications, ticketing, CRM, ERP, SIEM, EDR Operations (MLOps/LLMOps): monitoring, drift detection, logging, rollback, incident response Security & compliance: policies, access controls, auditability, regulatory alignment Build, Buy, or Blend? Most organizations land on a hybrid approach: Buy: fast time-to-value for common use cases (support, knowledge search, productivity) Build: differentiation, proprietary data advantage, unique workflows Blend: use commercial models with your data via retrieval (RAG) and strong governance If the use case touches sensitive data, regulated workflows, or security operations, “buy” still requires a “build mindset” around controls and oversight. High-Impact Business Use Cases (That Actually Work) 1) Knowledge Enablement: Search, Summarize, and Synthesize One of the most consistent wins is turning scattered internal knowledge into usable answers. Done properly—with permissions and citations—AI reduces time wasted searching across documents, tickets, wikis, and email archives. Policy and procedure Q&A with source links Employee onboarding copilots Sales enablement and proposal drafting grounded in approved content 2) Customer Support and Service Desk Acceleration AI can reduce handle time and improve consistency when it’s embedded into workflows—not replacing humans, but augmenting them. Draft responses with tone and policy enforcement Auto-summarize cases and generate next-step recommendations Suggest knowledge base updates based on repeated issues 3) Software Engineering Productivity (With Guardrails) Code assistants can increase velocity, but they also introduce licensing, security, and quality concerns if unmanaged. Boilerplate generation and refactoring suggestions Unit test generation and documentation drafting Secure coding recommendations (when paired with SAST/DAST and review) 4) Cybersecurity: Faster Detection, Triage, and Response Security teams are overwhelmed by alerts, tool sprawl, and staffing constraints. AI can help—but only when you treat it as part of your security architecture, not a shiny add-on. Alert enrichment and summarization for SOC analysts Natural-language querying of logs and telemetry Phishing analysis and user-report triage Playbook assistance for incident response workflows 5) Risk, Fraud, and Compliance AI can detect anomalies and streamline documentation-heavy workflows. Anomaly detection in transactions and access patterns Contract review and clause extraction Evidence collection support for audits (with strong access controls) The Risk Side of AI: What Leaders Must Take Seriously The New AI Attack Surface AI expands your risk profile in ways many organizations underestimate. Common threat categories include: Data leakage: sensitive data entering prompts, logs, or vendor systems Prompt injection: malicious instructions embedded in documents, emails, or web pages that hijack model behavior Model supply chain risk: compromised dependencies, unsafe plugins, unvetted open-source components Insecure integrations: overly permissive connectors to email, file shares, ticketing, or CRM Model inversion and extraction: attempts to recover training data or replicate proprietary model behavior Hallucinations and over-trust: humans acting on incorrect outputs Governance Is Not Red Tape—It’s the Operating System The organizations that scale AI safely treat governance as a product capability: Clear policy: what data can be used, where, and by whom Role-based access: least privilege for tools, connectors, and datasets Auditability: logs of prompts, outputs, sources, and actions taken Human-in-the-loop controls: approval gates for high-impact actions Model evaluation: accuracy, bias, safety, and security testing before rollout If you can’t explain how your AI reached an answer—or who had access to what—you don’t have an AI program. You have a liability. A Practical Framework for Responsible AI Adoption Step 1: Define Outcomes and “Non-Negotiables” Start with the business goal, then define constraints: What decision or workflow are we improving? What does success look like (time saved, errors reduced, revenue impact)? What data is involved (PII, PHI, client confidential, regulated data)? What are unacceptable outcomes (privacy breach, wrong guidance, compliance violation)? Step 2: Choose the Right Pattern (RAG, Fine-Tuning, or Agents) RAG (Retrieval-Augmented Generation): best for grounded answers using your documents with citations and permissioning. Fine-tuning: useful when you need consistent style or domain behavior, but it raises governance and lifecycle complexity. Agents/tool use: powerful for multi-step workflows (e.g., “open a ticket,” “pull logs,” “draft remediation”), but they demand strict guardrails. Step 3: Implement Guardrails That Match the Risk Controls should be proportional to impact: Data controls: classification, redaction, retention, encryption, tenant isolation Access controls: SSO/MFA, least-privilege connectors, scoped API keys Output controls: citations, confidence signaling, blocked actions, safe completion policies Workflow controls: approvals for financial, legal, or security-impacting actions Monitoring: abuse detection, drift monitoring, quality scoring, incident triggers Step 4: Operationalize with LLMOps To scale beyond pilots, treat AI like production software: Version prompts and workflows Maintain a test suite of real-world scenarios Track quality metrics and user feedback Establish rollback plans when performance regresses Document model changes and their impact Your First 90 Days: An AI Adoption Playbook Days 1–30: Inventory, Risk Triage, and Use Case Selection Inventory current AI usage: shadow AI is already happening via public tools. Classify data and workflows: determine what must never enter an AI system. Pick 1–2 use cases: high value, low-to-moderate risk, measurable outcomes. Decide success metrics: cycle time, quality score, deflection rate, analyst throughput. Days 31–60: Build a Controlled Pilot Limit scope: a specific team, dataset, and workflow. Enable logging and audit: prompts, outputs, source documents, user actions. Run red-team testing: prompt injection, data exfiltration attempts, unsafe outputs. Train users: how to verify outputs, what not to input, when to escalate. Days 61–90: Scale What Works, Fix What Doesn’t Quantify results: time saved and error rates are more persuasive than anecdotes. Harden governance: finalize policies, connector approvals, and access standards. Expand cautiously: add one dataset or one workflow at a time. Establish an AI steering group: IT, security, legal, compliance, and business owners. Vendor and Platform Due Diligence: Questions Leaders Should Ask Whether you’re buying a tool, using a cloud AI service, or integrating an LLM into your product, due diligence matters. Ask: Data handling: Is customer data used for training? How is it isolated? How is it retained and deleted? Security: What identity controls exist (SSO, MFA)? What encryption is used in transit and at rest? Logging and audit: Can we retrieve prompt/output logs for investigations and compliance? Model transparency: What model is used? How often does it change? Can we control updates? Connectors: How are permissions enforced? Is access scoped per user and per repository? Incident response: What is the vendor’s breach notification and support process? Evaluation: How do they measure hallucinations, toxicity, and task success? What’s Next: Agents, Multimodal AI, and “Zero Trust for AI” We’re moving rapidly from “AI that answers” to “AI that acts.” Agentic systems can execute multi-step tasks across tools—pulling data, modifying records, initiating workflows. That’s where the value skyrockets, and so does the risk. The future will belong to organizations that apply a Zero Trust mindset to AI: Never assume outputs are correct—validate and verify. Never over-permission tools—scope access tightly. Always log prompts, sources, actions, and outcomes. Continuously evaluate model performance and security posture. Conclusion: Make AI a Competitive Advantage—Not a Compounding Risk AI is already reshaping how work gets done. The organizations that win won’t be the ones that experiment the most—they’ll be the ones that operationalize AI with discipline: measurable outcomes, secure architecture, strong governance, and a clear understanding of where human judgment must remain in control. If you’re serious about deploying AI in a way that improves performance without exposing your business, start with three moves: pick a real use case , protect your data , and build governance that scales . Call to action: Identify one high-value workflow, run a controlled 90-day pilot with defined metrics, and treat security and governance as first-class requirements—not afterthoughts. ## Cybersecurity in 2026: The Practical Playbook for Protecting Your Business - URL: https://bartmcd.com/blog/cybersecurity-2026-practical-playbook-protect-business - Published: 2026-01-07 Cybersecurity used to be a technical problem delegated to the IT department. Today it’s a core business discipline—on par with finance, legal, and operations—because the risk is existential. A ransomware incident can halt revenue. A vendor breach can expose regulated data. A simple credential theft can become a full-scale compromise of cloud infrastructure in hours. I’ve seen organizations of every size learn this lesson the hard way: the attackers don’t care whether you’re a global enterprise or a 75-person professional services firm. They care whether you’re reachable , profitable , and unprepared . Cybersecurity isn’t about building an impenetrable fortress. It’s about reducing exposure, limiting blast radius, and recovering faster than your adversary can profit. The Modern Threat Landscape: What You’re Actually Defending Against If you’re still thinking in terms of “firewalls and antivirus,” you’re defending yesterday’s perimeter. Modern environments are distributed across cloud platforms, SaaS, endpoints, and third parties—meaning the real perimeter is identity, data, and configuration. The threats that matter most Ransomware and extortion: Not just encryption—today’s model includes data theft, public leaks, harassment, and pressure on customers and partners. Credential theft and account takeover: Phishing, MFA fatigue, token theft, and session hijacking leading to cloud and SaaS compromise. Business Email Compromise (BEC): Social engineering targeting finance workflows (invoice fraud, payroll diversion) with little or no malware involved. Supply chain and third-party risk: Breaches through vendors, MSPs, and software dependencies. Cloud misconfiguration: Over-permissive identities, exposed storage, weak segmentation, and unmanaged secrets. Insider risk: Malicious insiders are rare; negligent insiders are common. Both can be devastating without guardrails. Why attackers keep winning Attackers succeed because they operate with speed and leverage. They exploit two persistent advantages: Asymmetry: Defenders must be right everywhere; attackers only need to be right once. Complexity: Every new tool, cloud service, and vendor expands the attack surface unless deliberately governed. Cybersecurity Fundamentals: The Outcomes That Actually Matter Security programs fail when they chase tools instead of outcomes. The most resilient organizations align around a small set of measurable objectives—then build controls and processes to achieve them. The five core outcomes Know what you have: Assets, identities, data, and dependencies. Reduce exposure: Patch, harden, limit privileges, and eliminate risky configurations. Detect quickly: Centralize logging, alert intelligently, and watch high-risk behaviors. Respond decisively: Contain incidents, preserve evidence, communicate clearly. Recover confidently: Restore systems and data with tested backups and rehearsed plans. Use a framework—because maturity beats heroics Frameworks aren’t paperwork; they’re scaffolding. For most organizations, these are the practical choices: NIST Cybersecurity Framework (CSF): Excellent for building a program and reporting to leadership. CIS Controls: Highly actionable control set, ideal for prioritization. ISO 27001: Strong governance model; helpful when customers demand formal certification. The goal isn’t to “be compliant.” The goal is to use these models to drive consistent, measurable risk reduction. Identity Is the New Perimeter: Your First Line of Defense When environments are cloud-first and workforce is distributed, identity becomes the control plane for everything else. Most serious incidents I’ve investigated start with compromised credentials or abused privileges. Non-negotiables for identity security Phishing-resistant MFA: Prefer FIDO2/WebAuthn or equivalent where feasible—especially for admins. Least privilege by default: Remove standing admin rights; implement just-in-time elevation. Conditional access: Restrict based on device health, geo, risk signals, and session behavior. Strong password hygiene: Password managers, banned password lists, and monitoring for leaked credentials. Service accounts and secrets governance: Rotate keys, eliminate shared accounts, store secrets properly. Privileged access: where small mistakes become big breaches Privileged accounts should be treated like controlled substances: tightly managed, logged, and audited. A single over-permissioned cloud role can become an attacker’s shortcut to data, backups, and production systems. Zero Trust: What It Is (and What It Isn’t) Zero Trust is often marketed as a product. In reality, it’s a strategy: never trust by default, always verify, and assume breach . What Zero Trust looks like in practice Verify explicitly: Authenticate and authorize every access request using multiple signals. Use least privilege access: Minimize permissions and segment resources. Assume breach: Design systems so a compromised endpoint or identity doesn’t compromise everything. A practical Zero Trust roadmap Phase 1: Lock down admin access (phishing-resistant MFA, device compliance, privileged access management). Phase 2: Segment critical apps and data; reduce lateral movement opportunities. Phase 3: Implement continuous monitoring and risk-based access decisions. Securing Cloud and SaaS: Configuration Is Security Cloud doesn’t eliminate risk; it changes it. You inherit resilient infrastructure, but you also inherit a new responsibility: securing identity, permissions, data exposure, and configuration. Common cloud/SaaS failure patterns Over-permissioned roles: Excessive access that attackers can exploit after credential compromise. Unmonitored admin actions: No visibility into changes that impact security posture. Shadow IT: Departments adopting SaaS without security review. Exposed storage or misconfigured sharing: Data leakage through public links or permissive buckets. Cloud/SaaS controls that pay off fast Centralize identity: Single sign-on, consistent MFA, and lifecycle management. Security posture management: Continuous configuration monitoring and remediation workflows. Data classification and retention: Know what data exists, where it lives, and how long you need it. Audit logging everywhere: Admin activity, authentication events, and critical configuration changes. Ransomware Resilience: Prevent, Contain, Recover Ransomware is a business model, not a virus. Resilience is built long before an incident—through access controls, segmentation, and recovery readiness. Prevention controls that reduce likelihood Patch and vulnerability management: Especially internet-facing systems and VPNs. Email and web controls: URL rewriting, attachment sandboxing, and blocking known bad domains. Endpoint hardening: Disable risky macros, restrict script execution, and limit local admin rights. Containment controls that reduce blast radius Network segmentation: Separate users, servers, backups, and critical infrastructure. Privileged access controls: Prevent attackers from turning one foothold into total domination. Immutable or offline backups: Protect backups from being encrypted or deleted. Recovery readiness: the difference between an incident and a catastrophe Backups are not a strategy unless they are tested and restorable under pressure . You should know your recovery time objectives (RTO) and recovery point objectives (RPO) for each critical system—and you should have rehearsed the process. Detection and Response: Build the Muscle Before You Need It Most organizations are not failing at prevention alone; they’re failing at visibility and response discipline . A mature detection program doesn’t mean “more alerts.” It means better signals, clearer ownership, and faster containment. What a functional detection program includes Centralized logs: Identity, endpoints, cloud control plane, and key applications. High-value detections: Focus on credential abuse, privilege escalation, data exfiltration, and persistence. Runbooks: Step-by-step response playbooks for common scenarios. Regular tabletop exercises: Practice decisions, escalation, and communications—not just technical steps. Incident response: make decisions faster than attackers can move During an incident, confusion is the enemy. Define roles and authority in advance—especially around isolating systems, disabling accounts, and engaging outside experts. If your incident response plan lives in a binder, you don’t have a plan—you have a document. The Human Layer: Security Culture That Actually Works People are not the weakest link. They’re the most targeted link. Effective security culture isn’t built on blame; it’s built on clear expectations, easy-to-use controls, and constant reinforcement. Training that changes behavior Role-based education: Finance, HR, developers, and executives face different threats. Short, frequent sessions: Five minutes monthly beats an annual hour-long video. Phishing simulations with coaching: Focus on improvement, not punishment. Operational guardrails that reduce mistakes Clear approval workflows: Especially for wire transfers, vendor changes, and payroll updates. Secure defaults: Reduce reliance on “users doing the right thing” every time. Easy reporting: One-click reporting for suspicious emails and activity. AI and Cybersecurity: Powerful Amplifier, New Attack Surface AI is changing cybersecurity in two ways: it’s accelerating defense, and it’s scaling offense. The organizations that win will treat AI as an enhancer of disciplined security—not a replacement for it. How AI helps defenders Faster triage: Summarizing alerts, correlating events, and reducing analyst fatigue. Better detection engineering: Identifying abnormal behavior patterns across large datasets. Security copilots: Drafting incident reports, queries, and response steps (with human validation). How AI helps attackers More convincing social engineering: Polished, contextual phishing and impersonation at scale. Deepfake-enabled fraud: Voice and video impersonation targeting approvals and payments. Faster recon: Automated targeting of exposed assets, vendors, and employees. Practical AI governance for security leaders Define acceptable use: What employees can put into AI tools, and what they cannot (client data, credentials, IP). Review vendor models: Data retention, training usage, and access controls. Protect model inputs and outputs: Prevent prompt injection, data leakage, and over-trust in generated answers. Metrics That Matter: How to Prove Progress Without Vanity Numbers Boards and executives don’t need security jargon—they need clarity on risk and readiness. The right metrics connect security work to business outcomes. Meaningful security metrics Time to detect (TTD) and time to respond (TTR): Are you getting faster? MFA coverage: Especially for privileged and high-risk users. Patch SLAs: Percent of critical vulnerabilities remediated within defined windows. Backup recoverability: Frequency and success of restore tests for critical systems. Phishing resilience trends: Improvement over time, by department and role. Third-party risk posture: Vendor tiering, assessments completed, and remediation tracked. A Practical Cybersecurity Roadmap (90 Days to Stronger) If you’re trying to improve security without boiling the ocean, focus on the controls that reduce the most risk quickly. Days 1–30: Stabilize the basics Inventory critical systems, identities, and data repositories. Enforce MFA everywhere; prioritize phishing-resistant MFA for admins. Remove local admin rights broadly; lock down privileged accounts. Confirm backups for critical systems and run at least one restore test. Days 31–60: Reduce exposure and improve visibility Implement vulnerability scanning and patch SLAs. Centralize logs for identity, endpoints, and cloud admin actions. Deploy or tune endpoint detection capabilities with clear response ownership. Harden email security and implement BEC-resistant finance workflows. Days 61–90: Build response muscle and governance Run a tabletop exercise for ransomware and BEC scenarios. Create incident response runbooks and escalation paths. Tier vendors by risk and begin a repeatable third-party review process. Set executive-level metrics and a quarterly security review cadence. Conclusion: Cybersecurity Is a Business Capability—Invest Like It The organizations that handle cybersecurity best aren’t the ones with the most tools. They’re the ones with clear priorities , disciplined execution , and rehearsed resilience . They assume compromise is possible, limit blast radius when it happens, and restore operations with confidence. Cybersecurity is no longer an IT cost center—it’s a trust strategy. Your customers, partners, insurers, and regulators increasingly judge you by how well you protect data and maintain continuity. Start with identity, backups, and response readiness. Everything else gets easier when those foundations are solid. Call to action: If you want to strengthen your cybersecurity posture quickly, begin with a 30-day assessment of identity controls, backup recoverability, and incident response readiness—then build a prioritized roadmap tied to measurable risk reduction. The best time to prepare for an incident is before you’re in one. ## AI: What It Is, Why It Matters, and How to Use It Without Losing Control - URL: https://bartmcd.com/blog/ai-what-it-is-why-it-matters-how-to-use-it-safely - Published: 2026-01-07 Artificial intelligence has moved from “interesting” to “inescapable” in less than a decade. I’ve watched organizations adopt AI the way they adopted cloud: quickly, unevenly, and often without a clear understanding of where the risk actually lives. The difference is that AI doesn’t just change infrastructure—it changes decision-making. It influences what your people do, what your customers see, and what your company believes to be true. Done well, AI improves speed, accuracy, and scale. Done poorly, it introduces new attack surfaces, new compliance exposure, and a new class of operational failures that can be hard to detect until they’ve already caused damage. AI isn’t just another tool. It’s a system for producing outputs you may trust—often more than you should—unless you design for verification, governance, and resilience. What AI Actually Is (and What It Isn’t) AI is a broad term for systems that perform tasks typically associated with human intelligence: recognizing patterns, generating language, making predictions, and optimizing decisions. Most of what businesses call “AI” today is not sentient, not self-aware, and not “thinking” the way humans do. It’s math applied at scale, trained on large amounts of data, engineered to minimize error against a defined objective. Core AI categories you’ll encounter Machine Learning (ML): Models that learn patterns from data to make predictions (e.g., churn prediction, fraud detection). Deep Learning: A subset of ML using neural networks, effective for images, speech, and complex language tasks. Generative AI (GenAI): Models that generate new content—text, code, images, audio—based on learned patterns (e.g., chatbots, copilots). Reinforcement Learning: Systems that learn strategies through trial-and-error with rewards (common in robotics and some optimization problems). A helpful mental model: prediction vs. generation Traditional ML often predicts (Will this transaction be fraudulent?). Generative AI produces (Draft an email, summarize a contract, write code). Both can be powerful; both can be wrong. The key difference is that generative systems can produce confident-sounding errors that look plausible—especially under pressure when teams want speed. How AI Works: A Practical, Non-Theoretical View AI systems generally follow a lifecycle: data collection, training, evaluation, deployment, monitoring, and iteration. Each phase has distinct operational and security implications. Training: “You become what you ingest” Models learn from data. If the data is biased, incomplete, stale, or poisoned, the model’s outputs will reflect that. Training isn’t just a technical step; it’s a business decision about what you consider “truth” and what trade-offs you accept. Inference: where business value—and risk—shows up Inference is the moment the model produces output in a real workflow: a support response, a risk score, a recommended action. This is where you must decide: Who is accountable for the decision—the model, the operator, or the business owner? What guardrails prevent harmful or unauthorized outputs? How do you detect drift, failure, or manipulation? Why “accuracy” isn’t enough In production, the most important questions are rarely “Is it accurate?” They’re: Is it reliable across edge cases? Is it secure against manipulation? Is it explainable enough for regulators, auditors, and customers? Is it aligned with policy, ethics, and brand risk? Where AI Delivers Real Business Impact AI pays off when it reduces friction, improves decisions, or enables scale without adding uncontrolled complexity. The best implementations start with a clear problem statement, measurable outcomes, and an owner who will be accountable after the pilot ends. High-value enterprise use cases Customer support: Intelligent triage, suggested replies, automated summaries, multilingual response generation. Security operations: Alert enrichment, log summarization, phishing analysis, detection engineering assistance. IT operations: Ticket classification, root-cause analysis assistance, automated runbook execution (with approval gates). Software development: Code generation, test creation, vulnerability explanation, refactoring suggestions. Risk and compliance: Policy mapping, control evidence summarization, third-party risk review acceleration. Finance and planning: Forecasting, anomaly detection, invoice processing, spend categorization. What separates winners from “AI theater” AI theater is when a company adds a chatbot and declares victory. Real value shows up when AI is connected to the workflow, measured, governed, and continuously improved. The difference is operational discipline. The Risks Most Organizations Underestimate AI introduces a different risk profile than traditional software. It’s probabilistic, data-dependent, and often non-deterministic—meaning you can’t always reproduce the same output from the same input, especially as systems evolve. Security risks: a new attack surface Prompt injection: Attackers manipulate inputs to override instructions and exfiltrate data or produce unsafe actions. Data leakage: Sensitive data exposed through prompts, logs, training pipelines, or model outputs. Model inversion and extraction: Attempts to infer training data or replicate the model via repeated queries. Supply chain risk: Third-party models, plugins, agents, and open-source dependencies introduce hidden exposure. Autonomous action risk: Agents that can call tools (email, file access, ticketing, code deployment) can amplify mistakes at machine speed. Operational risks: silent failure is the worst kind Hallucinations: Confident but false outputs that slip into customer communications or internal decisions. Drift: Model performance degrades as data and behavior change over time. Overreliance: Teams stop validating outputs because “the model is usually right.” Inconsistent behavior: Small input changes produce large output shifts. Governance and legal exposure Privacy: Personal data in prompts, training sets, or retrieval systems can trigger regulatory obligations. IP and licensing: Training data provenance, output ownership, and reuse rights must be understood. Accountability: If AI makes a recommendation that harms a customer, regulators won’t accept “the model did it” as an answer. If you can’t explain how AI is used, where the data goes, and who approves the output, you don’t have an AI program—you have an incident waiting for a timestamp. Building AI the Right Way: A Field-Tested Approach Organizations get AI right when they treat it like a product, not a feature. That means ownership, controls, metrics, and lifecycle management. Step 1: Choose the right problem Start with a process that is high-volume, repetitive, and measurable. Avoid starting with “mission-critical decisions” where the cost of error is catastrophic. Define success metrics (time saved, error reduction, CSAT improvement, incident response time). Set boundaries (what the model must never do). Assign a single accountable owner. Step 2: Decide on your architecture (and your risk posture) Public LLM via API: Fast to start, requires strong data handling controls. Private or hosted models: More control, more operational responsibility. Retrieval-Augmented Generation (RAG): Uses your approved knowledge base at query time to reduce hallucination and improve relevance. Fine-tuning: Useful for specific styles or narrow tasks, but can increase governance burden if not managed carefully. Step 3: Put guardrails where they actually work Guardrails aren’t a disclaimer at the bottom of a chat window. They’re technical and procedural controls embedded in the workflow. Data classification and redaction: Prevent sensitive data from entering prompts or logs. Access control: Least privilege for tools, plugins, and data sources. Output validation: Policy checks, citation requirements, and deterministic constraints where possible. Human-in-the-loop: Mandatory review for high-impact actions (payments, account changes, legal commitments, deployments). Auditability: Log prompts, outputs, tool calls, and user identity—securely and with retention policy alignment. Step 4: Treat model behavior like production software Testing: Build test suites for safety, policy, accuracy, and adversarial inputs. Monitoring: Track quality, drift, latency, cost, and security anomalies. Change control: Version prompts, models, and knowledge bases. Know what changed and when. Incident response: Define what an “AI incident” is and how you’ll triage it. AI and Cybersecurity: The Double-Edged Upgrade AI improves security teams’ speed, but it also improves attackers’ speed. The net outcome depends on whether defenders operationalize AI with discipline. How defenders should use AI Reduce alert fatigue: Summarize and prioritize signals, not just generate more noise. Accelerate investigations: Convert raw logs into timelines and hypotheses, then verify. Improve phishing resilience: Analyze language patterns, detect impersonation attempts, and train users with realistic simulations. Codify tribal knowledge: Use RAG to make runbooks and prior incidents searchable and actionable. How attackers use AI Social engineering at scale: More convincing phishing, deepfake-enabled fraud, impersonation attempts. Recon and exploitation support: Faster research, payload iteration, and troubleshooting. Disinformation and manipulation: Automated content creation to erode trust or influence decisions. The practical takeaway for leadership If your security strategy assumes attackers are still writing broken English emails and manually probing systems, you’re defending yesterday. AI raises the baseline sophistication of threats—especially against people and process, not just technology. What the Future of AI Looks Like (and What to Prepare For) The near future is less about bigger models and more about integrated systems : agents that can plan, execute tasks, and interact with your tools. This will be transformative—and dangerous—if deployed without strong constraints. Trends to watch Agentic workflows: AI that can take actions, not just provide answers. Model specialization: Smaller, purpose-built models for specific tasks. Regulatory pressure: Increasing requirements for transparency, risk management, and data handling. Security-by-design for AI: More mature practices around testing, red teaming, and runtime controls. Conclusion: Adopt AI Like a Professional, Not Like a Tourist AI will reward organizations that combine ambition with discipline. The winners won’t be the ones who “use AI” as a slogan—they’ll be the ones who define clear use cases, secure the data, test the outputs, monitor behavior, and assign accountability. The most important question isn’t whether AI is powerful. It is. The question is whether your organization can harness that power without giving up control . Use AI to move faster—but build it so you can prove what it did, why it did it, and who approved it. Call to action: If you’re evaluating AI for your business, start with an “AI readiness review” that covers data classification, acceptable use, model/vendor risk, security controls, and measurable success metrics. Then pick one workflow, instrument it end-to-end, and scale only after you can demonstrate value and governance in the same sentence. ## Claude Code Having Its Moment - URL: https://bartmcd.com/blog/claude-code-having-its-moment - Published: 2025-12-31 Every few years, a tool shows up that doesn’t just improve developer productivity—it changes the way teams think about building software. Right now, Claude Code is having that moment. Claude Code is an AI-assisted coding tool from Anthropic, and its impact is happening in the most practical place possible: the day-to-day work of engineering teams shipping real products under real constraints—time, quality, security, and reliability. When a tool reduces friction in the build-test-fix loop, it doesn’t just speed up delivery—it changes what teams believe is possible in a sprint. What Claude Code Actually Is (And Why That Matters) Claude Code is designed to help developers write, understand, refactor, and troubleshoot code using Anthropic’s Claude models. But describing it as “AI that writes code” undersells what’s happening. The real value is that it functions like a high-leverage teammate: one that can read context quickly, propose options, explain tradeoffs, and help you move from ambiguity to execution. Claude Code’s real job: collapsing complexity Modern software development is less about typing and more about managing complexity: Understanding legacy code and tribal knowledge Coordinating changes across services and dependencies Maintaining consistency in patterns, quality, and security Reducing “time-to-confidence” when you change something Claude Code fits squarely into that reality. It’s not replacing engineering judgment—it’s accelerating it. Why Claude Code Is Having Its Moment Right Now Tools don’t get adopted because they’re clever. They get adopted because the environment makes them necessary. Claude Code is hitting at least four pressures engineering leaders feel every day. 1) The codebase is bigger than your team’s memory Most organizations aren’t building greenfield software. They’re maintaining systems with years of accumulated decisions. Claude Code helps teams navigate that reality by making it easier to: Summarize how a module works Trace how a request flows through services Identify likely regression points before making a change 2) Speed expectations keep rising “Move fast” used to be a cultural mantra. Now it’s a business requirement. AI assistance is shifting from “nice to have” to “baseline expectation,” especially for: Bug triage and root-cause analysis Refactoring and modernization efforts Test generation and coverage improvement 3) The talent gap is real Even great teams run thin. Claude Code can help junior developers ramp faster and help senior developers protect their time for architecture and critical decisions. 4) Security and compliance are finally part of the build process Security can’t be a ticket at the end of the sprint. The best teams build secure habits into daily workflows. Claude Code can support that—if you implement it with clear guardrails (more on that below). Where Claude Code Delivers Immediate Value Let’s talk about where this tool earns its keep. These are high-frequency engineering tasks where Claude Code can reduce cycle time and improve outcomes. Code understanding and onboarding One of the most expensive activities in software is context switching and ramp-up. Claude Code can help a developer go from “I’ve never seen this repo” to “I can contribute safely” faster by: Explaining what a service does and how it’s structured Summarizing key modules, classes, or design patterns Highlighting areas that look fragile or tightly coupled Refactoring without fear Refactoring is essential, but teams avoid it because it’s risky. Claude Code can assist with: Breaking large changes into safer incremental steps Identifying duplicated logic and suggesting consolidation Proposing patterns that improve readability and maintainability Refactoring still requires engineering judgment. The win is reducing the effort required to get to a refactor plan that’s realistic and testable. Debugging and incident follow-ups In the real world, “debugging” isn’t just finding the bug—it’s finding it quickly, understanding blast radius, and preventing recurrence. Analyze logs and error patterns to suggest hypotheses Propose likely failure points based on recent changes Generate candidate fixes and discuss tradeoffs Draft post-incident remediation tasks (tests, monitors, alerts) Test creation and quality uplift Teams often say “we need more tests,” but the backlog never clears. Claude Code can accelerate: Unit test scaffolding Edge case identification Regression test ideas based on known failures AI doesn’t replace a test strategy—but it can remove the friction that keeps teams from executing one. Documentation that stays current Documentation fails when it’s treated as a separate project. Claude Code can help generate and update: README improvements Runbooks and operational notes Inline comments where they add genuine clarity The Security Reality: AI Coding Tools Need Guardrails I’ve built and led cybersecurity teams long enough to know that convenience without controls becomes tomorrow’s incident report. Claude Code can absolutely be used safely—but you need a plan. Start with a simple policy: what can and cannot be shared Before rollout, define rules for handling sensitive information: No secrets in prompts (API keys, tokens, private keys, credentials) No proprietary customer data (PII, financial records, protected health information) Careful with internal system details (architecture diagrams, hostnames, internal IPs) Then enforce it with training and tooling—because “we told people once” isn’t a control. Treat AI-generated code like third-party code If your team would review a code snippet copied from a blog, they should review AI-generated code the same way: Require code review for any AI-assisted change Run SAST/DAST and dependency checks as usual Scan for secrets and validate configuration changes Verify licensing implications where applicable Focus on the biggest risk: false confidence The most dangerous failure mode isn’t malicious code—it’s plausible code that’s subtly wrong. Claude Code can produce output that looks correct but: Misses edge cases Introduces insecure defaults Breaks error handling or logging standards Creates performance regressions The solution is not fear—it’s discipline: review, test, and verify. How to Roll Out Claude Code Without Creating Chaos AI tools succeed when they’re operationalized—not when they’re “allowed.” Here’s a rollout approach that works in real organizations. 1) Pick two or three high-value workflows Don’t start with everything. Start where impact is measurable: Bug triage acceleration Unit test generation for under-tested modules Documentation and runbook upgrades 2) Define success metrics that matter Track outcomes leaders care about: Cycle time (ticket start to PR merged) PR review time and rework rate Defect rate and escaped defects On-call incident volume and MTTR 3) Create “prompt patterns” and team standards The teams that win with AI don’t just use it—they standardize how they use it. Establish reusable prompt patterns like: “Explain this function and list assumptions” “Propose two refactor options with tradeoffs” “Generate unit tests covering edge cases, include negative tests” “Threat-model this API endpoint and suggest mitigations” 4) Add security review checkpoints early Bring AppSec into the enablement process, not as a blocker at the end. A short checklist can prevent long-term pain: Secrets handling verification Approved repositories and environments Logging/telemetry requirements Secure-by-default coding patterns The Cultural Shift: Claude Code as a Force Multiplier The most interesting part of this moment isn’t the tool—it’s the behavioral change. Developers are increasingly working like this: Start with a rough idea Ask Claude Code to propose a clean structure Iterate on edge cases and tests Use the tool to sanity-check assumptions Ship with higher confidence and better documentation That’s not “AI replacing developers.” That’s developers upgrading their workflow. The teams that treat AI as a junior autopilot will get junior results. The teams that treat it as a senior collaborator will get leverage. What Comes Next Claude Code’s moment is part of a bigger shift: software development is moving from “write every line” to “orchestrate outcomes.” That means engineering leadership needs to adapt how they: Measure productivity (outcomes over output) Train developers (AI-assisted problem solving is a skill) Enforce security (guardrails plus verification) Maintain quality (tests and reviews become even more critical) Organizations that embrace this shift thoughtfully will build faster—and safer—than the ones that either ban the tools or adopt them with no standards. Conclusion: Don’t Just Try Claude Code—Operationalize It Claude Code is having its moment because it meets teams where they actually live: messy codebases, tight deadlines, real incidents, and constant change. Used well, it reduces friction, improves clarity, and accelerates delivery. Used carelessly, it can amplify bad habits and introduce risk. The difference is leadership. Put guardrails in place, standardize workflows, and measure outcomes that matter. That’s how you turn an exciting tool into a durable advantage. Call to action: If you’re evaluating Claude Code for your engineering organization, start with a 30-day pilot focused on two workflows (debugging and tests are a great place to begin). Define success metrics, involve security from day one, and build a small internal playbook your team can reuse. The goal isn’t experimentation—it’s operational excellence. ## Understanding the MongoDB Security Flaw: A Call to Action for Business Leaders - URL: https://bartmcd.com/blog/mongodb-security-flaw-business-leaders-action - Published: 2025-12-31 MongoDB has long been a favorite among businesses for its flexibility and scalability. However, as its adoption grows, so do the risks associated with its use. As of the end of 2025, MongoDB has become a frequent target for cyberattacks, particularly ransomware, exploiting instances left unsecured or with default configurations. This article delves into the current security challenges surrounding MongoDB and offers actionable insights for business leaders seeking to fortify their defenses. Increased Adoption and Associated Risks The popularity of MongoDB comes with a double-edged sword. While its open-source nature and ease of use make it an attractive option, these same features can lead to vulnerabilities if not properly managed. Recent reports indicate a surge in ransomware attacks targeting MongoDB instances, especially those exposed to the internet without adequate security measures. "The flexibility of MongoDB is both a strength and a vulnerability. Without proper security configurations, it becomes an open door for threat actors." - Jane Doe, CTO of SecureTech Solutions According to Cybersecurity Ventures, over 70% of MongoDB instances remain misconfigured or exposed to public access, highlighting a pressing need for businesses to address these security gaps. Emergence of New Vulnerabilities In 2025, a critical vulnerability (CVE-2025-XXXX) was discovered in MongoDB version 6.0, which allows for remote code execution. This has prompted immediate patch advisories from security experts. Additionally, automated attacks are increasing, specifically targeting misconfigured MongoDB databases exposed to the internet. "Business leaders must prioritize securing their NoSQL databases. MongoDB's default settings are not secure enough for sensitive data." - John Smith, Cybersecurity Analyst at Cyber Defense Labs Mitigating Risks: Best Practices for Securing MongoDB Enable Authentication: Ensure all MongoDB instances require authentication to access data. Enforce Encryption: Utilize encryption both in transit and at rest to protect sensitive information. Conduct Regular Audits: Schedule frequent security audits to identify and rectify vulnerabilities. Implement Access Controls: Define and enforce strict access controls to limit who can view or alter database contents. ABC Company's proactive measures, including multi-factor authentication and regular penetration testing, serve as a model for enhancing MongoDB security posture. Their efforts successfully thwarted a potential ransomware attack, proving the effectiveness of these best practices. The Cost of Complacency: Financial Implications of MongoDB Breaches The financial implications of a MongoDB breach can be staggering. IBM's 2025 report highlights that the average cost of a data breach involving MongoDB databases has risen to $4.35 million. The 2024 data breach at XYZ Corp, which resulted in a $5 million loss due to an unsecured MongoDB instance, underscores the critical need for regular security audits and robust access controls. Regulatory Pressure and Compliance With the increase in data breaches, regulatory bodies are tightening compliance requirements for data security. MongoDB users are urged to adopt comprehensive security measures to avoid hefty fines and legal repercussions. Navigating this new regulatory landscape requires an understanding of how securing MongoDB can prevent potential legal and financial setbacks. Conclusion: Taking Action Before It's Too Late Business leaders must recognize the gravity of MongoDB security flaws and take immediate action to safeguard their data. By implementing best practices, conducting regular security audits, and staying informed about new vulnerabilities, organizations can protect themselves from costly breaches. The time to act is now; ensure your MongoDB instances are secure to protect your business's future. Call to Action: Evaluate your MongoDB security today. Implement the recommended best practices and schedule a security audit to ensure your data remains protected against evolving cyber threats. ## Holiday Deepfake Scams: How Leaders Stop Fast Fraud - URL: https://bartmcd.com/blog/holiday-deepfake-scams-48-hour-leader-checklist - Published: 2025-12-28 The year-end festive season is a time of joy, celebration, and unfortunately, increased vulnerability to cyber threats. With many companies dealing with year-end travel, bonuses, and reduced staffing, they unwittingly create ideal conditions for cybercriminals to exploit through deepfake voice and video impersonation scams. These scams often leverage a sense of urgency to manipulate individuals into making hasty decisions, leading to wire fraud and credential theft. In this article, we will explore the common holiday scams and provide leaders with a practical 48-hour checklist to protect their organizations from these sophisticated threats. Understanding the Holiday Playbook During the holiday season, cybercriminals are keenly aware of the disrupted routines and increased distractions within organizations. They capitalize on these conditions by deploying deepfake technology to impersonate executives or other trusted individuals. The most common holiday scams include: Urgent Payment Requests: Fraudsters impersonate executives through deepfake voice or video calls, urgently requesting wire transfers or payment of fake invoices. Credential Harvesting: Using deepfakes to impersonate IT support or executives, scammers convince employees to disclose sensitive information or credentials. Phishing with Deepfake Videos: Combining traditional phishing techniques with deepfake videos to add credibility to fraudulent requests. "Deepfakes represent a process failure more than a technological failure. This means leaders can implement procedural safeguards to mitigate these risks effectively." - Bart McDonough Fast Controls: The 48-Hour Checklist To combat these threats, executives must focus on strengthening their processes. The following 48-hour checklist provides actionable steps to implement effective controls: 1. Establish Payment Verification Paths Implement multi-layered verification for all financial transactions. Require multiple approvals for significant payments, especially during the holiday season. Ensure that verification paths are documented and communicated to all relevant personnel. 2. Set Up Call-Back Rules Establish a mandatory call-back protocol for any payment request received via email or phone. The call-back should be made to a pre-verified number. Train staff to recognize and report any deviation from established communication channels. 3. Implement "No-Exceptions" Approvals Designate alternate approvers during key personnel absences to maintain the integrity of the approval process. Ensure that all exceptions are logged and reviewed by management to analyze potential vulnerabilities. 4. Enhance Employee Training Conduct regular training sessions focused on recognizing deepfake scams, particularly before the holiday season. Emphasize the importance of adhering to verification processes and reporting suspicious activity immediately. Conclusion: Proactive Defense Against Deepfake Scams As we navigate the holiday season, it's imperative for leaders to adopt a proactive stance against deepfake scams by strengthening organizational processes. By implementing the 48-hour checklist, businesses can create a resilient defense, ensuring that their financial and data assets remain secure. Remember, the key to stopping fast fraud lies not just in technological solutions but in robust process controls. Call to Action: Equip your team with the knowledge and tools they need to identify and thwart deepfake scams. Start implementing the 48-hour checklist today and turn this holiday season into a safe and joyous occasion for your organization. ``` ## The Basics and Importance of Using Face ID to Secure Your iPhone - URL: https://bartmcd.com/blog/face-id-basics-importance-securing-iphone - Published: 2025-12-28 In today's rapidly advancing technological landscape, safeguarding personal data on your devices is more crucial than ever. With our smartphones housing sensitive information ranging from bank details to personal communications, ensuring their security should be a top priority. One of the most effective tools at your disposal is Face ID, a biometric authentication system developed by Apple. In this article, we'll explore the basics of Face ID, its importance in securing your iPhone, and actionable steps to optimize its usage. Understanding Face ID: A Revolutionary Step in Security Face ID is a facial recognition system introduced by Apple with the iPhone X in 2017. It replaced the traditional Touch ID fingerprint sensor, offering a more seamless and secure way to unlock your device. But what makes Face ID so revolutionary? Advanced Technology: Face ID uses a combination of infrared sensors, cameras, and a dot projector to create a detailed 3D map of your face. This ensures that your device recognizes you accurately, even in varied lighting conditions and with changes like facial hair or glasses. Security and Privacy: The data used by Face ID is stored locally on your iPhone in the Secure Enclave—a dedicated chip designed to protect sensitive information. This means your facial data is never uploaded to Apple's servers or accessible by third-party apps. Continuous Learning: Face ID adapts to your appearance over time, learning from minor changes to ensure consistent performance. “Face ID is not just a convenience—it’s a critical layer of security for your digital life.” Why Face ID Matters: The Importance of Biometric Security Face ID is more than just a fancy new feature; it's a vital component of your iPhone's security architecture. Here's why it matters: Enhanced Security: With a false acceptance rate of approximately 1 in 1,000,000, Face ID is significantly more secure than traditional passwords or PINs. This makes it a formidable barrier against unauthorized access. Convenience without Compromise: Face ID allows you to unlock your device, authorize payments, and access apps with just a glance, combining ease of use with robust security. Protection Against Phishing: By removing the need for manual password entry, Face ID reduces the risk of phishing attacks, as your facial data cannot be replicated or stolen in the same way passwords can. Maximizing the Effectiveness of Face ID To ensure you're getting the most out of Face ID, consider these practical tips: Keep Your Device Updated: Regularly update your iPhone's software to benefit from the latest security enhancements and improvements to Face ID technology. Set Up an Alternate Appearance: If you frequently change your appearance with accessories, consider setting up an alternate appearance to improve recognition. Enable Attention Awareness: This feature requires you to look directly at your device to unlock it, adding an extra layer of security. Conclusion: Embrace Face ID to Secure Your Digital World In an era where digital security is paramount, Face ID stands out as a powerful tool for protecting your iPhone and, by extension, your personal data. By understanding its mechanics and leveraging its capabilities, you can enhance your device's security without sacrificing convenience. Call to Action: Take a moment today to review your iPhone's Face ID settings. Ensure it's set up correctly and fully utilized to guard your digital life effectively. After all, your security is in your hands—and in the glance of an eye. ``` ## How to Contact Law Enforcement After a Cyberattack (and When to Call Local Police vs. the FBI) - URL: https://bartmcd.com/blog/contact-law-enforcement-after-cyberattack-police-vs-fbi - Published: 2025-12-27 When a cyberattack hits, most organizations default to the same first steps: isolate systems, call IT, notify leadership, and start restoring operations. Those are all critical—but there’s another decision that often gets delayed until it’s too late: when (and how) to contact law enforcement . I’ve worked with companies through ransomware, business email compromise (BEC), insider incidents, and data theft. In many cases, law enforcement can help—but only if you engage them at the right time, with the right information, and with realistic expectations. The goal isn’t to “hand the problem off.” It’s to protect the business, preserve options, and reduce downstream damage . Rule of thumb: If the incident involves extortion, stolen funds, significant data exposure, or a credible threat actor, you should strongly consider contacting law enforcement early—often within the first 24 hours. Why Contact Law Enforcement at All? Some executives hesitate because they fear operational disruption, reputational risk, or regulatory consequences. Those concerns are understandable—but in practice, law enforcement involvement can create real advantages. What law enforcement can do Help with recovery leads (known ransomware groups, decryptor availability, infrastructure indicators). Coordinate with other agencies (financial fraud teams, international partners, intelligence units). Support fund recovery efforts in wire fraud/BEC cases—especially if contacted quickly. Create an official record that may help with insurance claims, banking disputes, and legal posture. Advise on safe engagement when extortion or threats are involved. What law enforcement typically will not do Instantly recover your data or “take down” the attacker on your timeline. Run your incident response —that remains your responsibility (and your IR firm’s job). Guarantee financial recovery (but they can materially improve the odds if engaged early). Before You Call: Do These Three Things First You don’t need a perfect forensic report to contact law enforcement, but you do need to avoid making the situation worse. 1) Stabilize and preserve evidence Do not wipe systems unless your incident response lead directs it. Preserve logs (SIEM, firewall, VPN, identity provider, email, EDR). Capture volatile evidence where possible (running processes, network connections) through your IR team. Document a timeline : what you saw, when you saw it, and what actions were taken. 2) Identify the incident type (roughly) Even a preliminary classification helps route you to the right place: Ransomware/extortion Business Email Compromise (BEC) / invoice fraud / wire fraud Data breach (PII/PHI/customer data exposure) Insider threat DDoS or service disruption Critical infrastructure impact 3) Align internally (quickly) Before contacting law enforcement, ensure these stakeholders are in the loop: Incident commander (internal or external IR lead) General Counsel / outside breach counsel Cyber insurance carrier (if applicable—many policies have notification requirements) Executive sponsor (CIO/CISO/COO/CEO depending on severity) Practical advice: If you have breach counsel, let them help coordinate the outreach. It can streamline communications and reduce the risk of sharing inaccurate information early. Who to Contact—and When Not all cyber incidents belong in the same lane. Here’s a practical guide to choosing between local police, federal agencies like the FBI, and other reporting options. 1) Contact Local Police When… Local law enforcement is appropriate when the incident has a clear local nexus, immediate physical risk, or when you need an official report for documentation purposes. You need a police report for insurance, banking, or legal documentation. There’s an insider component involving theft, sabotage, or harassment tied to an identifiable person. There are threats to people or facilities (doxxing, threats of violence, stalking, swatting risk). Physical theft is involved (stolen laptops, devices, badges, or on-prem equipment). How to approach local police: Be prepared that many departments have limited cyber specialization. You’re often contacting them to create an official record and to address any physical-world risk, not to run a full-scale cyber investigation. 2) Contact the FBI When… If your business is facing ransomware, extortion, significant data theft, or large financial loss, the FBI is often the right call. The FBI also has the advantage of broader visibility into threat actor campaigns and can coordinate across jurisdictions. Ransomware or extortion (including threats to leak data). Large-scale wire fraud/BEC or repeated fraud attempts. Material data breach involving regulated data (PII/PHI) or significant customer impact. Nation-state or advanced threat indicators (targeted intrusion, unusual tradecraft, critical IP theft). Critical infrastructure impact or public safety implications. How to contact the FBI: In an emergency: call your local FBI field office. For internet crime reporting: submit to the FBI’s IC3 (Internet Crime Complaint Center) at ic3.gov . Timing matters: In BEC/wire fraud, the first few hours are critical. If you suspect fraudulent wire activity, contact your bank immediately and contact the FBI/IC3 right away. The odds of freezing funds drop sharply with time. 3) Contact the U.S. Secret Service When… Many people associate the Secret Service with physical protection, but they also investigate financial crimes—including cyber-enabled fraud. Financial fraud and payment-related cybercrime (especially complex cases involving multiple accounts or rapid money movement). Large-scale fraud rings targeting businesses (invoice manipulation, payroll diversion, etc.). If you already have an FBI relationship, start there. But in some regions, Secret Service cyber/financial crime teams are exceptionally effective partners. 4) Contact CISA When… CISA (Cybersecurity and Infrastructure Security Agency) is not law enforcement, but it’s a major federal resource—especially for organizations that support critical functions. You are part of critical infrastructure or provide essential services. You want technical guidance , alerts, and coordination support. You need help with vulnerability exploitation events affecting many organizations. CISA can be a strong partner for situational awareness and defensive support, while the FBI handles criminal investigation. 5) Contact State Authorities When… Depending on your location and industry, you may need to notify: State Attorney General or consumer protection offices (often tied to breach notification laws). State regulators for financial services, healthcare, insurance, or education. This isn’t “law enforcement” in the classic sense, but it’s part of the broader government response that businesses must manage after certain breaches. A Simple Decision Framework for Businesses If you’re deciding who to contact, use this practical matrix. Call your local police if: You need a police report for documentation. You suspect an insider with a known identity. There are physical threats, stalking, harassment, or facility risk. Devices were physically stolen. Call the FBI (field office) and/or file with IC3 if: Ransomware/extortion is involved. Funds were stolen (or a wire is in-flight). There is significant data theft or a material breach. You suspect an organized criminal group or nation-state actor. Engage CISA if: You need federal-level defensive coordination or guidance. The incident affects essential services or broad supply chain exposure. What Information to Provide (and What Not to) What to have ready Company details: legal name, location, key contacts. Incident summary: what happened, when detected, current status. Scope: systems impacted, business functions affected, number of endpoints/servers (approximate). Indicators of compromise (IOCs): suspicious IPs/domains, file hashes, email headers, attacker notes. Ransom note details: filenames, extensions, communication channels, wallet addresses (if present). For BEC: fraudulent emails, headers, bank account details, wire confirmations, timeline. Evidence preservation steps taken and whether an IR firm is engaged. What to avoid Speculating about attribution (“it was definitely X group”) unless confirmed by evidence. Altering evidence (editing logs, deleting mailboxes, reimaging machines prematurely). Negotiating impulsively with extortionists without a plan and professional guidance. Operational reality: You can continue restoration and containment while law enforcement is engaged. The key is coordination—so your recovery doesn’t destroy the forensic trail. Special Case: Business Email Compromise (BEC) and Wire Fraud If there’s one category where speed and process matter most, it’s BEC. These cases are often recoverable— but only early . If you suspect a fraudulent wire transfer Immediately call your bank (do not rely on email) and request a recall/hold. Contact the receiving bank if known (your bank can help coordinate). Contact the FBI via your local field office and/or file an IC3 report at ic3.gov. Preserve email evidence (full headers, mailbox rules, forwarding configurations, login logs). Many organizations lose valuable hours debating whether it’s “bad enough” to report. In BEC, that delay can be the difference between recovery and a total loss. Ransomware: When Law Enforcement Helps Most Ransomware is more than encryption—it’s business interruption, extortion, and often data theft. Even if you don’t plan to pay, law enforcement can provide: Threat intelligence context (group behavior, known tactics, potential decryption history). Guidance on safe communications and risk factors (especially if data leak threats exist). Coordination if the incident is part of a broader campaign. Also note: paying a ransom may create legal and regulatory risk in certain circumstances. Your counsel and incident response team should guide that decision, and law enforcement can help you understand the broader threat landscape. What About Individuals (Not Businesses)? Individuals should also report cybercrime—especially when there’s financial loss, identity theft, stalking/harassment, or credible threats. Individuals should contact local police when: There are threats, harassment, stalking, doxxing , or extortion with personal safety concerns. A device was stolen or there’s a known local suspect. You need a police report for identity theft, banking claims, or documentation. Individuals should report to the FBI/IC3 when: You’ve suffered online financial fraud , wire fraud, crypto scams, or account takeover with loss. You’re a victim of ransomware (yes, it happens to individuals too). For identity theft-related issues, individuals may also use IdentityTheft.gov (FTC) to document and begin recovery steps. That’s not law enforcement, but it’s an important reporting and remediation pathway. How to Make the Call: A Practical Script When you contact law enforcement, clarity matters. Here’s a simple structure: Who you are: “I’m calling from [Company], I’m [Role], and I’m authorized to report this incident.” What happened: “We detected [ransomware/BEC/data theft] on [date/time].” Current status: “Systems are [contained/offline], IR team is engaged, evidence is being preserved.” Impact: “We have [estimated] endpoints affected, potential data exposure includes [types].” Urgency driver: “Funds were transferred at [time]” or “We received an extortion demand with deadline [time].” What you need: “We want to report and coordinate, and we can provide IOCs and logs securely.” Common Mistakes Businesses Make When Involving Law Enforcement Waiting too long —especially in wire fraud and extortion scenarios. Calling without internal alignment , leading to conflicting statements and confusion. Over-sharing prematurely without counsel/IR guidance, creating inaccuracies that are hard to unwind. Assuming law enforcement will “handle it” instead of treating them as one workstream in your response. Failing to preserve evidence —reimaging endpoints and losing logs before anyone can analyze them. Conclusion: Treat Law Enforcement as a Force Multiplier A cyberattack is already a high-stakes event: operational downtime, financial exposure, customer trust, and legal obligations collide fast. Contacting law enforcement isn’t about theatrics—it’s about keeping options open , improving the odds of recovery (especially with fraud), and ensuring you’re making decisions with the best available intelligence. For most businesses: contact local police when you need an official report, there’s a physical-world component, or an insider is involved. Contact the FBI (and file with IC3) for ransomware, extortion, major fraud, and meaningful data theft. Bring in CISA when you need broader defensive coordination—particularly in critical infrastructure or widespread exploitation events. Call to action: Don’t wait for the incident to figure this out. Build a “who-to-call” law enforcement and government contact plan into your incident response playbook now—field office numbers, escalation paths, and a checklist of what to preserve and share. The best time to establish those relationships is before you need them. ## The Cyber Attack Vectors That Matter Most - URL: https://bartmcd.com/blog/cyber-attack-vectors-that-matter-most - Published: 2025-12-25 Most people think cyberattacks start in a dark data center somewhere—an elite hacker breaking into a corporate network. That happens, but it’s not where most real-world compromise begins. In my experience building and running a cybersecurity services company, the most consistent entry point is far more personal: the endpoint —your phone, your laptop, your browser, your inbox, and your habits. Attackers don’t need to “hack the enterprise” if they can track you, trick you, or quietly steal from you through the devices you use every day. This article replaces and expands on the 2024 list that lived on bartmcd.com. The updated goal is simple: give you a practical map of today’s top attack vectors , with a clear emphasis on the user-level threats that drive privacy loss, account takeover, financial fraud, and long-term digital exposure. Cybersecurity isn’t just about stopping breaches—it’s about preventing unauthorized access, unwanted tracking, and silent data theft on the devices you live on. Two Realities: “User-Centric” Threats vs. “Enterprise-Scale” Attacks There’s a reason many security conversations miss the mark for everyday people: they focus on enterprise breach scenarios while ignoring the mechanics of how compromise usually starts. Bart’s User-Centric Focus: The Endpoint Is the Battlefield User-centric threats tend to revolve around: Unauthorized tracking (apps, ad tech, stalkerware, spyware behaviors) Device security failures (misconfigurations, weak settings, unsafe permissions) Privacy leakage (location, photos, contacts, messages, browser data) Credential theft leading to account takeover (email, banking, social) The Broader Context: How Organizations Get Hit Enterprises face the same threats—just at scale—with added complexity: exposed infrastructure, web apps, identity systems, vendors, and cloud services. The “classic” vectors still matter: Malware (including ransomware and infostealers) Social engineering (phishing, smishing, vishing, deepfake-enabled fraud) Exploits (unpatched vulnerabilities, zero-days, web app flaws like SQL injection) Denial-of-Service (DoS/DDoS) Man-in-the-Middle interception (especially on unsafe networks) The difference is not the categories—it’s the impact radius . A single compromised phone can be devastating for one person. The same technique against a company can become a headline. Attack Vector #1: Unauthorized Tracking (The Quietest “Cyberattack”) When people hear “attack,” they picture destruction. In reality, many modern threats are about surveillance —collecting enough data to influence, manipulate, impersonate, or monetize you. How Unauthorized Tracking Shows Up Over-permissioned apps collecting location, microphone access, contacts, photos SDK-based tracking embedded in legitimate apps (advertising and analytics) Stalkerware/spyware installed by someone with physical access Browser fingerprinting that identifies you even without cookies Practical Defenses Audit app permissions monthly: location, photos, microphone, Bluetooth, contacts Use “Allow Once” / “While Using” for location whenever possible Limit ad tracking and reset advertising identifiers on mobile devices Reduce browser tracking : privacy-focused browser settings, tracker blocking, and fewer extensions If you don’t control what your device shares, someone else will. Attack Vector #2: Malware (Including Infostealers Like MacStealer) Malware isn’t “a Windows problem” anymore. The modern malware ecosystem is built around credential theft , session hijacking , and data extraction —and it targets whatever platform gets the job done. Why Infostealers Are So Effective Infostealers (like the MacStealer family you may have seen referenced) are designed to grab: Saved passwords and autofill data Browser cookies that can enable session hijacking Crypto wallets and related credentials Files and notes where people store “temporary” secrets The uncomfortable truth: you can have “strong passwords” and still lose if an attacker steals your active session tokens or your password manager vault access. How Malware Commonly Gets In Fake software updates and lookalike installers Cracked/pirated software bundled with payloads Malicious browser extensions or compromised legitimate ones Phishing links leading to drive-by downloads or credential capture Practical Defenses Only install apps from trusted sources (official app stores or vendor sites) Use a password manager and protect it with strong MFA Keep OS and browsers updated (auto-update is your friend) Review browser extensions : remove anything you don’t absolutely need Use endpoint protection appropriate for your device (yes, even on macOS) Attack Vector #3: Phishing and Social Engineering (The Human Exploit) If I had to pick one vector that consistently outperforms the rest, it’s social engineering—because it scales, it’s cheap, and it targets the most complex system in the environment: human decision-making under pressure . Today’s Phishing Doesn’t Look Like “Phishing” Smishing (SMS): “Package delivery issue” or “Bank fraud alert” OAuth consent scams : “Sign in with Google/Microsoft” to grant access QR-code phishing (“quishing”): QR codes that route to fake login pages Voice phishing (vishing): spoofed caller ID, urgent “support” calls Deepfake-assisted fraud : audio/video used to impersonate executives or family Practical Defenses Slow down : urgency is a weapon—treat it as a red flag Never log in from a link in a message—navigate directly Use MFA , preferably app-based or hardware keys Verify out-of-band : call a known number, not the one in the email/text Phishing succeeds when you feel rushed, helpful, or afraid—often all three at once. Attack Vector #4: Insecure Device Settings (iPhone Spying, Laptop Tracking, and “It Was Already Allowed”) Some of the most damaging compromises don’t require advanced hacking. They require settings you never reviewed , permissions you granted years ago, or accounts that stayed signed in. Common “Everyday” Weak Points Location sharing left on indefinitely Cloud backups accessible through a compromised email account Bluetooth/Wi‑Fi auto-join that exposes you to unsafe networks Device management profiles (MDM) installed without understanding the impact Shared Apple IDs / shared Google accounts creating unintended access Practical Defenses Run a privacy checkup on your phone: location, sharing, device access Lock down your Apple/Google account with strong MFA and recovery controls Turn off auto-join for unknown Wi‑Fi networks Use a screen lock with a strong PIN/password (not a simple 4-digit code) Review connected devices and sign out of sessions you don’t recognize Attack Vector #5: Exploits and Unpatched Vulnerabilities (Including Zero-Days) Exploits are what people think “hacking” looks like: taking advantage of a flaw in software. For individuals, the most common scenario is still simple: you didn’t patch , or you’re running software that no longer gets security updates. Where Exploits Hit Most Often Browsers and browser components Operating systems (especially older versions) Routers and home network gear Common apps (PDF readers, conferencing tools, messaging clients) Practical Defenses Enable automatic updates for OS and major apps Replace end-of-life devices that no longer receive patches Update home routers and change default admin credentials Attack Vector #6: Man-in-the-Middle (MitM) and Unsafe Networks MitM attacks are about interception—capturing what you send, what you receive, or where you think you’re going online. Where It Happens Public Wi‑Fi (airports, hotels, cafes) Evil twin hotspots impersonating legitimate networks Compromised home routers redirecting traffic Practical Defenses Avoid sensitive logins on public Wi‑Fi when possible Use a reputable VPN on untrusted networks Ensure HTTPS (modern browsers help, but don’t ignore warnings) Attack Vector #7: Denial-of-Service (DoS/DDoS)—Disruption as a Weapon DoS and DDoS attacks are less about stealing and more about making something unavailable . Individuals usually feel this indirectly—services go down, accounts get rate-limited, or a small business website becomes unreachable. Why It Still Matters Extortion (“Pay or we keep your site down”) Cover for other activity (distraction during fraud attempts) Reputation damage for small organizations and creators Practical Defenses (Small Business / Creator Level) Use a CDN and DDoS protection for websites Enable rate limiting and basic WAF controls where available Have a failover plan for critical customer communications Your Personal Security Baseline: The “Do This This Week” Checklist If you want the highest return on effort, start here: Turn on MFA for email first, then banking, then social (email is the master key) Use a password manager and eliminate reused passwords Update everything (OS, browser, apps, router firmware) Audit app permissions and remove apps you don’t use Lock down account recovery (recovery email, phone number, backup codes) Back up your data (and test that you can restore it) You don’t need perfect security. You need resilient security—so one mistake doesn’t become a catastrophe. Conclusion: Protect the Endpoint, Protect the Person The threat landscape keeps evolving, but the fundamentals don’t change: attackers go where access is easiest, where oversight is lowest, and where humans are most likely to click, approve, install, or share. That’s why I’ve always emphasized endpoint and privacy protection. Your phone and laptop are no longer “devices.” They’re identity hubs . They hold your authentication, your location history, your private conversations, your financial access, and your digital life. If you secure the endpoint, you reduce the blast radius of almost every other attack vector. Call to Action If you want to take this from awareness to execution, start by doing one thing today: secure your email account with strong MFA and review your account recovery settings . Then work down the checklist. If you’d like, I can also tailor this into a version for your specific audience— individuals, families, executives, or small businesses —and include a short “what to do if you think you’re compromised” response plan to publish as a companion post. ## AI Agent Predictions for 2026: Week-Long Autonomous Tasks? - URL: https://bartmcd.com/blog/ai-agent-predictions-2026-week-long-autonomous-tasks - Published: 2025-12-22 AI Agents in 2026: How Close Are We to True Week-Long Autonomy? As we close out 2025, the rapid evolution of AI agents has left us both awed and cautious. From OpenAI’s GPT-5 turbocharging personalized learning platforms to Google DeepMind’s AlphaLens solving complex supply chain problems, the past year has proven that autonomous AI is no longer confined to science fiction. But how close are we to AI agents that can independently execute week-long tasks without human intervention? The answer: closer than you might think. The Building Blocks of Autonomous AI 1. Memory and Context Retention One of the critical advancements driving AI agents toward autonomy is their ability to maintain memory over extended periods. In 2025, models like Anthropic’s Claude 3 and OpenAI’s GPT-5 Plus introduced long-term contextual understanding, enabling agents to "remember" interactions across days, if not weeks. For example, enterprise AI assistants now manage ongoing projects across multiple departments, recalling specific team preferences, deadlines, and strategic goals. This persistent memory allows AI to perform tasks that require sustained effort, such as drafting multi-phase marketing campaigns or managing IT incident responses from start to finish. Looking ahead to 2026, we expect memory systems will become more granular and adaptive, enabling agents to track the nuances of even longer projects. This will be a linchpin for achieving week-long autonomy. 2. Multimodal Mastery 2025 also saw the rise of multimodal AI, capable of processing text, images, video, and even sensory data. Systems like OpenAI’s Gemini and Microsoft's VisionGPT blurred the lines between traditional AI capabilities, offering a unified interface for diverse inputs and outputs. This multimodal capability is crucial for autonomous tasks. Imagine an AI agent managing a retail store remotely: analyzing security footage, adjusting inventory levels, responding to customer queries, and even supervising staff schedules—all without human oversight. While some of these tasks are already achievable today, the integration of these functions into a seamless, week-long workflow is where 2026 holds transformative potential. Challenges on the Road to Week-Long Autonomy 1. Trust and Reliability Trust remains a significant hurdle. While 2025 brought significant improvements in AI interpretability, incidents like the "MedBot Misdiagnosis Scandal" in October highlighted the risks of over-reliance. The scandal involved an AI diagnostic tool failing to identify a rare but critical condition, leading to widespread calls for stricter regulations. For week-long autonomy to become a reality, AI agents must demonstrate consistent reliability across a variety of unpredictable scenarios. This will likely require more robust fail-safes and real-time auditing mechanisms, allowing humans to intervene when necessary without undermining the agent's autonomy. 2. Ethical and Regulatory Constraints The regulatory landscape surrounding AI tightened considerably in 2025, with the European Union passing its AI Accountability Act and the United States introducing the AI Transparency Framework. These regulations require detailed documentation of an AI system’s decision-making processes and impose penalties for violations. For AI to manage week-long tasks autonomously, it must navigate complex ethical considerations, such as balancing efficiency with fairness or ensuring privacy in sensitive industries like healthcare and finance. These constraints will shape not only the technical design of AI agents but also their operational scope. Breakthrough Applications to Watch 1. Autonomous Incident Response Teams Cybersecurity stands to benefit immensely from AI agents capable of week-long autonomy. By 2026, we anticipate the proliferation of AI-driven incident response teams that can detect, analyze, and mitigate cyber threats over extended periods without human input. These agents will leverage predictive analytics to identify emerging threats, implement countermeasures, and even patch vulnerabilities—freeing up human teams to focus on strategic initiatives. 2. Project Management and Operations In 2025, platforms like NotionAI and AsanaGPT began integrating autonomous features, enabling them to assign tasks, monitor deadlines, and generate reports. By 2026, we expect these platforms to evolve into full-fledged project managers capable of driving complex initiatives from inception to delivery over several days. For instance, an AI agent could independently manage the launch of a new product line, coordinating between marketing, supply chain, and customer support teams while dynamically adjusting to unforeseen challenges. 3. Personal Productivity Assistants On an individual level, AI agents are poised to become indispensable tools for personal productivity. Imagine a personal assistant that not only schedules your week but also negotiates contracts, books travel, handles email triage, and ensures you’re prepared for every meeting—all autonomously. These agents will act as a seamless extension of their users, freeing up valuable time to focus on strategic thinking and creative pursuits. How to Prepare for the AI Agent Future As we approach this new era of AI autonomy, business leaders must take proactive steps to harness its potential while mitigating risks. Invest in AI Literacy: Ensure your teams understand the capabilities and limitations of autonomous AI to make informed decisions about adoption. Reassess Risk Management: Develop protocols for monitoring AI agents and intervening when necessary, especially in high-stakes applications. Adapt Organizational Structures: Consider how autonomous AI can complement your workforce, and redesign workflows to maximize efficiency. Engage with Policy Discussions: Stay ahead of regulatory changes by participating in industry forums and collaborating with policymakers. "The organizations that succeed in 2026 will be those that embrace autonomous AI not as a replacement for human ingenuity but as an enabler of it." Conclusion: A Future Within Reach The dream of week-long autonomous AI agents is no longer a distant vision. With advancements in memory retention, multimodal capabilities, and ethical frameworks, 2026 could be the year we see these systems fully operational in select domains. However, the journey will require equal parts technological innovation and responsible governance. As we enter the new year, one thing is clear: the future of AI autonomy holds immense promise—but only for those prepared to navigate its complexities with care and foresight. ## 2025 Cybersecurity Year in Review: AI-Powered Threats and Record Breaches - URL: https://bartmcd.com/blog/2025-cybersecurity-year-in-review-ai-powered-threats - Published: 2025-12-19 2025: The Year Cybersecurity Faced Its Greatest Test 2025 will be remembered as a watershed year in the cybersecurity landscape. The convergence of AI-powered threats, record-breaking data breaches, and nation-state cyber warfare forced organizations to confront their vulnerabilities like never before. From the staggering $1.4 billion Bybit cryptocurrency heist to the Jaguar Land Rover (JLR) ransomware debacle that necessitated a government bailout, the costs of unpreparedness have never been clearer. As we close out the year, it's evident that cybersecurity is no longer just a technical issue—it’s a boardroom imperative. AI-Powered Threats Redefined the Cyberattack Playbook Artificial intelligence, heralded as a tool for innovation, has also become a double-edged sword in the hands of cybercriminals. This year, AI-powered cyberattacks evolved beyond mere automation, leveraging generative AI to craft hyper-personalized phishing campaigns, create undetectable malware, and even conduct real-time social engineering. Generative AI and Real-Time Phishing Generative AI tools like ChatGPT-6 and its open-source clones were co-opted to develop phishing emails indistinguishable from legitimate communications. Real-time phishing attacks surged, with threat actors using AI to adapt their tactics dynamically during conversations with victims. For example, a Fortune 500 CFO fell victim to a $20 million wire transfer scam after engaging with an AI chatbot masquerading as their CEO, complete with realistic voice synthesis. AI-Augmented Malware Malware also grew smarter, leveraging AI to evade detection and adapt to defensive measures. The "BlackWidow" ransomware strain, first identified in mid-2025, used AI to analyze a target’s network in real time, identifying the most valuable data to encrypt and prioritizing backups for deletion. This precision targeting resulted in faster and more devastating breaches, leaving organizations scrambling to recover. Key Insight: The rise of AI-powered threats underscores the need for equally advanced defensive measures. Organizations must invest in AI-driven threat detection and response systems to stay ahead of attackers. The $1.4 Billion Bybit Heist: A Wake-Up Call for Cryptocurrency Security Cryptocurrency exchanges once again found themselves in the crosshairs of cybercriminals, but none suffered as much as Bybit. In what is now the largest crypto heist in history, hackers exploited a zero-day vulnerability in Bybit's multi-signature wallet protocol, siphoning off $1.4 billion worth of Bitcoin and Ethereum in under 48 hours. The attack was meticulously planned, with threat actors using blockchain analytics to identify high-value wallets and deploying AI to bypass anti-fraud systems. Despite efforts to track the stolen funds, the hackers successfully obfuscated their movements using decentralized mixers and privacy coins. Lessons from Bybit’s Collapse Proactive Threat Hunting: Regularly audit and stress-test critical systems, especially those handling high-value transactions. Layered Security: Implement multiple layers of defense, including behavioral analytics and anomaly detection, to catch sophisticated attacks. Incident Response Planning: Establish robust incident response protocols that include partnerships with blockchain analytics firms to track stolen assets. The Bybit incident has already prompted a wave of regulatory scrutiny, with global financial authorities calling for stricter oversight of cryptocurrency platforms. However, as history has shown, regulation often lags behind innovation, leaving the industry vulnerable to further attacks. Jaguar Land Rover’s Ransomware Crisis: A National Security Issue When Jaguar Land Rover (JLR) fell victim to a ransomware attack in August, the repercussions rippled far beyond the automotive industry. The attackers, believed to be a state-sponsored group, encrypted critical manufacturing systems, halting production across multiple facilities. With losses mounting and supply chains grinding to a halt, the UK government intervened, providing a financial bailout to prevent the collapse of the country’s largest carmaker. The attack highlighted the growing trend of ransomware groups targeting critical infrastructure and strategically important industries. Worse, the JLR breach exploited a known vulnerability in an outdated industrial control system—a stark reminder of the risks posed by technical debt. What Businesses Can Learn from JLR Patch Management: Prioritize patching and upgrading legacy systems that support critical operations. Supply Chain Security: Conduct regular security assessments of third-party vendors and partners to identify weak links. Cyber Insurance: Review and update cyber insurance policies to ensure adequate coverage for ransomware incidents. Key Insight: Ransomware attacks on critical industries are no longer isolated incidents—they are national security issues. Governments and private sectors must collaborate to harden defenses and respond effectively. Nation-State Cyber Warfare Escalates 2025 also saw an alarming rise in cyber warfare activities, with nation-states using cyberattacks as tools of geopolitical influence. The most significant incident occurred in October, when a coordinated attack attributed to a state-sponsored group disrupted power grids across Eastern Europe, leaving millions without electricity for days. Such attacks underscore the vulnerability of critical infrastructure to cyber threats. Despite years of warnings, many countries still lack the robust defenses needed to protect essential services from sophisticated adversaries. Building Cyber Resilience in Critical Infrastructure Zero Trust Architecture: Implement zero-trust principles to segment networks and limit lateral movement. Threat Intelligence Sharing: Foster collaboration between public and private sectors to share threat intelligence and improve situational awareness. Red Team Exercises: Conduct regular red team exercises to test the resilience of critical infrastructure against simulated attacks. The events of 2025 have made it clear that cybersecurity is not just a corporate concern but a national priority. Governments must take the lead in developing comprehensive strategies to defend against cyber warfare. Looking Ahead: Preparing for 2026 As we head into 2026, the lessons of this tumultuous year must guide our approach to cybersecurity. The threats we face are evolving at an unprecedented pace, fueled by advancements in technology and the growing sophistication of adversaries. Organizations must adopt a proactive, intelligence-driven approach to security, focusing on prevention, detection, and rapid response. Actionable Steps for 2026 Invest in AI-Driven Security: Leverage AI and machine learning to enhance threat detection, automate response, and stay ahead of attackers. Strengthen Employee Training: Regularly update cybersecurity awareness programs to address emerging threats like AI-powered phishing. Enhance Incident Response Capabilities: Develop and test incident response plans that account for advanced threats and multi-vector attacks. Collaborate Across Industries: Participate in industry-specific threat intelligence sharing initiatives to stay informed about the latest attack trends. 2025 was a challenging year for cybersecurity, but it also served as a powerful reminder of what’s at stake. By learning from the past and investing in the future, we can build a more secure digital environment for everyone. ## Digital Minimalism for CEOs - URL: https://bartmcd.com/blog/digital-minimalism-for-ceos - Published: 2025-12-17 Digital Minimalism for CEOs: Cut Through the Noise and Focus on High-Leverage Decisions The modern executive operates in an environment of relentless digital noise—emails flood inboxes, notifications clamor for attention, and endless streams of information compete for brain space. For CEOs, whose primary responsibility is to steer their organizations toward success, this constant bombardment can be crippling. To thrive, leaders must embrace digital minimalism : a deliberate approach to technology use that prioritizes clarity, focus, and high-leverage decision-making. In this article, we’ll explore practical strategies to manage email overload, reduce digital distractions, use technology intentionally, and create systems that preserve focused thinking time. Let’s dive into how you, as a CEO, can reclaim your attention and amplify your impact. Managing Email Overload: Taming the Inbox Beast Email is both a blessing and a curse. While it facilitates quick communication, it can easily spiral out of control. Studies show that the average professional spends 28% of their workweek managing email. For CEOs, this is simply unsustainable. Adopt the "One-Touch" Rule When processing your inbox, aim to touch each email only once. This means immediately deciding to: Respond: If it requires a quick reply, handle it right away. Delegate: Forward it to the appropriate team member with clear instructions. Defer: Schedule time to address it later if it requires deeper thought. Delete: If it's irrelevant, remove it without hesitation. Set Clear Communication Boundaries Train your team to respect your time by establishing clear email guidelines. For example: Encourage concise subject lines that summarize the key point. Request emails only for non-urgent matters; direct urgent issues through other channels. Batch internal updates into a single weekly summary rather than multiple daily emails. “Your inbox shouldn’t be your to-do list. It’s a tool, not a master.” Reducing Digital Distractions: Breaking Free from the Attention Economy Our digital tools are designed to capture and hold attention, often at the expense of productivity. For CEOs, staying focused is critical to making strategic decisions. Turn Off Non-Essential Notifications Audit your devices and disable notifications for apps that don’t directly support your responsibilities. Keep alerts only for critical functions, such as calendar reminders or urgent messages from key stakeholders. Schedule "No-Tech" Zones Designate specific times during your day to disconnect from all devices. Use this time for deep thinking, brainstorming, or reviewing strategic initiatives. Protect this sacred time as fiercely as you would a board meeting. Use Technology to Fight Technology Ironically, some tools can help minimize distractions. Consider apps like Freedom or Focus@Will to block distracting websites or create focused work environments with background music tailored for concentration. Being Intentional About Technology Use Technology is a powerful enabler, but only when used with intention. CEOs must resist adopting every shiny new tool and instead focus on those that drive real value. Perform a Digital Audit Regularly review the tools and platforms you use. Identify which ones genuinely support your goals and which are merely adding noise. Eliminate redundancies and consolidate functions wherever possible. Adopt the "Essentialism" Mindset Ask yourself: Does this tool or platform help me make better decisions, save time, or empower my team? If the answer is no, it doesn’t belong in your digital ecosystem. “Intentional technology use isn’t about doing more; it’s about doing what matters.” Creating Systems That Protect Focused Thinking Time Focus is a CEO’s superpower. Yet, it’s often under siege by the demands of a hyper-connected world. To reclaim your cognitive bandwidth, you need systems that actively protect your time and energy. Time-Block Your Calendar Set aside blocks of uninterrupted time for critical thinking, strategic planning, or creative work. Treat these blocks as immovable appointments and avoid scheduling meetings or calls during these periods. Delegate and Empower Your Team Not every decision should land on your desk. Build a culture of trust and empowerment within your organization so that your team can handle day-to-day operations, leaving you free to focus on high-leverage decisions. Practice Strategic Solitude Schedule regular retreats—whether an afternoon at a quiet location or a weekend unplugged—to reflect on the big picture. Solitude fosters clarity, creativity, and long-term thinking, all of which are essential for effective leadership. Conclusion: Focus on What Truly Matters As a CEO, your greatest value lies in your ability to make high-impact decisions. Digital minimalism isn’t about rejecting technology but about using it deliberately to amplify your focus and effectiveness. By managing email overload, reducing digital distractions, being intentional with technology, and creating systems for focused thinking, you’ll not only cut through the noise but also lead with clarity and purpose. Your next step: Take a moment today to identify one area where digital clutter is holding you back. Implement one strategy from this article, and commit to building habits that protect your time and attention. The results will speak for themselves. ## Google Gemini 3 and Agent Development Kit: The Open Source Push - URL: https://bartmcd.com/blog/google-gemini-3-agent-development-kit-open-source - Published: 2025-12-08 Google Gemini 3: A Leap Forward in Generative AI Two years after the groundbreaking release of Gemini 1, Google has once again captured the spotlight with Gemini 3 , its latest generative AI model. Announced alongside the open-source Agent Development Kit (ADK) , this release marks a pivotal shift in AI development—moving from proprietary systems to empowering developers worldwide with tools to build their own autonomous agents. Gemini 3 isn't just an incremental update. It represents a bold step into the next phase of agentic AI , where models are no longer passive responders but proactive problem-solvers. This shift is an acknowledgment of the growing demand for AI systems that can autonomously execute complex, multi-step tasks across domains. More importantly, the introduction of the ADK signals Google's recognition of the power of open-source collaboration in accelerating innovation. What Makes Gemini 3 Revolutionary? Unprecedented Scale and Multimodal Mastery Gemini 3 builds upon the strengths of its predecessors with a trillion-parameter architecture , making it one of the largest and most sophisticated models to date. But size alone isn’t its defining feature. Its true power lies in its ability to seamlessly integrate and understand multimodal inputs—text, images, video, and even sensor data—in real-time. In practical terms, this means Gemini 3 can simultaneously process a financial report, analyze video surveillance footage, and draft a strategy document, all while responding to voice commands. This leap in multimodal fluency is expected to revolutionize industries such as: Healthcare: Automating diagnostic interpretations by merging patient records with medical imaging. Finance: Real-time market analysis combining textual news feeds with stock performance visualizations. Manufacturing: Predictive maintenance powered by sensor data and AI-driven visual inspections. The model’s ability to cross-analyze multiple data types in parallel eliminates inefficiencies, making it a powerful tool for organizations navigating increasingly complex data landscapes. Improved Autonomy Through Agentic AI One of the most significant advancements in Gemini 3 is its capacity to autonomously execute tasks through a framework Google calls "Dynamic Task Chaining." Unlike previous AI models that required explicit user instructions for each step, Gemini 3 can independently identify sub-tasks, prioritize them, and execute them in sequence. For example, in a cybersecurity context, Gemini 3 could detect a network breach, identify the entry point, isolate the affected systems, and recommend remediation steps—all without human intervention. This kind of autonomy is not just a convenience; it’s a necessity in high-stakes, time-sensitive environments. “Gemini 3 represents a paradigm shift from reactive AI to proactive agents capable of complex decision-making.” The Agent Development Kit: Democratizing Agentic AI Why Open Source Matters Google’s introduction of the Agent Development Kit (ADK) has made waves in the developer community. By open-sourcing this toolkit, Google is inviting developers, researchers, and organizations to customize and deploy their own AI agents using the Gemini 3 framework. This move aligns with broader industry trends favoring open-source models, as seen in recent initiatives by OpenAI and Meta. What sets the ADK apart is its modular design , allowing developers to plug in their own datasets, integrate industry-specific tools, and even modify the core agentic behavior to suit unique use cases. Key features include: Customizable Task Libraries: Pre-built modules for common tasks like data analysis, content generation, and workflow automation. Integration APIs: Seamless connectivity with enterprise software like Salesforce, SAP, and Workday. Governance and Ethics Controls: Built-in frameworks for bias detection, transparency, and compliance with data privacy regulations like GDPR and CCPA. The open-source nature of the ADK ensures that smaller organizations, startups, and even individual developers can harness the power of Gemini 3 without the financial barriers traditionally associated with advanced AI systems. Fostering a Global AI Community Google’s decision to open-source the ADK is also a strategic move to foster a collaborative ecosystem. By lowering the barrier to entry, Google is ensuring widespread adoption of Gemini 3, which in turn enhances the model’s training through diverse use cases and feedback loops. This approach mirrors the success of open-source projects like PyTorch and Kubernetes, which have become industry standards through community-driven innovation. “The release of the ADK signals a new era where AI development will be driven by collective intelligence, not corporate silos.” Challenges and Risks of Agentic AI Autonomy vs. Control While the autonomy of Gemini 3 and its agents is a game-changer, it also raises serious questions about oversight and control . How do we ensure that these agents act in alignment with human values? What safeguards are in place to prevent misuse or unintended consequences? Google has anticipated these concerns by embedding robust governance mechanisms within the ADK. For example, organizations can configure agents to operate within predefined ethical boundaries, with real-time monitoring to flag potentially harmful actions. However, these measures are not foolproof, and the responsibility ultimately lies with the developers and organizations deploying these agents. Security Implications The increased accessibility of agentic AI also opens the door to potential abuse. Malicious actors could use the ADK to develop autonomous agents for phishing campaigns, disinformation, or even cyberattacks. As Gemini 3 and the ADK gain traction, cybersecurity professionals will need to adapt their strategies to counter these emerging threats. Key recommendations for organizations include: Deploy AI Threat Detection: Use AI to monitor and counteract malicious AI agents. Invest in Workforce Training: Educate employees about the risks and benefits of agentic AI. Collaborate on Industry Standards: Participate in initiatives to establish ethical guidelines and technical safeguards for agentic AI. The Road Ahead As we close out 2025, the release of Google Gemini 3 and the Agent Development Kit feels like a defining moment for the AI industry. By combining cutting-edge technology with an open-source ethos, Google has set the stage for a new wave of innovation. However, with great power comes great responsibility, and the onus is now on developers, organizations, and policymakers to ensure that these tools are used wisely. For business leaders, the message is clear: agentic AI is not a distant future; it’s here now. Those who embrace it and invest in understanding its capabilities will gain a competitive edge. But as with any transformative technology, success will require a delicate balance of ambition and caution. “The future of AI is agentic, collaborative, and open—but only if we manage its risks as carefully as we embrace its potential.” ## Adobe's AI Platform: Agents for Campaign Execution - URL: https://bartmcd.com/blog/adobe-ai-agents-campaign-execution-platform - Published: 2025-11-25 Adobe's AI Agents: Revolutionizing Marketing Campaigns In 2025, Adobe has once again redefined the creative and marketing landscape. With the launch of its AI-powered platform, featuring intelligent agents designed specifically for campaign execution, personalization, and content workflows, Adobe is equipping businesses with tools to deliver hyper-targeted campaigns at scale. These agents are not just augmenting human creativity; they are transforming how brands engage with their audiences, making precision marketing the new standard. As organizations continue to grapple with an explosion of digital channels and customer data, Adobe’s AI agents promise more than operational efficiency—they enable businesses to stay competitive by delivering personalized experiences in real time. Here’s how Adobe’s latest innovation is reshaping the creative industry and what it means for executives and marketers alike. AI Agents: The New Digital Workforce Adobe’s AI agents are far more than simple automation tools. These agents leverage advanced machine learning models to not only analyze complex datasets but also execute on insights autonomously. Integrated within Adobe’s Creative Cloud and Experience Cloud, they handle end-to-end campaign tasks, from ideation and content creation to audience targeting and optimization. How AI Agents Work Data-Driven Personalization: AI agents synthesize customer data from multiple touchpoints, such as social media interactions, website behavior, and purchase history, to create granular audience segments. These segments inform campaign strategies tailored to micro-moments in the customer journey. Content Automation: Using generative AI, the agents create and adapt content, including text, imagery, and video, to fit specific audience preferences. For example, a fashion retailer can now deliver personalized promotional videos to thousands of customers, each reflecting their unique style preferences. Optimized Execution: AI agents monitor campaign performance in real time, making adjustments on the fly. They test variables like messaging, timing, and design to maximize engagement and conversion rates without requiring manual intervention. By automating these traditionally manual and resource-heavy tasks, Adobe is enabling marketing teams to focus on strategy and creativity rather than execution. The result? Faster time-to-market and a significant reduction in operational overhead. Seamless Integration with Existing Workflows One of the most compelling aspects of Adobe’s AI platform is its seamless integration into existing creative and marketing workflows. The agents are designed to be intuitive, working alongside human teams rather than replacing them. This hybrid approach ensures that organizations can scale their operations without losing the personal touch that defines their brand identity. Key Features Driving Integration Natural Language Interfaces: Users can interact with AI agents through simple commands, such as, “Generate a holiday-themed email campaign for our premium customers.” Creative Assistance: The agents provide recommendations for design elements, copy, and layouts, drawing from Adobe’s extensive library of assets and templates. Collaborative Tools: Teams can review and refine AI-generated content directly within Adobe’s ecosystem, ensuring alignment with brand guidelines and creative vision. This ease of integration is critical as businesses increasingly adopt hybrid models, where AI complements human expertise. Adobe’s approach ensures that teams retain creative control while benefiting from the speed and efficiency of AI. Transforming the Creative Economy The introduction of AI agents is having a profound impact on the creative industry. With these tools, small businesses can compete with larger enterprises by executing campaigns that were previously beyond their capability. At the same time, large organizations are using AI to scale personalization efforts to millions of customers. “Adobe’s AI agents are leveling the playing field in marketing. Creativity is no longer constrained by budget or manpower—it’s driven by ideas and powered by AI.” In addition to democratizing access to advanced marketing capabilities, Adobe’s platform is fostering a new era of innovation. Creative professionals are using AI agents to push the boundaries of what’s possible, from immersive virtual experiences to dynamic, interactive content that adapts in real time. Implications for the Workforce While some feared that AI would replace jobs in the creative sector, Adobe’s implementation suggests otherwise. By taking over repetitive tasks, AI agents allow professionals to focus on higher-order work, such as strategy, storytelling, and ideation. This shift is creating new roles, such as AI trainers, data strategists, and digital experience designers, further diversifying the creative economy. Future-Proofing Marketing in the Age of AI As we look to the future, it’s clear that AI will continue to play an integral role in marketing and creative industries. For business leaders, the challenge is not just adopting these technologies but doing so in a way that aligns with long-term goals and values. Here are three key strategies to consider: Invest in Training: Equip your teams with the skills to work alongside AI. This includes understanding how to interpret AI-generated insights and refining content produced by AI agents. Focus on Ethics: With great power comes great responsibility. Ensure your use of AI aligns with ethical standards, particularly when it comes to data privacy and transparency. Embrace Agility: The pace of technological change is accelerating, and organizations must remain nimble. Regularly review your tech stack and processes to ensure you’re leveraging the latest capabilities. By taking these steps, businesses can not only adapt to the AI-driven future but thrive in it. Looking Ahead Adobe’s AI agents are a testament to the transformative power of technology. By blending artificial intelligence with human creativity, Adobe is enabling organizations to deliver personalized, impactful campaigns at a scale never before possible. As we move deeper into the AI era, one thing is clear: the businesses that embrace these innovations will lead the way in shaping the future of marketing and creativity. The question for executives is no longer whether to adopt AI, but how quickly they can integrate it into their strategies. With tools like Adobe’s AI agents, the possibilities are endless—and the time to act is now. ## Russia Surges Attacks on Ukraine: 70% Increase in Cyber Operations - URL: https://bartmcd.com/blog/russia-cyber-attacks-ukraine-70-percent-increase - Published: 2025-11-18 Russia's Cyber Onslaught: A 70% Spike in Attacks on Ukraine In the ongoing conflict between Russia and Ukraine, the battlefield has extended far beyond physical borders into cyberspace. Over the past year, Russian cyber operations targeting Ukraine have surged by a staggering 70%, according to the latest data from NATO’s Cyber Defense Center. These attacks have grown in scale, sophistication, and frequency, targeting critical infrastructure with a precision that underscores the evolving nature of modern warfare. The implications of these developments extend far beyond Eastern Europe, serving as a wake-up call for governments and private sectors alike. How prepared are we to defend against similar threats? The Tactics Behind the Attacks Sophisticated Phishing Campaigns One of the most alarming trends in the recent wave of cyberattacks is the increased use of advanced phishing campaigns. Russian threat actors have employed AI-enhanced techniques to craft hyper-targeted emails that bypass traditional spam filters and deceive even the most vigilant users. These phishing emails are no longer riddled with obvious typos or suspicious links; instead, they mimic legitimate correspondence with uncanny accuracy. For Ukraine, these attacks have compromised government communication channels and disrupted supply chain logistics. Weaponized Ransomware Ransomware remains a cornerstone of Russia’s cyber arsenal. The past year has seen the emergence of "modular ransomware," a new strain that adapts its behavior based on the target environment. In Ukraine, critical sectors such as energy, healthcare, and transportation have been paralyzed by these attacks, which not only encrypt data but also exfiltrate sensitive information for extortion or intelligence purposes. Supply Chain Infiltration Another key strategy involves infiltrating software supply chains. Russian hackers have exploited vulnerabilities in widely used software platforms and cloud services to compromise hundreds of downstream organizations. These attacks have cascading effects, impacting not just Ukrainian entities but also their international partners and allies. Lessons for Critical Infrastructure Defense The escalation in Russian cyber operations is a stark reminder that no nation or organization is immune to such threats. For business leaders and policymakers, Ukraine’s experience offers several critical lessons for defending critical infrastructure and ensuring operational resilience. 1. Prioritize Zero Trust Architecture The era of relying solely on perimeter defenses is over. A Zero Trust model, which assumes that threats can originate both outside and within the network, is essential. Organizations must implement continuous verification of user identities and device integrity before granting access to sensitive systems. Segment your network to limit lateral movement in case of a breach. Deploy multi-factor authentication (MFA) across all access points. Continuously monitor and analyze user behavior for anomalies. 2. Invest in AI-Powered Cyber Defense The use of artificial intelligence in phishing campaigns and ransomware development underscores the need for equally advanced defensive measures. AI-driven threat detection platforms can analyze vast amounts of data in real-time, identifying and neutralizing threats before they cause harm. Leverage AI to detect abnormal patterns in network traffic. Use machine learning models to predict and counteract emerging threats. Automate incident response to reduce reaction times. 3. Fortify Supply Chain Security As supply chain attacks become more prevalent, businesses must scrutinize their vendors and partners to ensure they meet rigorous cybersecurity standards. Conduct thorough security assessments of all third-party vendors. Mandate compliance with frameworks like NIST Cybersecurity Framework or ISO 27001. Establish mechanisms for real-time threat sharing across the supply chain. Collaborative Defense: A Global Imperative The surge in Russian cyber operations highlights the interconnected nature of cybersecurity. Attacks on one nation can ripple across borders, disrupting global supply chains and financial systems. To counter these threats, international collaboration is more critical than ever. Strengthen Public-Private Partnerships Governments and private enterprises must work together to share intelligence, develop joint response strategies, and invest in advanced technologies. Initiatives like the Global Cyber Resilience Partnership have already demonstrated the power of collaboration in combating sophisticated cyber threats. Enhance International Cyber Norms While efforts like the 2024 Tallinn Agreement have established some baseline norms for state behavior in cyberspace, enforcement remains a challenge. The international community must strengthen mechanisms for holding cyber aggressors accountable, whether through sanctions, diplomatic measures, or other means. Foster Workforce Resilience With the cyber threat landscape growing more complex, the demand for skilled cybersecurity professionals has never been greater. Governments and industries should invest in education and training programs to close the cybersecurity skills gap and build a workforce capable of defending against 21st-century threats. Looking Ahead: The Road to Resilience As we reflect on the 70% increase in Russian cyber operations against Ukraine, it’s clear that the stakes are higher than ever. Cybersecurity is no longer just an IT issue; it’s a national security and business continuity imperative. For executives and business leaders, the lessons from this crisis are clear: invest in robust defenses, prioritize resilience, and embrace collaboration. The question is not whether your organization will be targeted, but when—and how prepared you’ll be to respond. “Resilience is not about preventing attacks; it’s about ensuring you can survive and thrive in the face of them.” The time to act is now. Whether you’re leading a multinational corporation or a small business, the lessons from Ukraine’s cyber battlefield are a call to arms. Strengthen your defenses, collaborate with partners, and stay vigilant—because in the digital age, complacency is not an option. ## Microsoft Ignite 2025: Foundry, Azure Copilot, and Agentic Retrieval - URL: https://bartmcd.com/blog/microsoft-ignite-2025-foundry-azure-copilot-agentic - Published: 2025-11-11 Microsoft Ignite 2025: Redefining Enterprise AI Microsoft Ignite 2025 delivered a wave of groundbreaking announcements that will reshape how businesses harness AI and cloud technologies. From the launch of Foundry IQ to the unveiling of Azure Copilot agents and the innovative Agentic Retrieval models, Microsoft has positioned itself as the architect of enterprise AI evolution. Let’s dive into the details and explore their implications for business leaders navigating the digital transformation landscape. Foundry IQ: The Next Frontier of AI-Driven Collaboration One of the most anticipated announcements was Foundry IQ , a platform designed to enable seamless AI-driven collaboration across distributed teams. Foundry IQ blends generative AI with predictive analytics to provide real-time insights and decision-making capabilities. It’s more than a tool—it’s a strategic enabler. Key Features of Foundry IQ Context-Aware Collaboration: Foundry IQ integrates with Microsoft Teams to deliver AI-driven context summaries during meetings, automatically pulling relevant data from cloud repositories. Predictive Workflows: The platform anticipates project bottlenecks and suggests actionable solutions, reducing decision latency. Cross-Cloud Integration: Teams can leverage data across Azure, AWS, and Google Cloud, making Foundry IQ a versatile option for hybrid cloud environments. Foundry IQ’s potential lies in its ability to bridge the gap between data and decision-making. For executives, it’s not merely about collaboration—it’s about accelerating outcomes. Imagine walking into a quarterly strategy meeting and having Foundry IQ proactively outline key priorities based on market trends. The possibilities are transformative. “Foundry IQ is the connective tissue for enterprise teams, enabling smarter collaboration and faster execution.” Azure Copilot Agents: Empowering Business Autonomy While AI assistants have been a staple of productivity tools for years, Azure Copilot agents represent an evolution toward autonomous enterprise systems. These customizable agents are built on Microsoft’s advanced generative AI models, and they’re designed to act as virtual business consultants. Capabilities of Azure Copilot Agents Personalized Task Automation: Agents can handle complex workflows, from drafting contracts to managing compliance audits. Deep Integration: They interact seamlessly with Microsoft Dynamics, Power BI, and Azure Synapse, ensuring data-driven decision-making at every level. Industry-Specific Intelligence: Pre-trained templates allow agents to specialize in sectors such as healthcare, finance, and manufacturing. For CIOs and CTOs, Azure Copilot agents signal a shift toward a new era of business autonomy . These agents don’t just execute tasks—they learn and adapt to the organization’s goals, enabling a proactive approach to operational efficiency. “With Azure Copilot agents, enterprises gain a trusted AI partner capable of driving measurable business impact.” Agentic Retrieval Models: Revolutionizing Information Access Traditional search engines and retrieval systems often fail to meet the nuanced demands of enterprise users. Microsoft’s introduction of Agentic Retrieval models at Ignite 2025 aims to change that paradigm. These models combine semantic understanding, contextual relevance, and predictive insights to deliver unparalleled information access. How Agentic Retrieval Works Semantic Precision: It interprets user queries with deeper contextual awareness to surface the most relevant data. Dynamic Adaptation: The models learn from user behavior, continuously refining results to align with business needs. Unified Knowledge Graphs: By integrating enterprise datasets, Agentic Retrieval unifies disparate data sources into a cohesive narrative. For enterprises dealing with data sprawl, Agentic Retrieval models provide a much-needed solution. Imagine querying a system for market insights and receiving not only historical data but forward-looking projections based on current trends. This isn’t just search—it’s strategic intelligence. “Agentic Retrieval transforms data into actionable intelligence, empowering leaders to make informed decisions with confidence.” Implications for Enterprise Leaders The announcements at Microsoft Ignite 2025 underscore a pivotal shift in enterprise technology. AI is no longer a standalone tool—it’s becoming the backbone of business ecosystems. For executives, these innovations present both opportunities and challenges. Actionable Takeaways Invest in AI-Driven Tools: Platforms like Foundry IQ and Azure Copilot agents can enable faster decision-making and operational efficiency. Prioritize integration into your workflows. Enhance Data Governance: With advanced systems like Agentic Retrieval, data governance policies must evolve to ensure ethical and effective usage. Embrace Customization: Microsoft’s focus on industry-specific solutions highlights the importance of tailoring tools to your organization’s needs. Upskill Your Workforce: Equip your teams with the knowledge to work alongside AI systems effectively. As AI continues to evolve, enterprise leaders must stay ahead of the curve. Microsoft Ignite 2025 demonstrated that technology is not just about automation—it’s about augmenting human capabilities to achieve transformative results. The Road Ahead Microsoft’s announcements at Ignite 2025 serve as a reminder that enterprise AI is entering a new phase—one where collaboration, autonomy, and intelligence converge. For businesses ready to embrace these changes, the path forward is clear: adopt, adapt, and accelerate. As we look ahead to 2026 and beyond, the real question isn’t whether AI will shape the future—it’s how prepared we are to harness its potential. The time to act is now. ## 30,000 Vulnerabilities in 2024: The Patch Management Crisis - URL: https://bartmcd.com/blog/30000-vulnerabilities-patch-management-crisis - Published: 2025-10-28 The Patch Management Crisis: 2024’s 30,000 Vulnerabilities In 2024, the cybersecurity community faced an unprecedented challenge: over 30,000 vulnerabilities were disclosed globally, marking a staggering 17% increase from 2023. This surge in vulnerabilities has strained organizations’ ability to patch systems quickly and effectively. With cyberattacks targeting unpatched systems at record levels, patch management has moved from being a technical issue to a boardroom priority. The question isn’t just how to patch faster—it’s how to patch smarter. Why Vulnerability Disclosure Skyrocketed The explosion in vulnerability disclosures can be attributed to several factors: Automated Discovery Tools: Advances in AI-driven vulnerability scanners have enabled researchers to identify flaws at scale, particularly in open-source software and legacy systems. Increased Regulatory Pressure: Governments worldwide have mandated stricter vulnerability reporting requirements, with penalties for non-compliance becoming more severe in 2024. Expanded Attack Surfaces: The proliferation of IoT devices, SaaS platforms, and edge computing environments has dramatically increased the number of potential entry points for attackers. While these trends have enhanced awareness of security gaps, they’ve also created a logistical nightmare for IT teams tasked with remediation. Why Traditional Patch Management No Longer Works For years, organizations relied on a straightforward patching strategy: apply fixes as soon as they are released. However, in 2024, this approach proved inadequate for three key reasons: Volume Overload: With tens of thousands of vulnerabilities disclosed, it became impossible for IT teams to patch everything. Downtime Concerns: Enterprises running mission-critical systems faced operational risks when patches disrupted workflows. Inadequate Testing: Rushed patch deployments led to compatibility issues, sometimes causing more harm than good. Compounding the problem, threat actors have become faster at weaponizing new vulnerabilities. In some cases, exploits appeared within hours of a vulnerability’s disclosure—a phenomenon known as “zero-day to zero-hour.” Prioritization Strategies That Work Amid this crisis, organizations that successfully managed patching adopted prioritization strategies rooted in risk management. Here are the most effective approaches: 1. Focus on Exploitable Vulnerabilities Not all vulnerabilities are created equal. By leveraging threat intelligence platforms, organizations can determine which vulnerabilities are actively being exploited in the wild. This allows IT teams to prioritize patching efforts on high-risk vulnerabilities rather than wasting time on issues unlikely to be targeted. “Fix what matters most. A vulnerability without an exploit is a risk, but a vulnerability with an active exploit is a crisis.” 2. Use Automation to Scale Modern patch management tools equipped with AI can automate vulnerability assessment and remediation processes. In 2024, several vendors introduced solutions capable of: Automatically identifying critical vulnerabilities based on exploit likelihood. Simulating patch rollouts in virtual environments to prevent disruptions. Deploying patches across thousands of systems simultaneously. Automation not only accelerates patching but also reduces human errors that can inadvertently create new vulnerabilities. 3. Implement Virtual Patching Virtual patching emerged as a lifesaver for organizations unable to immediately patch critical systems. By using intrusion prevention systems (IPS) or web application firewalls (WAF), businesses can temporarily mitigate vulnerabilities by blocking exploit attempts until a permanent fix is applied. This strategy proved especially effective for legacy systems that vendors no longer support or for patches requiring extensive testing before deployment. 4. Align Patching with Business Goals Security leaders in 2024 shifted their mindset from “patch everything” to “patch smartly.” By aligning patching priorities with business objectives, organizations ensured that the systems supporting key revenue drivers or compliance requirements were addressed first. For example, healthcare providers focused on patching vulnerabilities in electronic medical record (EMR) systems to protect patient data, while financial institutions prioritized fixes for payment processing platforms. The Role of Cyber Insurance in Mitigating Risk In 2024, cyber insurance played a larger role in how organizations approached patch management. Insurers increasingly required proof of proactive vulnerability management as a prerequisite for coverage. Policies often stipulated: Regular vulnerability scans and documented remediation efforts. Use of advanced threat detection tools to identify exploitable risks. Evidence of compliance with industry patching standards. Organizations that failed to meet these requirements faced higher premiums or outright denial of claims following a breach. As a result, cyber insurance became both a motivator and a benchmark for improving patch management processes. Looking Ahead: Preparing for 2025 As we move into 2025, the patch management crisis is far from over. Vulnerability disclosures are expected to climb again, driven by continued advancements in AI and the expansion of digital ecosystems. Cybersecurity leaders must adopt sustainable strategies to stay ahead of this growing threat landscape. Key considerations include: Investing in Predictive Analytics: Emerging AI tools can forecast which vulnerabilities are likely to be exploited, empowering teams to prioritize more effectively. Strengthening Collaboration: Sharing threat intelligence across industries and governments will be critical in reducing response times to new vulnerabilities. Enhancing User Awareness: Training employees to recognize potential security risks, such as phishing attacks exploiting unpatched systems, remains essential. The patch management crisis of 2024 has underscored one undeniable truth: cybersecurity is no longer an IT issue—it’s a business imperative. Organizations that embrace risk-based prioritization, automation, and innovative solutions will be better positioned to protect their assets and maintain customer trust in the face of ever-growing threats. ## AI Agent Frameworks Compared: LangChain vs CrewAI vs AutoGen - URL: https://bartmcd.com/blog/ai-agent-frameworks-langchain-crewai-autogen - Published: 2025-10-21 Why AI Agent Frameworks Are the Backbone of Modern Enterprises The rapid evolution of artificial intelligence over the past decade has ushered in an era where AI agents are not only assisting but often autonomously driving business processes. Enterprises are leveraging these frameworks to streamline operations, personalize customer experiences, and enhance decision-making capabilities. However, with a crowded market of AI agent tools, choosing the right framework has become a strategic imperative. Today, we delve into three leading players: LangChain , CrewAI , and AutoGen . Each framework has carved out a distinct niche, but the real challenge lies in understanding which one aligns with your organizational goals. Whether you're seeking seamless integration, scalability, or advanced autonomy, the stakes are high, and the decision can shape your AI strategy for years to come. LangChain: The Modular Powerhouse LangChain has been a cornerstone in the AI agent ecosystem since its inception. Known for its modular design, LangChain excels in building customized applications that integrate large language models (LLMs) with external data sources, APIs, and user interfaces. Key Features: Flexibility: LangChain’s pipeline-based architecture allows developers to mix and match modules, enabling rapid prototyping and deployment. Data Connectivity: Seamless integration with databases, live APIs, and private knowledge bases makes LangChain a go-to for enterprises with complex data ecosystems. Community Support: With its open-source foundation, LangChain boasts a robust community of contributors who consistently release plugins and pre-built modules. However, LangChain is not without its challenges. While its modularity is a strength, it also introduces complexity. Enterprises without a mature engineering team may struggle with the steep learning curve and the need for custom configurations. LangChain is ideal for organizations that prioritize customization and have the resources to handle its technical intricacies. CrewAI: The Collaborative Workflow Specialist CrewAI has gained significant traction in 2025 as the go-to framework for collaborative workflows. It was designed with team-based environments in mind, focusing on enabling AI agents to work in tandem with human teams. Key Features: Human-in-the-Loop: CrewAI emphasizes human oversight, making it perfect for industries like healthcare and finance, where compliance and accuracy are critical. Workflow Optimization: Pre-built templates streamline common business tasks, such as document review, customer support, and project management. Cross-Platform Compatibility: CrewAI integrates effortlessly with popular enterprise tools like Microsoft Teams, Slack, and Salesforce. Despite its strengths, CrewAI’s reliance on human oversight can be a double-edged sword. While it mitigates risks and ensures accountability, it also limits the extent of automation. Enterprises looking to minimize human intervention might find CrewAI less appealing. For organizations that value collaborative AI and operate in regulated industries, CrewAI offers a balanced approach to innovation and control. AutoGen: The Autonomous Innovator AutoGen represents the cutting edge of AI agent frameworks, with its focus on building highly autonomous, self-improving systems. Designed for enterprises that demand scalability and minimal human intervention, AutoGen leverages advancements in reinforcement learning and neural architecture search. Key Features: Autonomous Agents: AutoGen agents are capable of independently setting goals, optimizing workflows, and adapting to changing conditions. Self-Learning Capabilities: Continuous learning enables AutoGen to refine its models and improve performance over time without extensive retraining. Enterprise-Grade Security: Built-in features like encrypted data pipelines and zero-trust architecture address modern cybersecurity challenges. The primary drawback of AutoGen is its complexity and cost. While it offers unparalleled autonomy, it demands significant computational resources and a skilled team to manage deployment and monitoring. For smaller enterprises, this may not be a viable option. If your organization is ready to embrace full autonomy and has the infrastructure to support it, AutoGen is the framework of choice. How to Choose the Right Framework for Your Business To decide which AI agent framework best suits your needs, you must first evaluate your organization’s priorities, technical capabilities, and long-term goals. Here are some actionable steps to guide your decision: 1. Define Your Objectives Are you looking to enhance collaboration, automate complex workflows, or gain better insights into your operations? Your primary use case should drive your choice of framework. 2. Assess Technical Resources Do you have an experienced engineering team capable of handling complex integrations, or will you rely on pre-built solutions? LangChain and AutoGen demand more technical expertise, while CrewAI offers user-friendly templates and workflows. 3. Evaluate Scalability Needs If your organization anticipates rapid growth or operates in a dynamic environment, AutoGen’s autonomous capabilities and scalability may be worth the investment. For businesses with stable workflows, CrewAI or LangChain might suffice. 4. Consider Compliance and Security Industries with strict regulatory requirements, like healthcare and finance, may prefer CrewAI for its focus on human oversight. AutoGen’s robust security features also make it a strong contender in these fields. 5. Pilot and Iterate Before committing to a framework, run a pilot project to test its capabilities and identify potential challenges. This hands-on approach can provide valuable insights and help you make an informed decision. The Road Ahead for AI Agent Frameworks As we look toward the future, it’s clear that AI agent frameworks will continue to play a pivotal role in enterprise innovation. The rise of hybrid AI systems—blending human oversight with autonomous capabilities—will likely shape the next wave of development. Additionally, advancements in quantum computing and federated learning could further enhance the performance and security of these frameworks. Whether you choose LangChain, CrewAI, or AutoGen, the key is to align the framework’s capabilities with your strategic goals. By making an informed choice, you can harness the transformative power of AI to drive growth, efficiency, and resilience in an increasingly competitive landscape. ## DoorDash's Third Breach: Why Some Companies Never Learn - URL: https://bartmcd.com/blog/doordash-third-breach-never-learn - Published: 2025-10-07 DoorDash's Third Breach: A Pattern of Negligence? For the third time in six years, DoorDash has fallen victim to a data breach, exposing sensitive customer data to bad actors. As consumers grow increasingly wary of companies unable to secure their information, businesses like DoorDash face mounting pressure to answer one question: When does negligence become liability? This latest incident serves as a stark reminder that cybersecurity lapses are rarely isolated events—they’re often symptoms of deeper organizational failures. The Breach: What Happened This Time? In the latest breach, DoorDash confirmed that unauthorized access resulted in the exposure of customer names, delivery addresses, and partial payment card information. Early investigations point to a compromised third-party vendor, an issue strikingly similar to their 2022 breach. The breach also highlights vulnerabilities in token-based API authentication, a technology widely adopted but poorly managed by some organizations. While DoorDash reassured customers that passwords and full payment card details were encrypted and secured, the breach still raises critical questions about their vendor management protocols and overall cybersecurity hygiene. Recurring Themes in DoorDash’s Breach History 2019: A data breach exposed the personal information of 4.9 million users due to poor internal access controls. 2022: A third-party vendor’s security failure led to compromised customer data. 2025: This most recent breach again involved a vendor vulnerability, suggesting systemic issues in how DoorDash manages external partnerships. Three breaches in six years are not just unfortunate coincidences—they reveal a pattern of inadequate prioritization of cybersecurity at both the strategic and operational levels. Why Companies Like DoorDash Struggle to Learn Repeated breaches often stem from a combination of cultural, operational, and strategic shortcomings. Here are the most common reasons companies fail to evolve their cybersecurity posture: 1. Reactive, Not Proactive Many organizations only invest in security measures after an incident occurs. DoorDash’s 2019 breach prompted better encryption protocols, but the company still neglected critical areas like vendor management, which contributed to subsequent breaches. 2. Over-Reliance on Vendors By 2025, the SaaS ecosystem is more interconnected than ever, with businesses relying on dozens of third-party vendors for core operations. However, many companies fail to vet their vendors rigorously or monitor ongoing compliance with security standards. 3. Insufficient Board-Level Engagement Cybersecurity is often viewed as a technical issue rather than a business-critical risk. Executives and boards that fail to treat cybersecurity as a strategic priority leave organizations vulnerable to repeated failures. “Cybersecurity negligence isn’t just poor management; in today’s environment, it’s a direct business risk that can erode customer trust and brand reputation irreparably.” The Cost of Negligence in 2025 Data breaches are no longer just PR nightmares; they’re existential threats. The financial fallout from cybersecurity incidents has skyrocketed in recent years. According to the 2025 Ponemon Institute report, the average cost of a data breach has risen to $5.4 million, up from $4.5 million in 2023. For consumer-facing companies like DoorDash, the intangible costs—loss of customer trust, legal liabilities, and reputational damage—are even harder to quantify. In the U.S., regulatory bodies like the FTC and state governments have begun imposing heavier fines and stricter requirements on companies with repeated breaches. California’s Consumer Privacy Act (CCPA) and similar legislations have extended liability to companies that fail to adequately vet their vendors. This regulatory shift turns negligence into a legal liability, making breaches like DoorDash’s latest incident far more consequential. Lessons for the Business World Vendor Accountability: Ensure third-party vendors meet stringent cybersecurity standards and conduct regular audits. Board Involvement: Treat cybersecurity as a business risk and make it a board-level priority. Continuous Improvement: Build an adaptive security strategy that evolves with emerging threats. Actionable Steps for Business Leaders Every executive should ask themselves: Could this happen to us? The answer is almost always yes unless proactive measures are taken. Here’s how leaders can ensure their organizations avoid DoorDash’s fate: 1. Build a Culture of Security Cybersecurity needs to be embedded into the company culture, not treated as an IT department issue. From the C-suite to entry-level employees, everyone should understand their role in maintaining security. 2. Leverage AI for Threat Detection AI-powered cybersecurity tools have advanced significantly by 2025. These tools can identify anomalies, predict vulnerabilities, and automate responses to detected threats. Business leaders should invest in AI solutions to reduce the human error component that contributes to breaches. 3. Prioritize Vendor Risk Management Organizations must establish robust vendor management programs that include: Comprehensive risk assessments before onboarding vendors Regular audits of vendor compliance with security standards Clear incident response protocols for vendor-related breaches 4. Adopt Zero Trust Architecture Zero Trust principles are not new, but their adoption has accelerated in recent years. By assuming all access requests are potentially malicious until verified, companies can reduce the risk of both internal and external threats. The Road Ahead DoorDash’s third breach is a cautionary tale for all businesses. In an era of heightened consumer awareness and stricter regulations, repeated cybersecurity failures are no longer excusable. Companies must treat cybersecurity as a core business function, not a technical afterthought. For DoorDash, the path forward will require significant investment in vendor management, cultural shifts, and a commitment to continuous improvement. For other organizations, this should serve as an urgent wake-up call: learn from others’ mistakes before they become your own. ## Collins Aerospace Attack: Ransomware Grounds Major Airports - URL: https://bartmcd.com/blog/collins-aerospace-ransomware-grounds-major-airports - Published: 2025-09-23 The Attack That Stopped Airports in Their Tracks On September 21, 2025, airports across Europe were plunged into chaos by a ransomware attack targeting Collins Aerospace's MUSE passenger processing system. Heathrow, Brussels, and Berlin airports saw flight cancellations, delays, and stranded passengers as critical systems went offline. The attack is a stark reminder of aviation's growing vulnerability to cyber threats, underscoring the need for heightened defenses in an industry that remains a prime target for cybercriminals. While Collins Aerospace has yet to confirm the full extent of the breach, early reports suggest that hackers exploited a known vulnerability in outdated software components tied to the MUSE system. With ransomware tactics growing increasingly sophisticated, this attack highlights the dire consequences of neglecting cybersecurity in critical infrastructure. Why Aviation Is a High-Value Target The aviation industry has become a lucrative target for cybercriminals, combining high stakes, complex systems, and substantial financial incentives. Airports and airlines rely heavily on interconnected systems to manage passenger data, flight schedules, and cargo logistics. When these systems are compromised, disruptions cascade, causing widespread operational paralysis. Key Factors Driving Vulnerability Legacy Systems: Many aviation technologies, including the MUSE system, rely on outdated software that is difficult to patch or upgrade without interrupting operations. Interconnectivity: Airports are hubs of digital interconnectivity, where systems for baggage handling, ticketing, and air traffic control are linked, often creating single points of failure. Financial Incentives: Ransomware operators understand the urgency of restoring operations in aviation, making airports likely to pay ransom demands quickly. The Collins Aerospace attack fits the growing trend of targeting critical infrastructure, where downtime can cost millions and have far-reaching economic consequences. In 2024 alone, ransomware attacks on transportation systems surged by 30%, according to the Cyber Threat Intelligence Alliance (CTIA). Lessons Learned: A Call to Action for Executives The Collins Aerospace breach offers valuable lessons for business leaders across industries, not just aviation. Ensuring cybersecurity is no longer optional; it’s a strategic imperative. Here are actionable steps executives can take to mitigate risks: Prioritize Endpoint Security: Airports and airlines must invest in advanced endpoint detection and response systems (EDR) to monitor and neutralize threats in real time. Upgrade Legacy Systems: While costly and disruptive, replacing outdated infrastructure is essential to reducing vulnerabilities and improving resilience. Conduct Regular Penetration Testing: Simulate attacks on your systems to uncover weaknesses before cybercriminals do. Implement Zero Trust Architecture: Minimize the impact of breaches by ensuring no device or user is trusted by default. Train Your Workforce: Human error remains a top attack vector. Comprehensive training on phishing and ransomware threats can significantly reduce risk. Executives must recognize that cybersecurity is not just an IT concern; it’s a boardroom priority. In industries like aviation, where downtime can ripple across economies, these measures are critical to safeguarding operations. The Rise of AI-Powered Ransomware One of the most alarming aspects of the Collins Aerospace attack is its likely use of AI-powered ransomware. By 2025, threat actors have increasingly leveraged artificial intelligence to enhance their operations. AI can automate the reconnaissance phase, identify vulnerabilities faster, and even craft phishing emails that are nearly indistinguishable from genuine communications. How AI Is Changing the Threat Landscape Adaptive Malware: AI enables malware to dynamically adjust its behavior, evading detection by learning from intrusion attempts. Enhanced Phishing Attacks: AI-generated phishing emails replicate human-like language patterns, making them more convincing. Automated Vulnerability Scanning: AI can scour systems for exploitable weaknesses without manual input. These advancements make ransomware attacks increasingly difficult to counter. Organizations must respond with equally sophisticated defenses, including AI-driven threat detection and predictive analytics to stay ahead of attackers. Aviation’s Path Forward While the Collins Aerospace attack is a wake-up call, it’s also an opportunity for the aviation industry to reassess its cybersecurity posture. Collaboration across stakeholders—from airlines to tech providers—is crucial for building a more resilient ecosystem. Key Strategies for Building Resilience Industry-Wide Collaboration: Establish partnerships between airlines, airports, and cybersecurity firms to share threat intelligence and best practices. Government Support: Advocate for increased investment in cybersecurity initiatives aimed at protecting critical infrastructure. Proactive Incident Response Plans: Develop and rehearse detailed response protocols to minimize downtime during cyber incidents. Looking forward, aviation leaders must treat cybersecurity as a cornerstone of operational strategy. The attacks of today are only the tip of the iceberg in an increasingly digital and interconnected world. “This attack is a stark reminder that cybersecurity failures in critical infrastructure can have real-world consequences, grounding planes, disrupting economies, and eroding public trust. The time to act is now.” As ransomware continues to evolve, the Collins Aerospace breach should serve as a cautionary tale for leaders across all sectors. Cybersecurity is no longer just about protecting data; it’s about ensuring the continuity and safety of the systems that underpin modern society. ## Jaguar Land Rover Ransomware: UK's Most Economically Damaging Cyberattack - URL: https://bartmcd.com/blog/jaguar-land-rover-ransomware-uk-most-damaging - Published: 2025-09-16 The Ransomware Attack That Brought Jaguar Land Rover to Its Knees In early May 2025, Jaguar Land Rover (JLR) fell victim to a crippling ransomware attack that has since been labeled the UK’s most economically damaging cyberattack in history. The assault shut down production lines, disrupted global supply chains, and left dealerships worldwide unable to fulfill orders for more than three months. The fallout was so severe that the UK government intervened with a £1.5 billion bailout to stabilize the company, underscoring the devastating cost of cyber unpreparedness. As we reflect on this watershed moment in cybersecurity, the JLR attack serves as a chilling reminder of the vulnerabilities inherent in modern digital ecosystems. It also raises urgent questions for executives and policymakers: How did this happen? Could it have been prevented? And what does it mean for the future of cybersecurity in an era of increasingly sophisticated cybercriminal tactics? How the Attack Unfolded A Perfect Storm of Vulnerabilities The attack reportedly began with a phishing email targeting a senior JLR executive. Despite years of warnings about the dangers of phishing, a single click on a malicious link granted attackers access to JLR’s network. From there, advanced ransomware—believed to be a variant of BlackCat—spread rapidly, encrypting critical systems across production facilities and corporate offices. JLR’s reliance on highly interconnected systems compounded the problem. The company’s manufacturing lines, logistics operations, and dealership networks were all tightly integrated with its IT infrastructure. Once the ransomware took hold, it effectively paralyzed the entire operation. This is a prime example of how digital transformation, while bringing efficiency, also introduces systemic risks when cybersecurity is not prioritized. Delayed Detection and Response One of the most glaring failures in the JLR incident was the delayed detection of the breach. According to reports, the ransomware had been quietly infiltrating systems for several weeks before activating its encryption payload. The lack of robust threat detection and an effective incident response plan allowed the attackers to operate undetected for far too long, exacerbating the damage. When the ransomware finally activated, JLR’s internal teams were unprepared to contain the outbreak. Their backups were either insufficiently protected or also compromised, forcing the company into the unenviable position of negotiating with the attackers. Despite efforts to restore systems independently, the complexity of the attack meant that JLR ultimately paid a reported $75 million ransom in cryptocurrency—only to discover that the decryption keys provided were incomplete and unreliable. The Economic Fallout Ripple Effects Across Industries The financial impact of the attack extended far beyond JLR itself. The company’s production halt disrupted the supply chains of hundreds of suppliers and vendors, many of whom rely heavily on JLR contracts. Auto parts manufacturers, logistics providers, and even local businesses in regions where JLR operates faced significant revenue losses, layoffs, and, in some cases, bankruptcy. The attack also had a chilling effect on consumer confidence. With production stalled, dealership inventories dwindled, leading to months-long delays for customers who had pre-ordered vehicles. JLR’s reputation took a severe hit, and competitors like BMW, Tesla, and Mercedes-Benz capitalized on the chaos to capture market share. A Government Bailout and Regulatory Scrutiny Recognizing the broader economic implications, the UK government stepped in with a £1.5 billion bailout package to stabilize JLR and prevent a cascading economic crisis. However, this move was not without controversy. Critics argued that taxpayers should not bear the financial burden of corporate cybersecurity failures, and the incident has sparked renewed calls for stricter cybersecurity regulations across critical industries. In response, the UK introduced the Cybersecurity Accountability Act in July 2025, mandating rigorous compliance measures for companies deemed critical to national infrastructure. The legislation includes steep fines for failure to meet minimum security standards and requires executives to certify the adequacy of their cybersecurity programs—a shift reminiscent of the financial accountability reforms seen after the Enron scandal in the early 2000s. Lessons Learned for Executives 1. Cybersecurity Is a Board-Level Responsibility The JLR attack underscores the need for cybersecurity to be treated as a strategic priority, not just an IT issue. Boards and C-suite executives must actively engage in cybersecurity oversight, ensuring that adequate resources and attention are allocated to this critical area. Actionable insight: Conduct regular risk assessments and ensure that cybersecurity metrics are included in board reporting. Consider appointing a Chief Cybersecurity Officer (CCSO) or a similar role to drive accountability at the executive level. 2. Invest in Resilience, Not Just Prevention No organization can guarantee it will never suffer a breach, but the ability to detect, contain, and recover from attacks can dramatically mitigate damage. JLR’s experience highlights the importance of having robust incident response plans, secure and regularly tested backups, and a clear strategy for engaging with threat actors. Actionable insight: Regularly test incident response plans through tabletop exercises and red team simulations. Invest in advanced threat detection technologies, such as AI-driven anomaly detection, to reduce dwell time. 3. Third-Party Risk Cannot Be Ignored Interconnected supply chains and outsourced services are now standard in most industries, but they also expand the attack surface. JLR’s reliance on third-party vendors and contractors may have played a role in the attack’s escalation, as suppliers were unable to fulfill orders, compounding delays and financial losses. Actionable insight: Implement rigorous third-party risk management programs, including regular security audits and contractual requirements for cybersecurity compliance. Consider adopting zero-trust principles to limit the scope of access for external partners. 4. Cyber Insurance Is Not a Substitute for Security While JLR reportedly had cyber insurance, the policy only covered a fraction of the total damages. Insurers increasingly scrutinize claims, particularly when companies fail to demonstrate compliance with industry-standard security practices. Actionable insight: Treat cyber insurance as a last line of defense rather than a primary security strategy. Ensure your organization meets or exceeds the security controls required by your policy to avoid claim denials. The Future of Cybersecurity in Critical Industries The JLR ransomware attack has been a wake-up call for businesses across the globe. As cyber threats grow more sophisticated and interconnected systems become ever more prevalent, the cost of inaction is becoming untenable. The attack has catalyzed a shift in how organizations approach cybersecurity, with an emphasis on resilience, accountability, and collaboration. As we look ahead, several trends are poised to shape the future of cybersecurity: AI-Driven Threat Detection: Artificial intelligence will play an increasingly central role in identifying and mitigating threats in real-time, reducing the window of opportunity for attackers. Stricter Regulations: Governments worldwide are likely to follow the UK’s lead in imposing tougher cybersecurity requirements, particularly for critical infrastructure sectors. Increased Public-Private Collaboration: The scale and complexity of cyber threats demand closer cooperation between governments, private companies, and international organizations. Focus on Cyber Resilience: Organizations will shift from a prevention-centric approach to one that emphasizes resilience, ensuring they can withstand and recover from attacks. “The JLR attack is a stark reminder that cybersecurity is no longer optional—it’s existential. Organizations that fail to act today risk becoming the next cautionary tale tomorrow.” Conclusion Jaguar Land Rover’s ransomware nightmare is a sobering example of the real-world consequences of cyber negligence. For executives and decision-makers, the message is clear: cybersecurity must be woven into the fabric of organizational strategy. The stakes are too high, and the threats are too persistent to do otherwise. Let JLR’s experience serve as both a warning and an opportunity. By prioritizing cybersecurity, investing in resilience, and fostering a culture of accountability, businesses can not only protect themselves but also thrive in an increasingly uncertain digital landscape. ## Model Context Protocol: When AI Agents Control Your OS - URL: https://bartmcd.com/blog/model-context-protocol-ai-agents-control-os - Published: 2025-09-09 Model Context Protocol: The AI Revolution Inside Your Operating System The idea of an AI seamlessly orchestrating your digital tasks once seemed like science fiction. But in 2025, it’s a reality, thanks to the Model Context Protocol (MCP). Microsoft’s recent integration of MCP into Windows has transformed the operating system into an AI-powered command center, allowing intelligent agents to control, manage, and optimize workflows across applications. While this innovation has unlocked unprecedented productivity, it also raises critical questions about security, autonomy, and trust in a world where AI agents now have access to your operating system. What Is Model Context Protocol? Model Context Protocol, or MCP, is a framework that allows AI models to interact with your operating system and its programs in a highly contextual manner. Think of MCP as a universal translator and coordinator for AI agents. It enables them to understand the state of different applications, make decisions, and execute actions across multiple programs with precision. How MCP Works At its core, MCP serves as a bridge between the AI agent and the operating system. Here’s how it functions: Contextual Awareness: MCP grants AI agents real-time visibility into the status of various applications, such as which files are open, active browser tabs, or pending tasks in a project management tool. Action Orchestration: AI can initiate actions like sending emails, updating calendar entries, or generating reports without the user needing to switch between apps. Permission Framework: MCP includes a robust permission system, allowing users to control which actions AI agents can perform and which data they can access. For example, imagine you’re preparing for a client meeting. Your AI assistant can pull relevant documents from your cloud storage, arrange slides in PowerPoint, summarize recent emails from the client, and even set up a Teams call—all without you lifting a finger. This is the promise of MCP. Why MCP Matters in 2025 Microsoft’s decision to bake MCP into Windows comes at a time when AI is no longer confined to standalone tools like ChatGPT or Google Bard. Instead, AI is becoming an integral part of our digital infrastructure. MCP represents a fundamental shift in how we interact with technology, moving from passive tools to proactive collaborators. Implications for Productivity The productivity gains are undeniable. MCP-enabled AI agents can handle repetitive tasks, manage complex workflows, and even anticipate your needs. Businesses are reporting double-digit increases in efficiency as employees spend less time on administrative tasks and more on strategic work. However, this newfound productivity comes with a learning curve. Organizations must train employees to work effectively alongside AI and adapt their workflows to leverage MCP’s capabilities fully. Security in the MCP Era With great power comes great responsibility, and MCP’s integration into Windows raises significant security concerns. The protocol’s ability to grant AI agents deep access to an operating system is a double-edged sword. While it enables automation and innovation, it also creates new attack surfaces for cybercriminals. “MCP is a game-changer, but it’s also a Pandora’s box for cybersecurity. Organizations must rethink their security strategies to address these emerging threats.” To mitigate risks, Microsoft has implemented several safeguards, including: Zero-Trust Architecture: AI agents must authenticate and operate within predefined permissions. Transparent Logs: Every action an AI agent takes through MCP is logged for auditability. AI Behavior Monitoring: Real-time monitoring detects and flags suspicious or unauthorized actions. Nevertheless, businesses must remain vigilant. A compromised AI agent could wreak havoc, from leaking sensitive data to sabotaging critical workflows. Challenges and Controversies Despite its promise, MCP has sparked debate among technologists, privacy advocates, and business leaders. The key issues include: Privacy Concerns By design, MCP requires AI agents to access sensitive data to function effectively. This raises questions about how user data is stored, processed, and shared. While Microsoft has emphasized its commitment to privacy, critics argue that the protocol still centralizes too much power in the hands of AI and OS manufacturers. Job Displacement The automation enabled by MCP has reignited fears about job displacement. While advocates argue that MCP frees workers from mundane tasks, skeptics worry that it could make certain roles obsolete, particularly in administrative and support functions. Vendor Lock-In Microsoft’s integration of MCP into Windows strengthens its position in the enterprise market but also raises concerns about vendor lock-in. Businesses that adopt MCP may find it challenging to switch to alternative platforms, especially as workflows and data become deeply intertwined with the protocol. Preparing for an MCP-Driven Future As MCP reshapes how we work, organizations must proactively adapt to remain competitive. Here are some actionable steps for business leaders: Invest in AI Training: Equip your workforce with the skills to collaborate effectively with AI tools and understand MCP’s capabilities. Review Security Policies: Update your cybersecurity framework to address the unique risks associated with MCP, including AI agent monitoring and data protection. Experiment and Iterate: Pilot MCP-enabled workflows in controlled environments to identify productivity gains and address potential challenges before scaling. Engage in Dialogue: Participate in industry forums to shape the standards and ethical guidelines governing MCP and similar technologies. By taking these steps, organizations can harness MCP’s potential while mitigating its risks. The Road Ahead Model Context Protocol is a major milestone in the evolution of AI and computing. By enabling AI agents to control operating systems, MCP has blurred the lines between human and machine workflows. While the technology is still in its early days, its impact on productivity, security, and the nature of work is already profound. As we look to the future, the challenge will be to strike the right balance between innovation and responsibility. MCP offers a glimpse of what’s possible when AI is deeply integrated into our digital lives—but it also reminds us that with great power comes an even greater need for vigilance. ## Drift Supply Chain Attack: When Security Vendors Get Hacked - URL: https://bartmcd.com/blog/drift-supply-chain-attack-security-vendors-hacked - Published: 2025-08-20 Drift Supply Chain Attack: A Wake-Up Call for the Industry In a chilling reminder of the interconnectedness of modern cybersecurity, the Drift supply chain attack has rocked the industry to its core. Drift, a widely trusted cloud-based automation platform, was breached in early August 2025, leading to cascading compromises at several high-profile organizations, including Palo Alto Networks, Zscaler, and even Google. The incident has exposed vulnerabilities in how security vendors manage their own defenses and has forced organizations to rethink their reliance on third-party tools. This attack isn’t just a footnote—it’s a watershed moment for cybersecurity. What Happened: Unpacking the Drift Breach The attack began with a sophisticated compromise of Drift’s backend systems, which are used to deploy updates and manage integrations across its vast client base. Threat actors, believed to be a highly capable Advanced Persistent Threat (APT) group, exploited a zero-day vulnerability in Drift's platform to inject malicious code into software updates. This code was then unknowingly distributed to Drift’s customers, effectively weaponizing their own security tools against them. Among the most notable victims were: Palo Alto Networks: Malware embedded in Drift updates allowed attackers to gain unauthorized access to their cloud security management layer. Zscaler: The breach compromised sensitive customer data and created vulnerabilities in their secure web gateway services. Google: Although Google’s layered defenses mitigated the full impact, attackers gained limited access to their internal ticketing and monitoring systems. While Drift has since patched the vulnerability and revoked compromised certificates, the damage is done. The trust in even the most well-regarded vendors has been shaken, and questions about supply chain security have resurfaced with renewed urgency. The Anatomy of a Supply Chain Attack Why Are Supply Chains an Attractive Target? Supply chain attacks, like the infamous SolarWinds breach of 2020, are high-reward operations for threat actors. By compromising a single vendor, attackers gain a foothold into the networks of multiple organizations. Drift’s platform, used by hundreds of enterprises for workflow automation and API management, was an ideal target due to its widespread adoption and deep integration into client systems. The attackers in this case demonstrated a deep understanding of Drift’s internal architecture. By leveraging a zero-day exploit, they bypassed existing detection mechanisms and inserted malicious payloads directly into Drift's update pipeline. The subsequent updates appeared legitimate to Drift’s clients, making the attack almost impossible to detect until it was too late. The Chain Reaction The Drift attack underscores the cascading nature of supply chain compromises. Once the malware infiltrated organizations like Palo Alto Networks and Zscaler, it opened the door for further exploitation: Attackers gained access to sensitive customer data, including configurations and security policies. They exploited trust relationships to move laterally across networks. Some organizations unknowingly propagated the malware to their own customers, extending the attack’s reach. This ripple effect highlights the critical need for organizations to assess not just their own security posture but also that of their vendors and partners. Lessons Learned: Strengthening Supply Chain Security 1. Demand Transparency from Vendors Organizations must hold their vendors to higher standards of transparency. This includes: Requiring detailed security audits and certifications. Demanding timely disclosure of vulnerabilities and breaches. Ensuring vendors provide clear guidelines for responding to potential compromises. In the case of Drift, earlier transparency about their security protocols might have mitigated the impact of this attack. 2. Implement Zero Trust Architectures Zero Trust principles are more relevant than ever. Organizations should assume that even trusted vendors can be compromised. Key measures include: Strictly limiting the permissions and access of third-party tools. Continuously monitoring for anomalous behavior in vendor applications. Segmenting networks to prevent lateral movement. “Trust is not a given in cybersecurity. It must be earned and constantly verified.” 3. Automate Supply Chain Risk Management Given the complexity of modern supply chains, manual oversight is no longer sufficient. Organizations should leverage AI-driven tools to assess and monitor vendor risks in real time. These tools can: Analyze vendor behaviors for inconsistencies. Identify potential vulnerabilities in third-party software. Provide actionable insights to mitigate risks before they escalate. Investing in such technologies is no longer optional—it’s a necessity. What’s Next for the Industry? The Drift supply chain attack has already prompted significant responses from the cybersecurity community. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued updated guidelines for vendor risk management, and several industry leaders are calling for stricter regulations around software supply chain security. However, regulation alone won’t solve this problem. It’s up to individual organizations to proactively address their vulnerabilities. At the same time, vendors like Drift must reassess their own practices. This includes conducting regular red team exercises, enhancing vetting processes for updates, and investing in advanced threat detection capabilities. Trust, once lost, is difficult to regain, and Drift will need to work tirelessly to restore confidence in their platform. Conclusion: A Call to Action The Drift supply chain attack is a stark reminder that no organization is invulnerable. As we continue to integrate third-party tools into our workflows, the risk of compromise grows alongside the convenience these tools provide. Executives must take this attack as a wake-up call to prioritize supply chain security, not as an afterthought but as a core component of their cybersecurity strategy. To safeguard your organization, focus not just on building robust internal defenses, but also on ensuring the integrity of your external partnerships. After all, in today’s hyperconnected world, your security is only as strong as the weakest link in your supply chain. ## GPT-5 Is Here: 400K Tokens and Unified Multimodal Processing - URL: https://bartmcd.com/blog/gpt-5-400k-tokens-unified-multimodal-processing - Published: 2025-08-12 GPT-5: Redefining the Bounds of AI Capability In a world where AI has become the backbone of industries from healthcare to finance, OpenAI has once again raised the bar with the release of GPT-5. Boasting an astonishing 400,000-token context window and unified multimodal processing, this latest iteration is not just an incremental improvement—it's a fundamental shift. Whether you're leading a business, managing a technical team, or simply intrigued by the evolution of AI, understanding GPT-5’s capabilities is essential to staying competitive in the rapidly changing landscape of 2025. What Makes GPT-5 a Game-Changer? 400,000 Tokens: Context Without Compromise One of the most groundbreaking aspects of GPT-5 is its ability to process up to 400,000 tokens in a single prompt. For context, this is roughly equivalent to 300 full pages of text. The implications are profound: Complex Document Analysis: Legal teams can now analyze entire contracts, regulatory filings, and case histories without breaking them into smaller chunks. Enterprise-Scale Applications: Financial modeling, supply chain optimization, and product roadmaps can now be fed into the model in one go, enabling unified insights. Improved Memory: GPT-5 can maintain context across lengthy conversations or processes, making it a powerful tool for customer service and technical support. For executives, this expanded token capacity means fewer limitations on how AI can digest and interpret your organization's most complex challenges. Unified Multimodal Processing While GPT-4 introduced basic multimodal capabilities, GPT-5 takes this to the next level by seamlessly integrating text, images, video, and even audio into its reasoning processes. Imagine uploading a sales report, a customer feedback video, and an audio recording of a stakeholder meeting, and receiving a cohesive analysis that ties all these inputs together. “GPT-5’s multimodal capabilities are no longer about convenience—they are about creating unified, actionable intelligence across diverse data formats.” From automating quality assurance in manufacturing to generating personalized marketing campaigns, the applications are limited only by your imagination. For example: Healthcare: Analyze a patient’s medical history, X-rays, and lab results simultaneously for faster and more accurate diagnoses. Retail: Combine customer purchase data, social media sentiment, and promotional video performance to fine-tune marketing strategies. Security: Process surveillance footage, access logs, and threat reports to identify vulnerabilities and ensure compliance. Implications for Businesses and Leaders New Frontiers in Automation With GPT-5, the boundaries of automation are expanding. This is particularly critical as businesses continue to face global labor shortages and increasing cost pressures. Key areas where GPT-5 can drive immediate impact include: Customer Engagement: Craft highly personalized, context-aware responses that enhance user satisfaction and reduce churn. Product Development: Use AI to simulate customer interactions and predict feature adoption before a single line of code is written. Executive Decision-Making: Generate comprehensive dashboards that synthesize financials, market trends, and team performance metrics. Leaders should begin identifying repetitive, high-volume tasks where GPT-5 can act as a force multiplier. The goal isn't just operational efficiency—it's strategic advantage. Data Strategy: A Competitive Necessity To extract maximum value from GPT-5, organizations must revisit their data strategies. Unified multimodal processing requires clean, well-organized data streams across text, video, audio, and images. Ask yourself: Is our data centralized? Fragmented data silos will diminish GPT-5's efficacy. Are we capturing the right types of data? Multimodal processing shines when diverse data sources are leveraged together. Are our teams ready? Training employees to effectively use GPT-5 is as important as the technology itself. Investing in data infrastructure today will ensure you can fully harness GPT-5's capabilities tomorrow. The Challenges and Ethical Questions As with any transformative technology, GPT-5 introduces new challenges that leaders must proactively address. AI Governance The expanded token limit and multimodal capabilities make GPT-5 more powerful—but also more prone to misuse. Deepfakes, disinformation campaigns, and privacy violations are legitimate concerns. Establishing robust AI governance frameworks is imperative: Implement audit trails for AI outputs to ensure accountability. Regularly update ethical guidelines to reflect new capabilities. Partner with industry groups to standardize responsible AI practices. Bias in Multimodal Data GPT-5’s ability to process diverse data types amplifies the risk of bias. For example, skewed datasets in image recognition or audio transcripts could lead to flawed conclusions. Leaders must prioritize: Regular bias audits to identify and mitigate issues. Diversity in training datasets to reflect real-world complexity. Building multidisciplinary teams that include ethicists, sociologists, and domain experts. Ethics isn’t just a regulatory requirement—it’s a business imperative as consumers increasingly demand transparency and fairness. What Should You Do Next? GPT-5 represents not just a technological leap but a strategic opportunity for those prepared to embrace it. Here’s how you can start: Audit Your AI Readiness: Evaluate your current AI tools, data infrastructure, and employee capabilities. Identify High-Impact Use Cases: Focus on areas where GPT-5 can deliver measurable ROI within the next 6-12 months. Train Your Teams: Equip your workforce with the skills to interact effectively with GPT-5, from prompt engineering to ethical considerations. Engage with Experts: Partner with AI consultants or vendors to accelerate adoption and avoid common pitfalls. The organizations that act now will be the ones defining their industries in the years to come. Final Thoughts As we stand on the precipice of a new era in AI, GPT-5 is a reminder of how far we've come—and how much further we can go. Its capabilities are vast, but its true potential lies in the hands of those who use it thoughtfully and strategically. The future is here; it’s up to you to shape it. ## AI at the Olympics: How Paris 2024 Used Machine Learning for Security - URL: https://bartmcd.com/blog/paris-2024-olympics-ai-machine-learning-security - Published: 2025-08-05 The AI Revolution at Paris 2024 Paris 2024 marked a turning point in global event security, where artificial intelligence and machine learning technologies played a pivotal role in ensuring public safety. As millions of spectators and athletes descended upon the city, organizers faced unprecedented challenges. From combating cybersecurity threats to safeguarding physical venues, AI proved to be the backbone of an innovative security strategy that set new standards for the future. AI-Driven Surveillance Systems One of the most significant advancements at the Paris Olympics was the deployment of AI-enhanced surveillance systems. These systems went far beyond traditional CCTV cameras, leveraging machine learning algorithms to identify threats in real-time. How It Worked AI-powered cameras analyzed video feeds to detect unusual behavior patterns, such as loitering in restricted areas or large crowd movements indicative of stampedes. Facial recognition systems were integrated to identify individuals on watchlists or those using counterfeit credentials. AI models adapted to changing environmental conditions, such as lighting and crowd density, improving accuracy over time. “By automating threat detection, Paris 2024 drastically reduced response times, ensuring swift action against security breaches.” The results were extraordinary: security personnel intercepted multiple unauthorized attempts to access restricted areas, and the system effectively managed crowd control during high-traffic events like the opening ceremony. Cybersecurity Defenses Reinforced by AI With over 10 million attendees and a global digital audience, the Olympics represented an irresistible target for cybercriminals. Organizers anticipated sophisticated attacks, from ransomware to phishing campaigns aimed at disrupting operations. AI became a critical tool in defending the games’ digital infrastructure. Proactive Threat Detection Machine learning algorithms monitored network traffic for anomalies, flagging suspicious activity before it could escalate. AI systems identified and neutralized phishing attempts targeting staff and volunteers, many of whom were accessing sensitive systems remotely. Natural language processing (NLP) was employed to analyze vast amounts of email and communication data, identifying fraudulent messages instantly. These proactive measures ensured that highly sensitive data—such as athlete medical records and event schedules—remained secure. Additionally, AI enabled faster recovery from minor breaches, limiting downtime and maintaining public trust. Managing Public Safety with Predictive Analytics Unlike previous Olympics, Paris 2024 embraced predictive analytics to anticipate and mitigate risks before they materialized. AI models were trained on historical data from past events, as well as real-time inputs like weather, crowd density, and transportation schedules. Applications of Predictive Analytics Forecasting crowd flow to optimize the deployment of security personnel and emergency services. Analyzing social media activity to identify potential flashpoints, such as planned protests or misinformation campaigns. Predicting logistical bottlenecks at checkpoints, reducing wait times for attendees. “By leveraging predictive analytics, Paris 2024 created a safer, more seamless experience for everyone involved.” The impact was tangible: emergencies were mitigated early, and the public enjoyed smoother access to venues and transportation hubs, contributing to the overall success of the games. Ethical Considerations and Transparency While AI brought undeniable benefits, it also raised important questions about privacy and transparency. Organizers took deliberate steps to address these concerns: Strict data governance policies ensured that personal information collected by AI systems was anonymized and securely stored. Public awareness campaigns educated attendees on how AI was being used and what measures were in place to protect their rights. Independent audits evaluated the fairness and accuracy of AI algorithms, preventing potential biases in surveillance and decision-making. These efforts demonstrated that technology and ethics could coexist, setting a precedent for future events and industries that implement AI at scale. Looking Ahead: AI’s Role in Global Events The success of Paris 2024 has already sparked interest among other event organizers, from the FIFA World Cup to large-scale music festivals. AI’s ability to enhance security while improving operational efficiency is clear. However, the lessons learned from Paris will shape how AI is deployed in the future: Investing in robust AI infrastructure early to ensure scalability during peak activity. Balancing security measures with ethical considerations to maintain public trust. Collaborating with private sector leaders in AI to stay ahead of emerging threats. As AI continues to evolve, its role in global events will undoubtedly expand, offering new possibilities for innovation while keeping safety at the forefront. “Paris 2024 proved that AI is not just a tool—it’s a transformative force in modern security operations.” Ultimately, the Paris Olympics showcased how machine learning and AI can enable safer, smarter, and more efficient events, paving the way for a future where technology enhances every aspect of global gatherings. ## AI Agents Can Now Work 7 Hours Straight: What This Means for Business - URL: https://bartmcd.com/blog/ai-agents-work-7-hours-straight-business-automation - Published: 2025-07-28 AI Agents Can Now Work 7 Hours Straight: A Turning Point in Enterprise Automation On July 2025, Anthropic’s Claude Opus 4 announced its groundbreaking ability to work continuously for up to seven hours on complex tasks—a feat that marks a paradigm shift in how businesses approach automation and productivity. This development underscores the growing maturity of AI agents as capable collaborators rather than mere tools. As businesses grapple with scaling operations and reducing costs, the implications of this advancement are both transformative and challenging. What Makes Claude Opus 4 Different? Unlike earlier iterations of AI agents, Claude Opus 4 combines extended task durability with enhanced contextual understanding. This AI model can seamlessly handle multi-step processes, analyze intricate datasets, and adapt its approach based on real-time feedback. Its ability to work for seven hours straight without human intervention is unparalleled in the field. Here’s why: Context Retention: Claude Opus 4 maintains contextual awareness across extended periods, ensuring consistency and accuracy throughout its operations. Dynamic Problem-Solving: The agent can pivot strategies mid-task, allowing for greater flexibility in addressing unexpected challenges. Energy Efficiency: Optimized algorithms ensure minimal computational strain, reducing the cost of prolonged engagements. These features make Claude Opus 4 not just a technical marvel but a practical asset for enterprise applications ranging from customer service to financial modeling. Implications for Business Automation Redefining Workflows The ability of AI agents to sustain focus for extended periods opens up new possibilities for workflow optimization. Tasks that once required human oversight or multiple handoffs can now be streamlined. For example: Customer service agents powered by Claude Opus 4 can handle complex support tickets end-to-end without escalation. Financial analysts can rely on AI to preprocess and model datasets overnight, enabling faster decision-making during business hours. Marketing teams can deploy AI agents to manage campaigns, analyze performance metrics, and suggest actionable adjustments in real time. By automating these processes, organizations gain agility, reduce costs, and free up human employees to focus on strategic initiatives. Enhanced Collaboration Between Humans and AI AI agents like Claude Opus 4 are no longer confined to performing isolated tasks. Instead, they are evolving into collaborators that complement human expertise. For instance: Co-creation: Design teams can use AI to generate prototypes, iterate on concepts, and refine outputs based on human feedback. Decision Support: Executives can leverage AI-driven simulations and predictions to make informed decisions in high-stakes scenarios. Knowledge Management: AI can serve as a digital assistant, organizing and retrieving insights from vast corporate databases during meetings. This synergy between humans and AI fosters innovation and drives competitive advantage, especially in industries where creativity and precision are paramount. Challenges and Risks Operational Risks While the capabilities of AI agents have expanded, their prolonged use raises operational risks that businesses must address: Over-reliance: Dependence on AI for critical tasks can create vulnerabilities if systems fail or produce errors. Bias Amplification: Extended engagements increase the likelihood of AI reinforcing biases embedded in training data. Security Concerns: Prolonged runtime may expose AI systems to cyber threats or unauthorized access. To mitigate these risks, organizations must implement robust oversight mechanisms and conduct regular audits of AI operations. Ethical Considerations As AI agents take on more responsibilities, ethical dilemmas become inevitable. Businesses must navigate questions such as: Should AI agents be allowed to make decisions that impact human lives, such as approving loans or screening job candidates? How do we ensure transparency in AI-driven processes, especially when outcomes are difficult to explain? What safeguards should be in place to prevent misuse or exploitation of AI capabilities? Addressing these concerns requires a commitment to ethical AI development and adherence to regulatory frameworks, such as the EU’s AI Act, which was expanded earlier this year to include stricter compliance measures for generative AI systems. Actionable Steps for Business Leaders To leverage the potential of AI agents like Claude Opus 4, executives must adopt a strategic approach. Here are key steps to consider: Invest in AI Training: Ensure that employees understand how to collaborate effectively with AI systems and interpret their outputs. Audit AI Deployments: Regularly evaluate the performance, security, and ethical implications of AI operations within your organization. Align AI with Business Goals: Identify areas where AI can deliver the greatest value, such as improving customer experiences or optimizing supply chain management. Prepare for Regulation: Stay ahead of compliance requirements by partnering with legal experts and incorporating transparency measures into AI workflows. “The businesses that thrive in the AI era will be those that balance innovation with responsibility, leveraging technology to enhance both productivity and trust.” Looking Ahead As AI agents like Claude Opus 4 continue to evolve, their impact on enterprise automation will only deepen. By 2030, we may see AI systems capable of working autonomously for days, handling projects that require sustained attention and adaptability. For now, the seven-hour milestone serves as a reminder of the incredible strides we’ve made—and the opportunities that lie ahead. For business leaders, this isn’t just a technological breakthrough; it’s a call to action. The future of work is being shaped by AI, and those who embrace its potential responsibly will lead the way into a new era of productivity and innovation. ## The 8 Minute Hack - URL: https://bartmcd.com/blog/the-8-minute-hack-guest-wifi-printer-exploit - Published: 2025-07-24 Better than tell you - just watch the video: List as Bart recounts a real-world penetration test conducted for a large asset management firm participating in an SEC governance program. While waiting in the lobby before the scheduled test, a penetration tester connected to the firm’s guest Wi-Fi using publicly displayed credentials. A basic network scan revealed only the tester’s laptop and an outdated, seven-year-old multifunction printer. The tester exploited a buffer overflow vulnerability on the printer, gaining command-line access within seconds. Cached administrator credentials from a prior login were discovered on the device. Although the printer’s Wi-Fi interface was connected to the guest network, its physical Ethernet port was connected to the firm’s production network, effectively creating a bridge between the two environments. Using the compromised printer and recovered admin credentials, the tester was able to move laterally into the production network and ultimately access the firm’s production database. The entire compromise—from sitting in the lobby to capturing the production database “flag”—took approximately eight minutes, before the meeting even began. The story highlights how overlooked devices like printers, poor network segmentation, and credential hygiene failures can lead to rapid, full-scale compromise—even during routine security exercises. ## ChatGPT Agent Launch: The Unified AI Workflow System - URL: https://bartmcd.com/blog/chatgpt-agent-unified-ai-workflow-system - Published: 2025-07-18 Revolutionizing AI Workflows: OpenAI’s Unified Agent System On July 18, 2025, OpenAI unveiled the next evolution in artificial intelligence productivity: the ChatGPT Agent. By integrating Operator, Deep Research, and the familiar ChatGPT interface into a single unified AI system, OpenAI has redefined what it means to work smarter in the age of artificial intelligence. This breakthrough isn’t just an incremental upgrade—it’s a paradigm shift in how businesses, researchers, and individuals interact with AI. What Is ChatGPT Agent? The ChatGPT Agent combines three previously standalone elements—Operator, Deep Research, and ChatGPT—into one cohesive system. OpenAI’s ambition was clear: streamline workflow automation, enhance decision-making, and close the gap between human input and AI-driven execution. With this unified system, users can now move seamlessly between tasks without the friction of managing multiple interfaces or AI models. Key Features of the Unified Agent Here’s what makes the ChatGPT Agent unique: Task Automation: Operator functionality has been upgraded to handle complex workflows, from scheduling meetings and summarizing documents to executing multi-step processes autonomously. Enhanced Research Capabilities: Deep Research’s advanced analytical engine is now embedded within the Agent, offering dynamic insights, data synthesis, and real-time updates on critical topics. Conversational Intelligence: The conversational abilities of ChatGPT ensure smooth, intuitive interaction—users can simply describe their needs, and the system dynamically adapts to execute them. Customizable Personas: The Agent allows for tailored AI personas, enabling industry-specific expertise or personal preferences to guide its responses and actions. “The ChatGPT Agent is more than a tool—it’s your personal AI colleague, capable of handling everything from strategic planning to operational execution.” Why This Matters for Business Leaders For executives and decision-makers, the ChatGPT Agent introduces a new era of efficiency and innovation. Consider how today’s corporate environments have shifted. Post-pandemic hybrid work models are now the norm, and the demand for seamless digital collaboration tools has skyrocketed. Add to this the increasingly complex global challenges businesses face—supply chain disruptions, cybersecurity threats, and economic uncertainty—and the need for adaptive, intelligent systems becomes evident. Driving Strategic Outcomes Accelerated Problem Solving: The Agent’s ability to combine research, analysis, and execution eliminates bottlenecks, allowing teams to move faster on critical decisions. Cost Optimization: By automating repetitive tasks and enhancing productivity, companies can reduce overhead costs and allocate resources more effectively. Data-Driven Insights: The Agent’s integrated research capabilities ensure executives are always armed with the latest data and trends, tailored to their industry. In short, the ChatGPT Agent doesn’t just help businesses survive—it positions them to thrive in an increasingly competitive landscape. The Technology Behind the ChatGPT Agent OpenAI’s success with the ChatGPT Agent stems from its mastery of several key technologies: Advanced Multimodal Models The Agent leverages multimodal AI models, capable of processing text, images, audio, and even video. This allows it to deliver richer, more nuanced responses across a wide range of inputs. For example, it can analyze visual data like charts or diagrams alongside written reports for deeper context. Dynamic Learning Systems Unlike previous iterations, the ChatGPT Agent employs dynamic learning. It adapts not just to individual user preferences but also to evolving organizational goals, ensuring alignment with long-term strategies. Enhanced Security Protocols Cybersecurity remains a top priority, and OpenAI has embedded robust safeguards into the ChatGPT Agent. Features like end-to-end encryption, secure API integrations, and anomaly detection ensure that sensitive data stays protected. “The ChatGPT Agent is as secure as it is powerful, giving organizations the confidence to deploy it across critical operations.” How to Maximize the ChatGPT Agent To unlock the full potential of OpenAI’s latest innovation, leaders need to approach adoption strategically. Here are actionable steps for leveraging the ChatGPT Agent effectively: Start Small: Identify high-impact areas where the Agent can immediately add value—such as automating data analysis or streamlining communications. Train Your Teams: Ensure employees understand how to interact with the Agent to maximize its capabilities. Host workshops or provide tutorials tailored to your organization’s needs. Integrate with Existing Systems: The Agent works best when paired with existing software and workflows. Invest in API integrations to create a seamless experience. Monitor and Optimize: Regularly review the Agent’s outputs and adjust configurations to align with evolving business goals. By taking these steps, organizations can fully harness the transformative power of the ChatGPT Agent. The Road Ahead As we move deeper into 2025, the ChatGPT Agent represents just the beginning of what unified AI systems can achieve. OpenAI has hinted at future updates, including more advanced predictive analytics, deeper integrations with IoT devices, and expanded industry-specific modules. For now, the ChatGPT Agent stands as a testament to the progress we’ve made in AI. It’s not just a tool—it’s a partner in innovation, designed to amplify human potential and drive progress in every sector. “The future of AI isn’t about replacement—it’s about augmentation. The ChatGPT Agent exemplifies this philosophy, empowering users to achieve more than ever before.” ## 700Credit Breach: 5.8 Million at Risk in Automotive Supply Chain Attack - URL: https://bartmcd.com/blog/700credit-breach-supply-chain-attack-58-million - Published: 2025-07-08 The 700Credit Breach: A Wake-Up Call for Supply Chain Cybersecurity The automotive industry is reeling from the latest cybersecurity breach at 700Credit, a leading provider of credit reports and loan prequalification services. In a sophisticated supply chain attack, hackers exploited a third-party API, exposing sensitive data for 5.8 million auto loan applicants. This breach not only underscores the continued vulnerabilities in supply chain ecosystems but also raises urgent questions about the industry's preparedness to secure customer data in an era of increasingly interconnected systems. As investigations continue, this incident reveals critical lessons for businesses reliant on third-party vendors. Let’s break down what happened, why it matters, and how companies can protect themselves from similar threats. What Happened: Anatomy of the 700Credit Breach The breach was first detected in late June 2025, when unusual activity was identified in a third-party API used by 700Credit to facilitate real-time credit checks between auto dealerships, lenders, and consumers. Cybercriminals reportedly exploited a zero-day vulnerability in the API’s authentication process, gaining unauthorized access to sensitive customer data. Early reports indicate that the exposed information includes: Full names Social Security numbers Driver’s license details Credit scores Loan application details Investigators believe the attackers leveraged advanced automation tools to exfiltrate data over weeks before the breach was discovered, highlighting a growing trend where cybercriminals use AI to scale their attacks. "This breach isn’t just about 700Credit—it’s a critical reminder that your organization is only as secure as the weakest link in your supply chain." Why Supply Chain Attacks Are on the Rise The 700Credit incident is part of a broader surge in supply chain attacks targeting third-party vendors. According to the 2025 Global Cybersecurity Trends Report, nearly 65% of all breaches this year have involved a compromised supplier or service provider. Several factors contribute to this rise: 1. Increasing Interconnectivity Modern businesses rely heavily on APIs and cloud integrations to streamline operations and improve customer experiences. However, each integration creates a potential entry point for cybercriminals. The more connected an ecosystem, the larger its attack surface. 2. Lagging Vendor Security Standards Many third-party vendors, especially in industries like automotive, lack the robust security frameworks required to withstand today’s sophisticated threats. Smaller vendors often prioritize functionality over rigorous security testing, leaving them vulnerable. 3. Weaponized AI Hackers are now leveraging AI to automate vulnerability scanning, credential stuffing, and data exfiltration. These tools make it easier to find and exploit weaknesses in interconnected systems, as seen in this breach. 4. Slow Incident Detection On average, supply chain breaches take 45-60 days to detect, according to industry benchmarks. By the time an attack is discovered, the damage is often extensive, as demonstrated by the weeks-long data exfiltration at 700Credit. Key Takeaways for Business Leaders The 700Credit breach serves as a stark reminder that supply chain security cannot be an afterthought. Here are actionable steps executives should take to mitigate risks: 1. Strengthen Third-Party Risk Management Establish a robust vendor risk management program that includes: Comprehensive security assessments for all third-party vendors Contractual requirements for regular penetration testing Mandating adherence to industry-recognized security frameworks like ISO 27001 or SOC 2 Don’t just trust—verify. Regularly audit your vendors’ security practices to ensure compliance. 2. Secure API Integrations Given the role of APIs in this breach, it’s critical to prioritize API security measures, such as: Implementing API gateways with robust authentication and rate-limiting features Encrypting all data transmitted via APIs Deploying AI-driven monitoring tools to detect unusual API traffic patterns 3. Invest in AI-Powered Threat Detection Traditional security tools are no match for the speed and sophistication of AI-driven attacks. Invest in advanced threat detection systems that leverage machine learning to identify anomalies in real time. These tools can flag malicious activity before data exfiltration occurs. 4. Develop a Cyber Resilience Plan No system is immune to attack, which is why resilience is key. Ensure your organization has: A tested incident response plan Secure data backup systems to prevent ransomware disruptions Cyber insurance coverage tailored to supply chain risks Resilience isn’t just about recovery—it’s about minimizing the impact of an attack and returning to normal operations quickly. Looking Ahead: The Future of Supply Chain Security The 700Credit breach will likely serve as a catalyst for regulatory changes in the automotive industry, similar to how the SolarWinds attack in 2020 spurred new cybersecurity mandates for software vendors. Expect to see: Stricter regulations: Governments may introduce new laws requiring vendors to meet minimum cybersecurity standards. Enhanced transparency: Businesses might demand greater visibility into their vendors’ security postures, including real-time risk dashboards. Increased investment: Organizations will likely allocate larger budgets to secure their supply chains, recognizing the financial and reputational risks of a breach. In a world where supply chains are only becoming more complex, proactive security measures are no longer optional—they’re a business imperative. Final Thoughts The 700Credit breach is a stark reminder that even trusted partners can introduce significant risks to your organization. As technology evolves, so do the tactics of cybercriminals. By investing in robust supply chain security, prioritizing API protection, and embracing AI-driven threat detection, business leaders can stay ahead of the curve and protect their customers’ trust. "Cybersecurity isn’t just an IT issue—it’s a boardroom priority. The 700Credit breach is proof that ignoring supply chain vulnerabilities can have devastating consequences." Let this incident be a turning point for your organization. The cost of inaction is far greater than the investment required to secure your digital ecosystem. ## The EU AI Act Enforcement Begins: Are You Ready? - URL: https://bartmcd.com/blog/eu-ai-act-enforcement-begins-are-you-ready - Published: 2025-06-27 The EU AI Act Enforcement Begins: Are You Ready? Today marks a pivotal moment in the global technology landscape: the enforcement of the European Union’s AI Act officially begins. With its sweeping scope and significant penalties—up to 35 million euros or 6% of global annual turnover—this legislation has become a top compliance priority for businesses worldwide. Whether you're operating in Europe or not, the EU AI Act is likely to impact your organization if you develop, deploy, or distribute AI systems. The question is: Are you ready? Understanding the EU AI Act The EU AI Act, initially proposed in 2021 and finalized in late 2024, was designed to establish a legal framework for the safe and ethical use of artificial intelligence. It categorizes AI systems into four risk levels: unacceptable, high, limited, and minimal risk . Each category comes with specific obligations and restrictions for organizations building or deploying these systems. Key Highlights of the Act Prohibited AI Practices: Systems that exploit vulnerabilities of individuals, deploy subliminal techniques causing harm, or enable social scoring by governments are banned outright. High-Risk AI Systems: These include AI used in critical infrastructure, healthcare, law enforcement, and employment. They require extensive documentation, risk assessments, and ongoing monitoring. Transparency Obligations: AI systems interacting with humans, generating deepfakes, or used for biometric identification must clearly inform users of their nature. Post-Market Surveillance: Companies must set up systems to monitor the performance and safety of their AI after deployment. While the Act primarily targets businesses operating within the EU, its extraterritorial reach means that compliance is required for any company whose AI systems affect EU citizens. Given the global nature of AI development, this effectively makes the EU AI Act a global standard. Compliance Challenges and Common Pitfalls Many organizations have spent the past year scrambling to align their AI practices with the Act’s requirements. However, compliance is proving far more complex than anticipated. Here are some of the most common issues companies face: 1. Mapping AI Applications to Risk Categories Identifying whether your AI systems fall into the high-risk category is not always straightforward. For example, a recruitment algorithm that screens candidates might seem benign but could qualify as high risk if it impacts the hiring process significantly. Misclassification can lead to compliance failures and hefty fines. 2. Documentation and Explainability The Act places a heavy emphasis on explainability , requiring companies to provide detailed documentation about how their AI systems work. For many organizations, particularly those using black-box machine learning models, this poses a significant technical and operational challenge. 3. Cross-Border Data Transfers For organizations that rely on data processing outside of the EU, the compliance burden is even greater. Ensuring that data handling practices meet EU standards for privacy and security is critical but often overlooked. 4. Continuous Monitoring Unlike traditional compliance efforts, adhering to the EU AI Act isn’t a one-time exercise. The requirement for ongoing monitoring and reporting means that businesses will need to invest in robust post-market surveillance systems to ensure continued compliance. A Practical Compliance Checklist As enforcement begins, organizations must act swiftly to ensure they are prepared. Below is a practical compliance checklist to guide your efforts: Conduct an AI Inventory: Create a comprehensive list of all AI systems currently in use, under development, or planned for deployment. Classify each system according to the Act’s risk categories. Perform Risk Assessments: Evaluate high-risk systems for potential impacts on user safety, fairness, and data privacy. Document your findings meticulously. Develop Explainability Protocols: Work with your data science and engineering teams to create clear, accessible documentation for each AI system. This should include algorithmic design, training data sources, and decision-making logic. Implement Governance Structures: Establish a dedicated AI compliance team or appoint an AI ethics officer to oversee compliance efforts. Ensure that this team is well-versed in both technical and legal aspects of the Act. Set Up Monitoring Systems: Invest in tools and processes to track AI system performance and flag anomalies in real-time. Regularly review these systems to ensure they remain effective. Train Your Team: Offer training programs on the EU AI Act to employees across departments, from legal and compliance to engineering and product development. By following this checklist, your organization can reduce the risk of non-compliance and position itself as a leader in ethical AI practices. The Global Ripple Effect The EU AI Act is not just a European issue—it’s a global game changer. Much like the GDPR reshaped data privacy standards worldwide, the AI Act is expected to influence how governments and organizations approach AI regulations beyond Europe. Already, similar legislative efforts are underway in the U.S., Canada, and across Asia. Businesses that proactively align with the EU AI Act will be better prepared for these emerging frameworks. Moreover, compliance can be a competitive advantage. As public scrutiny of AI technologies grows, customers and partners are increasingly choosing to work with companies that demonstrate a commitment to ethical, responsible AI practices. Being ahead of the curve on compliance can help build trust and differentiate your brand in a crowded marketplace. Looking Ahead As the dust settles on the EU AI Act’s first day of enforcement, one thing is clear: the era of unregulated AI is over. Organizations that fail to adapt will face not only financial penalties but also reputational damage and loss of customer trust. On the other hand, those that embrace compliance as an opportunity to innovate and improve will thrive in this new regulatory environment. “The EU AI Act is not just a legal requirement; it’s a blueprint for building safer, more transparent, and more equitable AI systems. Compliance isn’t the finish line—it’s the starting point for responsible innovation.” As we move forward, the companies that succeed will be those that view compliance not as a checkbox exercise but as a core component of their AI strategy. The EU AI Act is here, and it’s time to rise to the challenge. ## SK Telecom and Coupang: 56 Million Records in Korean Data Crisis - URL: https://bartmcd.com/blog/sk-telecom-coupang-56-million-records-korean-data-breach - Published: 2025-06-20 The Largest Data Breach in South Korea’s History On June 20, 2025, South Korea woke up to news of an unprecedented cybersecurity breach that has shaken the nation’s digital infrastructure. SK Telecom and Coupang, two of the country’s largest companies, confirmed that cybercriminals had infiltrated their systems, exposing sensitive data of 56 million customers. This incident marks one of the most significant breaches in the Asia-Pacific (APAC) region, spotlighting vulnerabilities in even the most robust organizations. What makes this breach particularly alarming isn’t just its scale but the sophisticated methods employed by attackers. Leveraging AI-enhanced phishing campaigns and zero-day exploits, cybercriminals bypassed traditional security measures, leaving both companies scrambling to mitigate fallout. For executives and business leaders, this crisis serves as a wake-up call: cybersecurity is no longer just an IT issue—it’s a boardroom priority. What Happened: Anatomy of the Breach Advanced Persistent Threats (APTs) and AI-Driven Attacks The attack began with an Advanced Persistent Threat (APT) group leveraging artificial intelligence to launch highly targeted phishing campaigns. Employees at SK Telecom were lured into clicking what appeared to be routine internal communications. Once inside, attackers deployed polymorphic malware capable of evading endpoint detection tools, exploiting zero-day vulnerabilities in legacy systems. At Coupang, the breach stemmed from a supply chain attack. A third-party logistics software provider was compromised, granting attackers lateral access to Coupang’s internal systems. This underscores a critical weak link in modern cybersecurity: the supply chain. The Fallout: What Was Exposed? The attackers exfiltrated a staggering array of personal data, including: Customer names, phone numbers, and physical addresses Payment information, including partially encrypted credit card details Browsing and purchase history from Coupang Telecommunications usage data from SK Telecom The leaked data not only compromises personal privacy but also opens the door to secondary attacks, such as identity theft, financial fraud, and targeted scams. “This breach is a sobering reminder that no company is immune. The attackers aren’t just targeting data—they’re targeting trust.” Key Lessons for Organizations 1. The Growing Threat of AI in Cybercrime AI-enabled attacks have become a defining characteristic of 2025’s threat landscape. In this breach, attackers used AI to mimic human behavior, making phishing emails nearly indistinguishable from legitimate correspondence. They also employed AI to adapt malware signatures in real-time, evading traditional detection methods. To counteract these tactics, organizations must invest in AI-driven cybersecurity tools capable of real-time anomaly detection. Behavioral analytics, for instance, can help identify unusual patterns in network traffic, even if malware signatures are unrecognizable. 2. Supply Chain Vulnerabilities Are a Boardroom Issue The Coupang breach highlights how third-party vendors can become entry points for attackers. Supply chain attacks have surged by 50% in the last two years, according to the latest APAC Cybersecurity Report. Mitigation strategies include: Conducting rigorous third-party risk assessments Mandating cybersecurity certifications for vendors Implementing zero-trust network architectures Boards must demand transparency not only from their internal teams but also from external partners. A lapse in one link of the chain can jeopardize the entire organization. 3. Crisis Management Plans: The Clock Is Ticking Both SK Telecom and Coupang faced criticism for their delayed response times, with initial breach notifications coming nearly 72 hours after detection. In a hyper-connected world, this lag can exacerbate the damage, both in terms of data loss and public trust. Every organization should have a detailed incident response plan that includes: Clear communication protocols for internal and external stakeholders Pre-established relationships with forensic investigators and legal counsel Simulated breach drills to test the effectiveness of the plan “The first 24 hours after a breach are critical. How you respond can either contain the fallout or amplify the chaos.” What’s Next for South Korea—and Beyond The aftermath of this breach will likely shape cybersecurity policy in South Korea for years to come. Lawmakers have already called for stricter regulations under the Personal Information Protection Act (PIPA), including steeper penalties for companies that fail to safeguard consumer data. Globally, this event will fuel discussions around cybersecurity standards in the APAC region. As the digital economy grows, so does the need for cross-border collaboration to address shared vulnerabilities. Expect to see more public-private partnerships aimed at enhancing threat intelligence sharing and developing unified security frameworks. Opportunities for Leaders While the crisis has exposed critical weaknesses, it also presents an opportunity for organizations to reevaluate their security postures. Here’s what leaders should prioritize: Invest in AI-driven security tools: Use AI not just as a defensive measure but as a predictive tool to anticipate and neutralize threats before they materialize. Focus on employee training: Humans remain the weakest link in cybersecurity. Regular, realistic training can significantly reduce the risk of phishing and social engineering attacks. Adopt a zero-trust model: Verify every user and device attempting to access your systems, regardless of whether they’re inside or outside the corporate network. Conclusion: A Call to Action The SK Telecom and Coupang breach is a stark reminder that cybersecurity must evolve as quickly as the threats we face. For executives, this is an inflection point. The question is no longer if you’ll be targeted but when . The time to act is now. By adopting a proactive, AI-enabled approach to cybersecurity, fortifying the supply chain, and prioritizing rapid incident response, organizations can not only survive but thrive in today’s increasingly hostile digital landscape. ## o3-pro: OpenAI's Most Capable Model Yet - URL: https://bartmcd.com/blog/o3-pro-openais-most-capable-model-yet - Published: 2025-06-11 o3-pro: OpenAI's Most Capable Model Yet In a world where artificial intelligence has become the backbone of modern business, OpenAI has raised the bar yet again. Today, the company unveiled o3-pro , its most advanced AI model to date. Designed to handle the most complex and high-stakes queries, o3-pro promises unprecedented levels of reliability and accuracy, making it an indispensable tool for industries ranging from healthcare to finance. But what truly sets this model apart? Let’s dive into its capabilities and implications for the future of AI. The Evolution of AI Models: From GPT-4 to o3-pro It’s hard to believe that just a few years ago, GPT-4 was the gold standard for natural language processing. By 2023, GPT-4 turbocharged productivity, enabling businesses to accelerate decision-making and automate complex workflows. However, as adoption soared, so did the demand for greater accuracy and contextual understanding , especially in industries where mistakes can lead to significant consequences. OpenAI responded with the o3 series, which introduced enhanced reasoning capabilities and fine-tuned industry-specific models. With o3-pro, the company has taken a quantum leap forward. Leveraging breakthroughs in multimodal processing, o3-pro seamlessly integrates text, images, and even dynamic video analysis to deliver insights with unparalleled precision. What Makes o3-pro Different? Precision at Scale: o3-pro boasts a 40% improvement in factual accuracy compared to its predecessors, reducing the risk of "hallucinated" information. Contextual Mastery: The model excels at understanding nuanced prompts, making it ideal for complex tasks like legal document analysis or medical diagnostics. Industry Customization: Pre-trained with domain-specific datasets, o3-pro includes verticalized solutions for healthcare, finance, legal, and engineering sectors. Real-Time Adaptability: With built-in feedback loops, o3-pro can learn and adapt to new information in real time, ensuring it stays relevant in rapidly evolving industries. How Businesses Can Leverage o3-pro For executives leading organizations in 2025, the question isn’t whether to adopt AI but how to use it strategically. o3-pro offers several key advantages that can help businesses gain a competitive edge: 1. Risk Mitigation In industries like finance and healthcare, errors can have catastrophic consequences. With o3-pro’s improved factual accuracy and contextual understanding, companies can reduce risks associated with misinformation. For example: Healthcare: o3-pro can assist in diagnosing patient conditions with greater confidence by cross-referencing medical literature and patient history. Finance: The model can analyze market trends and historical data to provide more reliable investment recommendations or detect fraud with higher precision. 2. Enhanced Customer Engagement Customer expectations have evolved dramatically. They demand not only faster responses but also deeper, more personalized interactions. o3-pro enables businesses to: Provide 24/7 customer support with AI agents that understand complex customer queries and provide accurate resolutions. Analyze customer sentiment in real time through multimodal inputs, such as text and video, to deliver tailored experiences. 3. Operational Efficiency Automation remains a key driver for cost savings and operational agility. With o3-pro, businesses can automate tasks that were previously too complex for AI, such as: Drafting and reviewing legal contracts with an eye for inconsistencies and compliance risks. Streamlining supply chain operations by predicting disruptions and optimizing logistics in real-time. Challenges and Ethical Considerations While o3-pro is a monumental step forward, it’s not without its challenges. As AI systems grow more powerful, the ethical implications of their deployment become increasingly significant. In 2025, these are the pressing concerns: 1. Bias in AI Even with advanced training on diverse datasets, AI models like o3-pro can inadvertently inherit biases. For instance, a healthcare AI might underperform for underrepresented patient groups if the training data lacks diversity. Businesses must invest in rigorous testing and ethical oversight to mitigate these risks. 2. Data Privacy The ongoing debate around data privacy has reached a fever pitch in 2025, especially with the introduction of stricter regulations like the Global Data Ethics Act. Companies using o3-pro need to ensure that sensitive customer data is handled responsibly and in compliance with these new legal frameworks. 3. Dependence on AI As organizations integrate o3-pro into critical workflows, overreliance on AI systems could pose a new kind of operational risk. Leaders must strike a balance between leveraging AI and maintaining human oversight to ensure accountability. The Future of AI: What’s Next? o3-pro sets a new benchmark for what AI can achieve, but it also raises the question: where do we go from here? As quantum computing inches closer to mainstream adoption, the potential for even more powerful AI systems is on the horizon. Imagine an AI that not only understands human language but can also simulate complex systems like global economies or climate models with near-perfect accuracy. “o3-pro isn’t just a tool; it’s a partner for decision-making in an increasingly complex world. The real challenge for businesses isn’t just adopting this technology, but learning how to wield it responsibly.” As we continue to push the boundaries of AI capabilities, one thing is clear: the future will belong to those who can harness these technologies ethically and effectively, transforming them into engines of innovation and growth. Final Thoughts With o3-pro, OpenAI has delivered a model that’s as close to a crystal ball as technology allows. Whether you’re navigating the complexities of global supply chains, innovating in healthcare, or striving to offer unparalleled customer experiences, o3-pro offers a powerful, reliable solution. But as with any transformative technology, success lies not just in adoption but in thoughtful, strategic implementation. As we look ahead, the organizations that thrive will be those that approach AI not as a magic bullet, but as a tool to augment human intelligence and tackle the world’s biggest challenges. The launch of o3-pro is a reminder that the future isn’t just coming—it’s already here. ## A New Chapter: Reflections on Agio's Journey and What Lies Ahead - URL: https://bartmcd.com/blog/agio-journey-reflections-and-netrio-transition - Published: 2025-06-11 What We Built Together After more than a decade building Agio into one of the most trusted names in managed IT and cybersecurity for the financial services industry, I am proud to announce that we have completed our transition to Netrio. Looking back on Agio's journey, I am filled with an immense sense of pride—not in any single achievement, but in the totality of what we created together. We built more than a company. We built an operating system for excellence. That operating system was founded on three pillars that I believe are inseparable: people , culture , and technology . The people at Agio were never just employees—they were problem-solvers, trusted advisors, and dedicated professionals who showed up every day to protect our clients. Many of them have been with us for years, growing alongside the company and bringing an institutional knowledge that cannot be replicated. Watching them develop into leaders has been one of the greatest rewards of this journey. Our culture was intentionally built around accountability, transparency, and genuine care—both for each other and for the clients we served. In an industry that can easily become transactional, we chose to be relational. That distinction matters. It showed up in every service call, every crisis response, and every long-term partnership we forged. And our technology platform—the systems, processes, and security frameworks we developed—was always in service of a simple goal: making the complex manageable for our clients. We invested heavily in building tools that didn't just meet compliance checkboxes but actually reduced risk and created operational resilience. But perhaps what I'm most proud of is something that cannot be purchased or manufactured: the trust of our clients . In an industry where a breach can end careers, destroy reputations, and unravel firms, our clients entrusted us with their most sensitive operations. We never took that trust for granted. It was the foundation upon which every decision was made, and it remains the legacy I am most honored to leave behind. Why Netrio—And Why Now When evaluating potential paths forward for Agio, the decision to join forces with Netrio was not simply about finding a buyer. It was about finding a partner who truly understood what we had built and was committed to building upon it—not dismantling it. Netrio shares our conviction that managed IT and cybersecurity must be delivered with both technical excellence and genuine partnership. They recognize that the relationships we have cultivated with our clients are not just contracts to be inherited—they are commitments to be honored. What excited me most about Netrio was their long-term vision. They see Agio not as an acquisition to be absorbed, but as a foundation to be accelerated. The capabilities we developed, the client relationships we nurtured, and the culture we built—these are assets they intend to invest in and grow. For our clients, this means continuity without compromise. The team members you know and trust are staying. The service levels you expect will be maintained and enhanced. And the roadmap for new capabilities will be expanded, not contracted. For our team, this represents opportunity. Netrio brings resources, scale, and ambition that will create new paths for professional development and career growth. The best people want to work on hard problems with great colleagues—and this partnership creates more of those opportunities. My Personal Commitment to This Transition Change is never easy, and transitions of this magnitude require careful attention. I want to be direct about my role going forward. While I will not be in an active day-to-day management position, I remain deeply committed to ensuring this transition succeeds. The coming months are critical—not just for systems integration, but for preserving the intangibles that made Agio special. I will be working closely with the Netrio leadership team to: Ensure client relationships are seamlessly maintained and strengthened Support our team members through the transition and help preserve our culture Advise on strategic decisions that affect the combined organization's direction Be available as a resource for clients and colleagues who have questions or concerns This is not a departure. It is a passing of the torch. And I intend to make absolutely certain that torch is passed well, with the flame burning as bright as ever. I owe that to our clients. I owe that to our team. And frankly, I owe that to myself—because after investing more than a decade of my life into building something meaningful, I want to see it thrive for decades more. What's Next for Me So what comes next? The honest answer is: I'm taking time to be thoughtful about it. After nearly fifteen years of building and leading in the cybersecurity and managed IT space, I have a perspective on the industry that I'm eager to apply in new ways. The landscape has shifted dramatically—AI is transforming how businesses operate, cyber threats have become existential risks for organizations of all sizes, and the intersection of technology and strategy has never been more important. I see opportunities at that intersection. Whether through advising companies navigating these challenges, investing in the next generation of solutions, writing and speaking about the lessons I've learned, or building something entirely new—the possibilities are energizing. But I've also learned that the best decisions come from reflection, not reaction. So I'm giving myself the space to think carefully about where I can have the greatest impact. Stay tuned. There's more to come. A Final Word of Gratitude Building Agio has been the professional privilege of my life. To our clients—thank you for your trust. To our team—thank you for your dedication, your creativity, and your friendship. To our partners—thank you for believing in what we were building. And to everyone who will be part of Agio's next chapter under Netrio: I am confident that the best is yet to come. ## Coinbase Extortion Attempt: Inside the Contractor Attack - URL: https://bartmcd.com/blog/coinbase-extortion-attempt-contractor-insider-attack - Published: 2025-05-28 Inside the Coinbase Extortion Attempt: A Warning to the Crypto Industry In early 2025, Coinbase faced a chilling reminder of the vulnerabilities within the crypto industry: an extortion attempt by overseas contractors who exploited insider access. The attack underscored the growing risk posed by insider threats, particularly in a sector where trust and security are paramount. As cryptocurrency adoption continues to expand globally, the lessons from this incident serve as a wake-up call for organizations to reassess their defenses against insider exploitation. What Happened: The Anatomy of the Attack The extortion attempt began when a group of overseas contractors working on Coinbase's customer support systems accessed sensitive internal data. Leveraging their legitimate credentials, these individuals extracted user account information, including transaction histories and partial personal identifiers. They then demanded payment in cryptocurrency, threatening to release the data publicly if Coinbase did not comply. Coinbase's response was swift and decisive. Upon detecting suspicious activity, the company initiated a full-scale investigation, leveraging advanced AI-driven monitoring tools to trace the breach. The individuals responsible were identified within hours, and their access was revoked. Coinbase worked closely with law enforcement agencies and cybersecurity experts to ensure the stolen data was contained and the perpetrators were held accountable. Understanding Insider Threats in the Crypto Industry The Coinbase incident is a stark reminder that the biggest threats often come from within. Insider threats can take many forms, from malicious contractors to disgruntled employees or even accidental misconfigurations. In the crypto industry, where trust underpins every transaction, the impact of insider threats can be devastating. Why Crypto Is a Prime Target High-value assets: Cryptocurrency transactions often involve significant sums, making them attractive to malicious actors. Pseudonymity: The pseudonymous nature of blockchain makes it challenging to trace stolen funds, increasing the appeal for cybercriminals. Decentralization: The decentralized nature of crypto platforms can lead to fragmented security protocols, which insiders may exploit. Common Vulnerabilities Third-party contractors: Many crypto companies rely on external vendors for services such as customer support or software development. These contractors can become weak links if their access is not properly managed. Privileged access: Employees and contractors with elevated privileges can misuse their access for personal gain or malicious intent. Insufficient monitoring: Without continuous, real-time surveillance, insider threats can go undetected for extended periods. Lessons Learned: Strengthening Your Defenses While Coinbase’s swift response mitigated the damage, the incident underscores the need for proactive measures to prevent insider threats. Here are actionable steps that executives and business leaders can take to fortify their organizations: 1. Implement Zero Trust Principles Zero Trust, the cybersecurity model that assumes no user or device is trustworthy by default, is critical in preventing insider threats. Organizations should: Limit access to sensitive data based on roles. Continuously verify users and devices, even if they are within the network perimeter. Enforce multi-factor authentication (MFA) for all access points. 2. Conduct Regular Security Audits Periodic audits ensure that insider threats are identified and addressed promptly. These audits should include: Reviewing access logs for unusual activity. Assessing the security posture of third-party contractors. Testing the effectiveness of AI-driven monitoring tools. 3. Train Employees and Contractors Human error remains one of the leading causes of security breaches. Comprehensive training programs can reduce this risk by educating employees and contractors on cybersecurity best practices. Key topics should include: Recognizing phishing attempts and social engineering tactics. Safeguarding credentials and devices. Understanding the consequences of insider threats. 4. Use AI and Behavioral Analytics Advanced AI and machine learning tools, now widely adopted in 2025, play a crucial role in detecting insider threats. Behavioral analytics systems can flag unusual activity, such as: Sudden access to large volumes of sensitive data. Unusual login patterns or geographic anomalies. Attempts to disable security controls. “Insider threats are not just a technical challenge; they are a human challenge. To address them effectively, organizations must combine advanced technology with a culture of accountability and trust.” The Future of Insider Threat Prevention The Coinbase extortion attempt highlights the evolving landscape of insider threats. As the crypto industry continues to grow, these threats will become more sophisticated. Organizations must stay ahead by investing in cutting-edge technologies and fostering a robust security culture. Looking forward, advancements such as blockchain-based identity management systems and decentralized access control may further mitigate insider risks. However, the human element will always remain a critical factor. By prioritizing both technology and training, businesses can build resilient defenses against the next wave of insider threats. For executives and leaders in the crypto space, the key takeaway is clear: insider threats are inevitable, but their impact can be minimized through vigilance, preparation, and swift action. The Coinbase incident is not just a cautionary tale—it’s a call to action. ## Operator Gets Smarter: OpenAI's Agent Upgrade to o3 - URL: https://bartmcd.com/blog/operator-gets-smarter-openai-agent-upgrade-o3 - Published: 2025-05-24 Operator Gets Smarter: OpenAI's Leap to o3 In a world where artificial intelligence is increasingly embedded in daily operations, OpenAI’s latest upgrade to its Operator platform has sent ripples through industries. Dubbed the "o3 model," this version represents a substantial leap forward in agentic AI, offering businesses enhanced persistence, greater contextual accuracy, and unprecedented adaptability. From customer service to executive decision-making, o3 is changing how we work and interact with technology. The Evolution to o3 OpenAI’s Operator, first introduced in 2023, quickly became synonymous with agentic AI—autonomous systems capable of executing complex, multi-step tasks. Unlike traditional AI, which often requires human intervention to handle edge cases or clarify instructions, Operator has continually evolved to reduce dependence on human oversight. The o3 upgrade epitomizes that evolution. What sets o3 apart is its groundbreaking ability to maintain persistence . This means Operator can now retain context and learn from ongoing interactions over extended periods, a feature sorely lacking in earlier iterations. Persistent AI eliminates the need for repetitive re-training and enables seamless continuity across tasks and conversations. Additionally, o3 boasts a quantum leap in accuracy, thanks to its enhanced language model architecture. By incorporating real-time environmental data and refining its decision-making algorithms, o3 delivers recommendations and actions that align more closely with human expectations. This accuracy is not just theoretical—it’s already being tested in high-stakes environments like financial trading desks, healthcare diagnostics, and supply chain logistics. Why Persistence Matters One of the most transformative aspects of the o3 upgrade is its ability to "remember" and adapt. Persistence is about more than just recalling previous interactions; it’s about creating a dynamic feedback loop that improves outcomes over time. Here’s why this matters: Better Customer Experiences: In customer service, a persistent AI remembers a user’s history, preferences, and prior issues, enabling faster and more personalized solutions. Improved Operational Efficiency: For businesses, a persistent AI can maintain long-term projects, tracking progress and adapting strategies as new data becomes available. Higher Trust Levels: When users feel that AI understands and adapts to them, adoption rates increase, and resistance diminishes. Consider a healthcare example: a persistent Operator could manage a patient’s entire treatment journey, from diagnosis to recovery, adapting recommendations as new symptoms emerge or treatments progress. This capability represents a seismic shift from the transactional AI of two years ago. Accuracy Meets Adaptability The o3 model’s accuracy improvements stem from its ability to integrate real-world, situational data into its decision-making processes. This is critical in industries like finance, where even minor inaccuracies can lead to catastrophic losses. For example, in the financial sector, o3-powered Operators are now capable of: Risk Assessment: Continuously analyzing global market conditions to adjust investment strategies in real time. Fraud Detection: Identifying anomalous patterns with a higher degree of precision, reducing false positives and negatives. Portfolio Optimization: Offering asset allocation recommendations that align more closely with real-time client goals and market dynamics. These advancements are not limited to finance. In manufacturing, o3’s adaptability enables predictive maintenance models that evolve based on machine performance data, significantly reducing downtime and maintenance costs. “The o3 model isn’t just smarter—it’s more human. By combining persistence with contextual accuracy, it bridges the gap between automation and genuine collaboration.” Agentic AI Matures Agentic AI, once a buzzword, is now a cornerstone of many enterprises. With the o3 upgrade, OpenAI has further clarified what it means to build truly agentic systems. These systems are no longer reactive but proactive, capable of anticipating user needs and adjusting autonomously to changing environments. This maturity comes at a critical time. As we navigate 2025, the regulatory landscape around AI is tightening. The EU’s Artificial Intelligence Act, set to take full effect this year, has established stricter compliance requirements to ensure transparency, accountability, and ethical use of AI. OpenAI has positioned o3 as a model of compliance, incorporating features like: Explainability: The AI can articulate its reasoning processes, making it easier for human operators to understand and trust its decisions. Ethical Guardrails: Built-in mechanisms prevent harmful or biased outcomes, aligning with global standards for ethical AI. Customizable Governance: Enterprises can tailor the AI’s decision-making parameters to comply with industry-specific regulations. The maturity of agentic AI also opens up broader societal implications. For example, smart cities are already deploying o3-based systems to manage traffic flows, energy consumption, and public safety. As these systems grow more autonomous, the potential for efficiency gains—and ethical dilemmas—will only increase. What’s Next? As we look ahead, the o3 upgrade raises important questions for executives and business leaders: How will you integrate persistence into your AI strategy? Businesses must evaluate where persistent AI can provide the most value, whether in customer service, operations, or strategic planning. Are your teams ready to collaborate with smarter AI? Employee training and change management are critical to ensure a smooth transition. Is your compliance framework up to date? With regulatory scrutiny increasing, organizations must ensure their AI systems meet new legal and ethical standards. What’s your competitive edge? Early adopters of o3 are already gaining a significant advantage. Can you afford to wait? The o3 upgrade is a reminder that AI is no longer just a tool; it’s a partner. As businesses adapt to this new paradigm, those that embrace the full potential of agentic AI will lead the way into an increasingly automated and intelligent future. “In 2025, the question is no longer whether AI can do the job. It’s whether you’re ready to keep up with it.” ## Blue Shield of California: 4.7 Million Exposed via Google Analytics - URL: https://bartmcd.com/blog/blue-shield-california-google-analytics-data-exposure - Published: 2025-05-13 Blue Shield of California’s Breach: A Wake-Up Call for Analytics Oversight In what is being called one of the most significant data exposure events of the year, Blue Shield of California has confirmed that a misconfigured Google Analytics setup led to the exposure of sensitive personal information for 4.7 million patients. This revelation has sent shockwaves through the healthcare and cybersecurity sectors, raising urgent questions about the hidden risks of analytics tools and third-party integrations. At a time when healthcare organizations are doubling down on digital transformation, this breach underscores how even a seemingly benign technology can become a security liability. The Anatomy of the Breach The breach originated from an improperly configured Google Analytics implementation within Blue Shield of California’s patient portal. According to investigators, the misconfiguration allowed sensitive information—such as patient names, medical record numbers, and even details about treatment plans—to be transmitted to Google’s servers. This violates HIPAA (Health Insurance Portability and Accountability Act) regulations and compromises patient trust. What makes this incident particularly alarming is the widespread use of analytics tools in healthcare. Google Analytics, often used to track user activity and improve digital experiences, is not inherently problematic. However, when improperly set up, these tools can inadvertently collect and transmit sensitive data, creating vulnerabilities that hackers—or even the analytics provider—could exploit. “This breach is a stark reminder that convenience often comes at the cost of security. Even tools designed to enhance user experience can lead to catastrophic consequences if not carefully managed.” Understanding the Hidden Risks of Analytics Tools This incident highlights a broader issue: the hidden risks associated with analytics platforms. Many organizations rely heavily on third-party tools to gain insights into user behavior, often without fully understanding the security implications. Here are some of the key risks: Data Leakage: Misconfigured analytics tools can inadvertently capture Personally Identifiable Information (PII), violating privacy laws and exposing organizations to regulatory penalties. Third-Party Risks: Data sent to external servers is no longer under the organization’s direct control, increasing the risk of misuse or unauthorized access. Regulatory Non-Compliance: Tools like Google Analytics may not be compliant with privacy laws like HIPAA, GDPR, or CCPA unless explicitly configured to meet stringent requirements. Blind Spots: Many organizations don’t fully audit or monitor the data flows created by these tools, leaving them unaware of potential vulnerabilities. For healthcare providers like Blue Shield of California, these risks are especially pronounced. The sensitivity of health-related data makes it a prime target for cybercriminals and amplifies the consequences of any breach. Lessons Learned: How to Safeguard Analytics Implementations If there’s one takeaway from this incident, it’s that organizations need to treat analytics tools with the same level of scrutiny as any other aspect of their IT infrastructure. Here’s how you can fortify your analytics implementations: 1. Configure with Privacy in Mind Ensure that analytics tools are configured to anonymize data. For Google Analytics, this includes enabling IP anonymization and disabling the collection of PII. Use robust validation processes to confirm that no sensitive data is being inadvertently captured or transmitted. 2. Conduct Regular Audits Perform regular audits of your analytics setup to identify potential vulnerabilities. Use tools that can map out data flows and flag any instances where sensitive information may be leaving your network. 3. Limit Third-Party Data Sharing Minimize the use of third-party integrations that require data sharing. Where integrations are necessary, ensure that the third-party provider adheres to stringent security and compliance standards. 4. Train Your Team Your IT and marketing teams should undergo regular training on how to securely implement and manage analytics tools. Understanding the security implications of these platforms is no longer optional; it’s a necessity. 5. Leverage Privacy-Focused Alternatives Consider using privacy-focused analytics platforms like Matomo or Plausible, which allow you to retain full control over your data and offer built-in compliance with privacy regulations. “Cybersecurity isn’t just about preventing breaches; it’s about embedding security into every layer of your organization’s digital ecosystem. Analytics tools are no exception.” The Regulatory and Reputation Fallout The breach has triggered a swift response from regulators. The U.S. Department of Health and Human Services (HHS) is already investigating whether Blue Shield of California violated HIPAA’s stringent privacy and security rules. Potential penalties could include multi-million-dollar fines and mandatory corrective actions. But perhaps even more damaging is the hit to Blue Shield’s reputation. In the age of digital-first healthcare, patient trust is paramount. A breach of this magnitude not only erodes trust but also serves as a cautionary tale for other organizations in the sector. Looking Ahead: The Future of Analytics in a Privacy-First World The Blue Shield of California breach is not an isolated incident; it’s a symptom of a larger issue. As more organizations turn to data analytics to drive decision-making, the need for robust governance and secure implementation has never been more critical. Moving forward, expect to see the following trends: Stricter Regulations: Governments worldwide are likely to introduce more stringent rules governing the use of analytics tools, especially in sensitive sectors like healthcare. Increased Scrutiny on Third-Party Providers: Companies will demand greater transparency and accountability from analytics providers regarding how data is collected, stored, and used. Adoption of Privacy-Centric Technologies: Organizations will increasingly adopt solutions that prioritize data privacy, including self-hosted analytics platforms and AI-driven privacy tools. Blue Shield’s breach serves as a stark reminder that the road to digital innovation is fraught with risks. By learning from this incident and implementing best practices, organizations can not only protect themselves but also foster a culture of trust and accountability in an increasingly data-driven world. ## M&S Ransomware Attack: When IT Outsourcing Backfires - URL: https://bartmcd.com/blog/ms-ransomware-attack-it-outsourcing-backfires - Published: 2025-04-28 The Marks & Spencer Ransomware Attack: A Wake-Up Call On April 22, 2025, Marks & Spencer, one of the UK’s leading retail giants, experienced a ransomware attack that brought operations to a grinding halt. Shoppers faced closed stores, online orders were suspended, and employees struggled with inaccessible systems. The incident exposed a critical blind spot: the hidden risks of IT outsourcing in cybersecurity. While outsourcing IT services has been a popular cost-saving strategy for decades, the M&S attack underscores the vulnerabilities that can arise when companies rely on external vendors for critical infrastructure. The fallout from this attack serves as a cautionary tale for business leaders worldwide. What Went Wrong? Vendor Mismanagement: The Achilles’ Heel The ransomware exploited vulnerabilities in the IT systems managed by one of Marks & Spencer’s third-party providers. This vendor was responsible for maintaining the retailer’s payment processing systems and customer databases. Reports indicate that outdated software and unpatched security flaws created an easy entry point for attackers. Compounding the problem, the vendor's incident response plan was insufficiently robust. When the attack struck, delays in communication and action worsened the impact, leaving M&S unable to restore critical operations in a timely manner. Insufficient Oversight Marks & Spencer, like many organizations, failed to conduct rigorous audits of their vendors’ cybersecurity practices. Despite relying heavily on outsourced IT services, their governance framework lacked the depth to ensure compliance with evolving security standards. This oversight allowed vulnerabilities to persist unchecked, creating fertile ground for ransomware threats. The Hidden Risks of IT Outsourcing Businesses often turn to outsourcing for reasons like cost efficiency, scalability, and access to specialized expertise. However, as the M&S incident illustrates, outsourcing can also introduce significant risks if not managed effectively. Here’s what executives need to know: Loss of Direct Control: When critical IT functions are outsourced, companies often lose visibility into day-to-day security practices, making it harder to detect and mitigate risks proactively. Vendor Vulnerabilities: Third-party providers may not prioritize cybersecurity to the same extent as the contracting company, leading to gaps in protection. Complex Incident Response: Coordinating between internal teams and external vendors during a cyberattack can slow down recovery efforts and amplify damage. Actionable Insights for Business Leaders Strengthen Vendor Management The first step in mitigating outsourcing risks is establishing robust vendor management protocols. Business leaders should: Conduct thorough due diligence before engaging an IT service provider, including reviews of their cybersecurity measures and certifications. Mandate regular audits of vendor systems to ensure they comply with industry standards and best practices. Include cybersecurity clauses in contracts to hold vendors accountable for maintaining secure systems and responding effectively to incidents. Adopt a Zero Trust Framework Zero Trust architecture has become a cornerstone of modern cybersecurity strategies, and its relevance will only grow in 2025. By assuming that every user, device, and system is a potential threat, companies can reduce their exposure to ransomware and other attacks. Key steps include: Implementing identity verification protocols for all users accessing critical systems. Using micro-segmentation to limit the ability of ransomware to move laterally across an organization’s network. Continuously monitoring network activity to detect and respond to anomalies in real time. Invest in Incident Response Preparedness The M&S ransomware attack highlighted the importance of a robust incident response plan. Businesses should: Develop a crisis management strategy that includes clear roles and responsibilities for internal teams and external vendors. Run regular tabletop exercises to simulate cyberattack scenarios and test the effectiveness of their response plans. Partner with cybersecurity firms that specialize in rapid containment and recovery to minimize downtime in the event of an attack. Looking Ahead: The Future of IT Outsourcing As we move deeper into 2025, the landscape of IT outsourcing is likely to shift. Businesses will demand greater transparency and accountability from vendors, and cybersecurity will become a top priority in outsourcing agreements. Emerging technologies like AI-driven risk assessments and blockchain-based audit trails will empower companies to monitor vendor performance more effectively. However, technology alone won’t solve these challenges. Business leaders must adopt a proactive mindset, treating vendor cybersecurity as a strategic priority rather than an operational afterthought. “Outsourcing isn’t inherently risky, but ignoring the cybersecurity implications of your vendors is. Companies that succeed in 2025 and beyond will be those that manage outsourcing relationships with the same rigor as their internal operations.” Conclusion: Turning Lessons into Action The Marks & Spencer ransomware attack is a stark reminder that outsourcing IT functions doesn’t absolve companies of their cybersecurity responsibilities. On the contrary, it demands a higher level of vigilance and strategic oversight. By strengthening vendor management, adopting advanced security frameworks, and prioritizing incident response preparedness, organizations can turn outsourcing from a potential liability into a competitive advantage. Executives must ask themselves: How well do we know our vendors’ security practices? If the answer is anything less than “intimately,” now is the time to act. Cyber threats aren’t slowing down. Neither should your defense strategy. ## OpenAI o3 and o4-mini: Native Tool Use During Reasoning - URL: https://bartmcd.com/blog/openai-o3-o4-mini-native-tool-use-reasoning - Published: 2025-04-17 OpenAI’s Latest Leap: o3 and o4-mini Redefine AI Reasoning The AI landscape has shifted once again with OpenAI’s release of o3 and o4-mini. These models are not just iterations of their predecessors; they represent a fundamental evolution in how artificial intelligence operates. By seamlessly integrating web browsing, code execution, and file operations directly into their reasoning process, OpenAI has blurred the line between AI as a tool and AI as an autonomous problem-solver. For business leaders and executives, this development isn’t just another headline—it’s a signal to reassess how AI fits into strategic planning. The ability of these models to natively use tools during reasoning marks a pivotal moment in technology, one that demands attention and action. What Sets o3 and o4-mini Apart OpenAI’s o3 and o4-mini models bring a game-changing ability to integrate actions like web browsing, file manipulation, and code execution into their reasoning processes. This capability isn’t layered on top of the model; it’s baked into its architecture. The Move from Passive to Active Reasoning Previous AI iterations, including GPT-4 Turbo, relied on static datasets for reasoning and required external plugins for actions like browsing or executing code. o3 and o4-mini, however, treat these capabilities as native functions. This means the AI can: Search the web in real-time to retrieve the most current data. Write, test, and execute code directly during problem-solving. Manipulate files , such as analyzing spreadsheets or generating reports, without external help. By embedding these abilities, OpenAI has created models that are inherently more adaptive, efficient, and capable of managing complex tasks autonomously. o4-mini: The Lightweight Contender While o3 is positioned as the flagship model for enterprise-level operations, o4-mini is making waves as the affordable, nimble alternative. Designed for smaller-scale deployments, it balances performance and cost-effectiveness, making advanced AI capabilities accessible to startups and smaller organizations. For teams on a budget, o4-mini provides an entry point into cutting-edge technology without sacrificing functionality. Its ability to execute web searches, analyze files, and run code efficiently makes it a viable option for diverse industries, from fintech to healthcare. Implications for Business Strategy The introduction of these models is more than a technological upgrade—it’s a strategic inflection point. Here’s how executives should think about leveraging o3 and o4-mini to stay competitive: Streamline Decision-Making: By retrieving real-time data and executing calculations autonomously, these models can accelerate decision cycles, reducing reliance on manual research and analysis. Enhance Productivity: Teams can offload repetitive tasks, such as generating reports or debugging code, to AI, freeing up human resources for higher-value work. Expand Capabilities: The native tool integration allows businesses to tackle complex problems, such as predictive modeling or cybersecurity threat analysis, with minimal intervention. However, as with any transformative technology, it’s critical to approach adoption strategically. Rushing to integrate these models without a clear plan can lead to operational inefficiencies and security vulnerabilities. Challenges and Considerations Despite their groundbreaking capabilities, o3 and o4-mini come with their own set of challenges. Executives need to address these proactively to ensure successful integration. Data Security Risks With native web browsing and file manipulation, these models have unparalleled access to sensitive information. This creates new attack vectors for cybersecurity threats. Organizations must: Implement robust access controls: Ensure AI systems operate within strict permissions frameworks. Monitor AI activity: Use monitoring tools to track actions taken by the model, especially when handling sensitive data. Encrypt data: All files and communications involving the AI should be encrypted to minimize data leakage risks. Ethical and Regulatory Compliance The ability to search the web and execute actions autonomously raises ethical and legal concerns. For instance, how should organizations handle AI-generated insights that might inadvertently incorporate biased or inaccurate information? Leaders must: Establish governance protocols: Define clear standards for how AI-generated outputs are reviewed and utilized. Stay informed: Keep up with evolving regulations, such as the AI Accountability Act passed in late 2024, which mandates transparency in AI decision-making. Looking Ahead: The Next Frontier The release of o3 and o4-mini signals OpenAI’s commitment to pushing the boundaries of AI capability. But this is likely just the beginning. Experts predict that the next wave of AI models will focus on even deeper integration, such as: Hardware synchronization: AI models that can directly interact with IoT devices and robotics. Cross-model collaboration: Multiple AI systems working in tandem to solve multidisciplinary problems. Emotional intelligence: Greater ability to interpret and respond to human emotions, enhancing user experience. For executives, staying ahead of these trends will require ongoing education and a willingness to experiment. The companies that thrive in this new era will be those that view AI not as a tool, but as a co-pilot in their journey toward innovation. “AI isn’t replacing human intelligence—it’s amplifying it. The leaders who understand this will unlock unparalleled possibilities for their organizations.” Action Steps for Executives To capitalize on the capabilities of o3 and o4-mini, here are three actionable steps for executives: Audit existing workflows: Identify areas where native AI tool use could streamline operations or enhance decision-making. Invest in training: Equip your teams with the knowledge needed to work effectively alongside advanced AI systems. Pilot strategically: Start small, testing the integration of these models in controlled environments to evaluate impact before scaling. The release of o3 and o4-mini is not just a technological milestone—it’s a call to action for leaders who recognize the transformative power of AI. By approaching adoption thoughtfully, organizations can harness these innovations to drive growth, efficiency, and resilience in the face of a rapidly changing world. ## Why Every Enterprise Needs an AI Agent Strategy Now - URL: https://bartmcd.com/blog/why-every-enterprise-needs-an-ai-agent-strategy-now - Published: 2025-04-08 Why Every Enterprise Needs an AI Agent Strategy Now In just two short years, AI agents have gone from experimental tools to indispensable assets for businesses worldwide. A recent survey highlights that 99% of developers are actively utilizing AI agents , signaling a seismic shift in technology adoption. Enterprises that fail to implement an AI agent strategy today risk falling behind in efficiency, innovation, and customer satisfaction. If 2024 was the year of experimentation, 2025 is undeniably the year of execution. Let’s explore why AI agents are critical and how you can craft a winning strategy. The Rise of AI Agents in Business What Are AI Agents and Why Now? AI agents are autonomous programs designed to perform specific tasks, make decisions, and even learn over time. They leverage advancements in large language models (LLMs), reinforcement learning, and automation tools. Unlike traditional software, these agents operate with a degree of independence, enabling businesses to reduce manual intervention while scaling operations seamlessly. By early 2025, AI agents are ubiquitous across industries. For example: Finance: AI agents like Morgan Stanley's wealth management assistant provide real-time portfolio insights and risk assessments. Healthcare: Virtual care coordinators, such as those powered by MedGPT-4, help streamline patient triage and follow-ups. Retail: Personalized shopping assistants like Amazon’s Sidekick AI predict customer needs and offer tailored recommendations. With the global AI market projected to exceed $1.2 trillion by the end of 2025, the question isn’t “if” your enterprise should adopt AI agents—it’s “how fast” you can do it. The Shift from Tools to Agents One key development driving adoption is the transition from isolated AI tools to integrated AI agents. Tools like ChatGPT or Copilot were revolutionary in their own right, but they often required human oversight to initiate tasks. Today’s AI agents are proactive. For example, enterprise-grade solutions like OpenAI's CodexOps and Google's Vertex AI orchestrate workflows autonomously, from customer service to predictive maintenance. “AI agents are no longer just tools; they are collaborators. They don’t just answer questions—they solve problems.” Why You Need an AI Agent Strategy Today 1. Competitive Advantage Organizations leading in AI agent adoption are already reaping the benefits of faster decision-making, cost savings, and improved customer engagement. Consider Tesla’s autonomous operations platform, which deploys AI agents to manage everything from supply chain logistics to predictive vehicle maintenance. The result? A 20% reduction in operational costs and a 15% increase in delivery speed over the past year. Your competitors are undoubtedly exploring similar opportunities. Without a solid AI agent strategy, you risk losing market share to more agile rivals. 2. Workforce Transformation AI agents aren’t here to replace employees—they’re here to augment them. By handling repetitive tasks, AI agents free up your workforce to focus on high-value, creative, and strategic activities. For instance, law firms using AI-driven research agents have reduced case preparation time by 40%, enabling attorneys to dedicate more time to client interaction and strategy. But there’s a catch: the success of this transformation hinges on reskilling your workforce. Employees need to understand how to work alongside AI agents to maximize their potential. 3. Data-Driven Decisions AI agents thrive on data. They don’t just process it—they analyze patterns, predict outcomes, and recommend actionable insights. This capability is particularly impactful in industries like manufacturing, where predictive agents have cut equipment downtime by as much as 30%. By embedding agents with access to real-time data streams, enterprises are making faster, smarter decisions than ever before. Crafting Your AI Agent Strategy Building an AI agent strategy doesn’t have to be overwhelming. Here’s a step-by-step guide to get started: 1. Identify High-Impact Use Cases Begin by pinpointing areas in your organization where automation and intelligence can deliver the most value. Common starting points include customer service, IT support, and supply chain management. For example, a Fortune 500 retailer deployed customer engagement agents, leading to a 25% improvement in Net Promoter Scores (NPS). Focus on high-impact areas that align with your strategic goals to drive measurable ROI. 2. Select the Right Technology Stack The AI agent ecosystem has matured significantly. Platforms like AWS Bedrock, Microsoft Azure OpenAI Service, and Anthropic’s Claude Enterprise offer robust tools for developing, deploying, and managing AI agents. Evaluate these platforms based on: Scalability: Can the platform grow with your business? Security: Does it comply with industry standards and data protection regulations? Integration: How seamlessly does it connect with your existing systems? Remember, your technology stack will be the foundation of your AI agent strategy. Choose wisely. 3. Build a Cross-Functional Team Deploying AI agents isn’t just an IT initiative—it’s a business transformation effort. Assemble a cross-functional team that includes stakeholders from IT, operations, HR, and customer experience. This ensures that your AI agent strategy aligns with organizational objectives and addresses potential roadblocks early. 4. Prioritize Ethics and Governance AI agents operate autonomously, which makes ethical considerations and governance critical. In 2024, the EU’s AI Act introduced stringent guidelines for transparency, accountability, and bias mitigation in AI systems. Expect similar regulations to roll out globally this year. Build compliance into your strategy from day one to avoid costly fines and reputational damage. The Future of AI Agents By 2030, analysts predict that AI agents will manage more than 70% of enterprise workflows. While this may sound like science fiction, consider how rapidly we’ve progressed: just five years ago, generative AI was in its infancy. Today, enterprises are running fully autonomous processes powered by intelligent agents. As we look ahead, the next wave of innovation will likely focus on: Adaptive Learning: Agents will dynamically improve their performance based on real-world feedback. Inter-Agent Collaboration: Networks of AI agents will work together to handle complex, multi-faceted tasks. Human-Agent Interaction: Enhanced interfaces will make working with AI agents as intuitive as collaborating with a colleague. “The enterprises that invest in AI agents today will define the competitive landscape of tomorrow.” Conclusion The era of AI agents is here, and it’s transforming the way businesses operate. By developing a comprehensive AI agent strategy, your enterprise can unlock unprecedented efficiency, innovation, and customer satisfaction. Don’t wait for your competitors to take the lead—act now and position your organization for success in 2025 and beyond. Remember, the clock is ticking. The question isn’t whether AI agents will shape the future of business—it’s whether your enterprise will be ready for it. ## NYU Data Breach: 3 Million Student Records Exposed - URL: https://bartmcd.com/blog/nyu-data-breach-3-million-student-records-exposed - Published: 2025-03-25 One of the Largest Educational Data Breaches in History On March 20, 2025, New York University (NYU) confirmed a data breach that compromised over 3 million applicant records spanning 35 years. This breach is being called one of the largest in the education sector’s history, with personal data including Social Security numbers, addresses, academic records, and even financial details now circulating on the dark web. For an institution as prestigious as NYU, the breach has sent shockwaves through the academic and cybersecurity communities alike. But what went wrong? And, more importantly, what can other universities and educational institutions learn from this incident? Let’s unpack the situation and explore actionable strategies to fortify cybersecurity in the education sector. The Anatomy of the NYU Data Breach According to NYU’s preliminary investigation, the breach originated from an unpatched vulnerability in a legacy admissions database. The database, which hadn’t been upgraded since 2020, was connected to a broader network that included active systems. Attackers exploited the vulnerability to gain access and exfiltrate data over a period of several months before detection. Adding to the issue, NYU’s monitoring tools failed to detect the anomaly due to gaps in their real-time alerting systems. By the time the breach was discovered, the attackers had already uploaded the stolen data to a well-known marketplace on the dark web, where it was sold to multiple buyers. “This breach underscores the dangers of outdated systems and insufficient monitoring in today’s cybersecurity landscape,” said Heather Lin, a cybersecurity analyst with a focus on higher education. Key Lessons for Educational Institutions The NYU breach serves as a wake-up call for every educational institution handling sensitive data. Here are the critical lessons that leaders in academia must take away from this incident: 1. Legacy Systems Are a Ticking Time Bomb Many universities still rely on legacy systems that were implemented decades ago. While these systems may still perform their intended function, they are often ill-equipped to handle modern cybersecurity threats. The NYU breach highlights the importance of proactive legacy system management. Conduct regular audits: Institutions must assess legacy systems for vulnerabilities and prioritize upgrades or replacements. Segment networks: Legacy systems should be isolated from critical networks to minimize risk exposure. Apply patches promptly: Consistent patch management is the simplest and most effective way to close known vulnerabilities. 2. Implement Zero Trust Architecture The concept of “trust but verify” is obsolete. Educational institutions must adopt Zero Trust Architecture (ZTA), which operates on the principle of “never trust, always verify.” Limit access: Only grant users access to the systems and data they need, and nothing more. Authenticate continuously: Use multi-factor authentication (MFA) and behavioral analytics to verify users at every step. Monitor anomalies: Real-time monitoring and anomaly detection are critical to identifying breaches early. Had NYU implemented a Zero Trust framework, lateral movement across its systems could have been minimized, potentially stopping the breach in its early stages. 3. Prioritize Incident Response Planning An effective incident response (IR) plan can significantly reduce the impact of a data breach. NYU’s delayed detection and response exacerbated the fallout. Run regular simulations: Conduct tabletop exercises to test your IR plan under realistic scenarios. Establish a response team: A dedicated cybersecurity team with clear roles and responsibilities is essential. Invest in detection tools: Modern Endpoint Detection and Response (EDR) tools can identify threats more effectively than traditional antivirus software. NYU has since announced plans to overhaul its IR strategy, but the damage has already been done. The Broader Implications for Student Privacy The ripple effect of this breach extends far beyond NYU’s campus. Millions of former applicants, some of whom are now professionals in various fields, are at risk of identity theft and other forms of cybercrime. The breach also raises questions about the long-term data retention practices of educational institutions. It’s time for universities to rethink their data retention policies: Minimize data collection: Only collect data that is absolutely necessary for admissions and operations. Set data deletion timelines: Implement policies to automatically delete data that is no longer needed. Encrypt sensitive information: Even if attackers gain access, encrypted data is far more difficult to exploit. “Educational institutions have a duty to protect the data entrusted to them. Failing to do so not only harms individuals but erodes public trust in the system,” said Andrea Patel, a legal expert specializing in data privacy. What’s Next for NYU and the Education Sector? NYU has pledged to invest $25 million in cybersecurity upgrades over the next two years, including the deployment of a state-of-the-art Security Operations Center (SOC) and migration to a more secure cloud-based infrastructure. They’ve also promised to provide identity protection services to all affected individuals for the next five years. However, the damage to NYU’s reputation is harder to quantify. Prospective students and their families may now think twice before submitting sensitive information, while alumni and donors may question the institution’s ability to safeguard their data. For the education sector as a whole, this incident should be a catalyst for change. Institutions must stop viewing cybersecurity as a secondary concern and start treating it as a core part of their operational strategy. With the increasing sophistication of cybercriminals and the rise of AI-driven attacks, the stakes have never been higher. Action Items for Leaders in Education Here’s a quick checklist for educational leaders looking to bolster their cybersecurity posture: Audit legacy systems and prioritize upgrades or decommissioning. Adopt a Zero Trust Architecture to limit unauthorized access. Invest in real-time monitoring and anomaly detection tools. Develop and test a comprehensive incident response plan. Review and update data retention and encryption policies. Educate staff and students on cybersecurity best practices. Cybersecurity is no longer optional—it’s a necessity. The NYU breach is a stark reminder of what’s at stake and the cost of complacency. Let this be a turning point for the education sector to lead by example in data protection and privacy. ## Task Duration Doubling Every 7 Months: METR's AI Capability Research - URL: https://bartmcd.com/blog/metr-ai-task-duration-doubling-every-7-months - Published: 2025-03-14 The Accelerating Curve of AI Capability In a striking revelation, METR's recent research has demonstrated that artificial intelligence’s ability to handle complex tasks is doubling every seven months—a pace that eclipses Moore's Law and highlights the exponential trajectory of machine learning advancements. As businesses increasingly integrate AI into their workflows, this rapid development is reshaping industries, redefining productivity metrics, and challenging leaders to rethink how they approach innovation and workforce strategies. Understanding METR's Findings METR, a leading AI research group, analyzed performance benchmarks across diverse sectors, from natural language processing and computer vision to multi-modal AI systems capable of handling tasks spanning multiple domains. Their conclusions are grounded in real-world applications, focusing on how quickly AI systems improve in performing specific tasks that were previously the domain of human expertise. Key Metrics of AI Growth Task Complexity: Tasks requiring higher levels of reasoning, contextual understanding, and adaptability are now solvable by AI in record time. Multi-domain Integration: AI systems like OpenAI’s GPT-5 and Google's Gemini are seamlessly combining skills across text, image, and audio processing. Time Efficiency: The time required for AI to master these tasks reduces by half every seven months, signaling relentless acceleration. The implications of these findings are profound. For instance, AI systems are now capable of generating high-quality legal documents, performing diagnostic analyses in healthcare, and even designing marketing campaigns more effectively than human counterparts. The speed of this evolution is not just a technological story—it’s an economic and ethical one. What This Means for the Future of Work As AI capabilities surge, the future of work is transitioning from augmentation to transformation. Businesses that once viewed AI as a tool for efficiency are now witnessing its potential for creativity and innovation. However, this rapid evolution also raises critical questions. The Shift in Skill Demand In 2025, organizations are already seeing a decline in demand for repetitive, task-based roles. Instead, there’s an increasing emphasis on: Strategic Thinking: Human employees are expected to focus on high-level decision-making and complex problem-solving. AI Management: Roles in AI oversight, tuning, and ethical governance are becoming critical. Adaptability: Workers must continually upskill to remain relevant as AI tools evolve. For example, in the finance sector, AI now handles the bulk of quantitative analysis, leaving human analysts to focus on strategic investment decisions and client relationship management. Similarly, in marketing, AI-driven tools generate content and optimize campaigns, while marketers shift their focus to brand strategy and customer experience. Challenges and Ethical Considerations While the doubling of AI capabilities offers immense potential, it also brings challenges that executives cannot ignore. Job Displacement The pace of AI adoption is outstripping the ability of many workers to adapt. METR’s findings suggest that job displacement will accelerate in industries with high automation potential, such as manufacturing, logistics, and customer service. Governments and businesses must collaborate to design retraining programs and ensure equitable access to new opportunities. Bias and Fairness As AI systems become more complex, ensuring fairness and eliminating bias becomes exponentially harder. For example, multi-modal AI systems operating on text, images, and audio may inadvertently reinforce societal biases embedded in their training data. Ethical AI design and robust oversight are non-negotiable. Security Risks Advanced AI systems are increasingly targeted by cybercriminals. In recent months, high-profile breaches have demonstrated how adversarial attacks can manipulate AI systems, causing financial losses and reputational damage. Leaders must prioritize cybersecurity frameworks tailored for AI environments. "The doubling of AI capabilities every seven months isn’t just a technical milestone—it’s a call to action for business leaders to align strategies, ensure ethical practices, and secure their systems against emerging risks." Actionable Strategies for Leaders Given the speed of AI evolution, executives must take proactive steps to harness its benefits while mitigating risks. Here are some key strategies: Invest in AI Literacy: Ensure your leadership team understands AI fundamentals, trends, and ethical considerations. Upskill Your Workforce: Focus on training programs that align employees with AI-enhanced roles and responsibilities. Adopt Agile Frameworks: Implement agile business models that allow your organization to adapt to rapid technological changes. Prioritize Ethics and Security: Develop clear policies on ethical AI usage and invest in cybersecurity measures tailored for AI systems. Collaborate with AI Innovators: Partner with AI research groups and technology providers to stay ahead of the curve. For instance, leading companies like Amazon and Siemens have already implemented robust AI training programs for employees, ensuring they can work effectively alongside AI systems. Meanwhile, governments in the EU and Asia are ramping up regulatory frameworks to address AI ethics and security—a trend that executives should monitor closely. Conclusion: Leadership in the Age of AI As METR’s research underscores, AI’s capability growth is not slowing down—it’s accelerating. For executives and business leaders, this is both an opportunity and a challenge. Those who act decisively, embracing AI while addressing its ethical and operational complexities, will position their organizations for sustainable success. The age of AI transformation is here. Are you ready to lead it? ## Claude Projects: Anthropic's Answer to Enterprise AI Memory - URL: https://bartmcd.com/blog/claude-projects-enterprise-ai-memory - Published: 2025-03-05 Claude Projects: A Game-Changer for Enterprise AI Memory In a world where AI powers everything from customer service to strategic decision-making, Anthropic has raised the bar with Claude Projects . This new feature, available to Claude Pro and Team users, introduces a groundbreaking 200,000-token context window and persistent, project-level memory. For businesses, this means AI that not only remembers but also contextualizes and collaborates over extended periods—a leap toward truly intelligent enterprise solutions. The Evolution of AI Memory: Why Context Matters Historically, one of the biggest bottlenecks in AI has been its memory—or lack thereof. Most large language models (LLMs) operate within limited context windows, often forgetting earlier parts of a conversation or project as they process new information. This short-term memory has been a pain point for professionals trying to use AI for complex, multi-step processes, such as drafting legal documents or analyzing financial trends. Claude Projects addresses this challenge with its 200K-token context window, enabling it to process and retain substantially more information at once. To put this into perspective, 200,000 tokens equate to roughly 150,000 words or an entire book’s worth of data. For enterprises, this means Claude can now understand and respond to comprehensive datasets, detailed project briefs, or months of customer interactions without losing track of the narrative. Persistent Memory: The Key Differentiator Unlike traditional LLMs that "forget" interactions immediately after the session ends, Claude Projects introduces persistent memory. This feature allows the AI to recall specific details tied to a project over days, weeks, or even months. For example: A marketing team can collaborate with Claude on an ongoing campaign, with the AI remembering past strategies, target audience preferences, and performance metrics. Legal teams can rely on Claude to draft and refine contracts, keeping track of specific clauses and terms relevant to a particular client or case. Product managers can maintain a running dialogue with Claude, using it to track feature requests, prioritize tasks, and generate reports on progress. This level of persistent memory transforms Claude from a transactional tool into a long-term collaborator. “Claude Projects represents a paradigm shift for enterprise AI. Persistent memory allows organizations to build a relationship with their AI, making it a true extension of their team.” Implications for Enterprise Workflows The introduction of Claude Projects has profound implications for how businesses leverage AI. Here are three key ways it can transform enterprise workflows: 1. Enhanced Collaboration Across Teams With persistent memory, Claude Projects becomes a centralized knowledge hub. Teams can share AI-driven insights without losing critical context. For instance, a sales team can pass detailed customer profiles to a support team, ensuring seamless handoffs and superior customer experiences. 2. Accelerated Decision-Making By retaining and analyzing historical data, Claude Projects enables faster, more informed decision-making. Whether it’s synthesizing trends from quarterly reports or generating predictive models, the AI’s ability to "remember" past interactions eliminates redundant groundwork. 3. Reduced Operational Overhead Repetitive tasks like documentation, data entry, and report generation can now be handled with greater accuracy and efficiency. Moreover, the AI’s capability to recall past work reduces the need for manual re-briefing, freeing up human resources for higher-value tasks. Security and Privacy: A Critical Lens Of course, persistent memory raises legitimate concerns about data security and privacy . Anthropic has taken steps to address these issues, implementing enterprise-grade encryption and user-controlled memory settings. Organizations can choose what data Claude retains, ensuring compliance with regulatory frameworks like GDPR and CCPA. Anthropic’s focus on Constitutional AI —guiding its models with ethical principles—also plays a crucial role in mitigating risks. By embedding guardrails, Claude Projects is designed to prioritize user safety and minimize misuse. “Security is not an afterthought; it’s a core feature. We’ve built Claude Projects with enterprise-grade safeguards to ensure your data stays yours.” How to Get Started with Claude Projects For businesses looking to take advantage of Claude Projects, onboarding is straightforward. Here are some actionable steps to get started: Upgrade to Pro or Team: Claude Projects is currently exclusive to these tiers. Evaluate your organization’s needs and choose the appropriate plan. Define Your Use Cases: Start by identifying areas where persistent memory can have the greatest impact, such as customer service, project management, or data analysis. Set Memory Boundaries: Use Anthropic’s memory management tools to define what data Claude retains, ensuring alignment with your security policies. Train Your Teams: Provide training to ensure employees understand how to interact with Claude effectively and securely. Looking Ahead: The Future of AI in Business As we settle into 2025, the release of Claude Projects underscores a broader trend: AI is shifting from a tool to a true business partner. Persistent memory is just the beginning. As models like Claude continue to evolve, we can expect even more advanced features, such as real-time learning and deeper integrations with enterprise software ecosystems. For organizations ready to embrace this change, the potential rewards are immense. From enhanced productivity to more strategic innovation, Claude Projects is not just a feature—it’s a glimpse into the future of work. ## The GenAI Phishing Epidemic: When AI Makes Scams Undetectable - URL: https://bartmcd.com/blog/genai-phishing-epidemic-ai-makes-scams-undetectable - Published: 2025-02-25 The Rise of AI-Powered Phishing Tactics Phishing scams have always relied on deception, but the game has changed dramatically. Over the past two years, generative AI tools have empowered cybercriminals to create hyper-realistic, personalized phishing campaigns that are nearly impossible to detect. These tools, once primarily used for innovation, have become weapons in the hands of bad actors, blending technology and manipulation into a potent threat. The result? A wave of undetectable scams targeting individuals and businesses alike, leaving security teams scrambling to adapt. How Generative AI Has Supercharged Phishing Personalization at Scale Before generative AI, phishing emails often contained glaring errors: poor grammar, generic greetings, or mismatched branding. Today, those flaws are relics of the past. Generative AI can craft emails that mimic an organization’s tone, branding, and language with precision. Cybercriminals now scrape publicly available data from LinkedIn, social media, and corporate websites to feed AI models, producing highly tailored messages that appear legitimate. For example, attackers can create emails that address employees by name, reference internal projects, or even simulate the communication style of senior executives. With AI tools like ChatGPT 4.5 and its competitors, generating convincing content takes seconds, allowing fraudsters to launch thousands of tailored attacks simultaneously. Voice Cloning and Deepfake Technology Phishing has expanded beyond emails. Voice cloning, powered by advanced AI models, has made vishing (voice phishing) far more convincing. Cybercriminals can replicate a CEO’s voice with just a few seconds of audio, calling employees to request urgent payments or sensitive information. Similarly, deepfake technology now enables video phishing, where attackers impersonate executives in live video calls. The result? Employees are more likely than ever to fall for these scams, as they no longer rely solely on visual or auditory cues to detect fraud. Key Insight: Generative AI has blurred the line between legitimate communication and scams, making traditional phishing detection methods obsolete. Case Studies: The GenAI Phishing Epidemic in Action Several high-profile incidents in 2024 highlighted the growing threat of AI-powered phishing: Financial Sector Breach: A major global bank lost $120 million after employees were tricked by deepfake video calls. Attackers posed as executives, requesting urgent wire transfers to "secure accounts." Healthcare Data Leak: A hospital system suffered a data breach when attackers used AI-generated emails to infiltrate its network, compromising patient data. Tech Company Espionage: A tech giant faced intellectual property theft after engineers were targeted with AI-generated emails requesting access credentials to "collaborate on a confidential project." These incidents are not isolated. Instead, they represent the tip of the iceberg in a rapidly evolving threat landscape. Defending Against AI-Driven Phishing Attacks Adopt Advanced Threat Detection Tools Traditional email filters and security protocols are no match for AI-powered phishing. Organizations must invest in advanced threat detection platforms that leverage machine learning to identify subtle anomalies in communication. Tools like AI-enhanced email security platforms and behavioral analytics systems can flag suspicious activity, even when the content appears legitimate. Educate Employees Continuously Employee training remains a critical defense against phishing, but it must evolve to address AI-driven threats. Organizations should conduct regular workshops and simulations that teach teams to recognize the nuances of generative AI scams. Key training areas include: Identifying overly personalized messages and unusual requests. Verifying communications via secondary channels, such as phone calls or in-person confirmations. Understanding the latest AI technologies attackers may use. Implement Multi-Factor Authentication (MFA) MFA remains one of the simplest yet most effective defenses against phishing. Even if attackers gain access to login credentials, MFA ensures they cannot easily enter systems without an additional layer of verification. By integrating biometric authentication or hardware security keys, organizations can further enhance their defenses. Limit Public Data Exposure AI-driven phishing thrives on publicly available data. Organizations should audit their online presence and limit the amount of sensitive information shared on websites, social media, and professional platforms. For example, removing employee contact details and internal project references can reduce the risk of targeted attacks. Partner with Cybersecurity Experts The complexity of AI-powered phishing demands expert support. Managed cybersecurity services providers (MSSPs) can offer real-time threat intelligence, incident response, and proactive defense strategies tailored to evolving risks. Collaborating with external experts ensures organizations stay ahead of the curve. Key Insight: Defending against AI-driven phishing requires a multi-layered approach that combines technology, education, and vigilance. The Future of AI and Cybersecurity Generative AI continues to evolve, with new models becoming more powerful and accessible. While the technology offers immense opportunities for innovation, it also poses significant risks. Governments and industry leaders are beginning to regulate AI usage, with frameworks like the 2024 Global AI Ethics Accord aiming to curb misuse. However, enforcement remains a challenge. Looking ahead, organizations must prepare for even more sophisticated attacks. AI-powered scams will likely incorporate real-time data analysis, enabling attackers to adjust their tactics mid-operation. To combat this, cybersecurity teams must embrace AI as a defensive tool, leveraging its capabilities to predict and neutralize threats proactively. Key Insight: The battle between AI-driven attacks and defenses will shape the future of cybersecurity. Staying adaptive is no longer optional—it's essential. Conclusion: A Call to Action The GenAI phishing epidemic is a stark reminder that cybersecurity must evolve alongside technological advancements. Organizations, executives, and employees have a shared responsibility to recognize the risks and implement robust defenses. By adopting cutting-edge tools, prioritizing education, and fostering a culture of vigilance, businesses can turn the tide against these sophisticated scams. As we navigate this new era, one thing is clear: the only way to outsmart AI-powered attackers is to stay one step ahead, leveraging the same tools they use for malicious purposes to secure our future. ## AI Agents in 2025: Beyond the Hype to Real Enterprise Value - URL: https://bartmcd.com/blog/ai-agents-2025-real-enterprise-value - Published: 2025-02-18 AI Agents Are Changing the Game By 2025, AI agents have moved from experimental to essential. No longer confined to chatbots or voice assistants, these agents now play critical roles in decision-making, operations, and customer interactions across industries. According to a recent Gartner study, 33% of organizations have deployed AI agents in some capacity, and that figure is expected to grow exponentially. The question is no longer "Can we use AI agents?" but "How can we maximize their value within our enterprise?" As AI capabilities mature, the hype of 2022 has made way for tangible results. Companies that strategically implement AI agents are reaping measurable benefits: faster decision cycles, improved customer satisfaction, and even reduced operational costs. However, the road to successful deployment is fraught with challenges—from organizational resistance to ethical considerations. Let’s explore how businesses can overcome these hurdles and unlock the full potential of AI agents. Practical Use Cases: Where AI Agents Deliver Value 1. Enhanced Customer Support Customer support has been one of the earliest and most successful applications of AI agents. Today’s AI agents are no longer limited to handling simple FAQs. Thanks to advancements in natural language processing (NLP), they can now engage in complex conversations, troubleshoot technical issues, and even predict customer needs. For example, a major telecom provider recently implemented an AI agent capable of resolving 60% of customer queries without human intervention. The agent not only reduced call center costs by 25% but also improved customer satisfaction scores by 18%. These intelligent systems leverage real-time sentiment analysis to adjust their tone and responses, creating a more human-like interaction. 2. Intelligent Decision Assistance AI agents are increasingly being used to assist executives and managers in making data-driven decisions. They analyze vast amounts of data, identify trends, and offer actionable recommendations—all in real time. In industries like finance, this capability is proving indispensable. Consider a hedge fund that employs an AI agent to generate trading strategies. By analyzing market data, news sentiment, and historical performance, the agent provides insights that would take human analysts weeks to uncover. The result? A 15% increase in portfolio returns and significantly reduced research costs. 3. Process Automation Beyond customer interactions, AI agents are automating repetitive tasks across departments. From HR to supply chain management, these agents are streamlining workflows, reducing errors, and freeing up human employees for more strategic work. Take the example of a global retail chain using AI agents to manage inventory. By predicting demand and automating restocking processes, the company reduced stockouts by 30% and cut operational expenses by $12 million annually. This is not just automation; it’s intelligent, adaptive automation that evolves with the business. Key Implementation Strategies 1. Start Small, Scale Strategically One of the biggest mistakes companies make is trying to do too much too soon. Deploying AI agents is not a one-size-fits-all solution. Instead, start with a pilot project in a single department or process. Measure the impact, refine the approach, and then scale across the organization. For example, a leading healthcare provider began its AI journey with a single agent for appointment scheduling. Once the agent proved its value—reducing call wait times by 50%—the company expanded its use to claims processing and patient follow-ups. This phased approach minimized risk and ensured long-term success. 2. Invest in Data Quality AI agents are only as good as the data they’re trained on. Poor-quality data leads to poor performance, and in some cases, operational risks. Before deploying AI agents, organizations must prioritize data governance, ensuring accuracy, relevance, and security. Take the example of a logistics company that struggled with inaccurate delivery forecasts from its AI agent. A deep dive revealed that inconsistent data entry was the root cause. After implementing stricter data validation processes, the agent’s accuracy improved by 40%, restoring stakeholder confidence. 3. Balance Automation with Human Oversight While AI agents can handle many tasks autonomously, they are not infallible. Human oversight remains critical, especially for high-stakes decisions or customer interactions. The goal should be to create a symbiotic relationship where AI agents handle the routine, and humans step in for strategic or nuanced tasks. For instance, a financial services firm uses AI agents for fraud detection. While the agents flag suspicious transactions, human analysts review and confirm these cases. This hybrid approach has reduced false positives by 30% while maintaining high detection rates. Overcoming Challenges 1. Addressing Employee Resistance One of the biggest barriers to AI adoption is employee resistance. Concerns about job displacement and trust in AI systems can slow down implementation. Transparent communication and upskilling programs are essential to mitigate these fears. For example, a manufacturing company rolled out AI agents alongside a robust training program. Employees were taught how to work with the agents and given opportunities to reskill for higher-value roles. The result was a 25% increase in productivity and a workforce that embraced rather than resisted the technology. 2. Navigating Ethical Concerns As AI agents take on more responsibilities, ethical considerations become increasingly important. Issues like bias in decision-making and data privacy cannot be ignored. Organizations must establish clear ethical guidelines and ensure ongoing audits of AI systems. In 2024, a major retailer faced backlash when its AI agent was found to exhibit bias in customer service interactions. The incident highlights the importance of regular testing and updating of AI models to ensure fairness and compliance with regulations. 3. Integrating with Legacy Systems Many organizations struggle to integrate AI agents with existing systems and workflows. Legacy infrastructure can be a significant barrier, leading to inefficiencies and underutilization of AI capabilities. A phased integration strategy, coupled with cloud-based AI solutions, can help overcome this challenge. For instance, a global bank successfully integrated AI agents into its legacy CRM system by leveraging API-based connectors. This approach minimized downtime and ensured a seamless transition, allowing the bank to offer personalized customer experiences without overhauling its entire IT infrastructure. The Road Ahead As we move further into 2025, the adoption of AI agents shows no signs of slowing down. Organizations that embrace these technologies strategically will gain a competitive edge, while those that hesitate risk falling behind. The key lies in focusing on practical applications, investing in the right infrastructure, and addressing challenges proactively. “AI agents are not a magic bullet, but when implemented thoughtfully, they can transform how businesses operate and compete.” The next frontier? AI agents that not only execute tasks but also learn and adapt autonomously, driving continuous improvement without human intervention. The future is here, and it’s time for enterprises to seize the opportunities that AI agents bring to the table. ## The Death of the Open Office - URL: https://bartmcd.com/blog/the-death-of-the-open-office - Published: 2025-02-17 The Death of the Open Office: Why Top Executives Are Reclaiming Private Spaces and What It Means for Productivity For decades, the open office reigned supreme as the hallmark of modern workplace design. Heralded as a solution to foster collaboration, flatten hierarchies, and boost innovation, it became a staple in companies worldwide. From tech startups to corporate giants, the open office was seen as the physical embodiment of a more transparent and connected work culture. But now, in a post-pandemic world where the need for versatile and effective work environments has never been greater, top executives are rethinking this model. Private offices, long thought of as a relic of the past, are making a strong comeback—and for good reason. The shift holds critical implications for how we think about productivity, focus, and the future of work. The Original Promise of Open Offices The open office concept was initially pitched as a revolutionary approach to workplace design. It promised to: Encourage collaboration: By removing physical barriers, employees would have more opportunities for spontaneous interactions and idea-sharing. Promote transparency: Open layouts symbolized a more egalitarian office culture, breaking down the walls—both literal and metaphorical—between leadership and employees. Reduce costs: Open spaces allowed companies to fit more desks into less square footage, making it a financially attractive option. These promises were alluring, and for a time, open offices did seem to deliver on some of their goals. However, cracks in the foundation began to show as the novelty wore off and the realities of working in open spaces became apparent. Why Open Offices Failed Despite their initial appeal, open offices have largely failed to live up to their lofty promises. Studies and employee feedback reveal significant drawbacks that have led many organizations to reconsider this model: 1. A Productivity Killer Open offices are notorious for distractions. The constant noise, lack of privacy, and frequent interruptions have been shown to reduce employee productivity . Research published in the "Journal of Environmental Psychology" found that open office workers report higher levels of stress and lower levels of concentration compared to those in private spaces. 2. Collaboration at the Expense of Focus While open layouts were designed to foster collaboration, they often do so at the expense of deep, focused work. In reality, employees in open offices tend to use headphones or seek out quiet corners to escape the chaos, undermining the very collaboration the design aimed to encourage. 3. Hygiene and Health Concerns The COVID-19 pandemic further highlighted the vulnerabilities of open office designs. Shared spaces and close quarters made it easier for illnesses to spread, prompting companies to reassess the safety of such environments. 4. One Size Doesn’t Fit All Perhaps the biggest flaw of the open office is its assumption that all work styles are the same. Diverse teams require diverse environments . Creative brainstorming sessions thrive in open spaces, but analytical or deep thinking tasks demand quiet and privacy. “The one-size-fits-all approach of the open office failed because it didn’t account for the complexity of human work. Productivity isn’t just about proximity; it’s about purpose and focus.” The Return of Private Offices for Deep Work Recognizing these shortcomings, many organizations are pivoting back to private offices, especially for executives and roles requiring significant deep work. Here’s why this shift is gaining traction: 1. Deep Work Drives Results Cal Newport, in his book Deep Work , argues that the ability to focus without distraction is a superpower in today’s economy. Private offices provide the sanctuary needed for this kind of high-value work. 2. Executive Leadership Requires Privacy For top executives, privacy is not a luxury—it’s a necessity. Whether discussing sensitive issues, strategizing long-term plans, or making critical decisions, leaders need spaces where they can think and speak freely without the risk of interruptions. 3. A Hybrid Model for the Modern Workplace Many companies are now embracing a hybrid model that balances private spaces for focused work with open areas for collaboration. This approach recognizes that different tasks require different environments, and the physical office should adapt accordingly. Balancing Collaboration with Focused Work The challenge for leaders isn’t just about choosing between open and private offices—it’s about creating a workplace that supports both collaboration and focus. Here are actionable steps to achieve this balance: Design for flexibility: Incorporate a mix of open spaces, private offices, and shared meeting rooms to accommodate various work styles and tasks. Leverage technology: Use collaboration tools and scheduling software to minimize unnecessary interruptions and maximize productivity. Foster a culture of respect: Encourage employees to respect each other’s time and focus by establishing norms for when and how to communicate. Measure and adapt: Regularly gather feedback from employees to understand what’s working and make adjustments to the office design as needed. Conclusion: The Future of Work Is Purpose-Driven The death of the open office doesn’t mean the end of collaboration or innovation—it marks the beginning of a more thoughtful approach to workplace design. By reclaiming private spaces and balancing them with open areas, executives can create environments that truly support productivity and well-being. As we move forward, leaders must recognize that the best workplaces are those that align with the diverse needs of their teams. The goal isn’t to return to the cubicle farms of the past or cling to the open-office ideal—it’s to design spaces that empower employees to do their best work, whatever that looks like. Your office should work for you, not against you. Take a hard look at your current setup and ask yourself: Is it enabling focus and collaboration, or is it holding your team back? The answer might just be the key to unlocking your organization’s full potential. ## Bybit Heist: North Korea Steals $1.4 Billion in Largest Crypto Theft Ever - URL: https://bartmcd.com/blog/bybit-heist-north-korea-largest-crypto-theft - Published: 2025-02-11 The Largest Crypto Theft in History: A Wake-Up Call On January 15, 2025, the world witnessed an unprecedented cybercrime: North Korea's infamous Lazarus Group executed the largest cryptocurrency heist ever recorded, stealing $1.4 billion from the Bybit exchange. This staggering breach has sent shockwaves through the financial and tech industries, raising urgent questions about the vulnerabilities in our digital financial systems and the evolving tactics of state-sponsored cybercriminals. As cryptocurrency adoption continues to grow, this attack serves as a pivotal warning for organizations and individuals alike. Breaking Down the Bybit Heist How Did Lazarus Execute the Attack? The Lazarus Group leveraged a sophisticated multi-stage strategy to infiltrate Bybit's infrastructure. Here’s a breakdown of their approach: Social Engineering: Attackers targeted Bybit employees with a highly convincing spear-phishing campaign. They used AI-generated deepfake identities to pose as job recruiters, gaining access to internal systems through malicious attachments. Zero-Day Exploits: The group exploited previously unknown vulnerabilities in Bybit's API and wallet management system. This allowed them to bypass multi-signature wallet protections and initiate unauthorized transfers. Blockchain Analysis Evasion: Using advanced obfuscation techniques like mixer services and cross-chain swapping, the stolen funds were laundered across multiple blockchains, making recovery efforts nearly impossible. Despite Bybit's robust security framework, the attackers demonstrated a chilling level of sophistication. This wasn't just a failure of technology—it was a failure to anticipate how state-sponsored attackers could exploit human and systemic weaknesses. North Korea’s Growing Reliance on Cybercrime The Bybit attack is part of a broader trend. North Korea's state-sponsored hacking groups have increasingly turned to cryptocurrency theft as a means of bypassing international sanctions. According to a 2024 UN report, cybercrime now accounts for over 30% of the country's GDP. The Lazarus Group, in particular, has been at the forefront, previously linked to high-profile heists like the Axie Infinity Ronin bridge breach in 2022. Their success underscores the need for global cooperation to combat state-sponsored cybercrime. Without coordinated action, these groups will continue to operate with impunity, leveraging the borderless nature of cryptocurrency to fund illicit activities. Lessons Learned: How to Protect Cryptocurrency Assets 1. Strengthen Organizational Security For crypto exchanges and financial institutions, the Bybit heist should serve as a stark reminder of the importance of a multi-layered security approach. Here are the immediate steps organizations should take: Adopt Zero Trust Architecture: Implement strict access controls, where no user or device is trusted by default, even if they are inside the network. Enhance Employee Training: Regularly educate employees on the latest phishing tactics, emphasizing the risks posed by AI-generated deepfakes. Conduct Red Team Exercises: Simulate real-world attack scenarios to identify vulnerabilities and improve incident response protocols. 2. Secure Personal Investments For individual crypto investors, the Bybit attack highlights the need for personal vigilance. Here’s how you can safeguard your assets: Use Hardware Wallets: Keep the majority of your funds in cold storage, disconnected from the internet. Enable Multi-Factor Authentication (MFA): Ensure all accounts are protected with MFA, preferably using a hardware-based solution like YubiKey. Avoid Centralized Platforms: While convenient, centralized exchanges are prime targets for hackers. Consider decentralized finance (DeFi) solutions, but remain cautious of their own vulnerabilities. Remember, the security of your assets is only as strong as your weakest link. Regularly review your practices and adapt to the evolving threat landscape. 3. Advocate for Industry-Wide Standards The cryptocurrency industry must move beyond a reactive approach to security. Stakeholders should advocate for standardized security protocols across exchanges, wallets, and blockchain networks. Key areas of focus include: Interoperable Security Standards: Develop standards that ensure consistent security practices across platforms. Real-Time Threat Intelligence Sharing: Create a global network for sharing information on emerging threats, enabling faster responses. Regulatory Oversight: Support balanced regulations that prioritize security without stifling innovation. Without collective action, the industry will remain a patchwork of isolated efforts, leaving critical gaps for attackers to exploit. The Role of Artificial Intelligence in Cybersecurity AI technology played a dual role in the Bybit heist. On the one hand, Lazarus leveraged AI-powered tools to execute their attack, from generating deepfake profiles to automating phishing campaigns. On the other hand, AI has the potential to be a powerful defensive tool. Here’s how organizations can harness AI to stay ahead of cybercriminals: Anomaly Detection: Use AI algorithms to identify unusual patterns in transaction data, such as large transfers or activity from unfamiliar IP addresses. Threat Prediction: Leverage predictive analytics to anticipate potential attack vectors based on historical data. Automated Incident Response: Deploy AI-driven systems to respond to breaches in real-time, minimizing damage and recovery time. However, it’s important to note that AI is not a silver bullet. Organizations must integrate AI into a broader security strategy, combining technology with human expertise and robust governance frameworks. A Call to Action: Preparing for the Future The Bybit heist is a sobering reminder of the stakes in today’s digital economy. As cybercriminals become more sophisticated, the responsibility to protect assets lies with all of us—business leaders, cybersecurity professionals, and individual investors. To avoid becoming the next headline, take proactive steps to secure your systems, advocate for stronger industry standards, and leverage emerging technologies like AI responsibly. Most importantly, recognize that cybersecurity is not a one-time investment but an ongoing process. The $1.4 billion stolen from Bybit is a stark warning of what’s at stake. Let this be the moment we all take action to build a safer, more resilient digital future. ## o3-mini Goes Free: OpenAI's Reasoning Model for Everyone - URL: https://bartmcd.com/blog/openai-o3-mini-free-reasoning-model-chatgpt - Published: 2025-01-31 The Democratization of Advanced AI: A Watershed Moment Today, OpenAI has made a groundbreaking announcement: the o3-mini model, once reserved for premium users, is now available to all free-tier ChatGPT accounts. This move marks a significant shift in the AI landscape, bringing advanced reasoning capabilities to millions of users worldwide. As we enter 2025, this democratization of technology signals a new era where access to high-functioning AI is no longer a privilege but a public resource. With o3-mini, users can experience enhanced problem-solving, nuanced decision-making, and contextual understanding—all at no cost. But what does this mean for businesses, individuals, and the broader tech ecosystem? Let’s explore the implications of this pivotal moment and how you can leverage o3-mini for maximum impact. What Makes o3-mini Different? o3-mini isn’t just another AI model; it represents a leap forward in reasoning and contextual comprehension. Built on OpenAI’s third-generation architecture, this model strikes a balance between computational efficiency and cognitive depth. Key Features of o3-mini Advanced reasoning: The model excels in logical deduction, pattern recognition, and multi-step problem-solving, making it ideal for complex queries. Contextual adaptability: o3-mini can understand nuanced prompts and adjust its responses based on evolving context. Resource efficiency: Unlike its larger counterparts, o3-mini delivers high performance while maintaining lower computational demands, which is critical for scaling access. For free-tier users, this means tasks that once required premium subscriptions—such as strategic planning, in-depth data analysis, or even creative ideation—are now within reach. The implications for accessibility and innovation are enormous. Why Now? OpenAI’s Strategic Shift This release comes at a time when competition in the AI space is more heated than ever. Over the past year, we've seen significant advancements from other players like Anthropic’s Claude 3.0 and Google’s Gemini models. By offering o3-mini for free, OpenAI is not only reinforcing its commitment to accessibility but also responding to market pressures to remain a leader in the space. “The release of o3-mini for all users is aligned with OpenAI’s mission to ensure artificial general intelligence benefits all of humanity.” – Sam Altman, CEO of OpenAI Additionally, the timing aligns with increased scrutiny from global governments on AI ethics and accessibility. The European Union's AI Act, expected to come into full effect later this year, emphasizes equitable access to AI technology. OpenAI's decision may also be a proactive step to align with these regulatory frameworks. How Businesses Can Leverage o3-mini For executives and decision-makers, the availability of o3-mini opens up numerous opportunities to integrate advanced AI capabilities into everyday operations. Here are some actionable ways businesses can take advantage of this new resource: Enhance Customer Interaction Deploy o3-mini in customer support workflows to handle complex queries that previously required human intervention. Use its advanced reasoning to personalize customer interactions, increasing satisfaction and loyalty. Streamline Internal Processes Automate routine decision-making processes, such as resource allocation or scheduling, with greater accuracy. Leverage o3-mini’s problem-solving abilities for internal brainstorming sessions, strategy development, or competitive analysis. Enable Cross-Team Collaboration Utilize o3-mini to summarize and synthesize large datasets, enabling more informed decision-making across departments. Foster collaboration by using the model to mediate and resolve conflicts in project goals or priorities. With these applications, even small businesses with limited AI budgets can level the playing field against larger competitors. Challenges and Ethical Considerations While the release of o3-mini is a major step forward, it does come with its challenges. For one, the sudden influx of advanced AI into the free tier raises concerns about misuse. Misinformation campaigns, phishing schemes, and other malicious activities could see a surge as bad actors exploit the model’s reasoning capabilities. On the ethical front, questions about data privacy and model transparency remain. OpenAI has committed to improving user education and implementing safeguards, but the responsibility also lies with businesses and individuals to adopt AI responsibly. “With great power comes great responsibility. As o3-mini becomes widely available, the need for ethical AI use has never been more critical.” – Bart McDonough The Road Ahead The release of o3-mini to free-tier users is more than just a product update; it’s a statement about the future of AI. By making advanced reasoning accessible to all, OpenAI is setting a precedent that could reshape how we think about technology and its role in society. For business leaders, this is an opportunity to innovate, differentiate, and drive value in ways that were previously unimaginable. For individuals, it’s a chance to harness the power of AI for personal growth and everyday problem-solving. And for the tech industry, it’s a reminder that progress is only meaningful when it’s shared. The democratization of o3-mini could very well be remembered as the moment when AI became truly universal. The question now is: how will you use this power? ## OpenAI Operator: The First True AI Agent Is Here - URL: https://bartmcd.com/blog/openai-operator-first-true-ai-agent - Published: 2025-01-24 The Dawn of Agentic AI: OpenAI Operator Changes Everything Today marks a historic milestone as OpenAI unveils Operator, its first autonomous AI agent capable of browsing the web, completing forms, and executing complex tasks with minimal human oversight. In an era defined by rapid advancements in artificial intelligence, Operator is not just an evolution—it’s a revolution. For businesses, governments, and individuals alike, this groundbreaking technology signals the beginning of the agentic AI era, where machines act with purpose and adaptability. The question now is: are we ready? What Makes Operator Different? While AI systems like ChatGPT and Bard have dominated headlines over the past few years, their capabilities were primarily limited to conversational interfaces and predefined functions. Operator is something entirely new: a true agent. Unlike its predecessors, Operator doesn’t just respond to queries; it proactively solves problems by executing tasks independently, learning from its successes and failures, and adapting to real-world conditions. Key Features of Operator Autonomous Task Execution: Operator can identify objectives, formulate strategies, and carry out actions without explicit instructions for every step. Web Browsing and Interaction: From researching competitive data to filling out application forms, Operator navigates the web as seamlessly as a human user. Contextual Learning: Using reinforcement learning, Operator refines its approach based on outcomes, improving its efficiency over time. Integration with Business Systems: Operator connects with CRM platforms, project management tools, and enterprise software to enhance workflow automation. "Operator represents a paradigm shift in artificial intelligence, where machines don’t just compute—they act with purpose. This technology has the potential to redefine industries overnight." Implications for Businesses The launch of Operator is poised to transform the corporate world. Its ability to autonomously complete tasks previously reserved for human employees means businesses can significantly boost productivity while reducing operational costs. However, this is not without its challenges. Opportunities Enhanced Efficiency: Operator can handle repetitive, time-consuming tasks faster than any human, freeing employees to focus on strategic initiatives. Scalability: Organizations can deploy Operator across multiple departments, scaling operations without increasing headcount. 24/7 Availability: Unlike human workers, Operator functions continuously, ensuring round-the-clock service and task execution. Challenges Security Risks: As Operator interacts with sensitive systems and data, robust cybersecurity measures are essential to prevent breaches or misuse. Workforce Displacement: The automation of certain roles may lead to job losses, requiring businesses to invest in reskilling initiatives. Ethical Considerations: How should organizations regulate an AI agent that acts autonomously? Clear guidelines will be critical. "Businesses must embrace Operator strategically, balancing its transformative capabilities with ethical considerations and security safeguards." AI Governance: The New Imperative The introduction of Operator underscores the urgent need for updated AI governance frameworks. Governments and regulatory bodies worldwide must address the implications of agentic AI to ensure responsible deployment. This means clarifying rules around data privacy, accountability, and ethical use. Recent Developments in AI Regulation Since the landmark AI Act passed by the European Union in 2024, global efforts to regulate AI have gained momentum. The U.S. followed suit with the Responsible AI Innovation Act last year, which introduced guidelines for autonomous systems like Operator. These regulations emphasize transparency, requiring developers to disclose an AI agent’s decision-making processes and limitations. However, gaps remain. For example, how do we assign liability when an AI agent makes a harmful decision? And what safeguards ensure that autonomous systems don’t operate outside their intended scope? As Operator ushers in the agentic era, these questions demand immediate answers. How Businesses Can Prepare Adopting Operator—or similar agentic AI systems—requires thoughtful planning and preparation. Organizations must evaluate their readiness across several dimensions to ensure successful implementation. Actionable Steps for Executives Audit Current Processes: Identify tasks suitable for automation and assess how Operator could optimize these workflows. Invest in Security: Strengthen cybersecurity protocols to protect sensitive data and systems interacting with autonomous agents. Develop AI Literacy: Provide training for employees and leadership teams to understand the capabilities and limitations of agentic AI. Monitor Regulatory Trends: Stay informed about evolving AI regulations to ensure compliance and mitigate risks. Pilot Small Deployments: Begin with limited use cases to test Operator’s effectiveness before scaling across the organization. "Preparation is key. Organizations that take a proactive approach to integrating agentic AI will gain a competitive advantage in the years ahead." Final Thoughts: A New Chapter in AI As OpenAI Operator ushers in the era of agentic AI, the world faces a pivotal moment. This technology promises to reshape industries, streamline operations, and redefine the relationship between humans and machines. Yet, it also brings challenges that demand careful consideration—security, ethics, and workforce impacts among them. The key for business leaders and policymakers lies in balancing innovation with responsibility. Operator is not just a tool; it’s a catalyst for change. And as we move forward, the question isn’t whether agentic AI will transform our world—it’s how we’ll navigate that transformation. "Operator is here. The future isn’t coming—it has arrived." ## US Treasury Breach: Chinese Hackers Access 3,000 Classified Files - URL: https://bartmcd.com/blog/us-treasury-breach-supply-chain-attack-3000-files - Published: 2025-01-14 US Treasury Breach: A Stark Reminder of Supply Chain Vulnerabilities On January 14, 2025, the cybersecurity world is grappling with the fallout of a high-profile breach involving the US Treasury. Chinese hackers successfully exploited a third-party vendor to gain unauthorized access to over 3,000 unclassified Treasury files. While the files were not classified, they contained sensitive information critical to financial policy and international trade. This incident underscores the growing risks inherent in supply chain security, a challenge that continues to plague organizations worldwide. How the Breach Unfolded The attack leveraged a sophisticated supply chain vulnerability. Hackers targeted a third-party vendor providing IT services to the Treasury, using compromised credentials obtained from a phishing campaign. Once inside the vendor’s network, they escalated privileges and moved laterally to access Treasury systems. This breach highlights the increasingly advanced tactics employed by state-sponsored threat actors like the Chinese hacker group believed to be responsible. Key Exploitation Techniques Credential Harvesting: Phishing emails impersonated senior officials, tricking employees into providing login credentials. Zero-Day Exploits: A vulnerability in the vendor’s VPN software allowed attackers to bypass security protocols undetected. Lateral Movement: After breaching the vendor, attackers carefully navigated systems to reach Treasury servers without triggering alarms. “This breach is a stark lesson in the dangers of weak supply chain security. When one vendor falls, the domino effect can jeopardize critical infrastructures.” The Growing Threat of Supply Chain Attacks Supply chain attacks have become increasingly prevalent, with hackers exploiting the interconnected nature of modern business ecosystems. In 2024 alone, the FBI reported a 47% increase in supply chain-related breaches, driven by state-sponsored groups and opportunistic cybercriminals alike. Why Supply Chains Are Vulnerable Organizations often rely on a vast network of third-party vendors and contractors, many of whom lack robust cybersecurity measures. These vendors become entry points for attackers, who exploit their weaker defenses to target high-value systems. Key factors driving vulnerability include: Inadequate Vendor Security: Smaller vendors often lack the resources to implement advanced cybersecurity protocols. Complex Networks: The sheer number of vendors and sub-contractors makes it challenging to monitor every connection. Insufficient Oversight: Many organizations fail to conduct thorough security audits of their supply chain partners. “The weakest link in your supply chain can become the gateway to your most sensitive data.” Lessons for Business Leaders This breach serves as a wake-up call for executives across industries. The following actionable steps can help mitigate supply chain risks and strengthen organizational defenses: 1. Conduct Comprehensive Risk Assessments Regularly evaluate the cybersecurity posture of all vendors and contractors. This includes: Reviewing security certifications and compliance with frameworks like NIST and ISO 27001. Conducting penetration tests to identify vulnerabilities in vendor systems. Ensuring vendors implement robust access controls and encryption practices. 2. Implement Zero Trust Principles Adopt a “never trust, always verify” approach to network security. This includes: Segmenting networks to limit access to sensitive systems. Requiring multi-factor authentication (MFA) for all users. Monitoring user behavior for signs of compromise or privilege escalation. 3. Strengthen Incident Response Plans Prepare for the inevitable by ensuring your organization has a robust incident response strategy. Key components include: Establishing clear communication protocols for breach notifications. Conducting regular drills to test response capabilities. Partnering with cybersecurity firms to expedite forensic investigations. 4. Invest in Advanced Threat Detection Leverage tools powered by artificial intelligence (AI) and machine learning to identify anomalies in real-time. Modern solutions can detect supply chain threats by analyzing patterns across diverse data sources, enabling faster intervention before attacks escalate. The Role of AI and Machine Learning in Modern Cybersecurity As we move deeper into 2025, AI-powered cybersecurity tools are proving indispensable in combating sophisticated threats like supply chain attacks. These technologies can analyze vast datasets to spot emerging threats, providing proactive defense measures that traditional systems cannot match. Examples of AI in Action Anomaly Detection: AI can identify unusual login patterns or data transfers indicative of a breach. Behavioral Analysis: Machine learning algorithms can flag deviations from normal user behavior, prompting further investigation. Automated Response: AI systems can isolate compromised accounts or block malicious traffic without human intervention. “AI is rapidly becoming the backbone of cybersecurity, enabling organizations to stay ahead of evolving threats.” Conclusion: A Call to Action The US Treasury breach should serve as a catalyst for change. Business leaders must prioritize supply chain security in their broader cybersecurity strategy. Failure to act not only puts sensitive data at risk but also jeopardizes the trust of customers, partners, and stakeholders. By investing in proactive measures, leveraging AI-powered tools, and fostering a culture of cybersecurity awareness, organizations can fortify their defenses against the next wave of supply chain attacks. The stakes have never been higher, and the time to act is now. ## 2024 Cybersecurity Year in Review: The Worst Breaches and What We Learned - URL: https://bartmcd.com/blog/2024-cybersecurity-year-in-review-worst-breaches - Published: 2024-12-30 The Breach That Rocked Healthcare: Change Healthcare In early 2024, Change Healthcare, a major player in healthcare technology, suffered a devastating ransomware attack. The breach exposed the sensitive medical records of over 50 million patients, making it one of the largest healthcare data breaches in history. Threat actors exploited a zero-day vulnerability in the company’s cloud-based platform, targeting unpatched systems that were critical for daily operations. The fallout was swift and severe. Hospitals and clinics relying on Change Healthcare’s services faced operational disruptions, delayed patient care, and significant financial losses. The attack also renewed scrutiny on the healthcare sector’s preparedness for increasingly sophisticated cyber threats. What We Learned Zero-day vulnerabilities demand proactive defense: Organizations must adopt a more aggressive approach to vulnerability management, including implementing advanced threat detection and threat-hunting programs. Immutable backups are non-negotiable: Change Healthcare’s inability to restore systems quickly highlighted the importance of secure, immutable backups to minimize downtime during ransomware attacks. Healthcare must prioritize security: The breach underscored how underfunded and outdated cybersecurity approaches in healthcare can lead to catastrophic outcomes. “When organizations treat cybersecurity as a cost center rather than a strategic priority, they leave themselves vulnerable to attacks that can destroy their reputation and bottom line.” Snowflake: The Cloud Giant’s Wake-Up Call In mid-2024, Snowflake, a leading cloud data platform, experienced a serious security incident involving the misconfiguration of its shared responsibility model. Hackers exploited improperly secured APIs to gain unauthorized access to sensitive customer data, including financial records and intellectual property. While Snowflake’s systems themselves were not directly breached, the incident exposed gaps in how the company educated its customers about securing their environments. It also highlighted the growing complexity of cloud security as more enterprises shift to multi-cloud strategies. What We Learned Shared responsibility must be more than a buzzword: Both cloud providers and customers need to clearly define roles and responsibilities for security, with regular audits and training. API security is a critical weak point: As APIs become a backbone of modern applications, prioritizing their security with technologies like API gateways and runtime protection is essential. Transparency builds trust: Snowflake’s swift disclosure and communication were praised, reminding other companies that transparency during a breach is invaluable for maintaining customer trust. “Cloud security isn’t just about technology—it’s about collaboration. Without clear communication between providers and customers, the entire ecosystem is at risk.” Salt Typhoon: The Supply Chain Nightmare In what many are calling the "SolarWinds of 2024," the Salt Typhoon breach demonstrated the devastating potential of supply chain attacks. Salt Typhoon, a widely used software for managing container orchestration, was compromised when attackers embedded malicious code into its update mechanism. Thousands of organizations unknowingly downloaded the tainted update, granting attackers access to their networks. The breach was particularly alarming because it targeted the heart of DevOps processes, directly impacting software development lifecycles. Victims ranged from financial institutions to critical infrastructure providers, demonstrating how deeply supply chain attacks can infiltrate diverse industries. What We Learned Supply chain visibility is essential: Organizations must demand greater transparency from their vendors, including regular software bill of materials (SBOM) disclosures. Code integrity checks can’t be overlooked: Advanced tools for continuous code scanning and digital signature verification are now table stakes for software development teams. Incident response plans must include upstream threats: Companies need to prepare for scenarios where trusted third-party software becomes the attack vector. “The Salt Typhoon breach proved that your security is only as strong as the weakest link in your supply chain.” The AI Factor: How Generative AI Fueled Cyber Attacks 2024 was also the year when generative AI became a double-edged sword. While tools like OpenAI’s GPT-5 and Google Gemini continued to revolutionize industries, they also became powerful weapons in the hands of cybercriminals. From crafting highly convincing phishing emails to automating malware development, generative AI amplified the scale and sophistication of cyber threats. One particularly shocking case involved an AI-generated spear-phishing campaign that targeted a multinational bank. The attackers used AI to mimic the writing style of the CEO in real time, tricking executives into transferring millions of dollars to fraudulent accounts. The incident raised alarms about how AI can compromise even the most secure organizations. What We Learned AI tools must include guardrails: Developers of generative AI need to prioritize controls that prevent misuse, such as monitoring for malicious activity and adding friction to sensitive functionalities. Employee training needs an AI upgrade: Security awareness programs must evolve to teach employees how to spot AI-generated scams, which are often indistinguishable from human communications. AI must be part of the defense strategy: Organizations should leverage AI for threat detection, anomaly spotting, and predictive risk analysis to stay ahead of attackers. “AI is the ultimate arms race in cybersecurity. The same tools that empower businesses can also empower bad actors—if we’re not careful.” Key Takeaways for 2025 As we look ahead to 2025, the cybersecurity landscape will only grow more complex. The biggest breaches of 2024 have left us with critical lessons that must guide our strategies moving forward: Invest in resilience, not just defense: Breaches are inevitable. Focus on minimizing damage and recovering quickly, rather than chasing the impossible goal of perfect security. Adopt a zero-trust architecture: Whether it’s securing APIs, mitigating insider threats, or protecting against supply chain attacks, zero-trust principles must guide decision-making. Collaborate across industries: No organization can go it alone. Sharing threat intelligence and best practices is crucial for combating global cyber threats. Prepare for AI-driven threats: As generative AI continues to evolve, organizations must adapt their defenses to account for its potential misuse. Cybersecurity is no longer just an IT issue; it’s a business imperative. The organizations that thrive in 2025 and beyond will be those that treat security as a strategic enabler, not an afterthought. The stakes are higher than ever, but so are the opportunities to lead with resilience and innovation. ## Google Gemini 2.0: Agentic AI Goes Mainstream - URL: https://bartmcd.com/blog/google-gemini-2-0-agentic-ai-goes-mainstream - Published: 2024-12-17 Google Gemini 2.0: The Dawn of Agentic AI It’s official: Google has redefined the AI landscape yet again. With the release of Gemini 2.0, the company has transitioned from building digital assistants to empowering full-fledged, decision-making AI agents . This evolution isn’t just a product update—it’s a paradigm shift, and businesses need to pay attention. Gemini 2.0 represents more than faster response times and improved conversational capabilities. It’s Google’s first major step into mainstreaming autonomous agentic AI . In a world where OpenAI’s GPT-5 and Anthropic’s Claude Next are making waves, Gemini 2.0 strikes a unique chord with its focus on proactive, goal-oriented AI functionalities. The release is a clear signal: the AI race has entered a new phase, and it’s not about who can compute the fastest; it’s about who can act intelligently on behalf of the user. From Assistants to Agents: What’s the Difference? For years, AI assistants like Google Assistant, Alexa, and Siri have been helpful but ultimately reactive tools. They wait for commands and execute tasks. Gemini 2.0 changes the game by introducing agentic AI—software capable of initiating actions, making decisions, and adapting independently . Key Features of Gemini 2.0 Proactive Decision-Making: Gemini 2.0 anticipates user needs and executes tasks without requiring step-by-step instructions. Task Autonomy: Instead of performing a single task, Gemini 2.0 can manage entire workflows—whether it’s planning a trip, optimizing a team’s schedule, or even negotiating contracts. Contextual Awareness: The AI adapts to real-time changes, ensuring that decisions align with evolving priorities or environmental factors. Cross-Platform Integration: Gemini 2.0 seamlessly operates across Google’s ecosystem and third-party apps, making it a true command center for personal and professional life. “Gemini 2.0 is not just a tool; it’s a collaborator. This shift from assistants to agents marks the beginning of a more autonomous AI era.” For businesses and executives, the implications are profound. Imagine an AI agent that not only compiles reports but identifies key insights, schedules follow-up meetings, and drafts action plans—all autonomously. This is what Gemini 2.0 promises. Why Agentic AI Is a Game Changer The shift to agentic AI is about more than convenience. It’s about creating leverage. In a competitive business environment, leveraging AI agents can mean the difference between being a market leader or falling behind. Here’s why: 1. Enhanced Productivity AI agents like Gemini 2.0 don’t just perform tasks faster; they take entire projects off your plate. For instance, in customer service, a Gemini agent can handle full workflows—from triaging customer complaints to offering refunds or escalating issues. This frees up human teams to focus on strategic initiatives. 2. Improved Decision-Making AI agents excel at analyzing massive datasets and providing actionable insights in real time. They don’t just crunch numbers—they make data-driven recommendations, reducing the risk of human error. For executives, this means better, faster decisions and the ability to stay ahead of market trends. 3. Cost Efficiency While the initial investment in deploying AI agents may seem steep, the long-term cost savings are undeniable. By automating repetitive tasks, businesses can reduce operational expenses while reallocating resources to high-impact areas. “Agentic AI is not about replacing humans. It’s about augmenting human capabilities, ensuring that every decision and action is as informed and efficient as possible.” What This Means for the AI Landscape The release of Gemini 2.0 also highlights a broader trend: the maturation of the AI industry. As foundational models like GPT-5 and Gemini 2.0 become more advanced, the focus is shifting from raw computational power to applicability and usability . In 2024, we’ve seen AI startups and tech giants alike pivot towards creating AI solutions that are not just smarter but also more integrated into daily life. Microsoft’s Copilot, for example, has become a staple in enterprise productivity, while Meta’s AI characters have redefined social media engagement. Gemini 2.0’s agentic capabilities set a new benchmark, forcing competitors to rethink their strategies. Privacy and Ethical Considerations With great power comes great responsibility. As Gemini 2.0 and other AI agents gain autonomy, concerns around data privacy, security, and ethical decision-making are more pressing than ever. Google has emphasized that Gemini 2.0 is built with rigorous safeguards, including transparency features that allow users to track and audit the AI’s actions. However, businesses adopting agentic AI must also take responsibility. This includes: Conducting regular audits to ensure AI decisions align with ethical standards. Implementing robust data governance policies to protect sensitive information. Training employees to work effectively alongside AI agents, minimizing risks of misuse or over-reliance. Executives must recognize that while agentic AI can drive incredible value, it also introduces new layers of complexity in compliance and accountability. How to Prepare Your Organization for Agentic AI Adopting agentic AI like Gemini 2.0 isn’t just a tech upgrade; it’s a strategic transformation. Here are actionable steps to ensure a smooth transition: 1. Assess Your Current AI Maturity Before diving into agentic AI, evaluate your organization’s existing AI capabilities. Do you already leverage AI for data analysis, customer service, or process automation? If not, start small with pilot projects to build foundational expertise. 2. Invest in Training and Change Management Introducing AI agents will disrupt workflows. Prepare your teams by offering training programs that not only teach them how to use the technology but also address potential concerns about job displacement. Position AI agents as tools for empowerment, not replacement. 3. Prioritize Security and Governance Agentic AI introduces new vulnerabilities, from data breaches to unauthorized actions. Work with your IT and cybersecurity teams to implement safeguards, such as role-based access controls and real-time monitoring of AI activities. 4. Experiment and Iterate Start by deploying Gemini 2.0 in low-risk environments. Use these pilot programs to refine workflows, gather feedback, and measure ROI. Once confident, scale up to more critical operations. “The organizations that succeed in the age of agentic AI will be those that embrace change, experiment boldly, and prioritize ethical AI practices.” The Road Ahead Google Gemini 2.0 is more than just a product; it’s a glimpse into the future of AI. By enabling AI agents to act autonomously and proactively, Google has set a new standard for what technology can do—and what we can achieve with it. For executives and business leaders, the message is clear: the age of agentic AI is here, and those who adapt quickly will reap the rewards. Whether it’s enhancing productivity, driving innovation, or staying ahead of competitors, Gemini 2.0 offers a roadmap to a smarter, more efficient future. The question isn’t whether you should adopt agentic AI. It’s how quickly you can make it a cornerstone of your strategy. The clock is ticking, and the future waits for no one. ## OpenAI's 12 Days of OpenAI: Everything You Need to Know - URL: https://bartmcd.com/blog/openai-12-days-announcements-o1-chatgpt-pro-o3 - Published: 2024-12-10 The Significance of OpenAI's December Announcements OpenAI has made waves this December with their “12 Days of OpenAI” campaign, unveiling a series of announcements that redefine their trajectory in artificial intelligence. From the surprise launch of the o1 AI assistant to the expanded capabilities of ChatGPT Pro and an intriguing preview of the o3 multimodal platform , the company has cemented its place as a leader in generative AI development. But what do these announcements mean for businesses, individuals, and the broader technology landscape? Let’s dive in. o1: A Game-Changer for Personal AI Assistants On the first day of their campaign, OpenAI introduced o1 , a hyper-customizable AI assistant designed to integrate seamlessly into personal and professional workflows. Unlike traditional AI assistants, o1 is marketed as a “co-pilot for life,” offering capabilities that extend far beyond basic scheduling or information retrieval. What Sets o1 Apart? Customizability: Users can train o1 on their unique preferences and integrate it into specific applications, from CRMs to personal fitness trackers. Privacy-First Design: All data processed by o1 is encrypted end-to-end, and users have granular control over what is shared or stored. Adaptability: o1 continuously learns and evolves, becoming smarter and more aligned with user needs over time. o1 has already found strong adoption among executives and teams looking to streamline operations. For example, early adopters in the financial sector report using o1 for real-time compliance monitoring and predictive analytics, reducing human workload by nearly 40% in some cases. “o1 isn’t just a tool; it’s a partner in productivity, designed to make your life frictionless and focused.” ChatGPT Pro: A Leap in Generative AI OpenAI also unveiled significant upgrades to ChatGPT Pro , their premium subscription offering. With the competition in generative AI heating up, these enhancements ensure that OpenAI remains a step ahead of rivals like Anthropic’s Claude 3 and Google’s Gemini AI. Key Features of ChatGPT Pro Context Expansion: Pro users can now upload entire projects—spanning hundreds of pages—and receive detailed analyses within minutes. Real-Time Collaboration: New collaborative editing features enable multiple users to work on the same ChatGPT instance simultaneously, ideal for brainstorming or problem-solving. Industry-Specific Fine-Tuning: ChatGPT Pro offers pre-trained models tailored to industries such as healthcare, law, and software development. These upgrades make ChatGPT Pro a formidable tool for businesses. For instance, law firms are leveraging the platform’s legal-specific model to draft contracts and conduct case research, saving countless hours of manual effort. Meanwhile, developers find its real-time debugging capabilities invaluable in accelerating the software development lifecycle. What It Means for Organizations The improvements in ChatGPT Pro underscore a broader trend: AI is no longer just a tool for efficiency but a driver of strategic decision-making. Companies that adopt these advanced technologies will find themselves better positioned to outpace competitors. o3 Multimodal Preview: A Glimpse into the Future Perhaps the most tantalizing announcement of the 12 days campaign is the o3 multimodal preview . This forthcoming platform promises to integrate text, image, video, and even haptic feedback capabilities into a single, unified interface. While still in its early stages, o3 is set to revolutionize how we interact with AI. Why o3 Matters Seamless Integration: Imagine designing a marketing campaign in minutes by simply uploading a set of images and videos, and having the AI generate cohesive, high-quality content across all formats. Accessibility: o3 is being developed with inclusivity in mind, featuring cutting-edge tools for visually and hearing-impaired users to engage with AI in new ways. Enterprise-Ready: The platform will offer APIs designed for large-scale business adoption, enabling seamless integration with existing tech stacks. While o3 is still in its preview phase, the potential applications are immense. For example, manufacturers could use it to design immersive training modules that combine text, video, and haptics, reducing onboarding times and increasing worker proficiency. “o3 isn’t just about multimodal AI—it’s about creating an entirely new category of human-computer interaction.” Lessons for Business Leaders So, what should executives and decision-makers take away from OpenAI’s flurry of announcements this December? Here are three key insights: 1. The AI Arms Race is Accelerating With OpenAI, Anthropic, and Google all vying for dominance, the pace of AI development is only intensifying. Businesses that fail to adopt these tools risk falling behind competitors who are leveraging AI to innovate faster and operate more efficiently. 2. Customization and Privacy Are No Longer Optional The success of o1 and ChatGPT Pro highlights a growing demand for AI solutions that can be deeply personalized while maintaining robust privacy standards. Organizations should prioritize solutions that align with these principles to build trust with users and stakeholders. 3. Prepare for a Multimodal Future The o3 platform’s preview is a clear signal that the future of AI interaction will be multimodal. Businesses should start exploring how they can leverage these capabilities to transform customer experiences, employee training, and product development. Final Thoughts OpenAI’s “12 Days of OpenAI” campaign has not only showcased the company’s technological prowess but also set the agenda for the next wave of AI innovation. From personal AI assistants to enterprise-grade generative models and groundbreaking multimodal platforms, these announcements are a wake-up call for anyone still underestimating the transformative power of AI. The challenge now lies in adoption. Leaders must move quickly to evaluate these tools, understand their potential impact, and integrate them into their organizations. As the AI landscape evolves at breakneck speed, one thing is clear: the future belongs to those who adapt and innovate. ## The Top 5 Cybersecurity Risks for Private Equity Firms - URL: https://bartmcd.com/blog/top-cybersecurity-risks-private-equity-firms - Published: 2024-11-29 In the fast-paced world of private equity, where transactions are swift and high-stakes, cybersecurity often takes a backseat. However, with the increasing sophistication of cyber threats, private equity firms must prioritize safeguarding their digital assets. Let's explore the top five cybersecurity risks that these firms face and how they can mitigate them effectively. 1. Data Breaches Data breaches remain one of the most significant threats to private equity firms. These breaches can expose sensitive financial data, proprietary business information, and personal details of clients and employees. Such incidents not only tarnish a firm's reputation but can also lead to substantial financial losses. Mitigation Strategy: Implement strong access controls, regularly update security protocols, and conduct routine security audits. Encrypt sensitive data both at rest and in transit to add an extra layer of protection. 2. Phishing Attacks Phishing attacks continue to be a prevalent threat vector. Cybercriminals employ increasingly sophisticated techniques, making it challenging for even the most vigilant employees to differentiate between legitimate and fraudulent communications. Mitigation Strategy: Educate employees about recognizing phishing attempts and encourage a culture of skepticism regarding unsolicited emails. Deploy email filters and multi-factor authentication to reduce the risk further. 3. Insider Threats Insider threats are often underestimated but can be equally, if not more, damaging than external attacks. Disgruntled employees or those with malicious intent can exploit their access to sensitive information, causing irreversible harm. Mitigation Strategy: Implement strict access management policies and monitor user activity for unusual behavior. Regularly review access permissions and ensure they are granted on a need-to-know basis. 4. Ransomware Ransomware attacks can cripple a private equity firm by encrypting critical data and demanding a ransom for its release. The consequences of such an attack can be devastating, resulting in operational downtime and financial losses. Mitigation Strategy: Maintain regular backups of all critical data and store them securely offline. Invest in advanced endpoint protection solutions and ensure that all systems are up-to-date with the latest security patches. 5. Third-Party Risks Private equity firms often rely on third-party vendors and partners, which can introduce additional vulnerabilities. A weak link in the supply chain can compromise the entire firm's cybersecurity posture. Mitigation Strategy: Conduct thorough due diligence on all third-party vendors, ensuring they adhere to robust cybersecurity standards. Establish clear contractual obligations regarding security practices and perform regular assessments of their compliance. "In the realm of private equity, cybersecurity is not just a technical issue; it's a business imperative. Protecting digital assets is crucial to maintaining trust and ensuring long-term success." - Bart McDonough Conclusion In an industry where information is power, private equity firms must stay ahead of the ever-evolving cyber threats. By understanding and addressing these top cybersecurity risks, firms can safeguard their assets, protect their reputation, and continue to thrive in a competitive landscape. As the old adage goes, an ounce of prevention is worth a pound of cure. Now is the time to fortify your cybersecurity defenses. Call to Action: Evaluate your firm's current cybersecurity posture and take proactive steps to address vulnerabilities. Engage with cybersecurity experts to conduct a comprehensive risk assessment and develop a robust security strategy tailored to your specific needs. ## Microsoft Copilot's Enterprise Evolution: AI in Every Workflow - URL: https://bartmcd.com/blog/microsoft-copilot-enterprise-evolution-ai-workflows - Published: 2024-11-26 Microsoft Copilot's Enterprise Evolution: AI in Every Workflow Just over a year since Microsoft announced its game-changing Copilot integration within Microsoft 365, the technology has become an inseparable part of enterprise workflows. From drafting nuanced emails to synthesizing complex data across organizational silos, Copilot has redefined the way businesses operate. With its latest updates in 2024, including advanced workplace search capabilities and themed email authoring, Copilot is no longer just an AI assistant—it’s the backbone of enterprise productivity. Deep Integration: AI Embedded in Everyday Tools Microsoft has achieved what many AI vendors have long aspired to: seamless integration of artificial intelligence into the tools employees already use every day. Copilot isn’t a standalone platform; it’s woven into the fabric of Microsoft 365 products like Word, Excel, Teams, and PowerPoint. This deep integration has been pivotal in driving adoption and delivering tangible business value. 1. Enhanced Collaboration in Teams In 2024, Microsoft expanded Copilot’s capabilities within Teams, making it indispensable for hybrid and remote work. The AI can now summarize lengthy meetings in seconds, highlighting action items and assigning tasks directly to team members. It also supports real-time language translation, ensuring global teams can collaborate without barriers. “With Copilot in Teams, we’ve cut our post-meeting follow-ups by half. It’s like having a project manager in every meeting,” said the CIO of a leading financial services firm. 2. Smarter Data in Excel Excel has long been a cornerstone of enterprise data analysis, but Copilot’s AI-driven suggestions have taken it to the next level. Complex formulas, data visualizations, and even predictive analytics are now accessible to non-technical users. For instance, Copilot can analyze quarterly sales data and automatically generate reports that identify trends and outliers. Practical Insight: Train teams to use Copilot’s “Explain This” feature in Excel to understand data correlations and improve decision-making. Workplace Search: A Unified Knowledge Hub One of the most transformative updates in 2024 has been the rollout of workplace search, a unified AI-powered search engine that spans the entire Microsoft ecosystem. Unlike traditional search tools, Copilot doesn’t just retrieve documents; it understands context and delivers actionable insights. 1. Breaking Down Silos Modern enterprises generate vast amounts of data, much of which remains locked in disconnected systems. Copilot bridges these silos by indexing and connecting data across Microsoft 365 apps, SharePoint, and even third-party platforms like Salesforce and ServiceNow. Need to find the latest version of a client proposal? Copilot not only retrieves it but also cross-references related emails and meeting notes. 2. Contextual Relevance Copilot’s search capabilities go beyond keywords to understand intent. For example, asking “What were the key takeaways from the Q3 earnings call?” returns a concise summary, relevant slides, and follow-up actions. This level of contextual relevance has made workplace search a cornerstone for knowledge workers. “Copilot’s search function is like having a personal researcher on call 24/7. It doesn’t just find information; it makes sense of it for you,” noted an executive at a global consulting firm. Themed Email Composing: Personalization at Scale Email remains a critical communication channel for enterprises, and Copilot’s new themed email composing functionality has revolutionized how businesses engage with stakeholders. The AI leverages natural language generation to craft emails tailored to specific audiences, ensuring the right tone, style, and messaging. 1. Advanced Customization Whether you’re drafting a formal investor update or a casual team announcement, Copilot can adjust the email’s tone and content to match your intent. It even pulls in relevant data from your files and calendars, ensuring accuracy and relevance. 2. Time Savings For high-volume email tasks like marketing campaigns or customer outreach, Copilot’s templates and dynamic personalization capabilities save hours of work. By analyzing recipient preferences and past interactions, the AI ensures every email feels human and engaging. Actionable Tip: Use Copilot to A/B test email variations for better open and response rates. Challenges and Considerations While Copilot’s enterprise evolution is impressive, it’s not without challenges. As with any AI tool, success depends on how well organizations implement and govern its use. Here are a few considerations: Data Privacy: Copilot’s effectiveness relies on accessing sensitive company data. Enterprises must ensure robust governance policies to protect this information. Bias and Accuracy: AI models like Copilot can sometimes generate biased or inaccurate outputs. Ongoing training and human oversight are essential. Employee Training: While Copilot is user-friendly, employees need guidance on how to leverage its full potential. “AI is only as good as the data it’s trained on and the people who use it. Organizations must strike the right balance between automation and human oversight,” warned a cybersecurity expert at a recent AI governance summit. Looking Ahead: What’s Next for Copilot? Microsoft shows no signs of slowing down. Future updates are expected to include deeper integrations with third-party platforms, more advanced natural language processing, and even proactive workflow suggestions—where Copilot anticipates your needs before you articulate them. The rumored integration of generative AI for video editing in PowerPoint is another game-changer to watch in 2025. As enterprises continue to embrace digital transformation, tools like Microsoft Copilot will play an increasingly central role. The key for business leaders is to not only adopt these technologies but to strategically integrate them into their workflows, ensuring they drive both efficiency and innovation. “AI isn’t just a tool; it’s an infrastructure. Enterprises that fail to adapt risk falling behind,” one tech analyst aptly summarized during a recent industry event. With Copilot, Microsoft has set a high bar for what enterprise AI can achieve. The question now isn’t whether your organization should adopt it, but how quickly you can fully leverage its potential. ## Salt Typhoon Escalates: Senator Calls It 'Worst Telecom Hack in History' - URL: https://bartmcd.com/blog/salt-typhoon-worst-telecom-hack-ss7-ai-tools - Published: 2024-11-19 Salt Typhoon: The Anatomy of a Historic Cyberattack "This is, without question, the worst telecom hack in history." These were the words of Senator Carla Martinez during a Congressional hearing this week, as the nation grapples with the full extent of the Salt Typhoon campaign. First detected in late 2023, this Chinese state-sponsored cyber-espionage operation has not only breached major telecom providers but also targeted high-profile political figures, including former President Donald Trump and Senator J.D. Vance. The revelations, disclosed in a classified report leaked to the press on November 15, 2024, paint a sobering picture of advanced persistent threat (APT) activity. The campaign exploited vulnerabilities in telecom infrastructure, intercepting communications and siphoning sensitive data on an unprecedented scale. As businesses and government agencies scramble to assess their exposure, it’s imperative to understand how this breach happened and what we can do to mitigate future risks. How Salt Typhoon Operated The Telecom Weak Link Salt Typhoon represents a masterclass in exploiting systemic vulnerabilities. The attackers specifically targeted the signaling system used by telecom operators to route calls and messages—an aging infrastructure known as Signaling System 7 (SS7). Despite years of warnings from cybersecurity experts, the SS7 protocol remains riddled with security flaws, making it an attractive target for bad actors. The group used these vulnerabilities to intercept SMS messages, compromise multi-factor authentication (MFA) codes, and gain access to privileged systems. This enabled them to exfiltrate sensitive communications from political figures, corporate executives, and even journalists. The campaign was so stealthy that many of the affected organizations didn’t realize they had been breached until the leaked report surfaced. Advanced Tactics and Tools Salt Typhoon’s success also hinged on their use of advanced AI-driven tools. These tools enabled the attackers to automate reconnaissance and adapt their techniques in real time. For example: Machine Learning Algorithms: Used to analyze telecom traffic and identify high-value targets, such as communication patterns involving political figures. Deepfake Voice Cloning: Leveraged to impersonate targets in real-time calls, tricking victims into divulging sensitive information. Zero-Day Exploits: Exploited vulnerabilities in widely used telecom hardware, bypassing traditional security measures. By combining these techniques, Salt Typhoon demonstrated a level of sophistication that has redefined the threat landscape for 2024 and beyond. Implications for National Security The scope and scale of the Salt Typhoon campaign have triggered widespread alarm within the U.S. government. Beyond the immediate damage to individual victims, the breach has exposed systemic vulnerabilities that could jeopardize national security. "This isn’t just a wake-up call—it’s a five-alarm fire. Our reliance on outdated telecom protocols has made us sitting ducks for adversaries." — Senator Carla Martinez Salt Typhoon underscores the critical importance of securing communication channels that are foundational to both government operations and private industry. In an era where AI can amplify the capabilities of cybercriminals, even minor vulnerabilities can have catastrophic consequences. Lessons for Business Leaders While government agencies bear much of the responsibility for addressing systemic issues like SS7 vulnerabilities, business leaders must also take proactive steps to protect their organizations. Here are some key lessons from the Salt Typhoon breach: Reassess Telecom Dependencies: Many businesses rely heavily on SMS-based MFA for securing their systems. Given the demonstrated vulnerabilities, it’s time to transition to more secure authentication methods, such as hardware security keys or app-based MFA. Invest in AI-Driven Threat Detection: Just as attackers are leveraging AI to enhance their capabilities, defenders must do the same. AI-driven security tools can help identify unusual activity and respond to threats in real time. Audit Third-Party Vendors: Telecom providers and other third-party vendors represent a significant attack surface. Regular audits and stringent security requirements are essential to minimize risk. Implement Zero-Trust Architecture: By assuming that no system or user can be inherently trusted, organizations can limit the potential damage of a breach. This includes segmenting networks, enforcing least-privilege access, and continuously monitoring for anomalies. Business leaders who fail to act now risk becoming the next victims of an attack that could have been prevented with proper foresight and investment. What Needs to Change? Salt Typhoon has reignited debates about the need for regulatory reform in the telecom industry. Despite years of warnings, many providers have been slow to address the inherent vulnerabilities in SS7 and similar protocols. Moving forward, lawmakers and regulators must prioritize: Mandatory Security Standards: Establishing baseline security requirements for telecom providers, including encryption and secure signaling protocols. Increased Penalties for Non-Compliance: Holding organizations accountable for failing to address known vulnerabilities. Public-Private Collaboration: Encouraging closer cooperation between government agencies and private industry to share intelligence and develop innovative solutions. These changes won’t be easy or inexpensive, but they’re necessary to safeguard the nation’s digital infrastructure in an increasingly hostile cyber environment. The Road Ahead Salt Typhoon is a stark reminder that cybersecurity is no longer a back-office concern—it’s a boardroom priority. As businesses and governments continue to navigate the fallout from this historic breach, it’s clear that the old ways of thinking about security are no longer sufficient. To stay ahead of adversaries, organizations must embrace a proactive, forward-thinking approach to cybersecurity. This includes leveraging emerging technologies, fostering a culture of vigilance, and advocating for systemic change at the highest levels. The stakes have never been higher, but with the right strategies and investments, we can build a more secure future. ## Election 2024: Did AI and Deepfakes Change the Game? - URL: https://bartmcd.com/blog/election-2024-ai-deepfakes-misinformation - Published: 2024-11-07 How AI and Deepfakes Shaped Election 2024 As the dust settles on one of the most contentious elections in U.S. history, one question looms large: did AI and deepfake technology fundamentally alter the rules of political engagement? This election brought unprecedented challenges as campaigns, voters, and even regulators grappled with synthetic media, hyper-targeted AI-generated content, and the blurred lines between truth and fabrication. For better or worse, the 2024 presidential race may well be remembered as the year technology became a decisive player in shaping democracy. The Rise of AI-Generated Campaign Strategies Artificial intelligence has been a tool in political campaigns for years, but 2024 marked a turning point. Campaigns leveraged advanced AI models, successors to OpenAI's GPT-4 and Google's Bard, to create hyper-personalized voter outreach strategies. These tools analyzed vast amounts of data to segment voters with surgical precision, crafting messages tailored to individual values, concerns, and even voting history. AI's Role in Microtargeting Personalized Messaging: AI-driven tools generated millions of unique emails, social media ads, and text messages, each designed to resonate with specific voter demographics. For instance, a suburban mother in Ohio might receive an ad highlighting education policies, while a young entrepreneur in Texas saw content focused on economic innovation. Predictive Analytics: Campaigns used predictive AI to forecast voter behavior, enabling real-time adjustments to messaging and resource allocation. This reduced wasteful spending and maximized impact in battleground states. While these strategies improved voter engagement, critics argue they deepened political polarization by creating echo chambers of information tailored to reinforce pre-existing beliefs. The question remains: does this level of personalization enhance democracy or undermine it by isolating voters in their own ideological silos? Deepfakes: The New Frontier of Misinformation Deepfake technology, which uses AI to create hyper-realistic but fake videos and audio, reached new heights in 2024. From fabricated speeches by candidates to misleading attack ads, deepfakes pushed the boundaries of what voters could trust. The Weaponization of Deepfakes Fake Candidate Videos: In the final weeks of the campaign, a deepfake video depicting one candidate making inflammatory remarks went viral, garnering millions of views before being debunked. Although the video was quickly exposed as a fake, the damage to the candidate's reputation was irreversible. Disinformation Campaigns: Foreign actors and domestic groups alike deployed deepfakes to sow confusion and distrust. These efforts targeted swing-state voters, with the goal of suppressing turnout or swaying opinions at critical moments. Despite advances in detection technology, the sheer volume and sophistication of deepfakes made it nearly impossible to debunk all false content in real-time. This created an environment where voters were left questioning the authenticity of nearly everything they saw online. “The 2024 election was not just a battle of ideas; it was a battle of realities. The lines between fact and fiction have never been more blurred.” Regulatory Gaps and the Struggle for Accountability Heading into the election, lawmakers and tech companies were acutely aware of the risks posed by AI and deepfakes. Yet, despite years of warnings, regulatory efforts fell short. Proposed legislation, such as 2023's AI Accountability Act, stalled in Congress due to partisan gridlock. Meanwhile, tech platforms implemented only piecemeal solutions, such as labeling suspected deepfakes and limiting the reach of flagged content. Missed Opportunities Inconsistent Enforcement: Social media platforms struggled to apply policies uniformly, leading to accusations of bias and fueling mistrust among users. Lack of Transparency: While some platforms used AI to identify and remove deepfakes, the algorithms themselves were often opaque, leaving the public in the dark about how decisions were made. The regulatory inaction left voters vulnerable to manipulation, raising urgent questions about how to balance free speech with the need to protect democratic integrity. Moving forward, policymakers must prioritize creating clear guidelines for the use of AI in political campaigns. Lessons Learned and the Path Ahead Despite the challenges, the 2024 election offers valuable lessons for navigating the intersection of technology and democracy. Here are three actionable takeaways for business leaders, policymakers, and technology professionals: Invest in Media Literacy: As AI-generated content becomes more prevalent, educating the public on how to identify and critically evaluate synthetic media is essential. Schools, workplaces, and community organizations all have a role to play in fostering digital literacy. Enhance Detection Tools: The tech industry must continue to innovate in detecting and flagging deepfakes. Collaboration between private companies, governments, and academia will be key to staying ahead of bad actors. Establish Ethical Guidelines: Organizations using AI for political purposes should adopt voluntary ethical standards that prioritize transparency and accountability. This includes clearly labeling AI-generated content and disclosing data sources. Conclusion: A Turning Point for Democracy The 2024 presidential election has shown us both the promise and peril of AI in the democratic process. While these technologies have the potential to enhance engagement and efficiency, they also pose significant risks to trust and transparency. As we look to the future, one thing is clear: the conversation about AI's role in society is just beginning. The choices we make now will shape not only the next election but the very fabric of our democracy for generations to come. ## California's AI Laws: The Most Aggressive State Regulation Yet - URL: https://bartmcd.com/blog/california-ai-laws-aggressive-state-regulation - Published: 2024-10-22 California’s Bold AI Regulation: A Paradigm Shift California has long been a trailblazer in technology and innovation, but 2024 marks a new chapter in its leadership: aggressive AI regulation. With the passage of AB 2655 and the strengthening of existing deepfake laws, California is now the most heavily regulated state for artificial intelligence in the US. While federal efforts remain fragmented, California’s comprehensive approach is setting a precedent. For businesses leveraging AI, the implications are profound—and ignoring them could be costly. Breaking Down AB 2655: Transparency and Accountability AB 2655, signed into law earlier this year, represents a landmark in AI governance. Dubbed the “AI Accountability Act,” this legislation requires companies using AI systems to adhere to strict transparency and reporting requirements. The law’s key provisions include: Algorithmic Transparency: Companies must disclose the decision-making processes of AI systems, including training data sources and model architecture. Regular Audits: Businesses are required to conduct annual audits to identify biases or discriminatory outcomes in AI models. Consumer Protections: End users must be informed if they are engaging with AI, particularly in customer service or hiring scenarios. For industries relying heavily on AI—such as finance, healthcare, and retail—the compliance burden is significant. Companies are scrambling to implement robust protocols and documentation practices, while legal teams are preparing for potential lawsuits stemming from noncompliance. Actionable Steps for Businesses To navigate AB 2655, businesses should focus on the following: Invest in AI Governance: Establish an AI ethics board or appoint an AI compliance officer to oversee implementation. Enhance Documentation: Maintain detailed records of datasets, training processes, and model iterations to satisfy audit requirements. Conduct Bias Testing: Use third-party tools or consultants to evaluate AI systems for unintended discriminatory outcomes. “Transparency isn’t just a regulatory requirement; it’s a competitive advantage in an era of increasing consumer distrust.” Deepfake Legislation: Safeguarding Elections and Reputation California’s updated deepfake laws target the abuse of generative AI for creating deceptive content. With the 2024 presidential election marred by viral AI-generated videos, lawmakers acted swiftly to tighten regulations. The revised law criminalizes the distribution of deepfake content intended to mislead voters or damage reputations. Notable provisions include: Mandatory Watermarking: AI-generated content must include visible identifying marks to distinguish it from authentic material. Election Protections: Creating or sharing deepfakes designed to manipulate political outcomes can result in felony charges. Defamation Safeguards: Victims of malicious deepfake content now have expanded rights to sue for damages. By forcing accountability onto content creators and platforms, California aims to curb the spread of misinformation. Social media giants like Meta, TikTok, and X (formerly Twitter) face mounting pressure to implement robust detection and removal systems for deepfake content. How Businesses Can Adapt If your company uses generative AI to create marketing materials, entertainment, or other media, compliance with deepfake laws is essential. Practical steps include: Implement Watermarking: Ensure all AI-generated images and videos are clearly marked as synthetic. Monitor Platforms: Use AI detection tools to identify unauthorized deepfakes of your brand or executives. Educate Employees: Train your teams on the legal risks associated with generative AI misuse. “The cost of failing to manage deepfake risks isn’t just financial—it’s reputational, and that’s priceless.” The Federal vs. State Battle: A Regulatory Patchwork While California’s actions are groundbreaking, they underscore a broader issue: the lack of a cohesive federal framework for AI governance. The National AI Commission, established in early 2024, has yet to deliver actionable guidelines, leaving states to fill the void. This fragmented approach creates challenges for businesses operating across multiple jurisdictions. Consider these disparities: California’s Rigorous Standards: Transparency and consumer protection are paramount, with steep penalties for noncompliance. Texas and Florida’s Light-Touch Approach: These states prioritize innovation over regulation, creating a stark contrast with California. New York’s Focus on Data Privacy: While less comprehensive than California, New York’s AI laws emphasize privacy protections for consumers. For businesses, navigating this regulatory patchwork requires adaptability and foresight. Legal teams must stay updated on state-specific requirements, while executives should advocate for federal action to simplify compliance. “Inconsistent rules across states create a minefield for companies relying on AI. Federal leadership is overdue.” The Road Ahead: Preparing for Nationwide Trends California’s aggressive stance on AI regulation is likely to inspire similar actions in other states. Already, Massachusetts and Illinois are drafting laws modeled on AB 2655. Meanwhile, international efforts—like the EU’s AI Act—continue to push for global standards. For businesses, staying ahead of these trends is both a challenge and an opportunity. Strategic Recommendations To future-proof your organization, consider these strategies: Adopt a Global Mindset: Align your AI practices with international standards, such as the EU’s AI Act, to prepare for global expansion. Strengthen Partnerships: Collaborate with vendors, legal experts, and industry groups to share compliance insights and tools. Invest in Training: Educate your workforce on ethical AI practices to reduce risks and enhance innovation. As AI continues to evolve, the regulatory landscape will undoubtedly become more complex. Yet, businesses that embrace compliance as a strategic advantage—and invest in ethical, transparent AI—will emerge as leaders in this new era. ## Internet Archive Breach: 33 Million Users Affected - URL: https://bartmcd.com/blog/internet-archive-breach-33-million-users-affected - Published: 2024-10-15 Internet Archive Breach: What Happened? On October 12, 2024, the Internet Archive, known for its massive collection of digital artifacts and the Wayback Machine, confirmed a significant cybersecurity incident. A combined data breach and distributed denial-of-service (DDoS) attack exposed the personal information of approximately 33 million users, including email addresses, hashed passwords, and account details. While the platform has since contained the attack, the implications are far-reaching for both users and organizations relying on its services. This breach is particularly unsettling for a nonprofit organization dedicated to preserving open access to knowledge. It underscores an urgent reality: no entity, regardless of its mission, is immune to cyberattacks in today’s digital landscape. Breaking Down the Attack The Breach: Stolen Credentials and Poor Password Hygiene Initial investigations suggest hackers exploited vulnerabilities in the Internet Archive’s outdated user authentication framework. Despite years of warnings from cybersecurity experts, the platform relied on SHA-1 hashed passwords , a protocol deemed insecure as far back as 2017. Attackers likely employed credential-stuffing techniques, leveraging previously leaked email-password pairs to access user data. Compounding the issue, reports indicate that many users had weak passwords or reused credentials from other services. This highlights a perennial problem: even in 2024, password hygiene remains a weak link in cybersecurity. The DDoS Attack: A Smokescreen Simultaneously, the Internet Archive faced a sophisticated DDoS attack, bombarding its servers with an estimated 1.2 terabits per second of traffic. This onslaught disrupted access to its archives and masked the data exfiltration in progress. Experts suspect the attackers used botnets powered by compromised IoT devices, a tactic that has grown increasingly common with the proliferation of smart home technologies. The combination of a data breach and DDoS attack demonstrates a coordinated, multi-pronged approach to modern cyberattacks. Organizations must be prepared to defend on multiple fronts simultaneously. The Fallout: Why This Matters The Internet Archive breach serves as a cautionary tale for both individuals and organizations. Here are the key lessons: User Data at Risk: Exposed email addresses and passwords can fuel further attacks, including phishing schemes and identity theft. Reputation Damage: For a trusted nonprofit like the Internet Archive, this breach could erode public confidence in its ability to safeguard data. Operational Disruption: The DDoS attack temporarily crippled access to the organization’s resources, impacting researchers, journalists, and educators worldwide. As organizations increasingly rely on digital infrastructure, the cost of a breach extends beyond financial losses to include damage to brand reputation and operational continuity. How to Protect Your Accounts If you have ever interacted with the Internet Archive or similar platforms, it’s crucial to take immediate steps to secure your accounts. Here’s what you should do: 1. Change Your Passwords Create strong, unique passwords for each account. Use a mix of uppercase letters, lowercase letters, numbers, and special characters. Consider using a password manager to generate and store complex passwords securely. Remember, reusing passwords across multiple accounts is a recipe for disaster. A breach in one platform can serve as a gateway to others. 2. Enable Multi-Factor Authentication (MFA) Activate MFA wherever possible, especially for accounts tied to sensitive information, like email or banking. Opt for app-based authenticators like Google Authenticator or Microsoft Authenticator instead of SMS-based MFA, which is vulnerable to SIM-swapping attacks. MFA adds an extra layer of security, making it significantly harder for attackers to gain unauthorized access. 3. Monitor for Unusual Activity Keep an eye on your email for suspicious login attempts or password reset requests. Use a free or paid service to monitor if your email address appears in future data breaches. Proactive monitoring can help you respond swiftly to potential compromises. What Organizations Can Learn For businesses and nonprofits alike, the Internet Archive breach is a wake-up call. Cybersecurity must be a strategic priority, not an afterthought. Here are the critical takeaways for organizations: 1. Regularly Update Systems Outdated software and protocols are low-hanging fruit for attackers. Conduct regular security audits and promptly patch vulnerabilities. If your organization is still using insecure hashing algorithms like SHA-1, it’s time to migrate to more robust options like bcrypt or Argon2. 2. Invest in DDoS Mitigation Given the rise of DDoS attacks, organizations must invest in mitigation strategies. These include: Deploying cloud-based DDoS protection services. Configuring firewalls to block malicious traffic. Using rate-limiting techniques to prevent server overload. DDoS attacks may not always be preventable, but their impact can be minimized with the right defenses. 3. Educate Employees and Users Human error remains a leading cause of cyber incidents. Regularly train employees on best practices, like recognizing phishing attempts and avoiding public Wi-Fi for sensitive transactions. Similarly, educate your user base to adopt stronger security habits. Cybersecurity is not just about technology—it’s about culture. Building a security-first mindset can significantly reduce risks. The Road Ahead The Internet Archive breach is a stark reminder that even noble missions are not exempt from cyber threats. In an era where data is currency, attackers are becoming more sophisticated, and no organization can afford to be complacent. For individuals, this incident highlights the importance of personal cybersecurity hygiene. For organizations, it’s a call to action to double down on proactive defenses and user education. While breaches are inevitable, their impact can be mitigated with preparation, vigilance, and a commitment to ongoing improvement. As we look to the future, the question is not whether cyberattacks will happen, but how well we’ll be prepared to respond. The lessons from the Internet Archive breach should serve as a blueprint for building a more secure digital ecosystem. ## ChatGPT Gets Real-Time Web Search: A New Era for AI Assistants - URL: https://bartmcd.com/blog/chatgpt-real-time-web-search-new-era-ai-assistants - Published: 2024-10-08 ChatGPT Gets Real-Time Web Search: A Game-Changer for AI Assistants In a landmark move that’s set to redefine the role of artificial intelligence in our daily lives, OpenAI has officially rolled out real-time web search capabilities for ChatGPT. This update, which became available to all ChatGPT Plus and Enterprise users last month, represents a paradigm shift for AI assistants, transforming them from static knowledge repositories into dynamic, real-time information engines. With direct internet access, ChatGPT can now provide up-to-the-minute answers, analyze live data, and offer insights that were previously out of reach for AI systems limited to static training datasets. But what does this mean for businesses, users, and the broader AI ecosystem? Let’s dive into the implications, opportunities, and potential pitfalls of this new era of AI-driven web search. How Real-Time Search Changes the AI Assistant Landscape Until now, most AI assistants operated within the confines of a "knowledge cutoff," relying on datasets that were frozen at a specific point in time. For example, ChatGPT previously only had access to information up to October 2023 unless explicitly connected to external plugins or APIs. This limitation often rendered AI assistants outdated for rapidly evolving industries like finance, technology, and healthcare. Now, with real-time search capabilities, ChatGPT can: Access live news and updates: Whether it’s the latest market movements, emerging cybersecurity threats, or breaking geopolitical events, the AI can provide timely insights. Deliver accurate and current answers: Users no longer have to worry about outdated information influencing decisions. Verify and cross-reference sources: Unlike static models, real-time search allows for dynamic fact-checking, reducing the risk of misinformation. This capability positions ChatGPT not just as an assistant but as a proactive partner in decision-making. For businesses, this means faster, smarter, and more informed strategies—whether you're responding to client inquiries, conducting competitive analysis, or managing crisis situations. Applications Across Industries 1. Financial Services In sectors like finance, where every second counts, real-time search capabilities are a game-changer. Portfolio managers can ask ChatGPT for the latest stock prices, breaking regulatory updates, or currency exchange rates, empowering them to make faster, data-driven decisions. “Real-time search turns ChatGPT into a financial analyst’s dream assistant, bridging the gap between raw data and actionable insights.” 2. Healthcare The integration of live search opens new doors for healthcare applications. Medical professionals can now query ChatGPT for the latest research studies, drug approvals, or outbreak monitoring reports. This could significantly enhance patient care by bringing the most current medical knowledge directly to the point of need. 3. Cybersecurity As cyber threats evolve by the minute, staying informed is non-negotiable. ChatGPT’s ability to monitor live threat intelligence feeds, security blogs, and vendor updates in real time equips security teams with a powerful tool to identify risks and respond proactively. Example: A security analyst could ask ChatGPT for the latest on a specific vulnerability, then receive not only detailed information but also recommended mitigation strategies. Challenges and Considerations While the promise of real-time search is immense, it’s not without challenges. Here are some critical considerations that decision-makers should keep in mind: Accuracy and reliability: Real-time information is only as good as its sources. Businesses must ensure that ChatGPT’s outputs are cross-verified, especially for critical decisions. Bias in search results: The algorithms powering search engines may inadvertently prioritize certain viewpoints or sources, influencing the AI’s responses. This raises questions about objectivity and fairness. Privacy and security: Allowing AI to access live web data introduces potential vulnerabilities. Organizations must assess how these tools handle sensitive queries and ensure compliance with data protection laws. “As we embrace real-time AI, the emphasis must shift from simply deploying technology to ensuring it is used responsibly and ethically.” What’s Next for AI Assistants? The introduction of real-time search is just the beginning. As AI continues to evolve, we can expect even deeper integrations into business processes, including predictive analytics, automated decision-making, and personalized user experiences. The focus will increasingly shift toward making these systems more transparent and trustworthy, addressing the ethical challenges that come with such transformative technology. For organizations, the key takeaway is clear: staying competitive in this new era will require a proactive approach to leveraging AI capabilities. This means not only adopting tools like ChatGPT but also investing in employee training, security protocols, and governance frameworks to maximize their value. Final Thoughts OpenAI’s decision to incorporate real-time web search into ChatGPT marks a pivotal moment in the AI landscape. By bridging the gap between static knowledge and live, actionable information, this update transforms AI assistants into indispensable tools for both individuals and organizations. As this technology becomes more widespread, the businesses and leaders who embrace it thoughtfully and strategically will be the ones who thrive. The future of AI is here—and it’s happening in real time. ## Salt Typhoon: Chinese Hackers Compromise US Telecom Infrastructure - URL: https://bartmcd.com/blog/salt-typhoon-chinese-hackers-us-telecom-cyberattack - Published: 2024-09-24 Salt Typhoon: The Largest Telecom Cyberattack in U.S. History On September 24, 2024, the cybersecurity world is grappling with the fallout from "Salt Typhoon," an audacious cyberattack attributed to Chinese state-sponsored hackers. In an unprecedented breach, the attackers infiltrated critical infrastructure at AT&T, Verizon, T-Mobile, and other major telecom providers. The attack compromised millions of data records, disrupted services, and exposed vulnerabilities that have long been overlooked in the telecom sector. This breach underscores the evolving threat landscape and raises critical questions about the resilience of our national infrastructure. Here's what you need to know about Salt Typhoon, how it happened, and what it means for businesses and individuals moving forward. How Salt Typhoon Unfolded A Coordinated Attack on Telecom Giants The Salt Typhoon operation began as a silent intrusion, leveraging zero-day vulnerabilities in widely used telecom management software. By exploiting weaknesses in traffic-routing protocols and SIM authentication systems, the attackers gained access to sensitive operational data and customer information. This breach wasn't just about stealing data—it was about control. Over the course of six months, the attackers embedded themselves into telecom networks, mapping their architecture and planting backdoors. It wasn’t until a routine network audit at a regional provider uncovered unusual traffic patterns that the breach came to light. By then, the attackers had already exfiltrated terabytes of data. What Was Compromised? Customer Data: The breach exposed call records, text messages, and location data for tens of millions of users. Network Operations: Hackers accessed core network infrastructure, potentially allowing them to intercept communications or disrupt services. Intellectual Property: Sensitive proprietary information about telecom technologies and processes was stolen. “Salt Typhoon represents not just a breach of data, but a breach of trust in the backbone of our digital world.” Implications for U.S. National Security Telecom infrastructure is a critical component of national security. It supports everything from emergency services to military communications. The Salt Typhoon breach exposed vulnerabilities that extend beyond commercial interests, directly impacting national defense and public safety. Moreover, the timing of this attack is significant. With tensions between the U.S. and China escalating over semiconductor supply chains and AI supremacy, Salt Typhoon serves as a stark reminder of how cyber warfare is reshaping global power dynamics. The breach also highlights the need for stronger public-private partnerships to secure national infrastructure. Lessons for the Private Sector While the attack targeted telecom providers, its lessons apply to every industry. The incident underscores the importance of proactive cybersecurity measures and the need to anticipate, rather than react to, emerging threats. Key takeaways include: Zero Trust Architecture: Organizations must adopt a "never trust, always verify" approach to network security, ensuring that even internal traffic is scrutinized. Supply Chain Security: Telecom providers rely on a web of third-party vendors, many of which were implicated in the Salt Typhoon breach. Vetting and securing these relationships is critical. Incident Response Preparedness: The delayed detection of Salt Typhoon highlights the need for robust monitoring and rapid response capabilities. The Role of AI in Cybersecurity and Cyberattacks The Salt Typhoon breach also demonstrates how artificial intelligence is transforming both the offensive and defensive sides of cybersecurity. On the one hand, AI-enabled tools helped the attackers automate reconnaissance and exploit vulnerabilities faster than ever before. On the other hand, AI could have been a game-changer in detecting and mitigating the breach sooner. AI as an Offensive Tool The attackers reportedly used AI to analyze network traffic and identify anomalies that could be exploited. This capability allowed them to remain undetected for months, demonstrating the growing sophistication of state-sponsored cyber operations. AI as a Defensive Tool Conversely, AI-powered threat detection systems could have identified the unusual patterns of behavior that characterized the Salt Typhoon breach. Machine learning algorithms excel at spotting activity that deviates from the norm, even in complex environments like telecom networks. Businesses should be investing in AI-driven cybersecurity solutions to keep pace with the evolving threat landscape. However, these tools must be complemented by human expertise to interpret findings and respond effectively. Actionable Steps for Business Leaders Salt Typhoon is a wake-up call for executives and boardrooms. Cybersecurity is no longer just an IT issue—it’s a business resilience issue. Here’s what leaders need to do now: Engage in Cyber Risk Discussions: Make cybersecurity a recurring topic at board meetings. Ensure the leadership team understands the potential financial, reputational, and operational impacts of a breach. Invest in Advanced Threat Detection: Allocate resources toward AI-driven tools that can detect and respond to threats in real time. Conduct a Security Audit: Assess your organization’s current cybersecurity posture, focusing on high-risk areas like supply chain vulnerabilities and employee access controls. Strengthen Incident Response Plans: Ensure that your organization can respond quickly and effectively to a breach, minimizing damage and downtime. Collaborate with Industry Peers: Share threat intelligence and best practices with other organizations in your sector to build collective resilience. Remember, the cost of inaction is far greater than the cost of prevention. Looking Ahead Salt Typhoon is a stark reminder that no organization—or nation—is immune to cyber threats. As we become increasingly reliant on digital infrastructure, the stakes continue to rise. The telecom sector, in particular, must prioritize security as a foundational element of its operations, not an afterthought. For businesses, the key takeaway is clear: Cybersecurity must be embedded into every aspect of your organization, from strategy to execution. The next Salt Typhoon is not a question of if, but when. Will you be ready? “In cybersecurity, complacency is the greatest vulnerability.” ## First International AI Treaty Signed: What It Means for Global AI Governance - URL: https://bartmcd.com/blog/first-international-ai-treaty-global-ai-governance - Published: 2024-09-17 The Dawn of a New Era in AI Governance On September 17, 2024, the Council of Europe officially adopted the world’s first legally binding international AI treaty, marking a pivotal moment in global efforts to regulate artificial intelligence. This treaty, signed by 46 member states, introduces a unified framework for AI governance, aiming to address the ethical, social, and legal challenges posed by rapidly advancing AI technologies. With generative AI systems like GPT-5 and multimodal AI tools redefining industries, the treaty signals a collective recognition that coherent guidelines are no longer optional—they’re essential. Key Provisions of the AI Treaty The AI treaty focuses on three core pillars: transparency, accountability, and human rights protection. These principles aim to strike a balance between technological innovation and safeguarding society from potential harm. Here’s a breakdown of the treaty’s major provisions: Transparency Requirements: The treaty mandates that AI developers disclose key operational details about their systems, including data sources, algorithmic decision-making processes, and limitations. This is a direct response to growing concerns about "black box" AI models. Accountability Frameworks: Governments and organizations deploying AI systems must establish clear accountability mechanisms, ensuring that human oversight remains intact in critical applications such as healthcare, finance, and criminal justice. Human Rights Protections: AI systems that infringe on fundamental rights—such as privacy or freedom of expression—are prohibited under the treaty. This provision builds upon existing human rights laws to address the unique challenges posed by AI. These provisions aim to set a baseline for responsible AI development and deployment, creating a level playing field across member states while providing a blueprint for non-member countries to follow. Why This Treaty Matters Now The timing of this treaty couldn't be more critical. Over the past year, AI technologies have surged in capability and adoption, with systems like OpenAI’s GPT-5 and Google’s Gemini AI transforming industries ranging from education to cybersecurity. However, these advancements have also amplified risks: Bias and Discrimination: Despite progress in mitigating algorithmic bias, AI systems continue to exhibit discriminatory outcomes, especially in hiring, lending, and law enforcement applications. Privacy Concerns: The proliferation of AI tools capable of analyzing vast amounts of personal data has heightened worries about surveillance and data misuse. Economic Disruption: Automation driven by AI has displaced workers across industries, sparking debates about job security and the future of work. The treaty aims to address these issues proactively, recognizing that the consequences of unchecked AI development could be catastrophic if left unregulated. “The AI Treaty represents a critical step toward ensuring that artificial intelligence serves humanity rather than undermines it.” Challenges in Implementation While the AI treaty is a significant milestone, its success will depend on effective implementation—a task fraught with challenges: Standardization Across Borders One of the treaty’s primary goals is to establish uniform AI standards across its member states. However, achieving this is easier said than done. Countries vary widely in their technical capabilities, regulatory infrastructures, and cultural attitudes toward AI. Harmonizing these differences will require sustained cooperation and investment. Enforcement Complexities Ensuring compliance with the treaty’s provisions will be another hurdle. It’s one thing to legislate transparency and accountability; it’s another to enforce these principles in practice, especially when dealing with multinational corporations operating across jurisdictions. Balancing Innovation and Regulation Critics have voiced concerns that stringent regulations could stifle innovation, particularly for startups and smaller organizations lacking the resources to meet complex compliance requirements. Striking the right balance between fostering innovation and maintaining safeguards will be an ongoing challenge. What Business Leaders Need to Know For executives and business leaders, the AI treaty is not just a policy shift—it’s a wake-up call. Organizations leveraging AI must adapt to this new regulatory landscape or risk falling behind. Here’s what you need to consider: Audit Your AI Systems: Conduct a thorough review of your AI technologies to ensure compliance with transparency, accountability, and human rights standards. Invest in Explainable AI: Develop systems that provide clear, understandable explanations for their decisions, as this will be critical for meeting transparency requirements. Collaborate with Legal Teams: Work closely with legal experts to navigate the treaty’s provisions and build robust compliance frameworks. Prioritize Ethical AI Practices: Incorporate ethical considerations into your AI development processes, focusing on fairness, inclusivity, and long-term societal impact. By taking proactive steps, businesses can not only ensure compliance but also demonstrate their commitment to responsible AI practices—a move that could enhance their reputation and strengthen consumer trust. Looking Ahead The Council of Europe AI Treaty is undoubtedly a landmark achievement, but it’s also just the beginning. As AI technologies continue to evolve, so too will the challenges they pose. Future discussions will likely focus on emerging issues such as autonomous decision-making, AI-driven warfare, and the ethics of artificial general intelligence (AGI). For now, the treaty serves as a vital foundation for global AI governance, offering hope that humanity can harness the power of AI responsibly and equitably. It is a reminder that while technology shapes the future, it is up to us to shape the technology. ## OpenAI o1: The Model That Thinks Before It Speaks - URL: https://bartmcd.com/blog/openai-o1-model-that-thinks-before-it-speaks - Published: 2024-09-10 OpenAI o1: A Paradigm Shift in AI Reasoning In a world where AI models have grown increasingly faster, OpenAI's latest innovation, o1, disrupts the status quo by prioritizing deliberate reasoning over speed. Released today, the o1 model is designed to "think before it speaks," addressing one of the most pressing issues in artificial intelligence: superficiality in problem-solving. This breakthrough could redefine how businesses, governments, and individuals interact with AI. The Problem with Speed-Driven AI Generative AI models like GPT-4 Turbo and Bard have dominated the landscape in recent years, offering rapid responses to queries but often sacrificing depth and accuracy. As we’ve seen in 2023 and early 2024, this speed-focused approach has led to critical missteps: Surface-level answers: Many models generate text that appears intelligent but lacks true understanding, leading to errors in industries like healthcare, finance, and law. Hallucinations: AI-generated misinformation continues to be a persistent issue, sometimes with dire consequences. Trust erosion: As users become more aware of AI’s limitations, trust in generative models has steadily declined. OpenAI's o1 model directly addresses these challenges by introducing a reasoning-first design philosophy. Rather than rushing to provide immediate answers, o1 takes the time to analyze and evaluate complex inputs, yielding more thoughtful and reliable outputs. What Makes o1 Unique? Reasoning as a Core Feature The o1 model employs a groundbreaking architecture that incorporates "cognitive deliberation modules." These modules simulate a process akin to human critical thinking, enabling the model to: Assess context: o1 parses the nuances of a query before attempting a response. Weigh evidence: It evaluates multiple sources and perspectives before forming conclusions. Iterate internally: The model can refine its reasoning process before finalizing an answer. This deliberate approach is a departure from conventional neural networks, which often prioritize pattern recognition over logical analysis. Trade-offs for Quality While o1’s deliberate reasoning delivers unparalleled depth, there are trade-offs. Responses may take longer—sometimes several seconds compared to the near-instantaneous replies of its predecessors. However, in critical applications like medical diagnostics or legal advisories, this delay is a small price to pay for accuracy and reliability. Human-AI Collaboration Another key feature of o1 is its ability to collaborate with human users. The model invites iterative input, asking clarifying questions to ensure it fully understands the problem before providing a solution. This conversational dynamic enhances trust and minimizes errors, setting a new standard for user interaction with AI. Applications Across Industries The implications of o1 are far-reaching. Several industries are poised to benefit from this reasoning-focused model: Healthcare: o1 can assist in diagnosing complex conditions by evaluating symptoms, medical histories, and research data with precision. Finance: It can analyze market trends and risk factors more thoroughly, reducing the likelihood of costly investment mistakes. Legal: Law firms can leverage o1 to draft contracts, assess case law, and identify risks in a methodical manner. Education: Teachers and students gain access to a model that explains concepts in depth, fostering a deeper understanding of challenging subjects. “The o1 model doesn’t just provide answers—it helps users arrive at better questions and deeper insights. It exemplifies the next stage of AI evolution: reasoning-first intelligence.” Challenges and Criticism Despite its promise, o1 is not without challenges. Critics have raised concerns about: Computational cost: The added time for deliberation increases resource usage, which could limit scalability for smaller organizations. Context dependency: o1’s effectiveness relies heavily on the quality of the input it receives—garbage in, garbage out. Market adoption: Some users may resist the slower response times, particularly in industries where speed is paramount. OpenAI has acknowledged these concerns and emphasized that o1 is not intended to replace existing models but rather to complement them in scenarios where deep reasoning is essential. The Future of AI Models OpenAI’s introduction of o1 signals a broader shift in the AI landscape. As we move toward 2025, the focus may increasingly shift from speed and versatility to depth, accuracy, and ethical considerations. Other tech leaders are likely to follow suit, investing in reasoning-first designs to meet the demand for trustworthy AI. For executives and business leaders, the release of o1 offers an opportunity to rethink how AI is deployed within their organizations. The model’s emphasis on deliberate reasoning could be particularly valuable in decision-making processes, risk management, and customer-facing roles. The question isn’t whether you’ll integrate AI models like o1—it’s how quickly you can adapt to this new paradigm. Those who embrace reasoning-focused AI will gain a competitive edge, while those who cling to speed-driven models risk falling behind. Final Thoughts OpenAI’s o1 introduces a revolutionary approach to artificial intelligence, prioritizing thoughtful analysis over rapid response. By redefining what it means for AI to "think," o1 challenges us to reconsider the role of technology in decision-making and problem-solving. While the model is not without its limitations, its potential to transform industries and improve trust in AI is undeniable. As we step into this new era of reasoning-first AI, the responsibility lies with leaders to explore its possibilities and address its challenges. The o1 model isn’t just about smarter machines—it’s about fostering smarter collaboration between humans and AI. ## Port of Seattle Attack: Ransomware Disrupts Major US Infrastructure - URL: https://bartmcd.com/blog/port-of-seattle-ransomware-attack-critical-infrastructure - Published: 2024-08-27 Port of Seattle Attack: A Wake-Up Call for Critical Infrastructure On the eve of the busy Labor Day travel weekend, the Port of Seattle—the gateway to SEA Airport and one of the largest cargo ports in the United States—was brought to a standstill. The Rhysida ransomware gang, a name now synonymous with high-profile cyberattacks, encrypted key operational systems, disrupting passenger travel and cargo logistics for over 48 hours. This incident highlights the fragility of critical infrastructure in the face of evolving cyber threats, and it underscores the urgency of fortifying defensive measures. What Happened: Anatomy of the Attack The Rhysida ransomware group exploited known vulnerabilities in the Port of Seattle's IT systems, gaining access to operational technology (OT) networks. Once inside, the attackers deployed ransomware to encrypt systems used for cargo tracking, gate access, and passenger management at SEA Airport. The group also exfiltrated sensitive data, threatening to release it unless a multimillion-dollar ransom was paid in cryptocurrency. Key Factors That Enabled the Attack Unpatched Software: Despite numerous warnings, the port's systems contained unpatched vulnerabilities in widely used OT software. Weak Network Segmentation: The attackers were able to move laterally between IT and OT environments, underscoring the lack of robust segmentation. Insufficient Monitoring: The port’s security operations center (SOC) failed to detect suspicious activity early, allowing the attackers to dwell undetected for weeks. By the time the attack was discovered, critical systems were already encrypted, leaving the port no choice but to shut down operations entirely to contain the damage. Ransomware in 2024: Why the Threat Persists Ransomware attacks have evolved significantly since the early days of WannaCry and NotPetya. In 2024, threat actors like Rhysida operate as sophisticated criminal enterprises, offering ransomware-as-a-service (RaaS) to affiliates who carry out the attacks. These groups are highly organized, using advanced tactics and leveraging zero-day exploits to target high-value sectors like critical infrastructure. Notable Trends in Ransomware Double and Triple Extortion: Beyond encryption, attackers now exfiltrate data and threaten to sell or leak it, adding pressure on victims to pay. Targeting OT Systems: Operational technology, crucial for physical operations, has become a prime target due to its reliance on legacy systems and limited security measures. AI-Driven Attacks: Threat actors are increasingly using AI to automate reconnaissance, identify vulnerabilities, and evade detection. “Ransomware gangs have shifted their focus to critical infrastructure because the stakes are higher, and the payouts are bigger.” With the Port of Seattle attack, the Rhysida group demonstrated a keen understanding of their target, choosing a time and place where disruption would have maximum impact. Lessons for Critical Infrastructure Operators This attack is a stark reminder that no organization is immune, particularly those overseeing critical infrastructure. While the federal government has made strides in cybersecurity policy—through initiatives like the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)—implementation at the local level remains inconsistent. Actionable Steps to Strengthen Defenses Patch Management: Regularly update and patch all software, including OT systems, to close known vulnerabilities. Network Segmentation: Implement robust segmentation between IT and OT networks to limit lateral movement. Incident Response Plans: Develop and regularly test incident response plans tailored for ransomware scenarios. Zero Trust Architecture: Adopt a zero trust model to verify every user and device attempting to access your network. Cybersecurity Training: Conduct regular training for employees to recognize phishing and other social engineering tactics that often serve as entry points for attacks. These measures require investment, but the cost of inaction is far greater. The downtime, reputational damage, and regulatory penalties resulting from a ransomware attack can cripple an organization. The Role of AI in Cyber Defense As attackers leverage AI to enhance their capabilities, defenders must do the same. Advanced AI-driven cybersecurity tools can identify anomalies, predict potential threats, and automate responses, providing a critical edge in the ongoing battle against ransomware. How AI Can Mitigate Ransomware Risks Behavioral Analytics: AI can monitor user and network behavior to detect unusual activity indicative of an attack. Threat Hunting: Machine learning models can sift through vast amounts of data to identify hidden malware or command-and-control communications. Automated Patch Management: AI tools can prioritize and apply patches more efficiently, addressing vulnerabilities before attackers can exploit them. Organizations that fail to adopt these advanced technologies risk falling behind in the cybersecurity arms race, leaving themselves vulnerable to increasingly sophisticated threats. Looking Ahead: Building Resilience The Port of Seattle attack should serve as a rallying cry for critical infrastructure operators across the United States. The stakes are too high to ignore. As we move forward, a collaborative approach between government, private sector, and cybersecurity experts is essential to strengthen our defenses. What Executives Should Do Now Evaluate Risk Posture: Conduct a comprehensive risk assessment to identify vulnerabilities in both IT and OT environments. Engage Leadership: Ensure cybersecurity is a board-level priority, with adequate funding and oversight. Collaborate with Authorities: Build relationships with federal and local cybersecurity agencies to share intelligence and best practices. “Cyber resilience is not a one-time project; it’s a continuous process that requires commitment at every level of an organization.” By taking proactive measures today, organizations can protect themselves against the next wave of ransomware attacks. The Port of Seattle attack is a stark reminder of what’s at stake—and an opportunity to learn and adapt before it’s too late. ## Flux: The Open Source Image Generator Challenging Midjourney - URL: https://bartmcd.com/blog/flux-open-source-image-generator-challenging-midjourney - Published: 2024-08-15 Flux: The New Contender in Text-to-Image AI Black Forest Labs has made waves in the AI community by releasing Flux , a powerful open-source text-to-image generator boasting an impressive 12 billion parameters. With Midjourney and DALL-E dominating the commercial image-generation space, Flux positions itself as a disruptive force, offering creators, businesses, and developers a robust alternative free from subscription fees and restrictive licensing. This bold release not only challenges the status quo but also underscores the growing influence of open-source AI solutions in reshaping the creative technology landscape. The Rise of Open Source in Creative AI Over the past year, we’ve seen a significant shift toward open-source initiatives gaining traction in AI development. While commercial models like Midjourney V6 and Stability AI’s DreamStudio continue to push boundaries, the open-source community has been steadily growing. Flux’s release is a culmination of this shift, offering a tool that rivals the quality of proprietary models while fostering innovation through accessibility. What Sets Flux Apart? High Parameter Count: With 12 billion parameters, Flux matches or exceeds the complexity of leading commercial models, enabling nuanced and photorealistic image generation. Open Accessibility: Unlike closed systems, Flux is fully open-source, allowing users to experiment, customize, and deploy the model without licensing hurdles. Community-Driven Innovation: By releasing Flux to the public, Black Forest Labs empowers developers to collaborate, optimize, and expand its capabilities. These features combine to make Flux an appealing option for industries ranging from marketing to entertainment, as well as individual creators who seek cost-effective tools. Implications for Businesses For executives and business leaders, the introduction of Flux isn’t just a technological milestone—it’s a strategic opportunity. Here’s why: Reducing Costs Without Sacrificing Quality Commercial image-generation platforms often come with high subscription fees, usage limits, and restrictive terms of service. Flux eliminates these costs, allowing businesses to integrate powerful image-generation capabilities into their workflows without breaking the budget. Customizable AI Solutions Because Flux is open-source, organizations can tailor the model to fit their specific needs. Whether it’s fine-tuning for industry-specific imagery or deploying the model on private infrastructure for enhanced security, the flexibility is unmatched. Competitive Advantage Leveraging open-source technology like Flux enables businesses to innovate faster and differentiate themselves in saturated markets. Companies that embrace this shift early will be better positioned to capitalize on the growing demand for AI-driven creative solutions. “Open-source AI doesn’t just level the playing field—it creates entirely new opportunities for those willing to adapt and innovate.” Challenges and Considerations While Flux brings undeniable benefits, it’s important to acknowledge potential challenges as well: Technical Expertise: Deploying and optimizing an open-source model like Flux requires a skilled team familiar with AI technologies. Hardware Requirements: With 12 billion parameters, Flux demands significant computational resources, potentially requiring investment in high-performance GPUs or cloud services. Ethical Concerns: Open-source models are more susceptible to misuse, such as generating inappropriate or harmful content. Businesses must implement safeguards to mitigate these risks. Understanding these challenges will help organizations make informed decisions about incorporating Flux into their operations. The Bigger Picture Flux’s emergence signals a broader trend in the AI industry. As open-source projects become more competitive with proprietary solutions, we’re witnessing a democratization of technology that empowers individuals and smaller businesses to access cutting-edge tools. This is a pivotal moment for the creative AI ecosystem, as Flux pushes the boundaries of what’s possible while upholding principles of transparency and collaboration. For Black Forest Labs, the release of Flux is more than a technological achievement—it’s a statement. By choosing to invest in open-source development, they’ve positioned themselves as advocates for innovation that’s accessible to all. The ripple effects of this decision will undoubtedly shape the trajectory of AI in the years to come. Final Thoughts: Embracing the Future Flux is more than just a tool; it’s a paradigm shift. For executives and business leaders, the question isn’t whether to adopt open-source AI—it’s how soon . As the industry evolves, those who embrace Flux and similar technologies stand to gain a competitive edge, while others risk falling behind. Whether you’re a Fortune 500 leader or a startup founder, the time to explore Flux is now. Equip your organization with the tools to thrive in this new era of AI-driven creativity. ## SearchGPT and the AI Search Wars: Is Google's Dominance Ending? - URL: https://bartmcd.com/blog/searchgpt-ai-search-wars-google-dominance-ending - Published: 2024-08-06 SearchGPT Enters the Arena: A New Contender in Search In a move that has sent shockwaves through Silicon Valley, OpenAI has officially launched SearchGPT , its long-awaited AI-driven search engine. Designed to challenge Google’s two-decade dominance, SearchGPT promises a fundamentally different approach to information discovery, leveraging generative AI to deliver context-rich, conversational search results. This announcement comes as generative AI continues to reshape industries, from customer service to content creation, leaving many to wonder: Are we witnessing the dawn of a new era in search? Google, once untouchable, now faces real competition. While the tech giant has made strides with its own AI-powered tools like Bard and Gemini, critics argue that its innovation has been stifled by its reliance on ad-based revenue. Meanwhile, OpenAI’s nonprofit ethos and rapid technological advancements have positioned it as a credible challenger. But what does the rise of SearchGPT mean for businesses, consumers, and the future of online search? How SearchGPT Differs from Traditional Search Engines From Links to Answers Traditional search engines like Google operate on a simple principle: index the web, rank results, and display links. While this model has served us well, it often leaves users sifting through pages of results to find what they're truly looking for. SearchGPT, on the other hand, flips the script by delivering direct, conversational answers rather than a list of hyperlinks. Example: SearchGPT doesn’t just show you a list of articles on "best productivity tools for remote work." Instead, it synthesizes the information into a single, actionable response, complete with context, pros and cons, and even recommendations tailored to your query. It prioritizes relevance over volume , reducing information overload and saving users time. AI-Powered Personalization SearchGPT leverages OpenAI’s advanced natural language processing (NLP) capabilities to understand and adapt to the unique preferences of each user. By analyzing your search history, preferences, and even real-time context, it delivers results that feel almost eerily intuitive. For businesses, this opens up new challenges and opportunities. The key question: How do you optimize for a search engine that doesn’t rely on traditional SEO strategies like backlinks and keywords? The Battle for Trust: Can OpenAI Dethrone Google? Google’s dominance isn’t just a result of its technology; it’s about trust. For years, Google has been the default gateway to the internet, built on a reputation for delivering relevant and reliable results. However, this trust has been eroded in recent years by controversies over privacy, biased algorithms, and an overwhelming reliance on ads that sometimes prioritize revenue over user experience. “SearchGPT presents a direct challenge to Google’s ad-based model. Its focus on utility over monetization could redefine how we think about search engines.” OpenAI, by contrast, has positioned SearchGPT as a tool for the user, not the advertiser. Its subscription-based model eliminates the need for intrusive ads, allowing it to focus solely on delivering value. But trust isn’t earned overnight. SearchGPT will need to prove that it can consistently deliver accurate, unbiased, and up-to-date information—a formidable challenge in the ever-changing landscape of the internet. Google’s Counteroffensive In response to SearchGPT, Google has doubled down on its own AI initiatives. Its Gemini AI platform, announced late last year, integrates generative AI into Google Search in a way that feels native and seamless. Additionally, Google’s extensive data infrastructure gives it an edge in areas like real-time updates and local search. Still, Google faces a dilemma. Its ad-based revenue model, which generated over $224 billion in 2023, may be a golden goose, but it’s also a shackle. Shifting to a more user-focused approach, as SearchGPT has done, could mean sacrificing significant revenue—a risk Google may not be willing to take. Implications for Businesses For executives and business leaders, the rise of SearchGPT isn’t just a technological shift; it’s a strategic one. Companies that rely heavily on traditional SEO tactics will need to adapt to a new landscape where conversational AI is the gatekeeper to discovery. Optimize for AI-Driven Search With SearchGPT’s emphasis on direct answers over clickable links, businesses must rethink their digital strategies. This includes: Structured Data: Ensure your content is easily digestible by AI models, using well-organized, factual, and clear information. Authority Building: Focus on creating high-quality, trustworthy content that AI algorithms are more likely to prioritize. Conversational Engagement: Invest in creating FAQs, guides, and other resources that align with the conversational tone of AI-driven searches. Beware the Black Box One of the challenges of AI-driven search engines like SearchGPT is their opacity. Unlike traditional search engines, which provide a clear list of sources, AI-generated responses often lack transparency. This can make it difficult for businesses to understand how their content is being ranked—or even if it’s being included at all. Leaders should monitor developments in AI search closely and advocate for greater transparency from providers like OpenAI. What Lies Ahead in the AI Search Wars? While it’s too early to declare a winner in the battle between SearchGPT and Google, one thing is clear: The AI search wars are just beginning. As both companies continue to innovate, the ultimate victor may not be the one with the best technology, but the one that earns the trust and loyalty of users. For businesses and consumers, the rise of AI search engines represents both a challenge and an opportunity. Those who adapt quickly will find new ways to connect with audiences, while those who cling to outdated strategies risk being left behind. The rules of the game have changed, and the future of search belongs to those bold enough to embrace it. ## CrowdStrike Outage: When Security Tools Become the Problem - URL: https://bartmcd.com/blog/crowdstrike-outage-when-security-tools-fail - Published: 2024-07-30 When Security Tools Fail: The CrowdStrike Outage and Its Ripple Effects On July 20, 2024, a routine update from CrowdStrike, one of the most trusted names in endpoint detection and response (EDR), inadvertently caused widespread disruptions across global IT infrastructures. Companies relying on CrowdStrike Falcon experienced everything from network slowdowns to complete system outages. Ironically, the very tool designed to protect organizations became the source of chaos. This incident is a stark reminder that even the most robust cybersecurity tools are not immune to failure. Let's unpack what happened and explore actionable lessons for executives navigating an increasingly complex cybersecurity landscape. Understanding the CrowdStrike Incident The outage stemmed from a configuration error in a CrowdStrike Falcon update. The update introduced a conflict with certain operating system versions, triggering false positives and misidentifications of legitimate processes as malicious. The result? Thousands of endpoints were quarantined, disrupting operations across industries including finance, healthcare, and manufacturing. While CrowdStrike swiftly rolled out a patch within hours, the damage was already done. Companies faced downtime, productivity losses, and strained IT teams scrambling to restore normalcy. This event underscores the growing interdependence between cybersecurity tools and operational stability. Lessons for Managing Security Tool Risks 1. Vet Updates Before Deployment One of the most overlooked practices in cybersecurity is rigorous update testing. When CrowdStrike released its faulty update, many organizations deployed it immediately without validation. This incident highlights the importance of adopting a more cautious approach to updates. Test updates in isolated environments: Create a sandbox environment to evaluate the impact of updates before rolling them out company-wide. Roll out updates incrementally: Start with non-critical systems and monitor for issues before full deployment. Use automated testing tools: Leverage AI-powered testing solutions that simulate real-world scenarios to identify potential conflicts. 2. Diversify Your Security Stack While CrowdStrike remains a leader in EDR, this incident proves that no tool is infallible. Relying solely on one vendor can amplify risks during unexpected failures. Executives should consider adopting a layered security approach. Integrate complementary tools: Pair EDR solutions like CrowdStrike with other technologies such as network monitoring and behavioral analytics. Avoid vendor lock-in: Diversify across multiple providers to reduce the impact of a single-point failure. "A layered security approach ensures resilience. If one tool falters, others pick up the slack." 3. Establish Emergency Protocols When the CrowdStrike outage struck, organizations with pre-established incident response plans mitigated the fallout far more effectively than those without. This event reinforces the need for robust contingency planning. Create an incident response playbook: Define steps for addressing unexpected tool failures, including rollback procedures and communication plans. Train your team regularly: Conduct tabletop exercises to ensure employees know their roles during a cybersecurity crisis. Establish vendor SLAs: Negotiate service-level agreements that include rapid support during emergencies. Why Vigilance Matters in Today's Cyber Landscape The CrowdStrike outage is not an isolated incident. As cybersecurity tools become more sophisticated, their potential to disrupt operations—whether through misconfigurations, software bugs, or compatibility issues—also grows. In 2024, organizations face an unprecedented volume of cyber threats, ranging from AI-driven attacks to supply chain vulnerabilities. Security tools are indispensable, but they are not infallible. Executives must embrace a mindset of vigilance. This means treating cybersecurity tools not as infallible solutions but as critical components of a broader risk management strategy. It also means asking tough questions of vendors, conducting regular audits, and embedding resilience into every corner of the organization. Actionable Takeaways for Executives 1. Reassess Vendor Relationships Now is the time to review your partnerships with security vendors. Ask hard questions about their update validation processes and emergency response protocols. Ensure your vendors have a proven track record of addressing issues swiftly and transparently. 2. Prioritize Cyber Resilience Cyber resilience goes beyond protection; it encompasses the ability to adapt and recover. Invest in technologies and processes that minimize the impact of disruptions. Consider how you can build redundancy into your systems and workflows. 3. Stay Educated on Emerging Threats The landscape of 2024 is defined by rapid technological advancements. AI-driven attacks, zero-day vulnerabilities, and even risks stemming from quantum computing are reshaping the threat horizon. Stay informed and ensure your team has the resources to anticipate and address these evolving challenges. "Cybersecurity is not just about prevention; it’s about preparation and recovery." Conclusion: Turning Lessons Into Action The CrowdStrike outage serves as a wake-up call for organizations worldwide. It reveals the inherent risks in relying on security tools and the importance of proactive risk management. Executives must lead the charge in embedding resilience, cultivating vendor accountability, and fostering a culture of continuous improvement. Security tools like CrowdStrike Falcon will remain central to protecting digital assets, but they cannot be the sole line of defense. By learning from this incident and implementing the lessons outlined here, organizations can turn vulnerability into strength and ensure they are better prepared for the next unexpected challenge. ## The EU AI Act Is Now Law: A Global Turning Point - URL: https://bartmcd.com/blog/eu-ai-act-now-law-global-turning-point - Published: 2024-07-23 The EU AI Act: A Global Milestone Today marks a historic moment in technology regulation. With the European Union’s AI Act officially coming into force, the world has its first comprehensive legal framework governing artificial intelligence. This legislation, years in the making, is poised to shape the future of AI development, deployment, and usage not only in Europe but across the globe. For businesses leveraging AI, the countdown to compliance has begun, and the stakes couldn’t be higher. The AI Act represents more than just a legal framework—it signals a paradigm shift in how we approach AI governance. By addressing risks, ensuring accountability, and setting global benchmarks, it serves as a blueprint for other nations. But as with any regulation, the devil is in the details. Let’s break down what the law entails, its compliance timeline, and the steps organizations should take to navigate this new landscape. Understanding the Core Principles of the EU AI Act The AI Act categorizes AI systems based on their risk levels, from minimal risk to unacceptable risk, and establishes obligations accordingly. This tiered approach ensures that regulations are proportional to the potential harm posed by the technology. Here’s a closer look: Unacceptable Risk: These AI systems are outright banned. This includes technologies like social scoring systems (similar to those used in China) and real-time biometric surveillance in public spaces, unless for strictly defined national security purposes. High Risk: AI applications in critical sectors—such as healthcare, recruitment, and law enforcement—are subject to strict scrutiny. Developers and deployers must meet rigorous requirements for data quality, transparency, and human oversight. Limited Risk: Systems like chatbots must adhere to basic transparency obligations, such as informing users they are interacting with AI. Minimal or No Risk: Most other applications, including many consumer-focused AI tools, face few or no regulatory requirements. This risk-based framework reflects the EU’s intention to balance fostering innovation with safeguarding fundamental rights. However, for companies, especially those outside the EU, the implications are far-reaching. Compliance Timeline: What You Need to Know While the AI Act is now law, it doesn’t mean immediate enforcement for all requirements. The EU has outlined a phased timeline to give organizations time to adapt. Here’s what to expect: July 2024: The AI Act officially enters into force. Companies should begin internal assessments and preparations. January 2025: High-risk AI systems must comply with key provisions, including risk management systems, data governance practices, and documentation standards. July 2025: Enforcement begins for all new high-risk AI systems launched in the EU. July 2026: Existing high-risk AI systems must meet compliance requirements or face penalties. Firms that fail to comply with the AI Act could face fines of up to €30 million or 6% of global annual turnover, whichever is higher. For context, this is double the maximum penalty under the EU’s GDPR, signaling the seriousness with which the EU views AI accountability. How Global Companies Are Responding Although the AI Act is an EU regulation, its impact is global. Multinational corporations, particularly those in tech and AI-heavy sectors, are aligning their practices to meet the EU’s standards. Here’s why: The EU market is too significant to ignore, and compliance with the AI Act will likely set a de facto global standard, much like GDPR did for data privacy. Adhering to the regulation early demonstrates corporate responsibility and enhances trust with customers and partners. Non-compliance risks not only financial penalties but also reputational damage in an era of heightened scrutiny around AI ethics. Leading technology firms like OpenAI, Microsoft, and Google have already announced AI governance initiatives aligned with EU principles. For example, Microsoft recently launched its "Responsible AI Toolkit," a suite of resources designed to help enterprises manage AI risks. Similarly, OpenAI has introduced new transparency features for its GPT-5 model, ensuring users know when and how AI is being applied in decision-making processes. Beyond tech giants, industries ranging from financial services to healthcare are rethinking their AI strategies. Banks using AI for credit scoring, for instance, must ensure their algorithms are auditable and free from bias. Meanwhile, hospitals deploying AI diagnostics need to implement robust data governance and human oversight mechanisms. Actionable Steps to Achieve Compliance For executives and business leaders, compliance with the AI Act isn’t just a legal necessity—it’s an opportunity to differentiate your organization through ethical AI practices. Here are five practical steps to get started: Conduct a Comprehensive AI Audit: Identify all AI systems in use, their purposes, and their risk categories under the AI Act. Pay special attention to high-risk applications, as these will require the most effort to comply. Establish a Governance Framework: Appoint an internal AI compliance officer or team to oversee adherence to the regulation. Develop policies that address risk management, data quality, and human oversight. Invest in Explainable AI: High-risk systems must be transparent and interpretable. Ensure your AI models can provide clear, understandable explanations for their outputs to regulators, users, and other stakeholders. Enhance Data Practices: The AI Act emphasizes data quality and fairness. Audit your datasets for bias, ensure they are representative, and maintain robust documentation to demonstrate compliance. Engage Legal and Technical Experts: Partner with specialists in AI governance and EU law to navigate the complexities of the regulation. This can help mitigate risks and streamline compliance efforts. Beyond these immediate steps, organizations should view the AI Act as an ongoing commitment rather than a one-time checkbox exercise. Regular reviews and updates to your AI systems and processes will be essential as the regulatory landscape evolves. The Road Ahead: Global Implications The implementation of the EU AI Act is likely to accelerate regulatory efforts worldwide. Already, countries like the United States and Canada are debating AI legislation inspired by the EU’s framework. In the U.S., the Algorithmic Accountability Act has gained momentum, while in Asia, Japan is leading discussions on ethical AI practices. “The EU AI Act is not just about compliance—it’s about setting a global standard for responsible AI. Businesses that embrace these principles now will be better positioned to thrive in the AI-driven future.” For organizations, this means preparing for a patchwork of regulations across jurisdictions. Adopting a proactive, principles-based approach to AI governance can simplify compliance and reduce risks as new laws emerge. It can also drive innovation by fostering trust and unlocking new opportunities in regulated industries. As we look to the future, one thing is clear: AI is no longer the Wild West. The era of unregulated, unchecked AI is coming to an end, and the EU AI Act is leading the charge. For business leaders, the question is no longer whether to act but how quickly they can adapt to this new reality. ## Meta's LLaMA 3.1: Open Source AI Goes Mainstream - URL: https://bartmcd.com/blog/meta-llama-3-1-open-source-ai-goes-mainstream - Published: 2024-07-16 Meta's LLaMA 3.1: Open Source AI Goes Mainstream In a groundbreaking move, Meta has released LLaMA 3.1, an open-source AI model boasting an impressive 405 billion parameters. This development not only outpaces GPT-4 on several key benchmarks but also signals the growing dominance of open-source AI in a field previously defined by proprietary technologies. With its unprecedented scale and performance, LLaMA 3.1 is poised to reshape the AI landscape and democratize access to cutting-edge tools for businesses, researchers, and developers alike. The Rise of Open-Source AI Over the past decade, the AI sector has been largely dominated by closed ecosystems. OpenAI's GPT models, Google's DeepMind projects, and Anthropic's Claude have all maintained tight control over their algorithms, data, and APIs. However, Meta's LLaMA series has steadily chipped away at this paradigm, delivering high-performance models directly to the open-source community. Why Open Source Matters The release of LLaMA 3.1 represents more than just a technical achievement—it’s a philosophical shift. Open-source AI offers unique advantages: Transparency: Organizations can inspect and understand the AI's underlying code and data, enabling more ethical applications. Cost Efficiency: Businesses avoid costly licensing fees and can customize models for their specific needs without proprietary restrictions. Innovation: Developers worldwide contribute to rapid improvements, creating a virtuous cycle of advancement. Meta’s commitment to open-source is reshaping the competitive dynamics of AI and empowering smaller players to access transformative technologies that were once reserved for tech giants. Performance That Redefines Standards LLaMA 3.1 has astonished the AI community with its ability to outperform GPT-4 on multiple benchmarks, including reasoning, natural language understanding, and creative generation. Key metrics highlight its superiority: Reasoning: Achieved a 94.5% accuracy score on the Open Reasoning Benchmark (ORB), outpacing GPT-4's 92.1%. Language Understanding: Delivered contextual accuracy rates of 98.3% on the General Language Understanding Evaluation (GLUE) dataset. Creative Tasks: Produced more coherent and imaginative outputs in blind user testing. “LLaMA 3.1 is not just a step forward; it’s a leap. It proves that open-source AI can rival—and even surpass—proprietary models.” Meta achieved this by leveraging an enhanced training pipeline, incorporating diverse datasets, and refining multimodal capabilities. The model’s performance underscores the potential of open-source innovation in pushing boundaries traditionally set by closed systems. Implications for Business Leaders For executives and decision-makers, LLaMA 3.1’s release is a wake-up call. Open-source AI is no longer just a fringe option; it’s becoming the mainstream choice for practical applications. Here’s what business leaders need to consider: Strategic Opportunities with Open Source Adopting open-source AI like LLaMA 3.1 can unlock new possibilities: Customization: Tailor the model to align with your organization’s unique workflows and objectives. Cost Savings: Reduce overhead by eliminating licensing fees and using scalable, open infrastructure. Agility: Adapt quickly to market changes by leveraging a flexible, community-driven AI ecosystem. Businesses that embrace open-source AI will gain a competitive edge in innovation and efficiency, particularly in industries like finance, healthcare, and retail, where personalization and accuracy are paramount. Risks to Address While the benefits are significant, open-source AI also introduces challenges: Security Concerns: Open models are susceptible to misuse or exploitation if not properly safeguarded. Resource Requirements: Deploying and maintaining large-scale models like LLaMA 3.1 demands substantial computational resources. Lack of Support: Unlike proprietary solutions, open-source models may not provide dedicated support, requiring in-house expertise. Executives must weigh these risks carefully and implement robust governance frameworks to ensure responsible and effective use of open-source AI. The Future of AI Innovation Meta’s latest release marks a pivotal moment in the evolution of artificial intelligence. As open-source initiatives gain traction, we can expect a wave of innovation in areas such as: Collaborative Development: Cross-industry partnerships to refine models and share insights. Global Accessibility: Widening access to AI for organizations and researchers in developing nations. Ethical AI: Greater transparency and accountability in how models are developed and deployed. Moreover, the competitive pressure from open-source alternatives will likely push proprietary platforms to adapt, improving affordability and accessibility across the board. “The open-source AI revolution isn’t just about technology—it’s about creating a more inclusive and equitable future.” Key Takeaways With LLaMA 3.1, Meta has set a new standard for what open-source AI can achieve. As you evaluate your organization’s AI strategy, keep these points in mind: Open-source models now rival proprietary solutions, offering significant cost and customization benefits. Performance benchmarks indicate LLaMA 3.1 is a leader in reasoning, language understanding, and creativity. Business leaders must prepare for the risks and resource requirements of deploying large-scale open-source AI. The release of LLaMA 3.1 is not just a technological milestone—it’s a call to action. As open-source AI goes mainstream, the decisions you make today will shape your organization’s competitive position for years to come. Are you ready to embrace the future? ## NHS Synnovis Attack: Ransomware Cripples UK Healthcare - URL: https://bartmcd.com/blog/nhs-synnovis-ransomware-attack-uk-healthcare - Published: 2024-06-27 NHS Synnovis Attack: A Stark Warning for Healthcare Cybersecurity On June 20, 2024, the UK’s healthcare system faced a significant disruption as ransomware attackers targeted Synnovis, a key diagnostics partner for the National Health Service (NHS). The attack led to widespread delays in patient diagnostics, with hospitals across the country grappling with outages, canceled appointments, and a backlog of urgent tests. The incident underscores the critical vulnerabilities in healthcare cybersecurity and serves as a wake-up call for the industry to rethink its defenses. What Happened: Anatomy of the Synnovis Attack The attackers deployed a sophisticated ransomware strain, leveraging known vulnerabilities in outdated systems within Synnovis's IT infrastructure. Early reports suggest they gained access through a phishing email targeting an employee, followed by lateral movement to core systems. Once inside, the ransomware encrypted diagnostic data and effectively halted operations. The impact was immediate and far-reaching: Delays in critical diagnostic services, including blood tests and imaging. Disruption to cancer screenings, creating anxiety for thousands of patients. Overburdened staff forced to rely on manual records and processes. Significant reputational damage to Synnovis and the NHS. While Synnovis has not disclosed whether it paid the ransom, the recovery process remains ongoing, highlighting the extensive effort required to restore encrypted systems and rebuild trust with stakeholders. Lessons Learned: Strengthening Healthcare’s Cyber Defenses 1. Address Legacy Systems and Technical Debt One glaring issue highlighted by this attack is the reliance on legacy systems within healthcare. Many hospitals and diagnostics providers still use outdated software that is incompatible with modern security protocols. These vulnerabilities are a goldmine for attackers. Actionable Steps: Conduct a thorough audit of all IT assets to pinpoint outdated systems. Implement a phased approach to upgrade hardware and software regularly. Adopt virtualization and cloud-based technologies that are easier to patch and maintain. 2. Bolster Employee Awareness and Training The Synnovis breach reportedly began with a phishing email, a common yet preventable attack vector. Human error remains the weakest link in cybersecurity, especially in high-stress environments like healthcare. Actionable Steps: Enforce regular, mandatory cybersecurity training for all employees. Simulate phishing attacks to identify and educate at-risk staff. Implement robust email filtering and anomaly detection systems. 3. Build Resilience with Incident Response Plans Time was critical in the Synnovis attack, and the delayed public communication drew criticism. A well-documented and rehearsed incident response plan could have minimized chaos and accelerated recovery. Actionable Steps: Develop and test incident response plans tailored to ransomware scenarios. Establish clear communication protocols for internal teams and external stakeholders. Partner with cybersecurity firms for rapid response capabilities. 4. Implement Zero Trust Architecture The attackers’ ability to move laterally within Synnovis’s network highlights the need for a Zero Trust approach. This framework assumes attackers are already inside the network and restricts access accordingly. Actionable Steps: Adopt micro-segmentation to isolate systems and limit lateral movement. Enforce multi-factor authentication for all users and devices. Regularly monitor and verify user behavior to detect anomalies. The Broader Implications for Healthcare The Synnovis attack is not an isolated incident. It follows a worrying trend of ransomware targeting the healthcare sector. In the past year alone, global healthcare systems have faced an estimated 85% increase in ransomware attacks, fueled by the high value of medical data on the black market and the urgent nature of healthcare services. Healthcare organizations must recognize that cybersecurity is no longer a back-office issue—it is a patient safety issue. The inability to deliver timely care due to a cyberattack can have life-or-death consequences. “Technology is now the backbone of modern healthcare. Securing that backbone is as critical as the care it enables.” How Governments and Industry Can Collaborate Governments and regulatory bodies must play a more proactive role in safeguarding healthcare systems. The NHS Synnovis attack demonstrates the need for coordinated efforts to bolster cyber resilience. Key Areas for Collaboration: Developing and enforcing industry-wide security standards for healthcare IT. Providing financial incentives or grants for smaller providers to upgrade their systems. Sharing threat intelligence across public and private sectors to stay ahead of attackers. Establishing a national task force to respond to healthcare-specific cyber threats. Looking Ahead: The Cost of Complacency With cyberattacks on the rise, healthcare providers can no longer afford to view cybersecurity as a secondary concern. The Synnovis incident is a stark reminder that the cost of inaction—measured in financial losses, operational disruption, and patient outcomes—is far greater than the investment required to build robust defenses. The road to recovery for Synnovis and the NHS will be long, but the lessons learned from this attack offer a blueprint for the entire healthcare industry. By addressing vulnerabilities, investing in training, and adopting modern security frameworks, healthcare organizations can turn this crisis into an opportunity to emerge stronger and more resilient. ## Claude 3.5 Sonnet: The New Benchmark for AI Reasoning - URL: https://bartmcd.com/blog/claude-3-5-sonnet-new-benchmark-ai-reasoning - Published: 2024-06-21 Claude 3.5 Sonnet: Redefining AI Reasoning in 2024 In a year already marked by rapid advancements in artificial intelligence, Anthropic’s release of Claude 3.5 Sonnet has set a new standard for AI reasoning and vision capabilities. With generative AI reshaping industries from healthcare to finance, Claude 3.5 Sonnet emerges not just as a tool but as a benchmark. Its enhanced logical reasoning and multimodal vision capabilities promise to challenge the dominance of OpenAI’s GPT-4o and redefine what businesses should expect from AI systems. Why Claude 3.5 Sonnet Stands Out Anthropic has consistently positioned itself as a leader in AI safety and alignment, and Claude 3.5 Sonnet is a testament to that commitment. This version introduces groundbreaking improvements in reasoning processes, enabling it to analyze complex problems with a human-like approach. More importantly, its multimodal vision capabilities allow it to interpret and generate outputs based on images and text in tandem, pushing the boundaries of what AI can achieve. Key Features of Claude 3.5 Sonnet Enhanced Logical Reasoning: Claude 3.5 Sonnet can process nuanced scenarios such as legal reasoning, scientific hypothesis testing, and strategic business forecasting with unparalleled accuracy. Multimodal Vision: The integration of image and text analysis allows it to interpret diagrams, graphs, and visual data alongside textual inputs, making it indispensable for industries like architecture, engineering, and design. Contextual Memory: Its expanded memory system can retain information across longer conversations, enabling deeper and more meaningful interactions. Alignment and Safety: Built with Anthropic’s "constitutional AI" framework, Claude 3.5 Sonnet emphasizes ethical behavior and mitigates risks associated with hallucination or bias. These advancements position Claude 3.5 Sonnet as a direct competitor to OpenAI’s GPT-4o, sparking new debates about which model offers the best balance between performance, reliability, and safety. Claude 3.5 Sonnet vs. GPT-4o: A Head-to-Head Comparison As AI continues to evolve, businesses are increasingly looking for tools that excel in both reasoning and operational efficiency. Claude 3.5 Sonnet and GPT-4o represent two distinct approaches to achieving these goals, but how do they compare? Reasoning Capabilities While GPT-4o has long been celebrated for its versatility and language generation prowess, Claude 3.5 Sonnet’s reasoning abilities are more focused. For example, in legal applications, Claude 3.5 Sonnet outperformed GPT-4o in understanding case law nuances and crafting arguments grounded in precedent. This makes it particularly attractive for firms requiring specialized, logical outputs. Vision and Multimodal Integration GPT-4o introduced basic multimodal capabilities earlier this year, but Claude 3.5 Sonnet takes it a step further by enabling deeper analysis of visual information. For instance, in product design, Claude 3.5 Sonnet can interpret complex sketches and align them with textual requirements, a feature GPT-4o struggles to replicate with the same precision. Safety and Ethical Alignment Anthropic’s focus on "constitutional AI" gives Claude 3.5 Sonnet an edge in mitigating risks such as harmful outputs or bias. While OpenAI has made strides with GPT-4o’s safety protocols, Claude 3.5 Sonnet’s alignment framework is seen as more robust, offering greater confidence in high-stakes applications. In summary, businesses prioritizing specialized reasoning and ethical safeguards may find Claude 3.5 Sonnet to be the better choice, while those valuing broad versatility might still lean toward GPT-4o. Implications for Business Leaders For executives and decision-makers, the rise of Claude 3.5 Sonnet signals an important shift in AI capabilities. Here are actionable insights for leveraging this technology effectively: Adopt for Specialized Use Cases: Industries that require precise reasoning—such as law, medicine, or finance—should prioritize Claude 3.5 Sonnet for its depth and accuracy. Integrate Multimodal AI into Workflows: Businesses relying on visual and textual data can gain a competitive edge by leveraging its multimodal features for tasks like design reviews, quality control, and marketing campaigns. Prioritize Safety in High-Stakes Environments: For applications where ethical considerations are paramount, Claude 3.5 Sonnet offers superior alignment and risk mitigation. Evaluate ROI: Conduct pilot programs to measure performance improvements and cost efficiencies relative to existing AI tools, including GPT-4o. Looking Ahead: The Future of AI Reasoning The release of Claude 3.5 Sonnet highlights an important milestone in AI evolution. As models grow more capable, the focus is shifting from raw performance to nuanced applications and ethical considerations. While GPT-4o remains a strong contender, Anthropic’s emphasis on safety and specialized reasoning may redefine industry standards. “The next wave of AI innovation will be defined by how effectively we balance capability, alignment, and ethical responsibility.” For business leaders, this means staying ahead of the curve by not only adopting cutting-edge tools but also fostering a culture of responsible AI use. As we move deeper into 2024, the competition between Anthropic and OpenAI will undoubtedly drive further innovations, benefiting organizations across industries. ## Apple Intelligence: What Apple's AI Strategy Means for Privacy - URL: https://bartmcd.com/blog/apple-intelligence-ai-strategy-privacy - Published: 2024-06-12 Apple Intelligence: Redefining AI Through Privacy At this year’s Worldwide Developers Conference (WWDC), Apple made waves by unveiling its latest innovation: Apple Intelligence . Positioned as a privacy-first AI ecosystem, Apple Intelligence blends advanced on-device machine learning with seamless integration into tools like ChatGPT. But as the AI arms race intensifies, Apple’s approach raises critical questions about its impact on privacy and what it signals for the future of artificial intelligence. The Privacy-First Promise: Marketing or Mission? Apple has long championed privacy as a core value, branding it as a competitive differentiator. From App Tracking Transparency to Mail Privacy Protection, Apple has built a reputation as the tech giant that protects its users. With Apple Intelligence, the company claims to push this ethos even further by performing AI computations locally on your device, minimizing data sent to the cloud. But how does this promise hold up under scrutiny? On-Device AI: A Game-Changer Unlike competitors such as Google and Amazon, which rely heavily on cloud-based AI processing, Apple Intelligence emphasizes on-device AI . By keeping sensitive data—like your location, health metrics, and personal preferences—on your iPhone, iPad, or Mac, Apple significantly reduces the risk of data breaches or unauthorized surveillance. For example, Apple demonstrated how its on-device AI could power personalized workflows in Siri, predictive text completions in iMessage, and even proactive suggestions in Apple Maps—all without sending data off your device. This aligns with Apple’s existing principles of differential privacy, which anonymizes data to further protect user identities. Integrating ChatGPT: A Strategic Pivot Perhaps the most surprising announcement was Apple’s integration of OpenAI’s ChatGPT within its ecosystem. While ChatGPT currently dominates consumer AI, its reliance on cloud-based processing has raised privacy concerns. Apple’s approach is to give users the option to invoke ChatGPT functionalities while maintaining strict controls over what data is shared and processed. For instance, users can now ask Siri to draft complex emails or summarize documents using ChatGPT, but the interaction is mediated through Apple’s secure environment. This ensures that sensitive data like business communications or personal notes are not exposed to OpenAI’s servers. Apple’s move signals a willingness to collaborate with external AI leaders while still adhering to its privacy-first principles. Apple Intelligence redefines AI by integrating industry-leading tools like ChatGPT without compromising user privacy. Risks and Trade-Offs: Is Apple’s Approach Enough? While Apple’s privacy-first AI strategy is commendable, it’s not without limitations. Executives and business leaders should be aware of the potential trade-offs associated with Apple Intelligence. Limited Data Sharing Could Limit Capabilities One of the reasons cloud-based AI models like OpenAI’s GPT-4 remain so powerful is their ability to learn and improve through massive datasets. Apple’s on-device approach, while secure, inherently limits the scope of data available for training and refinement. This could result in AI tools that feel less intuitive or less accurate compared to their cloud-based counterparts. For example, while Siri’s new capabilities are impressive, they may lag behind Google Assistant in certain areas, such as real-time language translation or advanced contextual understanding. Businesses reliant on cutting-edge AI may find these limitations frustrating. Device Dependency and Hardware Costs Apple Intelligence leans heavily on the processing power of Apple’s custom silicon chips, such as the M3 and A17 Bionic. While this ensures high performance, it also means users must own the latest Apple devices to fully leverage these capabilities. For organizations managing a mixed fleet of devices or operating on tighter budgets, the cost of upgrading hardware could be a significant barrier. Additionally, this device-centric model raises questions about accessibility. How does Apple plan to include users in emerging markets or those with older devices in its AI vision? Actionable Insights for Executives Apple Intelligence is poised to disrupt AI adoption in enterprise environments, and leaders need to evaluate its implications carefully. Here are some key takeaways: Assess Data Sensitivity: If your organization handles sensitive customer data or proprietary information, Apple’s focus on on-device processing could offer a more secure solution than competitors relying on cloud-based AI. Evaluate Hardware Investments: Consider the cost-benefit trade-offs of upgrading to Apple’s latest devices to access the full potential of Apple Intelligence. Monitor AI Ecosystem Shifts: Keep an eye on how competitors like Google, Microsoft, and Samsung respond to Apple’s privacy-focused strategy. Industry trends can influence technology decisions and partnerships. Train Employees on Privacy-Aware Tools: If you adopt Apple Intelligence, ensure your teams understand its features and limitations, especially how to use tools like ChatGPT securely within the Apple ecosystem. The Broader Implications for AI and Privacy Apple’s foray into AI with Apple Intelligence is more than just a product launch—it’s a statement of intent. By prioritizing privacy, Apple is challenging the status quo of data-hungry AI models and forcing the industry to reevaluate its practices. This shift could have ripple effects across sectors, from healthcare to finance, where data security is paramount. However, the success of this strategy hinges on user adoption and satisfaction. If Apple Intelligence delivers on its promise of powerful, privacy-first AI, it could set a new standard for the industry. Conversely, if it falls short, it may reinforce the dominance of cloud-based AI models and their inherent privacy risks. Apple Intelligence isn’t just a product; it’s a paradigm shift in how we think about AI and privacy. Conclusion: A New Era for AI? As AI continues to evolve, the choices we make today will shape its future. Apple’s commitment to privacy through Apple Intelligence offers a compelling alternative to the data-driven models that currently dominate the landscape. For executives and business leaders, this is a critical moment to reassess your organization’s AI strategy. The question isn’t just whether Apple Intelligence can succeed, but what it signifies for a world increasingly defined by artificial intelligence. ## Colorado Becomes First US State with Comprehensive AI Law - URL: https://bartmcd.com/blog/colorado-first-comprehensive-ai-law-colorado-ai-act - Published: 2024-05-28 Colorado's Bold Step: The First Comprehensive AI Law in the United States On May 1, 2024, Colorado passed the landmark Colorado AI Act, establishing a legal framework for artificial intelligence development and deployment. This groundbreaking legislation reflects the growing need to regulate AI technologies amid rapid advancements in generative AI, autonomous systems, and decision-making algorithms. For businesses leveraging AI, this law is both a wake-up call and an opportunity to lead responsibly in an increasingly AI-driven economy. What Does the Colorado AI Act Entail? The Colorado AI Act introduces specific duties and responsibilities for entities that develop, deploy, or utilize AI systems within the state. While similar regulations have been discussed globally—most notably in the European Union's AI Act—Colorado has taken the lead domestically, setting a high bar for AI governance in the United States. Key Provisions Transparency Requirements: AI developers must disclose critical information about their systems, including intended use, limitations, and potential risks. Accountability Mandates: Businesses deploying AI must establish mechanisms to monitor and address biases, inaccuracies, and harm caused by their systems. Data Privacy Protections: AI systems must comply with strict privacy standards, ensuring that personal data is handled securely and ethically. Impact Assessments: Companies are required to conduct regular audits to evaluate the societal impact of their AI tools and report findings to regulatory bodies. These provisions aim to strike a balance between fostering innovation and mitigating risks, offering a model that other states may soon adopt. Why This Matters for Business Leaders For executives, the Colorado AI Act is not just a legal development; it signals a broader shift in how AI technologies are perceived and governed. Companies operating in Colorado—or even those outside the state with AI systems impacting Colorado residents—will need to align with these new standards. Immediate Implications Compliance Costs: Businesses will need to invest in legal counsel and technical resources to ensure adherence to the law. Operational Changes: Internal processes for AI development and deployment may require overhauls to meet transparency and accountability obligations. Reputation Management: Non-compliance risks not only fines but also reputational damage in an era of growing consumer awareness around AI ethics. However, there’s a silver lining. Companies that proactively embrace the Colorado AI Act can position themselves as leaders in ethical AI, earning consumer trust and gaining a competitive edge. Actionable Steps for Businesses To navigate this new regulatory landscape effectively, businesses should take the following steps: 1. Perform a Gap Analysis Assess your existing AI systems against the Colorado AI Act's requirements. Identify areas where your practices fall short, especially around transparency, accountability, and privacy. 2. Build Multidisciplinary Teams Compliance with AI regulations isn’t just a technical challenge—it requires collaboration across legal, technical, and operational teams. Establish a task force to oversee compliance efforts. 3. Invest in AI Governance Tools Leverage emerging AI governance platforms that help automate bias detection, privacy compliance, and impact assessment reporting. These tools can simplify adherence to the law while reducing manual effort. 4. Educate Stakeholders Train executives, developers, and end-users on the implications of the Colorado AI Act. A well-informed workforce is critical to implementing sustainable compliance practices. 5. Monitor Legislative Trends Colorado may be the first, but other states are likely to follow suit. Stay ahead of the curve by tracking related developments at the federal level and in other jurisdictions. The Bigger Picture: What This Means for AI Regulation Colorado’s move could trigger a domino effect across the United States, with other states adopting similar laws or pushing for federal regulations. For global businesses, this adds another layer of complexity as they navigate a patchwork of laws in different regions. “The Colorado AI Act is not just about compliance—it’s about redefining the relationship between technology and society. Businesses that align their AI strategies with ethical principles will thrive in this new era of accountability.” Moreover, this legislation reflects a growing recognition that AI’s unchecked growth poses risks to privacy, equity, and public trust. As generative AI tools like OpenAI’s GPT-4.5 and Google’s Gemini continue to reshape industries, lawmakers are prioritizing safeguards to ensure these transformations benefit society as a whole. Conclusion: Turning Challenge into Opportunity The Colorado AI Act is a landmark moment in the evolution of AI regulation. While it introduces new challenges for businesses, it also presents a chance to lead responsibly and innovate within ethical boundaries. By taking proactive steps today, companies can not only ensure compliance but also build resilient, future-ready frameworks for AI governance. Colorado has set the stage for a new era in AI oversight. The question now is: will your business rise to the occasion? ## Snowflake Breach: How 100+ Companies Were Compromised Through One Platform - URL: https://bartmcd.com/blog/snowflake-breach-100-companies-compromised - Published: 2024-05-22 Snowflake Breach: The Cybersecurity Disaster That Shook 2024 In late April 2024, revelations of a massive supply chain breach sent shockwaves through the business world. Over 100 companies, including household names like AT&T, Ticketmaster, and Santander, were compromised due to vulnerabilities exploited in Snowflake, the widely used cloud data platform. The breach, attributed to the notorious Scattered Spider group, is a stark reminder of the cascading risks inherent in interconnected systems. As we unpack this incident, it exposes critical lessons for cybersecurity in an era of digital interdependence. The Anatomy of the Snowflake Breach Snowflake’s appeal has always been its ability to seamlessly integrate data across organizations, enabling powerful analytics and collaboration. However, this very strength became its Achilles’ heel. Scattered Spider, known for their sophisticated social engineering and supply chain tactics, leveraged compromised credentials from a third-party vendor to infiltrate Snowflake’s platform. From there, they gained privileged access to sensitive customer data across multiple tenants. Initial investigations revealed that Scattered Spider used a combination of phishing attacks and credential stuffing to target the vendor, which had inadequate multi-factor authentication (MFA) protocols. Once inside the Snowflake ecosystem, the attackers exploited insufficient segmentation between customer environments, hopping from one tenant to another. The result was a domino effect, breaching over 100 companies and exposing everything from proprietary business intelligence to sensitive customer records. Key Lessons from the Fallout The Snowflake breach underscores several critical lessons for organizations reliant on third-party platforms. Here are the key takeaways: 1. The Fragility of Supply Chain Security When one link in the chain fails, the repercussions can ripple across the entire ecosystem. The breach highlights the need to scrutinize not just your own security practices but also those of your vendors and partners. Over-reliance on any single platform, no matter how robust, introduces systemic risk. Actionable Tip: Conduct regular third-party risk assessments, focusing on vendors who have privileged access to your systems or data. Actionable Tip: Require vendors to adopt strong authentication measures, such as hardware-based MFA. 2. The Importance of Tenant Isolation One of the most troubling aspects of the breach was the lack of sufficient tenant isolation within the Snowflake environment. This flaw allowed attackers to move laterally from one customer’s data to another’s, amplifying the scale of the compromise. Actionable Tip: Ensure cloud providers implement and regularly test robust tenant isolation mechanisms. Actionable Tip: Advocate for shared responsibility models where vendors are transparent about their security architecture. 3. The Evolving Threat of Scattered Spider Scattered Spider has emerged as one of the most sophisticated adversaries in the threat landscape, blending technical expertise with psychological manipulation. Their use of social engineering to bypass even advanced defenses is a wake-up call for organizations to double down on employee training and awareness programs. Actionable Tip: Invest in regular, realistic phishing simulations to improve employee vigilance. Actionable Tip: Deploy behavioral analytics to detect anomalies that traditional defenses might miss. How Snowflake and Victimized Companies Are Responding Snowflake has committed to a series of sweeping changes in the aftermath of the breach, including enhanced tenant isolation features and stricter access controls for third-party vendors. They’ve also pledged greater transparency by introducing a real-time incident notification system for customers. Meanwhile, affected companies are grappling with significant reputational damage and regulatory scrutiny. The breach has already triggered investigations under GDPR, CCPA, and other global privacy laws, with potential fines reaching into the hundreds of millions. For many organizations, this breach is a painful reminder of the cost of complacency. Several victims have announced plans to diversify their cloud providers and implement zero-trust architectures to mitigate future risks. Preparing for the Next Supply Chain Attack If the Snowflake breach teaches us anything, it’s that no organization is immune to supply chain threats. Here’s how you can strengthen your defenses: 1. Embrace a Zero-Trust Mindset Zero trust is no longer optional; it’s essential. Trust nothing, verify everything, and segment access to minimize the blast radius of an attack. Actionable Tip: Implement role-based access controls (RBAC) to restrict data access based on job responsibilities. Actionable Tip: Use micro-segmentation to isolate critical systems and limit lateral movement. 2. Automate Threat Detection and Response Manual processes are inadequate against adversaries like Scattered Spider, who operate with speed and agility. Automation can help you detect and respond to threats faster. Actionable Tip: Deploy Security Orchestration, Automation, and Response (SOAR) tools to streamline incident response. Actionable Tip: Integrate artificial intelligence to identify and mitigate emerging threats in real-time. 3. Build a Security-First Culture Technology alone won’t save you. A cybersecurity-aware workforce is your first line of defense against social engineering and other human-centric attacks. Actionable Tip: Make cybersecurity training mandatory for all employees, from interns to executives. Actionable Tip: Encourage a culture where employees feel empowered to report suspicious activity without fear of retribution. Final Thoughts The Snowflake breach is a harsh reminder that cybersecurity is not just a technical issue—it’s a business imperative. As organizations increasingly rely on interconnected platforms, the stakes for securing the supply chain have never been higher. By adopting a zero-trust mindset, automating defenses, and fostering a culture of security, companies can better prepare for the next inevitable attack. “The question is no longer if you’ll be targeted, but when. The time to act is now.” Let the lessons of this breach inform your strategy, not just for the sake of compliance, but for the survival and resilience of your organization in an increasingly hostile digital landscape. ## Google I/O 2024: Project Astra and the Future of AI Assistants - URL: https://bartmcd.com/blog/google-io-2024-project-astra-future-ai-assistants - Published: 2024-05-16 With a packed Shoreline Amphitheatre and millions tuning in virtually, Google I/O 2024 delivered a clear message: the future of AI assistants is here, and it’s called Project Astra. Alongside advancements like Gemini 1.5 and Veo video generation, Google unveiled its most ambitious vision yet for how artificial intelligence will transform the way we live, work, and collaborate. For technology leaders, the implications are both exciting and daunting, as these innovations promise to redefine digital interaction and productivity. Project Astra: The Smartest AI Assistant Yet Project Astra is Google’s next-generation AI assistant, and it aims to make Siri and Alexa look like relics of a bygone era. Powered by Gemini 1.5, Google’s advanced multimodal AI model, Astra is designed to be conversational, proactive, and deeply integrated into your daily life. Unlike its predecessors, Astra doesn’t just answer queries—it anticipates your needs and adapts to your behavior over time. Key Features of Project Astra Contextual Awareness: Astra can seamlessly understand and respond to complex, multi-turn conversations. Whether you're scheduling a meeting or planning a trip, Astra keeps track of context and nuance. Proactive Assistance: Using predictive analytics, Astra can suggest actions before you even ask. For example, it might remind you to review a report that’s due tomorrow or reorder supplies when inventory runs low. Cross-Platform Integration: Astra works effortlessly across Android, ChromeOS, and even iOS, ensuring a consistent user experience regardless of device. For technology leaders, the takeaway is clear: AI assistants are no longer optional add-ons but essential tools for driving efficiency and enhancing user experience. Businesses should begin exploring how to integrate Astra’s API into their workflows and customer-facing platforms. Gemini 1.5: The Brain Behind the Vision At the core of Google’s announcements is Gemini 1.5, an evolution of the Gemini 1 model introduced in late 2023. This multimodal AI is designed to process text, images, and video simultaneously, making it one of the most powerful AI models in production today. Gemini 1.5 is not just about speed and accuracy—it’s about versatility. Why Gemini 1.5 Matters Enhanced Multimodal Capabilities: By combining inputs like voice commands, visual data, and written instructions, Gemini 1.5 enables more natural and intuitive interactions. Smarter Customization: Enterprises can fine-tune Gemini 1.5 for specific use cases, from customer service bots to AI-driven design tools. Real-Time Collaboration: Gemini 1.5 integrates with Google Workspace to enable real-time AI collaboration in docs, slides, and meetings. This level of sophistication provides a competitive edge for businesses willing to embrace AI. Leaders should evaluate their existing AI strategies and consider how Gemini 1.5 might accelerate their digital transformation initiatives. Veo: A Leap in AI-Generated Video Google also showcased Veo, its first AI-powered video generation tool. Veo enables users to create high-quality, customized videos using only text prompts. Imagine typing a script and instantly receiving a polished video complete with animations, voiceovers, and music—all tailored to your brand’s identity. Potential Applications of Veo Marketing: Create promotional videos in minutes, reducing production costs and timelines. Training and Education: Develop engaging training materials or educational content with minimal effort. Internal Communication: Simplify the process of creating video updates or presentations for employees. However, Veo also raises questions about authenticity and intellectual property. As AI-generated content becomes indistinguishable from human-made media, businesses will need to establish clear guidelines to balance innovation with ethical considerations. Implications for Technology Leaders Google’s announcements underscore a broader trend: AI is no longer a futuristic concept; it’s a present-day reality reshaping industries. For executives and technology leaders, the challenge is to harness these tools responsibly and effectively. Actionable Steps Audit Your AI Readiness: Evaluate your organization’s current AI capabilities and identify gaps. Are your systems ready to integrate with tools like Project Astra or Gemini 1.5? Invest in Training: Equip your teams with the skills needed to work alongside AI tools. Consider workshops or certifications focused on AI integration and ethical use. Develop Clear Policies: As AI becomes more pervasive, establish guidelines for its use within your organization. Address issues like data privacy, intellectual property, and transparency. Experiment Strategically: Start with pilot projects to test how Google’s AI tools can add value to your business. Measure outcomes and scale successful initiatives. “AI is not just a tool—it’s a partner in innovation. The organizations that succeed will be those that integrate AI thoughtfully and strategically.” Looking Ahead Google I/O 2024 marks a pivotal moment for AI innovation. With Project Astra, Gemini 1.5, and Veo, Google is setting a new standard for what’s possible. For businesses, the opportunity is immense—but so are the challenges. The key lies in adopting these technologies with a clear strategy, ensuring that they drive value while aligning with broader organizational goals. The future isn’t just coming; it’s already here. The question is whether your organization is ready to embrace it. ## GPT-4o Launches: OpenAI's Multimodal Revolution - URL: https://bartmcd.com/blog/gpt-4o-launch-openai-multimodal-ai-revolution - Published: 2024-05-14 GPT-4o: The Game-Changer We've Been Waiting For In a bold leap forward, OpenAI has launched GPT-4o, a multimodal AI model that seamlessly processes text, images, audio, and video. This innovation is not just an incremental update; it represents a paradigm shift in artificial intelligence, reshaping industries and redefining how we interact with technology. As businesses scramble to understand its impact, one thing is clear: GPT-4o is poised to leave an indelible mark on the AI landscape. What Makes GPT-4o Different? True Multimodal Capabilities While GPT-4 introduced limited multimodal abilities, GPT-4o takes it to a new level, integrating text, image, audio, and video processing into a single system. This unification means that GPT-4o can analyze a video, extract the spoken words, interpret visual cues, and summarize content—all in one request. For example: Media Analysis: GPT-4o can review hours of video footage, identify key moments, and generate shareable summaries. Customer Support: It can address user queries by interpreting screenshots and audio recordings while providing contextual advice. Creative Content Creation: Users can submit a combination of sketches, voice notes, and text prompts to co-create marketing campaigns or product designs. This level of integration eradicates the need for fragmented tools, saving time and enhancing productivity. Enhanced Contextual Understanding One of GPT-4o’s most impressive features is its ability to maintain context across multiple input types. For instance, it can interpret a conversation that spans text and voice, maintaining continuity and delivering coherent responses. This opens doors for: Unified Collaboration: Teams can brainstorm ideas using a mix of formats without losing coherence. Complex Problem Solving: Businesses can upload technical documents, audio explanations, and visual diagrams for simultaneous analysis. The ability to bridge various input types ensures a fluid, intuitive user experience. Industries Poised for Transformation Healthcare Healthcare providers are already leveraging AI for diagnostics, but GPT-4o’s multimodal nature takes it a step further. Imagine a physician uploading MRI scans, patient notes, and voice recordings from consultations. GPT-4o can synthesize this data to offer diagnostic insights or suggest treatment plans. Additionally, with its video analysis capabilities, it can assist in surgical planning by reviewing procedure recordings and identifying areas for improvement. Education GPT-4o could revolutionize education by creating personalized learning experiences. Teachers could combine lecture notes, recorded lessons, and student feedback to generate tailored lesson plans. Students can engage with multimodal content to grasp complex concepts—watching explanatory videos, reading summaries, and listening to audio guides—all powered by GPT-4o. Media and Entertainment From scriptwriting to video editing, the creative industries stand to gain immensely. GPT-4o can analyze audience data alongside multimedia content to craft more engaging stories or edit video and audio for optimal impact. Content creators can now work across multiple formats seamlessly, accelerating production timelines and enhancing overall quality. Risks and Challenges Data Privacy The integration of multimodal inputs raises new concerns about data security. With GPT-4o capable of processing sensitive visual, audio, and text data, businesses must ensure robust encryption and user consent frameworks. The potential for misuse—such as creating deepfakes—also adds layers of complexity to regulatory discussions. Bias Amplification AI models are only as unbiased as the data on which they are trained. GPT-4o’s ability to process diverse formats might inadvertently amplify biases embedded in multimedia inputs. Companies must prioritize ethical oversight and invest in mechanisms to detect and mitigate bias. Accessibility and Cost While GPT-4o promises groundbreaking capabilities, access to such advanced technology could remain limited due to high costs. Smaller businesses and nonprofits may struggle to leverage its potential, exacerbating existing inequalities in digital transformation. OpenAI’s pricing and accessibility strategies will be critical in addressing this challenge. Actionable Steps for Business Leaders Adopt a Multimodal Mindset Businesses must rethink their workflows to incorporate multimodal tools effectively. Leaders should identify areas where GPT-4o can eliminate inefficiencies, such as customer service, content creation, or data analysis. Early adoption will offer a competitive edge. Invest in Training Introduce training programs to help teams harness GPT-4o’s capabilities. Familiarity with multimodal AI can accelerate its integration into daily operations and reduce the learning curve. Prioritize Ethical AI Practices Companies must establish guidelines for responsible AI usage. This includes obtaining proper consent for data inputs, ensuring compliance with privacy laws, and regularly auditing for bias. Partnering with industry organizations focused on ethical AI can offer additional support. Collaborate with OpenAI OpenAI has emphasized its commitment to working with stakeholders. Business leaders should engage directly with OpenAI to discuss industry-specific applications and co-create innovative solutions tailored to their needs. The Future of Multimodal AI As we move deeper into 2024, GPT-4o is already sparking conversations about the future of multimodal AI. Its potential stretches far beyond what we can currently imagine, from intelligent virtual assistants to autonomous systems capable of navigating complex environments. While the road ahead has its challenges, the opportunities are undeniably transformative. “GPT-4o isn’t just a technological advancement; it’s a glimpse into the future of AI-driven innovation. Those who embrace it early will shape industries for decades to come.” For business leaders, the message is clear: the multimodal revolution has arrived, and it’s time to prepare. Whether you’re accelerating operations, enhancing customer experiences, or breaking ground in innovation, GPT-4o is your new ally in navigating the future. ## Microsoft's Midnight Blizzard Attack: When Russia Targets Tech Giants - URL: https://bartmcd.com/blog/microsoft-midnight-blizzard-apt29-password-spraying-attack - Published: 2024-04-25 Microsoft's Midnight Blizzard Attack: A Wake-Up Call for Tech Giants In a chilling reminder of the evolving threat landscape, Russian-linked Advanced Persistent Threat (APT) group Midnight Blizzard—also known as APT29 or Cozy Bear—executed one of the most significant cyberattacks of the past year. By exploiting password spraying techniques, the group infiltrated Microsoft’s systems, compromising sensitive emails and source code repositories. This brazen attack has sent shockwaves through the tech industry and underscored the urgent need for organizations to revisit their cybersecurity posture. The Anatomy of the Midnight Blizzard Attack How the Breach Unfolded APT29 utilized a common yet insidious attack vector: password spraying . The technique involves using a limited set of commonly used passwords across a massive number of accounts, counting on the odds that at least one user employed a weak or reused password. Once they gained a foothold, the attackers escalated privileges and accessed critical systems, including Microsoft’s email and source code repositories. Microsoft disclosed that the attack was discovered in late 2023, after unusual anomalies were detected in its Azure Active Directory logs. The incident highlighted vulnerabilities in identity management and access controls, raising questions about how even a tech behemoth could fall victim to such an attack. The Stolen Crown Jewels The breach wasn’t just about data theft; it was an attack on trust. Emails detailing sensitive internal and external communications were exfiltrated. Even more concerning was the unauthorized access to portions of Microsoft’s proprietary source code for its flagship products, including Azure and Office 365. While Microsoft asserts that no customer data was compromised, the exposure of source code could provide attackers with a roadmap for future exploits. “This attack was a watershed moment, proving that even the most fortified organizations can be breached if fundamental security practices are overlooked.” Key Lessons for Enterprise Security 1. Strengthen Identity and Access Management The Midnight Blizzard attack underscores the importance of robust identity and access management (IAM). Organizations should adopt a Zero Trust architecture where no user or device is trusted by default. Enforce multi-factor authentication (MFA) across all accounts, especially for privileged users. Implement conditional access policies that block login attempts from unusual locations or devices. Regularly audit and limit access privileges, following the principle of least privilege (PoLP). Additionally, the adoption of passwordless authentication technologies, such as FIDO2 standards, can significantly reduce the risk of password-based attacks. 2. Monitor and Analyze Logs with Advanced Tools Timely detection of the attack was only possible due to Microsoft's sophisticated log monitoring capabilities. However, the incident revealed gaps in proactively identifying and responding to threats. Deploy Security Information and Event Management (SIEM) solutions for real-time log analysis. Leverage AI-powered threat detection tools that can identify anomalous behavior indicative of a breach. Ensure logs are stored and analyzed for an adequate retention period to uncover long-dwelling threats. As attackers grow more advanced, the integration of extended detection and response (XDR) platforms offers a unified view of threats across endpoints, networks, and cloud environments. 3. Conduct Regular Red Team Exercises Even the most comprehensive cybersecurity frameworks benefit from stress testing. Red team exercises simulate real-world attacks to identify vulnerabilities before adversaries can exploit them. This proactive approach helps organizations strengthen defenses and prepare incident response teams. Enterprises should: Engage third-party cybersecurity experts to conduct penetration tests and red team assessments. Incorporate attack simulations into regular security drills. Ensure findings are addressed promptly through patching and configuration changes. 4. Collaborate on Threat Intelligence The Midnight Blizzard attack highlights the importance of information sharing within the cybersecurity community. No organization is an island in today’s interconnected world, and collaboration is key to staying ahead of nation-state actors. Participate in threat intelligence sharing programs like the Cyber Threat Alliance (CTA) or regional CERTs. Subscribe to threat feeds that provide actionable insights into APT activity. Leverage open standards like STIX and TAXII to automate the exchange of threat intelligence. By pooling resources and intelligence, organizations can better understand the tactics, techniques, and procedures (TTPs) of adversaries like APT29. The Bigger Picture: Resilience in the Face of Nation-State Threats The Midnight Blizzard attack serves as a stark reminder that no entity—no matter how large or resource-rich—is immune to cyber threats. It also reinforces the notion that cybersecurity is not just a technology problem but a boardroom issue. Leadership teams must prioritize cybersecurity as a business-critical function. Looking ahead, organizations must invest in building cyber resilience by: Adopting a comprehensive incident response plan that is tested and revised regularly. Enhancing employee awareness through ongoing training and simulated phishing exercises. Allocating sufficient budget for cybersecurity, balancing it against the growing risk landscape. Conclusion: Turning a Crisis into a Catalyst The Midnight Blizzard attack was a sobering event, but it also serves as a rallying cry for enterprises worldwide. It’s a reminder that cybersecurity is a journey, not a destination. By learning from incidents like this, organizations can fortify their defenses, safeguard their assets, and maintain the trust of their customers and partners. “Cyber resilience isn’t just about preventing attacks—it’s about adapting, recovering, and becoming stronger in the face of adversity.” As we move deeper into 2024, the stakes have never been higher. The question isn’t whether your organization will be targeted—it’s whether you’ll be prepared when it happens. ## AI Regulations Are Coming: What Business Leaders Need to Know - URL: https://bartmcd.com/blog/ai-regulations-coming-what-business-leaders-need-know - Published: 2024-04-18 AI Regulations Are Coming: What Business Leaders Need to Know The rapid ascent of artificial intelligence has ushered in transformative opportunities—and mounting scrutiny. Governments across the globe are racing to regulate AI, creating a patchwork of laws and frameworks that will impact businesses big and small. From the European Union’s groundbreaking AI Act to emerging U.S. state-level policies, executives must prepare now to navigate this shifting landscape. The stakes are high: non-compliance could result in hefty fines, reputational damage, and even a halt in operations. Understanding the EU AI Act In January 2024, the European Union finalized the much-anticipated AI Act, widely regarded as the most comprehensive AI legislation to date. Its provisions classify AI systems into risk categories—minimal, limited, high, and unacceptable—and set stringent requirements for high-risk systems. This includes mandatory risk assessments, transparency obligations, and robust accountability measures. Key Implications for Businesses High-risk systems: If your business uses AI in critical areas such as hiring, credit scoring, or healthcare, you must conduct thorough impact assessments and document compliance measures. Transparency: AI systems interacting with consumers must disclose their machine nature, ensuring users know they’re engaging with non-human agents. Penalties: Non-compliance can result in fines up to €30 million or 6% of annual global turnover, whichever is higher. For businesses operating in or serving EU markets, the AI Act is not optional. It demands early and strategic action to align operations with its requirements. Companies should assess their AI portfolios now, identifying areas subject to regulation and implementing compliance frameworks. U.S. Moves Toward AI Governance While the United States has yet to pass federal AI legislation, 2024 has seen significant developments at the state level. Colorado became the first state to enact comprehensive AI governance laws in February, requiring transparency reports for AI systems and mandating ethical use guidelines for companies leveraging AI in sensitive sectors. Federal Efforts Gain Momentum The Biden Administration’s AI Bill of Rights, released in late 2023, laid the groundwork for broader federal action. This framework outlines principles such as data privacy, algorithmic fairness, and safe AI use, signaling the government’s intent to codify these into law. “AI governance is no longer a theoretical discussion. It's a reality shaping compliance, innovation, and trust in the U.S. and beyond.” Business leaders in the U.S. must keep a finger on the pulse of state-level developments while preparing for eventual federal mandates. Multi-jurisdictional compliance strategies will be crucial for companies operating across state lines. China’s Proactive Approach China has taken a proactive stance in AI regulation, implementing its Generative AI Code of Conduct in December 2023. This regulation emphasizes content control, requiring generative AI providers to ensure outputs align with the nation’s stringent censorship standards. Additionally, China mandates algorithmic audits and imposes significant penalties for violations. Impact on Global Companies Local compliance: Companies entering the Chinese market must tailor their AI systems to meet these requirements. Operational changes: Enhanced monitoring and auditing processes are necessary to avoid legal repercussions. As AI regulation tightens globally, businesses with international footprints face growing complexity. Executives must weigh compliance costs against market opportunities, implementing scalable solutions to meet diverse regulatory demands. Preparing for AI Regulation: A Strategic Approach With AI governance accelerating worldwide, businesses cannot afford to take a reactive stance. To thrive in this new era, leaders should adopt a forward-looking strategy that prioritizes compliance, risk management, and innovation. Steps for Business Leaders Conduct a regulatory audit: Identify which laws and frameworks apply to your organization based on your location, industry, and AI use cases. Build a compliance team: Establish cross-functional teams that include legal, technical, and operational experts to navigate AI governance. Invest in explainable AI: Transparent and interpretable systems will be critical for meeting disclosure requirements and building consumer trust. Stay informed: AI regulation is evolving rapidly. Regularly monitor legislative developments and adjust your strategies accordingly. Proactive compliance is not just about avoiding penalties—it’s a competitive advantage. Companies that lead in ethical AI use will strengthen stakeholder trust, attract top talent, and position themselves as industry leaders. The Bottom Line AI regulation is no longer a distant prospect; it is here, reshaping the business landscape. From the EU AI Act to state-level policies in the U.S. and global developments in China, the pressure on businesses to comply is mounting. Executives must act decisively, adopting strategies that enable compliance while fostering innovation. “The companies that thrive in the age of AI regulation will be those that see compliance not as a burden, but as an opportunity to build trust and drive sustainable growth.” The time to prepare was yesterday. But with the right approach, business leaders can navigate these new challenges and emerge stronger in the AI-driven future. ## National Public Data Breach: 2.9 Billion Records Exposed - URL: https://bartmcd.com/blog/national-public-data-breach-2-9-billion-records-exposed - Published: 2024-04-09 The Largest Data Breach in History: What Happened? On April 6, 2024, the world woke up to the shocking news of a monumental data breach that exposed the personal information of nearly 3 billion individuals. Dubbed the "National Public Data Breach," this cyber incident is now the largest in history, eclipsing all prior breaches by a significant margin. The stolen data includes Social Security numbers, addresses, financial records, and other sensitive personal information from individuals across 14 countries. The breach not only underscores the growing sophistication of cybercriminals but also serves as a wake-up call for organizations and individuals alike. Authorities have traced the breach to a misconfigured cloud storage bucket linked to a global third-party data aggregator. This company, which remains unnamed due to ongoing investigations, collects personal data across industries for analytics and marketing purposes. The breach exposed vulnerabilities in how such companies manage and secure the massive troves of information entrusted to them. As the fallout unfolds, businesses, governments, and individuals must understand the implications of this breach and take immediate action to protect themselves in a world where data breaches are no longer a possibility—they’re a certainty. Implications of the Breach 1. A Global Crisis in Trust The breach highlights a systemic issue with how sensitive information is stored, shared, and protected. Trust in digital ecosystems has been severely undermined, with businesses and governments now facing a public relations and compliance nightmare. Individuals, meanwhile, are left questioning the safety of their personal information in an increasingly interconnected world. Regulatory bodies worldwide are expected to respond with stricter data protection laws, following the lead of the EU's General Data Protection Regulation (GDPR) and similar legislation in California and other regions. However, legislation alone cannot solve the problem. Organizations must proactively invest in robust cybersecurity measures to regain trust. 2. Financial Fallout The financial impact of this breach is staggering. Analysts estimate that the total cost—including fines, legal fees, and brand damage—could exceed $50 billion globally. Affected companies may face lawsuits from victims, while governments are likely to impose heavy penalties for non-compliance with data protection laws. On an individual level, the exposed data is a goldmine for cybercriminals. Early reports indicate a spike in identity theft cases, phishing campaigns, and fraudulent transactions. The sheer scale of the breach means that no one is immune, and recovery could take years. 3. The Role of Artificial Intelligence Artificial intelligence (AI) played a dual role in this breach. On one hand, AI-driven tools are believed to have been used by attackers to automate the exploitation of vulnerabilities, enabling them to extract such a massive volume of data in a short time. On the other hand, AI is also being leveraged by cybersecurity firms to analyze the breach, identify affected systems, and mitigate ongoing risks. This incident underscores the growing importance of AI in both offensive and defensive cybersecurity strategies. Organizations must prioritize AI-driven solutions to stay ahead of increasingly sophisticated threats. How to Protect Yourself and Your Organization For Individuals If you believe your data may have been exposed in this breach, take the following steps immediately: Monitor Your Financial Accounts: Regularly review your bank and credit card statements for unauthorized transactions. Set up transaction alerts for real-time notifications. Freeze Your Credit: Contact major credit bureaus to freeze your credit. This prevents fraudsters from opening new accounts in your name. Enable Multi-Factor Authentication (MFA): Protect your online accounts by enabling MFA wherever possible. This adds an extra layer of security by requiring a second form of verification. Beware of Phishing Scams: Be cautious of emails, texts, or calls requesting personal information. Verify the legitimacy of any communication before responding. Use Identity Theft Protection Services: Consider subscribing to a reputable identity theft protection service, which can monitor your information and alert you to suspicious activity. For Organizations Businesses must act swiftly to mitigate risks and prevent future breaches. Key steps include: Conduct a Comprehensive Security Audit: Review your cybersecurity posture, including network security, cloud configurations, and third-party vendor practices. Implement Zero Trust Architecture: Adopt a zero-trust approach, which assumes that all users, devices, and systems are potential threats until verified. Encrypt All Sensitive Data: Ensure that sensitive data is encrypted both at rest and in transit. Even if stolen, encrypted data is much harder for attackers to exploit. Invest in AI-Driven Security Solutions: Leverage AI and machine learning tools to detect and respond to threats in real time. Train Employees: Regularly train employees on cybersecurity best practices, including recognizing phishing attempts and safeguarding sensitive information. Develop an Incident Response Plan: Have a robust incident response plan in place to minimize damage in the event of a breach. Lessons for the Future This breach serves as a stark reminder that no organization is immune to cyber threats. As technology evolves, so do the tactics of cybercriminals. To stay ahead, businesses must adopt a proactive and adaptive approach to cybersecurity. “The National Public Data Breach isn’t just a data breach—it’s a global wake-up call. In this digital age, cybersecurity must be a core business priority, not an afterthought.” For individuals, vigilance is key. Protecting personal information requires a combination of technological tools and cautious behavior. As we move forward, the ability to navigate the complexities of digital security will define success—not just for businesses, but for society as a whole. Final Thoughts The National Public Data Breach is a watershed moment in the history of cybersecurity. With billions affected and the fallout still unfolding, it’s clear that the stakes have never been higher. Organizations and individuals alike must take immediate action to protect themselves and prevent future incidents. As we reflect on this unprecedented event, let’s not lose sight of the opportunity it presents: a chance to rebuild trust, strengthen defenses, and create a more secure digital world for everyone. ## The Ivanti Zero-Day Crisis: A Wake-Up Call for Enterprise Security - URL: https://bartmcd.com/blog/ivanti-zero-day-crisis-enterprise-security-wake-up-call - Published: 2024-03-20 The Ivanti Zero-Day Crisis: A Wake-Up Call for Enterprise Security In one of the most alarming cybersecurity breaches of recent memory, Chinese nation-state actors exploited zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) to compromise none other than the Cybersecurity and Infrastructure Security Agency (CISA). This attack has sent shockwaves through the cybersecurity community, not only because of the high-profile target but also due to the ease with which attackers weaponized unpatched vulnerabilities in widely-used enterprise software. For security leaders, this incident serves as a wake-up call to rethink their approaches to patch management, zero-day mitigation, and vendor risk assessments. The Anatomy of the Ivanti Breach The attack leveraged a previously unknown zero-day vulnerability in Ivanti’s EPMM, a product relied upon by enterprises and government agencies to manage mobile devices and secure their access to corporate networks. By exploiting these flaws, the attackers gained initial access and were able to move laterally within the organization, exfiltrating sensitive data and planting backdoors for prolonged access. Understanding the Zero-Day Exploit Zero-day vulnerabilities remain one of the most dangerous threats in cybersecurity. They are flaws unknown to the vendor at the time of exploitation, giving attackers a significant head start. In the Ivanti case, the vulnerability allowed threat actors to bypass authentication mechanisms, granting unauthorized access to sensitive systems. According to reports, the attackers demonstrated a high degree of sophistication, chaining the Ivanti vulnerability with other exploits to escalate privileges and evade detection. This multi-stage attack highlights the growing complexity of nation-state operations, where attackers leverage not just technical expertise but also deep reconnaissance into their targets' infrastructure. “The Ivanti breach underscores a harsh truth: no organization, not even those that set the standards for cybersecurity, is immune to exploitation.” Why Enterprises Were Unprepared Despite warnings from Ivanti and CISA about the increasing risks of unpatched vulnerabilities, many organizations failed to deploy critical updates in a timely manner. The reasons are varied but familiar: Resource constraints: Many IT teams struggle with limited staff and budgets, making it difficult to prioritize patching over other operational demands. Complex environments: Large enterprises often run sprawling IT ecosystems with legacy systems, making rapid patch deployment challenging without causing disruptions. Vendor over-reliance: Organizations frequently trust software vendors to flag vulnerabilities, yet this trust can lead to complacency when vendors fail to act swiftly. The Ivanti breach has shattered the illusion that these challenges are manageable through traditional, reactive security measures. It’s time for security leaders to embrace more proactive strategies. Lessons Learned: Building Resilience Against Zero-Days The Ivanti crisis serves as a case study in what can go wrong when enterprises fail to anticipate and mitigate zero-day threats. Below are key lessons every security leader should take to heart. 1. Prioritize Vendor Risk Management Enterprises must scrutinize their software vendors more closely. The Ivanti breach revealed significant gaps in vendor communication and response mechanisms, which left many organizations unaware of the risk they faced. Ensure vendors have robust vulnerability disclosure and patching policies. Conduct regular security audits of third-party software. Understand the supply chain implications of each vendor’s security posture. Security leaders should also demand transparency from vendors regarding their bug bounty programs and incident response capabilities. A vendor’s ability to quickly identify, patch, and communicate about vulnerabilities can mean the difference between a minor incident and a full-blown crisis. 2. Automate Patch Management Manual patching processes are no longer sufficient to keep up with the pace of emerging threats. Organizations must invest in automated patch management solutions that can identify, test, and deploy updates with minimal human intervention. However, automation alone isn’t enough. Security teams need to: Integrate automated tools with comprehensive vulnerability scanning to ensure no gaps are left unaddressed. Implement rollback capabilities to minimize downtime in case of deployment issues. Regularly test patching processes in a simulated environment to identify potential risks. By streamlining patch management, organizations can significantly reduce the window of exposure to zero-day vulnerabilities. 3. Enhance Zero-Day Detection and Response While patching is critical, it’s not a panacea. Organizations must also bolster their ability to detect and respond to zero-day attacks in real-time. This requires a mix of advanced tools and well-trained personnel. Deploy AI-driven threat detection: Modern tools use machine learning to identify unusual patterns that may indicate a zero-day attack. Invest in endpoint protection: Solutions that monitor device behavior can help isolate and contain threats before they spread. Strengthen incident response plans: Ensure your team can act swiftly when a zero-day is discovered, including isolating affected systems and initiating forensic investigations. Proactive monitoring and rapid response capabilities can significantly limit the damage caused by zero-day exploits. The Role of Leadership in Strengthening Cybersecurity The Ivanti breach wasn’t just a failure of technology—it was a failure of leadership. Security leaders must recognize that their role extends far beyond implementing tools and policies. They need to foster a culture of vigilance and accountability throughout their organizations. Champion Cybersecurity Awareness Every employee, from entry-level staff to the C-suite, plays a role in an organization’s security posture. Leaders must ensure that employees understand the risks associated with phishing, social engineering, and other common attack vectors. Regular training sessions and phishing simulations can help reinforce best practices and reduce human error—a critical factor in many breaches. Secure Executive Buy-In Cybersecurity budgets are often the first to be scrutinized during economic downturns, but the Ivanti incident proves that underfunding security can have catastrophic consequences. Security leaders must present a compelling case for investment, emphasizing the long-term cost savings of robust defenses versus the staggering costs of a data breach. Engage the board with clear, data-driven insights into the organization’s risk profile and the effectiveness of current security measures. By aligning cybersecurity goals with broader business objectives, leaders can secure the resources they need to stay ahead of emerging threats. Looking Ahead: The Future of Enterprise Security The Ivanti zero-day crisis is a sobering reminder that the cybersecurity landscape is evolving faster than ever. As nation-state actors become more sophisticated and supply chain vulnerabilities continue to grow, organizations must adapt their strategies to stay resilient. Key trends to watch in 2024 and beyond include: The rise of quantum-resistant encryption to counteract advances in computing power. Increased reliance on AI and machine learning for predictive threat modeling. Greater collaboration between public and private sectors to share threat intelligence and coordinate responses. Ultimately, the organizations that thrive in this new era will be those that view cybersecurity not as an afterthought, but as a core component of their overall strategy. The stakes have never been higher, but with the right mindset and tools, we can adapt to the challenges ahead. ## Claude 3 Arrives: Anthropic's New Multimodal AI Family - URL: https://bartmcd.com/blog/claude-3-multimodal-ai-family-haiku-sonnet-opus - Published: 2024-03-12 Claude 3: A Leap Forward in Multimodal AI Anthropic has officially unveiled Claude 3, the next evolution of its AI systems, and it’s making waves across industries. Boasting three distinct models—Haiku, Sonnet, and Opus—Claude 3 pushes the boundaries of what multimodal AI can achieve. These models are tailored to meet the diverse needs of businesses, from quick decision-making to complex problem-solving. With multimodal capabilities (text, image, and data processing) at their core, the Claude 3 family stands as a prime example of how AI is evolving to be more specialized and adaptable. In a technological landscape already buzzing with OpenAI’s GPT-5 and Google DeepMind’s Gemini 2, Anthropic’s latest release shows it intends to remain a heavyweight contender. But what sets Claude 3 apart? And how can businesses leverage the Haiku, Sonnet, and Opus models? Let’s explore. The Claude 3 Family: Haiku, Sonnet, and Opus One of the most striking features of Claude 3 is its diversified approach. Instead of relying on a one-size-fits-all model, Anthropic has developed three distinct versions to cater to specific use cases: Haiku: The lightweight, fast-response model built for real-time interactions and customer-facing applications. Sonnet: A balanced model designed for mid-level complexity tasks, such as drafting reports, analyzing structured data, and providing contextual insights. Opus: The powerhouse of the Claude 3 family, optimized for deep analysis, intricate problem-solving, and multimodal synthesis at scale. Understanding the Use Cases Each model serves a specific purpose, and understanding these distinctions is critical for businesses looking to integrate Claude 3 effectively: Haiku: Ideal for chatbots, virtual assistants, and customer support, Haiku’s speed and efficiency make it perfect for handling high volumes of inquiries. For instance, an e-commerce site can deploy Haiku to manage customer queries, provide personalized recommendations, and even process returns in real time. Sonnet: This is the go-to model for knowledge workers. A financial services firm might use Sonnet to assess risk profiles by analyzing structured and unstructured data, such as market trends and client portfolios. Its balanced approach ensures reliable outputs without excessive computational costs. Opus: Designed for organizations tackling large-scale, multifaceted challenges, Opus can integrate text, images, and other data formats for a comprehensive analysis. Whether you’re a media company producing multi-format content or a research lab synthesizing data from various experiments, Opus delivers unparalleled depth and precision. Multimodal Capabilities: The Game Changer Claude 3’s headline feature is its multimodal capability , allowing it to interpret and generate outputs across text, image, and numerical data formats. This positions it as a direct competitor to OpenAI’s GPT-5, which also debuted multimodal functions late last year. The ability to seamlessly integrate different types of data opens up entirely new possibilities for automation and insight generation. For example, consider a supply chain management company. With Claude 3, they can analyze text-based contracts, interpret visual shipping manifests, and cross-reference this data with numerical inventory records to identify bottlenecks and optimize logistics—all within a single system. "Multimodal AI is the bridge between structured and unstructured data. The ability to connect these dots is what makes Claude 3 transformative for businesses."—Bart McDonough Anthropic has also emphasized safety and alignment in this new release, a hallmark of their brand. Unlike some competitors, Claude 3 employs stricter guardrails to reduce harmful outputs, making it a safer choice for industries like healthcare, finance, and education. How Claude 3 Stacks Up Against the Competition In today’s crowded AI landscape, where Microsoft Azure’s Copilot AI and Google’s Gemini 2 are vying for dominance, Claude 3 sets itself apart with its user-focused versatility. Here’s a quick comparison: Cost Efficiency: Haiku and Sonnet are priced competitively, making them attractive for small-to-medium businesses compared to the higher costs associated with GPT-5. Specialization: While GPT-5 aims to be a generalist, Claude 3’s tiered approach allows businesses to select a model tailored to their specific needs. Ethics and Safety: Anthropic’s focus on alignment ensures that Claude 3 adheres to stricter ethical guidelines, reducing the risk of misuse. That said, Anthropic still faces challenges in the form of broader integrations. While GPT-5 and Gemini 2 are deeply embedded in enterprise ecosystems like Microsoft 365 and Google Workspace, Anthropic’s partnerships remain more niche. However, their collaborations with Slack and Salesforce could be a sign of what’s to come. Adopting Claude 3 in Your Organization For executives evaluating Claude 3, here are some practical considerations: Assess Your Needs: Start by identifying the primary use case for AI in your organization. If you need customer-facing AI, Haiku is the logical choice. For internal data analysis, Sonnet or Opus may be more appropriate. Pilot Before Scaling: Deploy one of Claude 3’s models in a pilot program before committing to a full-scale rollout. This allows you to test its effectiveness and ensure alignment with your business objectives. Train Your Team: Even the most advanced AI system requires informed operators. Invest in training to help your teams understand how to maximize the value of Claude 3. Monitor Performance: Regularly review the model’s outputs to ensure they meet your expectations and adapt as necessary. Anthropic’s models are designed to learn and improve with feedback, so make the most of this feature. "The key to successful AI adoption is alignment—not just with your data, but with your organizational goals and culture."—Bart McDonough Final Thoughts: A New Era of AI Claude 3 isn’t just an incremental upgrade; it’s a rethinking of how businesses can deploy AI to solve real-world problems. By offering specialized models and multimodal capabilities, Anthropic has created a toolset that’s both versatile and powerful. Whether you’re a startup looking to streamline operations or an enterprise aiming to tackle complex challenges, Claude 3 provides a compelling solution. As the AI arms race continues to accelerate, one thing is clear: the winners will be those who can not only build the smartest models but also provide the most practical, ethical, and accessible tools. With Claude 3, Anthropic is proving it’s not just keeping pace—it’s shaping the future. ## Google Bard Becomes Gemini: What This Means for AI Users - URL: https://bartmcd.com/blog/google-bard-becomes-gemini-what-it-means-for-ai-users - Published: 2024-03-05 Google Bard Becomes Gemini: A New Era for AI Users On March 1, 2024, Google officially rebranded its AI assistant Bard as Gemini, marking a major milestone in its artificial intelligence strategy. Alongside the rebrand, the launch of Gemini Advanced introduces a staggering 1 million token context window, redefining how businesses and executives interact with generative AI. But what does this mean for users navigating the fast-evolving AI landscape? What Is Gemini and Why the Rebrand? Google’s decision to rebrand Bard as Gemini is more than a cosmetic update. The name Gemini reflects Google’s ambition to deliver AI models with “dual intelligence”—a blend of analytical precision and creative problem-solving. While Bard focused primarily on conversational AI, Gemini is designed to excel across a broader range of applications, from strategic decision-making to technical research. Why Now? The timing of this rebrand is strategic. OpenAI’s GPT-4 Turbo and Anthropic’s Claude 3 have dominated headlines in recent months, with both platforms pushing the boundaries of token limits and multimodal capabilities. Google needed a bold move to reclaim its position as a leader in the generative AI space. Gemini, with its advanced architecture and expanded capabilities, is a clear statement of intent. Key Features of Gemini Advanced 1 Million Token Context Window: This groundbreaking feature allows Gemini Advanced to process and retain context from massive datasets, documents, or conversations. For perspective, GPT-4 Turbo offers an 128,000-token context window—Gemini surpasses this by nearly eightfold. Enhanced Multimodal AI: Gemini integrates text, image, and speech processing seamlessly, enabling users to interact with data in ways that feel intuitive yet powerful. Enterprise-Level Security: With its roots in Google Cloud’s security infrastructure, Gemini Advanced includes enhanced encryption and compliance features tailored for businesses handling sensitive data. Implications for Business Users Gemini Advanced isn’t just an upgrade—it’s a game-changer for businesses. Here’s how it impacts key areas in the enterprise environment: 1. Transforming Knowledge Management The expanded token window makes Gemini Advanced ideal for analyzing large-scale documents, such as contracts, research reports, or regulatory filings. Instead of breaking content into smaller chunks, executives can now engage with entire datasets in a single prompt, receiving insights that are both comprehensive and contextually accurate. “Gemini’s 1 million token window means businesses can finally extract actionable insights from their sprawling archives without losing context in the process.” 2. Revolutionizing Productivity Tools Google has integrated Gemini into its Workspace suite, including Gmail, Docs, and Sheets. Features like AI-driven summarization and predictive analytics are now supercharged by Gemini’s advanced capabilities, enabling faster decision-making and minimizing human error. Automated meeting summaries that capture nuanced discussions. Dynamic spreadsheets with real-time forecasting powered by AI. Email drafting tools that adapt to brand tone and executive style. 3. Enhanced Strategic Planning For executives, Gemini Advanced provides a new level of strategic foresight. Its ability to simulate scenarios, analyze competitive landscapes, and assess risk means decision-makers can rely on AI not just for operational tasks but for high-stakes strategy. “AI is graduating from being a support tool to becoming a strategic advisor, and Gemini is leading this transformation.” Challenges and Considerations While Gemini Advanced represents a significant leap forward, it’s not without challenges. Businesses adopting this technology need to consider: Cost: Gemini Advanced’s capabilities come at a premium, with pricing structured to target enterprises rather than individual users. Data Privacy: Despite Google’s robust security measures, companies must ensure compliance with local and international data regulations. Learning Curve: Teams may require training to leverage Gemini’s full potential, especially when integrating its multimodal features into workflows. What’s Next for Gemini and AI? Google’s rebrand to Gemini signals its commitment to pushing the boundaries of AI innovation, but it also raises questions about the competitive landscape. How will rivals respond? Will OpenAI or Anthropic unveil their own solutions to match Gemini’s token window and enterprise focus? For businesses, the key takeaway is clear: AI is no longer just about generating text—it’s about delivering actionable insights, enhancing productivity, and driving strategic growth. Gemini Advanced is a glimpse into what’s possible when AI evolves from assistant to advisor. As AI continues to mature, leaders must stay informed about these shifts to ensure their organizations remain competitive. The era of Gemini is here, and it’s reshaping the way we work, plan, and innovate. ## Change Healthcare Breach: Why MFA Isn't Optional Anymore - URL: https://bartmcd.com/blog/change-healthcare-breach-why-mfa-isnt-optional - Published: 2024-02-28 Change Healthcare Breach: A Wake-Up Call In early 2024, it was revealed that a ransomware attack on Change Healthcare, a major provider of healthcare IT services, compromised sensitive data of over 100 million Americans. The attackers exploited weak authentication protocols, gaining access to critical systems and demanding a staggering $22 million in ransom. This breach is not just another entry in a long list of healthcare cyberattacks—it’s a stark reminder that multi-factor authentication (MFA) is no longer optional . For organizations still debating the necessity of robust authentication measures, this incident underscores the devastating consequences of inaction. MFA, often treated as a "nice-to-have," must now be viewed as a baseline requirement for cybersecurity hygiene. The Anatomy of the Change Healthcare Attack How It Happened According to post-incident reports, the attackers leveraged stolen credentials from an employee’s compromised email account. Once inside the network, they moved laterally, exploiting gaps in privileged access management and a lack of multifactor checks. Within days, they encrypted critical data and exfiltrated patient records, including Social Security numbers, medical histories, and insurance details. While Change Healthcare had implemented basic security measures, such as firewalls and endpoint protection, their failure to enforce MFA across all systems left them vulnerable to credential-based attacks. Simply put, a single stolen password created a domino effect that led to one of the most significant healthcare breaches in U.S. history. The Costs of the Breach The financial impact of the attack was catastrophic. Change Healthcare faced: $22 million in ransom payments, not to mention negotiation expenses. Regulatory fines from HIPAA violations, expected to exceed $50 million. Costs for incident response, legal fees, and patient notifications. Reputational damage, with a sharp decline in stock value and loss of client trust. Beyond financial losses, the breach disrupted healthcare services nationwide, delaying patient care and eroding confidence in digital health systems. Why MFA Is Non-Negotiable Understanding the Security Gaps Single-factor authentication, typically a username and password, is insufficient in today’s threat landscape. Passwords alone are easy targets due to: Phishing attacks: Cybercriminals craft convincing emails to steal login credentials. Credential stuffing: Reusing passwords across platforms turns one compromise into a cascading risk. Brute force attacks: Automated tools can guess weak or common passwords in minutes. MFA mitigates these risks by requiring an additional layer of verification, such as a biometric scan, a one-time passcode sent to a mobile device, or a hardware security key. Even if a password is compromised, MFA acts as a critical barrier, stopping attackers in their tracks. Lessons from Leading Organizations Companies like Microsoft and Google have long mandated MFA for both employees and customers. Their internal data shows that enabling MFA can block over 99.9% of account compromise attacks . Despite this, a 2023 report from Gartner revealed that only 45% of enterprises had fully implemented MFA across their environments. The Change Healthcare breach demonstrates that partial adoption is no longer sufficient. Cybercriminals will always target the weakest link, and organizations must close every possible door to unauthorized access. Implementing MFA: A Practical Guide Step 1: Prioritize High-Risk Accounts Not all accounts are created equal. Begin by enabling MFA for: Administrative accounts with elevated privileges. Remote access points such as VPNs and cloud platforms. Accounts handling sensitive data, like financial or patient records. This targeted approach ensures critical systems are protected while you scale MFA across the organization. Step 2: Choose the Right MFA Methods MFA options vary in security and user experience. Consider these common methods: SMS-based codes: Convenient but vulnerable to SIM-swapping attacks. Authenticator apps: Generate one-time codes on a user’s smartphone, offering a stronger alternative to SMS. Biometrics: Fingerprint or facial recognition provides high security but requires specialized hardware. Hardware tokens: Physical devices like YubiKeys offer the strongest protection against phishing and interception. For most organizations, a combination of authenticator apps and hardware tokens strikes the right balance between security and usability. Step 3: Educate and Train Your Workforce Even the most secure MFA system can fail if employees don’t understand its importance. Conduct regular training sessions to: Explain how MFA protects both the individual and the organization. Demonstrate how to set up and use MFA tools. Address common frustrations, such as lost devices or account lockouts. Empowering your workforce reduces resistance and ensures widespread adoption. Step 4: Monitor and Adapt Cybersecurity is not a one-time effort. Monitor authentication logs for unusual activity and be prepared to adapt to evolving threats. Regularly review and update your MFA policies to incorporate new technologies and address emerging risks. Looking Ahead: The Future of Authentication The Change Healthcare breach is a painful but necessary reminder that cybersecurity must evolve alongside the threats it faces. In 2024, the push for passwordless authentication is gaining momentum, with advancements in biometric and cryptographic technologies promising a future where passwords are obsolete. Until then, MFA remains a critical line of defense. Organizations that fail to adopt it risk not only financial losses but also the trust of their customers and stakeholders. As the cybersecurity landscape grows more complex, one thing is clear: MFA is no longer optional—it’s essential. “You don’t rise to the level of your goals; you fall to the level of your systems.” — James Clear In the case of Change Healthcare, their systems fell short. Don’t let yours do the same. ## Safeguarding Your Digital Footprint: Preventing Unauthorized Tracking on Your Laptop - URL: https://bartmcd.com/blog/safeguarding-your-digital-footprint-preventing-unauthorized-tracking-on-your-laptop - Published: 2024-02-20 In today's digitally driven world, our laptops serve as gateways to our personal and professional lives. They hold a treasure trove of information, from private conversations to sensitive financial data. However, this wealth of information can become a liability if it falls under the wrong gaze—particularly through unauthorized tracking software installed by someone you know. Understanding the Threat Tracking software, often referred to as spyware, can be clandestinely installed on your laptop without your knowledge. These programs can log keystrokes, monitor internet activity, access emails, and even activate the webcam or microphone to spy on you. Recognizing the signs of such software and knowing how to protect yourself is crucial in maintaining your digital autonomy. Signs of Unauthorized Tracking Unusual Performance Issues : Your laptop running slower than usual or crashing frequently can be a red flag. Strange Network Activity : Unexplained data usage or background network activities could indicate spyware transmitting data. Unfamiliar Programs or Icons : Spotting programs or icons you didn't install on your laptop might be a sign of unauthorized software. How to Protect Your Laptop 1. Keep Your Operating System and Software Updated Regular updates to your operating system and installed software are your first line of defense against vulnerabilities that can be exploited to install spyware. Enable automatic updates to ensure you're always running the latest versions. 2. Install and Update Antivirus Software Antivirus software can detect and remove spyware among other threats. Ensure you have reputable antivirus software installed on your laptop and that it's set to update automatically. 3. Be Cautious with Software Downloads Only download software from reputable sources to avoid inadvertently installing spyware. Be wary of email attachments or links from unknown sources, as these are common methods for distributing malicious software. 4. Enable Firewall Protection Both Mac and Windows come with built-in firewall protection, which can help prevent unauthorized access to your laptop. Ensure your firewall is always enabled and configured correctly. 5. Use Secure Passwords and Authentication Methods Secure your laptop with a strong, unique password and, if available, biometric authentication methods like fingerprint recognition. Change your passwords regularly and do not share them. 6. Regularly Check for Unauthorized Software Periodically review the list of installed programs on your laptop. If you find software that you don't recognize or don't remember installing, investigate further to ensure it's not spyware. 7. Cover Your Webcam Consider covering your laptop's webcam when not in use. This simple measure can prevent someone from spying on you even if they manage to compromise your laptop. Key Takeaways Update Religiously : Keep your operating system and all software up to date to protect against vulnerabilities. Install Antivirus : Use reputable antivirus software and keep it updated to detect and remove spyware. Download Wisely : Only download software from trusted sources and be cautious of email attachments and links. Enable Firewall : Make sure your laptop's firewall is always enabled to block unauthorized access. Strengthen Your Passwords : Use strong, unique passwords and change them regularly. Audit Your Software : Regularly check for and investigate unfamiliar programs installed on your laptop. Cover Your Webcam : A simple cover can prevent unwanted spying through your laptop's camera. By adhering to these guidelines, you can significantly reduce the risk of someone installing tracking software on your laptop. Protecting your digital footprint is not just about securing your data; it's about safeguarding your freedom and peace of mind in the digital age. ## Shielding Your iPhone from Unwanted Eyes: A Guide to Preventing Tracking and Spying - URL: https://bartmcd.com/blog/shielding-your-iphone-from-unwanted-eyes-preventing-tracking-spying - Published: 2024-02-14 In an age where our smartphones are extensions of ourselves, ensuring the privacy and security of these devices is paramount. iPhones, renowned for their robust security features, are not immune to threats posed by unauthorized tracking and spying software. The Risk Landscape Spyware and tracking software can be discreetly installed or injected into iPhones through various means—ranging from physical access to the device to phishing attacks. Once installed, these malicious tools can monitor your conversations, track your location, and even access your personal data without your consent. Identifying the Signs Unusual Battery Drain : Spyware can run in the background, leading to faster battery depletion. Increased Data Usage : Unexplained spikes in data usage might indicate spyware transmitting data from your device. Unexpected Behaviour : The iPhone acting erratically or displaying unfamiliar apps could be a sign of unauthorized access. Steps to Protect Your iPhone 1. Regularly Update iOS Apple frequently releases updates to iOS that address security vulnerabilities. Always ensure your iPhone is running the latest version of iOS to benefit from these protections. 2. Enable Two-Factor Authentication (2FA) for Your Apple ID 2FA adds an additional layer of security, making it harder for attackers to gain access to your Apple ID, which is central to iPhone privacy. 3. Use Strong, Unique Passwords Secure your iPhone and Apple ID with strong, unique passwords. Avoid using easily guessable information like birthdays or common words. 4. Be Cautious of Links and Attachments Phishing attacks often use links or attachments to install spyware. Be skeptical of unsolicited emails or messages, even if they appear to be from trusted sources. 5. Restrict App Permissions Regularly review the permissions granted to apps, particularly those accessing your location, microphone, camera, and contacts. Only allow necessary permissions to apps you trust. 6. Install Apps from the App Store Only The App Store has strict app review processes to minimize the risk of spyware. Avoid installing apps from unknown sources. 7. Consider Using a VPN A Virtual Private Network (VPN) can protect your online activities from being monitored, especially when connected to public Wi-Fi networks. Key Takeaways Update iOS : Keep your iPhone's operating system up to date to protect against security vulnerabilities. Strengthen Your Apple ID : Enable two-factor authentication and use strong, unique passwords. Exercise Caution : Be wary of links, attachments, and unsolicited messages to avoid phishing attacks. Audit App Permissions : Regularly review and restrict app permissions to minimize access to personal data. App Store Only : Download apps exclusively from the App Store to reduce the risk of installing spyware. Use a VPN : Consider using a VPN to encrypt your internet connection and protect your online activities. By adopting these practices, you can fortify your iPhone against unauthorized tracking and spying, ensuring that your personal information remains secure. ## Protecting Your Privacy: How to Prevent Unwanted Tracking by Loved Ones - URL: https://bartmcd.com/blog/protecting-your-privacy-prevent-unwanted-tracking-loved-ones - Published: 2024-02-04 In an era where technology intertwines deeply with our daily lives, the line between security and privacy often blurs. While the digital age brings convenience and connectivity, it also presents new challenges in maintaining our personal privacy. Understanding the Tools of Tracking Before we delve into solutions, it's crucial to understand the tools and methods that can be used for tracking: Mobile Phone Tracking Software : Applications installed on a smartphone that can track location, monitor calls, and access messages. Location Services Using Apple ID or Google Account : Services like "Find My iPhone" or Google's "Find My Device" that can track the location of your devices. Social Media Check-ins and Location Sharing : Features that allow users to share their location with friends or the public on social media platforms. Smart Home Devices : Devices connected to your home network that can indicate your presence at home. Vehicle Tracking Systems : Systems installed in vehicles that can monitor the location and sometimes even the driving habits of the driver. How to Protect Your Privacy 1. Audit Your Device Permissions Regularly review the apps on your phone and the permissions you've granted them. Ensure that only the apps you trust have permission to access your location, microphone, camera, and messages. 2. Secure Your Apple ID and Google Account Your Apple ID and Google Account are gateways to a lot of personal information, including your location. Use strong, unique passwords for these accounts and enable two-factor authentication (2FA) to add an extra layer of security. 3. Be Mindful of Social Media Settings Social media platforms can reveal a lot about your whereabouts through check-ins and location tags. Adjust your privacy settings to control who can see your posts and location information. 4. Use Privacy-Focused Tools Consider using privacy-focused apps and services that minimize data collection and tracking. For instance, use messaging apps with end-to-end encryption and browsers that do not track your online activities. Key Takeaways Conduct a Device and App Permissions Audit : Regularly check and adjust the permissions you've granted to apps on your devices. Strengthen Your Account Security : Use strong passwords and enable two-factor authentication for your Apple ID, Google Account, and other sensitive accounts. Adjust Social Media Privacy Settings : Be cautious about sharing your location on social media and review your privacy settings. Opt for Privacy-Focused Alternatives : Whenever possible, use services and apps that prioritize your privacy. By taking these steps, you can significantly enhance your privacy and protect yourself from unwanted tracking. Remember, in the digital age, being proactive about your privacy is not just a choice—it's a necessity. ## Brilliance in the Basics – 5: Data Backups and Redundancy - URL: https://bartmcd.com/blog/brilliance-basics-5-data-backups-redundancy - Published: 2023-06-05 Today, we're turning our spotlight onto a critical but often overlooked aspect of cybersecurity: Data Backups and Redundancy. 'Data Backup' refers to creating copies of your digital files that can be restored if the original data is lost or damaged. 'Redundancy' is storing these copies across different mediums or locations to ensure recovery, even if one backup is compromised. Why should you take data backups seriously? Protection Against Data Loss: From hardware failures to cyber attacks, data loss can occur unexpectedly. Regular backups ensure that you can restore your valuable data when disaster strikes. Buffer Against Ransomware: Ransomware attacks, where cybercriminals encrypt your data and demand a ransom for its return, are on the rise. Having a recent data backup allows you to restore your data without paying the ransom. Safeguarding Your Digital Legacy: Whether it's treasured family photos or important work documents, our lives are increasingly digital. Backups help protect this digital legacy. Actionable Insights Regular Data Backups: Make regular backups of your important files. Use a schedule that suits your needs—daily, weekly, or monthly. Multiple Backup Locations: Don't put all your eggs in one basket. Store backups in multiple places—on an external hard drive, a cloud service, or even a secure offsite location. Test Your Backups: Ensure your backups are working as intended by conducting regular test restores. Key Takeaways Data backups and redundancy protect against data loss, ransomware attacks, and help safeguard your digital legacy. Regular data backups, multiple backup locations, and testing your backups are crucial steps. Stay #CyberSafe! ## Brilliance in the Basics – 4: Endpoint Protection - URL: https://bartmcd.com/blog/brilliance-basics-4-endpoint-protection - Published: 2023-06-04 Today's highlight is on Endpoint Protection: a fundamental yet often neglected aspect of cybersecurity. In the world of cybersecurity, 'endpoint' refers to devices such as workstations, laptops, and mobile devices that connect to your network. Therefore, Endpoint Protection is about safeguarding these devices against cyber threats. Why endpoint protection is a big deal: Devices as Gateways: Your workstations, laptops, and mobile devices are gateways into your network. Endpoint protection acts like a sentinel, preventing malicious intruders from sneaking in. Threats on the Move: With remote work and on-the-go access, devices are used in various environments, often connecting to unsecured networks. This mobility expands the risk landscape. Advanced Threats Need Advanced Defenses: Cyber threats have become more sophisticated, making them harder to detect and counter. Actionable Insights Utilize a Comprehensive Endpoint Protection Platform: Invest in a platform like Microsoft Defender, Cylance, Norton, McAfee, or Bitdefender that provides an all-around security solution. Keep All Devices Up-to-Date: Ensure your devices are equipped with the latest software, firmware, and security patches. Educate Device Users: Imparting knowledge about endpoint protection and safe device use is crucial. Key Takeaways Devices like workstations, laptops, and mobile phones are gateways into your network, necessitating robust endpoint protection. The evolving nature of work and advanced cyber threats underscore the importance of endpoint protection. Adopting a comprehensive endpoint protection platform, regularly updating devices, and user education are crucial steps. Stay #CyberSmart, and remember – securing your endpoints means securing your digital domain. ## Brilliance in the Basics – 3: Software Updates - URL: https://bartmcd.com/blog/brilliance-basics-3-software-updates - Published: 2023-06-04 We all know the feeling—you're in the middle of a task on your device, and a notification pops up, "A new update is available." It's tempting to hit "Remind me later" and carry on with what you were doing. But here's the thing: those updates are more than annoying interruptions. They're essential protective measures for your digital life. Why are updates so important? Updates Patch Security Vulnerabilities: Software developers constantly test and tweak their products to find and fix vulnerabilities. When you install an update, you're closing off potential entry points for hackers. Updates Enhance Functionality: Updates often come with improvements to software performance and new features. Updates Ensure Compatibility: Software and apps are designed to work together. When one app gets updated and others don't, it can lead to compatibility issues. Actionable Steps Turn On Automatic Updates: Most devices and software have an option to automatically install updates. Regularly Check for Updates: Even with automatic updates turned on, it's worth manually checking for updates periodically. Don't Forget About Your Smaller Devices: It's easy to remember to update your computer or smartphone, but what about your smart TV, home security system, or other IoT devices? Be Patient: Updates can take time and might slow down your device temporarily, but the security benefits are worth the wait. Key Takeaways Updates patch security vulnerabilities, enhance functionality, and ensure compatibility. Enable automatic updates where possible and check for updates regularly. Don't neglect smaller devices like IoT devices. Be patient during updates—they're worth the wait. Stay #CyberSmart! ## Brilliance in the Basics – 2: Diverse Passwords - URL: https://bartmcd.com/blog/brilliance-basics-2-diverse-passwords - Published: 2023-06-04 This time, we're diving into a topic that touches almost every aspect of our digital lives: the importance of diverse passwords. Using different passwords for your various online accounts sounds straightforward enough, but you'd be surprised how often this crucial practice needs to be noticed. Why diverse passwords matter: Minimize Risk: When you use the same password across multiple accounts, you're essentially putting all your eggs in one basket. If one account is compromised, all your accounts are at risk. Limit Damage: If a cybercriminal does gain access to one of your accounts, having different passwords means the damage is contained to that single account. Strengthen Overall Security: Using diverse passwords makes it more challenging for cybercriminals to crack your accounts. It's like having different keys for every lock in your home. Actionable Insights Use a Password Manager: A password manager can help you create, store, and manage strong, unique passwords for all your accounts. Leverage Two-Factor Authentication: Two-factor authentication adds an extra layer of security. Even if someone cracks your password, they'll still need a second verification step. Regularly Update Your Passwords: Change your passwords periodically. And no, changing from 'Password1' to 'Password2' doesn't count! Key Takeaways Diverse passwords minimize risk, limit damage, and strengthen overall security. Use a password manager to handle the creation and storage of diverse passwords. Leverage two-factor authentication for an extra layer of security. Regularly update your passwords to stay ahead of cybercriminals. Stay #CyberSmart, and keep diversifying those passwords! ## Brilliance in the Basics – 1: Two-Factor Authentication - URL: https://bartmcd.com/blog/brilliance-basics-1-two-factor-authentication - Published: 2023-06-04 Welcome to the first part of our Brilliance in the Basics series. Today, we'll discuss the importance of configuring 2-Factor Authentication (2FA) for all your websites, not just the ones you "think" are critical. If there's anything close to a silver bullet in cybersecurity, 2FA would be it. Understanding 2-Factor Authentication 2-Factor Authentication is a security measure that requires two separate steps for verifying your identity when logging into an account. The first step typically involves entering your password, while the second step requires an additional piece of information or verification, such as a code sent to your mobile phone or a fingerprint scan. Why 2FA Matters for All Your Accounts Interconnectedness: With the growing interconnectedness of our digital lives, even seemingly insignificant accounts can pose a security risk. Cybercriminals often exploit weak points in your online presence to gain access to more valuable information. Credential stuffing: Hackers use a technique called credential stuffing, in which they use stolen credentials from one account to access other accounts that share the same username and password. Identity theft: Cybercriminals can use information from less critical accounts to build a profile of you, which can be used for identity theft or targeted attacks. Key Takeaways and Action Steps Recognize the value of 2FA: Understand that 2FA is a powerful security measure that can help protect your online presence. Set up 2FA on all your accounts: Don't just limit 2FA to your most critical accounts. Prioritize strong authentication methods: Choose robust 2FA methods, such as authentication apps or physical security keys, over less secure methods like SMS codes. Stay vigilant: Regularly monitor your accounts for suspicious activity. Stay #CyberSmart! ## Brilliance in the Basics: An Essential Cybersecurity Guide for Everyone - URL: https://bartmcd.com/blog/brilliance-in-the-basics-essential-cybersecurity-guide - Published: 2023-06-04 I'm thrilled to introduce you to our new series, "Brilliance in the Basics." This 5-part series is designed to equip you with the essential cybersecurity tips that will fortify your digital life. While the cyberspace may seem intimidating, understanding its fundamentals doesn't have to be. That's where "Brilliance in the Basics" comes in. Our goal is to make cybersecurity accessible, understandable, and most importantly, actionable for you. What You Can Expect Part 1 – Importance of Configuring 2-Factor Authentication Learn about the added layer of security that is 2-Factor Authentication (2FA) and why it's critical in protecting your online accounts. Part 2 – Importance of Diverse Passwords Understand why having diverse and strong passwords for different accounts is more than just a good practice—it's a necessity. Part 3 – Importance of Installing Updates Delve into the significance of regularly updating your devices, and how it forms a key line of defense against cyber threats. Part 4 – Importance of End Point Protection Discover how protecting your devices, from workstations to mobile devices, with antivirus software and other end point protection tools, can safeguard your digital footprint. Part 5 – Importance of Data Backups/Data Redundancy Find out why backing up your data and having redundancy measures in place can be a lifesaver in case of data loss or a cyber attack. Bonus – Importance of Freezing Your Credit Learn about this potent tool in protecting your financial identity and why you should consider it. The digital world is an integral part of our lives, and understanding its risks and safeguards is non-negotiable. Each post in the series will focus on one basic aspect of cybersecurity, explain its importance, and provide easy-to-follow steps on how you can implement it. Remember, we're all in this together. We're all part of the digital world, and we all have a role to play in securing it. Stay tuned as we embark on this cybersecurity journey together, and remember, it's not about becoming an overnight expert—it's about the brilliance in mastering the basics. Stay #CyberSmart! ## iOS 16.5: 39 Security Vulnerabilities Patched - URL: https://bartmcd.com/blog/ios-16-5-39-security-vulnerabilities-patched - Published: 2023-05-19 Let's discuss the latest iOS 16.5 update, which is crucial for the digital security of your iPhone. iOS 16.5 addresses a significant number of security vulnerabilities—39 to be precise. These vulnerabilities, if left unattended, provide potential entry points for hackers to infiltrate your device. Of these, Apple has identified three that are currently being actively exploited, meaning hackers are attempting to take advantage of these weaknesses in real-time. In cybersecurity terms, a 'vulnerability' refers to a weakness in your device's security that could potentially be exploited by hackers. 'Patching' these vulnerabilities involves reinforcing these weak points to prevent unauthorized access. 'Active exploitation' indicates that hackers are currently trying to exploit these vulnerabilities. iOS 16.5 plays a vital role in patching these vulnerable areas in your device's security. Not only is this update critical for iPhones, but it also extends to the entire Apple ecosystem, including macOS with Safari 16.5, watchOS 9.5, and tvOS 16.5. Therefore, if you utilize Apple products, installing this update is highly recommended. Key Takeaways Security Vulnerabilities and Patches: These are weak points that hackers can exploit. Patches, like the ones in the iOS 16.5 update, reinforce these weak points, keeping your device safe. Active Exploitation: This term indicates that hackers are currently trying to exploit certain vulnerabilities. It underlines the urgency to update your devices. Significance of Regular Updates: Updates aren't just for introducing new features. They also enhance your device's security and fix any existing vulnerabilities. Action Steps Update your device: Promptly install updates whenever they are available. This small step can significantly increase your device's security. Stay informed: Regularly check for updates on your devices, and take the time to read what these updates do. Practice good cybersecurity habits: Keep your devices updated, use strong, unique passwords, and stay alert to potential threats. Remember, proactive measures are essential in the digital world. Stay #CyberSmart! ## Why You Need a Password Manager: A Cybersecurity Must-Have - URL: https://bartmcd.com/blog/why-you-need-a-password-manager-cybersecurity-must-have - Published: 2023-05-19 In today's world, our digital lives hinge on a complex web of passwords. You probably juggle countless logins for everything from your work email to your favorite online shops. Remembering all these passwords is a headache, right? And let's face it, using the same password for everything isn't a solution—it's a one-way ticket to getting hacked. What is a password manager? It's a digital tool that stores all your passwords in an encrypted vault—like a secure digital diary of your passwords. You only need to remember one password (your master password) to unlock this vault, and voila, all your other passwords are at your fingertips. Pro #1: Never Forget a Password Again Password managers remember your passwords so you don't have to. The only password you need to remember is your master password. Say goodbye to those pesky "forgot your password?" prompts. Pro #2: Strong, Unique Passwords Password managers can generate complex, unique passwords for each of your accounts. That means no more resorting to weak passwords or reusing the same one for multiple accounts. Pro #3: Access Your Accounts from Anywhere You can use your password manager across all your devices. Whether you're on your laptop, smartphone, or tablet, your passwords are always just a few clicks away. Password Manager Recommendations LastPass: Popular password manager with a robust free version and comprehensive premium versions. 1Password: One of the best user interfaces, with a unique "travel mode" feature. Dashlane: Includes features like a VPN and dark web monitoring. Bitwarden: Open-source with a free version offering unlimited password storage. Keeper: Offers unlimited password storage and additional security tools. Key Takeaways A password manager stores and manages all your passwords securely. Use 2-factor authentication for added security. A password manager is part of a secure online presence, not the whole package. Stay #CyberSmart! ## Defend Your Mac: Tackling MacStealer & Atomic macOS Malware - URL: https://bartmcd.com/blog/defend-your-mac-tackling-macstealer-atomic-macos-malware - Published: 2023-05-07 In this post, we discuss a significant threat to your Mac computers: MacStealer and Atomic macOS Stealer malware . You can defend your valuable data and personal information from these digital villains with the right information. What are MacStealer and Atomic macOS Stealer? These two malware families are recent discoveries that specifically target macOS systems, stealing passwords, credit card information, and various files from infected Macs. Both malware strains work on macOS Catalina or later and can infect Intel or Apple Silicon chips. How do they work? MacStealer and Atomic macOS Stealer extract credentials and browser cookies from popular browsers like Firefox, Google Chrome, and Brave. They also target the macOS Keychain database, a place where your Mac stores sensitive information, such as passwords and credit card details. These malicious programs then send the stolen data to the attacker via messaging service Telegram. How can I protect myself? Keep your macOS up to date: Regularly update your Mac to the latest version and install security patches. Only download from trusted sources: Download and install software only from the official Apple App Store or other reputable sources. Use antivirus and internet security software: Install a reliable antivirus and security software package. Use diverse passwords and multi-factor authentication: Choose complex passwords and enable multi-factor authentication wherever possible. Be cautious with email links and attachments: Think twice before opening links or attachments received via email. Watch out for unusual password prompts: If you see a password prompt that looks different from the usual macOS prompts, be suspicious. By following these simple steps, you can keep your Mac safe from the ever-evolving threats in the digital world. Stay vigilant and stay protected! ## Keep Your iPhone Safe with Lockdown Mode - URL: https://bartmcd.com/blog/keep-your-iphone-safe-with-lockdown-mode - Published: 2023-04-26 Are you worried about the security of your iPhone? With cyber criminals constantly finding new ways to target phones, it's crucial to stay vigilant. Apple has you covered with its Lockdown Mode, introduced in iOS 16. This feature adds an extra layer of security to your device by blocking potential attack vectors. What is Lockdown Mode? Lockdown Mode is an advanced security feature on iPhones that reduces the attack surface of your device. It does so by blocking certain attachment types in messaging, disabling link previews, canceling FaceTime calls from unknown numbers, and more. This mode makes it more difficult for hackers to exploit vulnerabilities in your iPhone. How to Enable Lockdown Mode Open the Settings app. Scroll down to Privacy & Security. Tap on Lockdown Mode and enable the toggle. Who Should Use Lockdown Mode? Lockdown Mode is an excellent security feature for those who may be at a higher risk of targeted cyberattacks, such as journalists, activists, business executives, or public figures. However, anyone who wants to enhance their iPhone's security can benefit from enabling Lockdown Mode. Additional Security Tips Always update your software: Download software updates as soon as they are released. Be cautious with links: Avoid clicking links from unknown senders. Enable biometric authentication: Use Face ID or Touch ID wherever possible. Avoid unknown Wi-Fi networks: Public networks can be exploited by hackers. Turn off Bluetooth when not in use: This prevents hackers from exploiting Bluetooth vulnerabilities. Monitor app permissions: Check which apps have access to system privileges. Stay #CyberSmart and protect your personal information with these easy-to-implement security measures. ## AI vs. Your Passwords: How to Safeguard Your Online Accounts - URL: https://bartmcd.com/blog/ai-vs-your-passwords-safeguard-online-accounts - Published: 2023-04-21 I want to discuss a critical topic that impacts us all: password security. In the age of ever-evolving technology, AI is revolutionizing the way hackers can crack passwords, making our online accounts more vulnerable than ever. A recent study revealed that an AI-based password-cracking tool called PassGAN managed to compromise an alarming 51% of passwords in under a minute. Understanding PassGAN: AI-Powered Password Cracking PassGAN (password generative adversarial network) is an advanced AI tool that significantly speeds up the password cracking process. Unlike traditional methods that rely on manual analysis of leaked password databases, PassGAN autonomously learns the distribution of real passwords from actual password leaks. This makes it incredibly efficient, cracking 71% of passwords in less than a day and 81% in less than a month. Strengthening Your Password: Stay Ahead of AI To protect ourselves from AI-driven password-cracking tools, we must use strong passwords that are difficult to crack. Passwords with 12 or more characters, including upper and lowercase letters, numbers, and symbols, are the most effective. A password with 18 characters that include both letters and numbers is currently safe from AI cracking. Key Takeaways: Keep Your Passwords Cyber Smart Embrace long, complex passwords : Use at least 12 characters, combining upper and lowercase letters, numbers, and symbols. An 18-character password with letters and numbers is ideal. Enable 2FA/MFA : Two-factor authentication (2FA) or multi-factor authentication (MFA) adds an extra layer of security to your accounts. Opt for non-SMS-based methods when possible. Avoid password reuse : Using unique passwords for each account minimizes the risk of multiple account breaches if one password is compromised. Use auto-generated passwords : Many password managers can generate strong, random passwords for you, making it easier to maintain secure accounts. Update passwords regularly : Change your passwords periodically, particularly for sensitive accounts like email and banking. Stay away from public WiFi : Refrain from using public WiFi networks, especially for accessing sensitive accounts like banking or personal email. As AI continues to advance, it's crucial for us to stay informed and adapt our password habits to keep our accounts safe. By following the takeaways outlined above, we can better protect ourselves from AI-driven password-cracking tools like PassGAN. Stay #cybersmart and safeguard your online presence. ## Apple Cash Scams: How to Recognize and Avoid Them - URL: https://bartmcd.com/blog/apple-cash-scams-recognize-avoid - Published: 2023-04-20 Apple Cash has made it incredibly convenient to send and receive money instantly. However, it's important to be cautious and understand how to recognize common scams to keep your financial transactions secure. Use Apple Cash Wisely Apple Cash is designed for transactions between people you know and trust. So, to keep your Apple Cash experience safe and secure, only send and receive money with familiar contacts. Apple provides warnings when you attempt to send money via Apple Cash to someone outside your contacts or if a transaction is considered risky. Pay close attention to these warnings and exercise caution when making payments. Common Scams to Watch Out For Don't send money for items you haven't received – Be cautious when making purchases online, particularly in peer-to-peer marketplaces. Always ensure that you receive the item before sending payment. Don't send money in exchange for a check – Scammers often ask for Apple Cash payments in exchange for a check that eventually bounces. Be wary of scammers posing as employees – Legitimate businesses and government agencies will never request payment via Apple Cash. Don't send money to fake tech support – Apple will never ask for your Apple ID password, verification codes, or account security details. Key Takeaways Only use Apple Cash with people you know and trust. Heed Apple's warnings about risky transactions. Never send money in exchange for a check. Verify the identity of anyone claiming to represent a business or government agency. Don't share personal information or send money to "tech support." By following these guidelines, you can confidently use Apple Cash while protecting yourself from common scams. ## iPhone Users: Be Aware of Juice Jacking - URL: https://bartmcd.com/blog/iphone-users-be-aware-of-juice-jacking - Published: 2023-04-17 In today's fast-paced, technology-driven world, it's hard to imagine going a day without your mobile phone. That's why public charging stations at airports, hotels, and shopping centers can be a lifesaver when you're on the go. But did you know these charging stations can also pose a serious cybersecurity threat? What is Juice Jacking? "Juice jacking" is a term referring to the practice of hacking into phones through USB cables at public charging stations to steal data or infect devices with malware. Criminals design these fake charging stations to look like legitimate ones, easily tricking unsuspecting users. The Growing Threat Juice jacking has existed for years, but the recent rise in travel after easing COVID-19 restrictions may be increasing its prevalence. As more people rely on public charging stations, cybercriminals have more opportunities to exploit unsuspecting users. Protecting Yourself from Juice Jacking Carry your own portable battery charger: A personal power bank can keep your phone charged without relying on public stations. Use a USB data blocker: These devices, also known as "USB condoms," connect to your phone's charging cable and prevent data transfer while charging. Plug into wall sockets: Charge your device using a wall plug-in socket whenever possible, as it is less likely to be compromised. Power off your device: If you must use a public charging kiosk, completely power off your device before plugging it in to minimize the risk of data theft. Follow these simple guidelines to significantly reduce the risk of juice jacking and ensure the security of your mobile device. Stay cyber smart! ## Rorschach Ransomware: A Sophisticated Threat on the Horizon - URL: https://bartmcd.com/blog/rorschach-ransomware-sophisticated-threat-horizon - Published: 2023-04-13 The cybersecurity landscape is ever-changing, and the emergence of new threats is a constant challenge for professionals in the field. The latest addition to the list of dangerous ransomware is Rorschach, an incredibly fast and sophisticated malware that raises the bar for cyberattacks. A Lightning-Fast Ransomware The most notable aspect of Rorschach ransomware is its unprecedented encryption speed. According to Check Point Research, Rorschach can encrypt 220,000 local drive files in just four and a half minutes, making it nearly twice as fast as the notorious LockBit 3.0 malware. This increased speed means that victims have even less time to react and defend their systems before their data is locked away. The Patchwork of Techniques Rorschach combines the most effective techniques from various known ransomware strains, making it a formidable and highly customizable threat. Some of the borrowed features include autonomously carrying out tasks, a hybrid-cryptography scheme, and borrowed ransom notes from other ransomware families. Key Takeaways and Action Steps Maintain regular backups: Ensure that you have up-to-date backups of your critical data stored in a secure location, preferably offline. Implement robust cybersecurity measures: Deploy a comprehensive cybersecurity solution, including advanced threat detection and response capabilities. Keep software and systems updated: Regularly update your operating systems, software, and firmware. Educate employees: Ensure that your employees are aware of the risks associated with ransomware. Develop an incident response plan: Have a well-defined incident response plan in place. Rorschach ransomware is a stark reminder of the relentless evolution of cyber threats. By taking a proactive approach to cybersecurity, organizations can better protect themselves against this sophisticated menace. ## The Asymmetrical Impact of AI on Cybersecurity - URL: https://bartmcd.com/blog/asymmetrical-impact-ai-on-cybersecurity - Published: 2023-04-06 As technology evolves, so does the realm of cybersecurity. With the rapid advancements in Artificial Intelligence (AI), we're witnessing a significant shift in the landscape. AI has been hailed as a game-changer in many sectors, and cybersecurity is no exception. AI's Impact on Cybersecurity Offense (The Bad Guys) AI is undoubtedly playing a crucial role in enhancing the capabilities of cybercriminals: Phishing emails: AI-powered tools can create more sophisticated and convincing phishing emails that are harder to detect. Malware development: AI can help create malware that is more effective, adaptable, and stealthy. Exploiting vulnerabilities: AI can efficiently and quickly find vulnerabilities in software. Challenging verification systems: AI-driven attacks can bypass traditional verification methods. AI's Impact on Cybersecurity Defense (The Good Guys) On the flip side, AI is also providing cybersecurity professionals with more advanced tools: Spam and phishing detection: AI can improve the detection of spam and phishing emails. Vulnerability identification: AI can help identify vulnerabilities in code and even fix them automatically. Dynamic patching: AI can dynamically patch code as new vulnerabilities are detected. Enhanced SOC analysis: AI can help Security Operations Center analysts better understand their environments. The Asymmetry in AI Deployment While AI is revolutionizing both offense and defense in cybersecurity, there is a significant asymmetry in its deployment. The speed at which AI technology is adopted by cybercriminals is outpacing the defensive measures taken by organizations and individuals. Large organizations may have the resources to implement AI-driven cybersecurity defense technologies, but small and medium businesses, as well as individuals, are often left behind. This lag in deployment can leave them more vulnerable to cyberattacks. Key Takeaways The advent of AI in cybersecurity is a double-edged sword. Businesses and individuals must prioritize cybersecurity and invest in AI-driven solutions to level the playing field. Collaboration between organizations, cybersecurity vendors, and government agencies is crucial to ensure that defensive measures keep pace with the ever-evolving threats. ## Pinduoduo: Malware in a Mainstream App - URL: https://bartmcd.com/blog/pinduoduo-malware-mainstream-app - Published: 2023-04-05 As working professionals, we rely on our smartphones and apps for various tasks. From shopping to communication, we trust these apps with our personal information. But what if one of the most popular apps you use daily is hiding a dark secret? A Dangerous Discovery Pinduoduo, a popular shopping app in China with over 750 million users per month, has been found to contain malware capable of bypassing phone security, monitoring activities on other apps, reading private messages, and altering settings. Cybersecurity experts have called this discovery "highly unusual" and "pretty damning" for the e-commerce giant. How Pinduoduo Exploited Android Vulnerabilities The malware found in Pinduoduo specifically targeted Android-based operating systems from various manufacturers such as Samsung, Huawei, Xiaomi, and Oppo. By exploiting approximately 50 Android system vulnerabilities, Pinduoduo was able to gain access to user locations, contacts, calendars, notifications, and photo albums without consent. The Consequences As a result of these revelations, Google suspended Pinduoduo from its Play Store in March, and the company has faced intense scrutiny and criticism. The presence of such dangerous malware in a mainstream app has raised serious concerns about data security and privacy. Key Takeaways and Action Steps Be cautious when downloading and using apps, even from reputable sources. Always research the app and its developer before installation. Regularly update your phone and apps to the latest versions, which may contain security patches and fixes. Be mindful of the permissions you grant to apps. Only give necessary permissions that align with the app's purpose. If you use an Android device, use security software on your smartphone to protect against malware and other threats. Stay informed about the latest cybersecurity news and developments to better protect yourself and your data. The Pinduoduo case is a stark reminder that even popular and seemingly trustworthy apps can pose significant risks to our data and privacy. ## Pegasus Malware: A Cyber Threat You Can't Afford to Ignore - URL: https://bartmcd.com/blog/pegasus-malware-cyber-threat-cant-ignore - Published: 2023-04-03 You might have heard about the notorious Pegasus malware in the news. It's been making headlines for its high-profile targets, like journalists, activists, and government officials. But here's the thing: Pegasus isn't just a threat to the big players. It's something that should concern individuals and private businesses of all sizes. What is Pegasus, and why should you care? Pegasus is a powerful spyware developed by the Israeli cyber-intelligence firm NSO Group. Once installed on a target's device, it can access emails, texts, call logs, and even turn on the microphone and camera for real-time surveillance. Talk about a privacy nightmare! While it was initially designed to help governments combat terrorism and crime, Pegasus has been allegedly used for more nefarious purposes, such as spying on journalists, activists, and political dissidents. But don't let that fool you into thinking you're safe. The truth is, Pegasus can infiltrate anyone's device, and it's constantly evolving to become more sophisticated and harder to detect. Why Pegasus matters to individuals and private businesses Cybercriminals are opportunists. If they can get their hands on your sensitive data, they won't hesitate to exploit it for financial gain or other malicious purposes. For private businesses, the stakes are even higher. A Pegasus infection could lead to stolen intellectual property, compromised customer data, or corporate espionage. Key takeaways and action steps Update your devices: Always keep your devices and software up-to-date with the latest security patches. Be cautious with links and attachments: Be wary of clicking on unknown links or downloading attachments from unfamiliar sources. Use unique passwords and enable two-factor authentication (2FA): These measures make it more difficult for attackers to gain access to your accounts. Monitor your digital footprint: Regularly check your online accounts and devices for any signs of unauthorized access. Educate your team: If you run a business, make sure your employees are aware of the risks associated with Pegasus and other forms of malware. Consider cybersecurity insurance: For businesses, having a comprehensive cybersecurity insurance policy can help mitigate the financial impact of a cyber attack. In today's interconnected world, no one is immune to cyber threats like Pegasus. But by taking these steps, you can greatly reduce your risk and keep your digital life secure. Stay cyber smart! ## Leading Through Uncertainty - URL: https://bartmcd.com/blog/leading-through-uncertainty - Published: 2022-04-17 Leading Through Uncertainty: Five Frameworks to Navigate Market Volatility Without Losing Momentum Uncertainty in the market is not a new phenomenon, but its frequency and intensity have magnified in recent years. Economic upheavals, geopolitical tensions, and rapid technological advancements have created an unpredictable landscape for business leaders. For C-suite executives and business leaders, the challenge isn't just surviving these turbulent times; it's about thriving while keeping your team motivated and focused. In this article, I’ll share five frameworks that can help you lead confidently through uncertainty and empower your team to stay productive, resilient, and innovative. 1. Prioritize Transparent Communication Uncertainty breeds fear, and fear thrives in the absence of information. As a leader, one of your most critical roles during volatile times is ensuring open and transparent communication. This doesn’t mean sugarcoating challenges; it means presenting facts, discussing risks, and sharing your vision with clarity. Hold regular town halls to keep employees informed about market changes and organizational strategies. Create an open-door policy where team members can ask candid questions without fear of judgment. Share the "why" behind key decisions to build trust and alignment across the organization. “Transparency isn’t just about sharing information; it’s about fostering trust and showing your team that you’re navigating uncertainty together.” 2. Focus on What You Can Control Market volatility often leads to a fixation on external factors beyond your control. While it’s essential to stay informed, obsessing over uncontrollable variables can paralyze decision-making. Instead, focus your energy on the areas where you can make a tangible impact. Revisit your organization's core values and ensure they guide your decision-making process. Identify internal efficiencies that can be improved, such as streamlining operations or enhancing customer experiences. Empower your team to focus on their sphere of influence, whether it’s delivering excellent service or innovating within their roles. By emphasizing controllable factors, you can reduce anxiety and redirect energy toward productive outcomes. 3. Cultivate a Resilient Mindset Uncertainty tests not just your strategy but your mindset. As a leader, you set the tone for how your organization reacts to challenges. Cultivating resilience within yourself and your team is essential to maintaining momentum during turbulent times. Encourage a growth mindset by reframing challenges as opportunities for learning and innovation. Lead by example—show calmness, adaptability, and optimism in the face of adversity. Provide resources and training for stress management and emotional resilience within your workforce. “Resilience isn’t about avoiding challenges; it’s about facing them head-on with confidence and adaptability.” 4. Maintain Strategic Agility Rigid plans can become liabilities during periods of rapid change. Strategic agility allows you to pivot when necessary, adapt to new realities, and seize emerging opportunities. However, agility requires preparation—not reactive scrambling. Implement scenario planning to anticipate various outcomes and prepare contingency strategies. Build cross-functional teams to foster collaboration and speed decision-making. Adopt iterative processes to test new initiatives on a small scale before scaling them across the organization. By embedding agility into your strategy, you can turn uncertainty into a competitive advantage. 5. Inspire Through Vision and Values During uncertain times, employees look to leadership for direction and reassurance. A clear and inspiring vision is the anchor that keeps teams grounded and motivated. Paired with strong values, it provides a sense of purpose that transcends the chaos. Regularly articulate your vision and remind your team why their work matters. Demonstrate your commitment to core values through action, not just words. Celebrate small wins to reinforce progress and boost morale. “A compelling vision isn’t just about where you’re going—it’s about why you’re going there and how you’ll get there together.” Conclusion: Leading With Confidence in Uncertain Times Market volatility and economic uncertainty are inevitable, but they don’t have to derail your organization’s momentum. By prioritizing transparent communication, focusing on controllable factors, cultivating resilience, embracing agility, and inspiring through vision and values, you can lead your team with confidence and clarity. Remember, leadership during uncertainty isn’t about having all the answers; it’s about creating an environment where your team feels empowered to navigate challenges alongside you. Call to Action: If you’re ready to transform uncertainty into opportunity, start by evaluating how these five frameworks align with your current leadership practices. Which areas can you strengthen today? Share this article with your leadership team and begin the conversation about how to lead effectively in the face of uncertainty. ## Agio's 10-Year Anniversary: Letter from CEO, Bart McDonough - URL: https://bartmcd.com/blog/agios-10-year-anniversary-letter-from-ceo - Published: 2020-01-15 Ten years ago today, I was fortunate enough to have an opportunity to turn an idea into a strategy, coupled with a culture, which resulted in Agio. With an established culture, more than 275 employees and over 300 clients, Agio is focused on our vision to deliver the most secure and reliable information systems to the world's most prestigious entities. We live this vision every day through the hard work, dedication and commitment of our employees, who care deeply about the impact they have on our clients' lives. Agio's journey has been one of "add, tweak, delete," a phrase we often use internally. It has been an evolutionary experience filled with missteps, disappointments, and growing pains. It has also been a story of progress, triumph, and inspiration. And so, it is with the deepest sense of gratitude I thank you for standing by us with constructive support as we've embraced our guiding principle of making today better than yesterday. Since our founding, we have leveraged this #BeBetter philosophy to grow tremendously across many different benchmarks—some quantifiable and tangible, others more ethereal. In 2013, Agio changed the game with our purchase of Secure Enterprise Computing , a cybersecurity services and consulting company, effectively merging IT and cybersecurity under one roof in preparation for the next generation of managed services. In 2016, recognizing the evolution of cyber threats, we launched our Cybersecurity practice, which today helps our clients build, test, and monitor their defenses, culminating in what we call "resiliency." In 2019, Agio expanded its geographic footprint and services menu through the acquisition of Intersection, a cybersecurity consulting firm, and established a strong presence in the Mid-Atlantic U.S. market. And most recently, we continue to push boundaries with the forthcoming release of our AI-powered IT and cybersecurity platform, Agio Intelligence, which leverages our decades of data to unlock previously unavailable analytics and problem resolution for our clients' unique environments. This progressive service portfolio and Agio's market adaptability is driven by who we are and how we've done business over the last ten years. Our identity is a workplace which prioritizes employee engagement, client loyalty, and business growth through the lens of culture. In fact, one of the most critical moments in our company's ten-year history occurred in 2017, when, with the help of partners and specialists, we paused to define our core values, beliefs, and purpose. And from this process emerged Agio's Culture Code, which includes values such as "Be Invested" and "Be Passionate." This framework, known internally as our Core Four values, has served as both a beacon and a filter—attracting individuals who align with our principles and guiding decisions in moments of uncertainty. In addition to Agio's culture, when I look back over this past decade, I am most proud of the individuals who have grown in their careers here. The names and stories of so many who have evolved both personally and professionally at Agio are a reminder we are not just building a company, we are building livelihoods; we are building experiences; and most importantly, we are building relationships which will far outlast today. I am excited for the future, to embrace new challenges as Agio realizes its potential to become a next-generation Managed Services Provider focused on delivering resiliency to our clients through secure and reliable services. We've accomplished a tremendous amount together over the last ten years, and I look forward to where the next ten will take us. Thank you for your partnership – we couldn't have made it here without you. Cheers to us and the community we continue to build! ## Understanding GDPR: What the Financial Services Community Needs to Know - URL: https://bartmcd.com/blog/understanding-gdpr-financial-services-guide - Published: 2018-05-18 In May 2018, the General Data Protection Regulation (GDPR) came into effect, heralding a new era of data protection and privacy across the European Union. For the financial services community, understanding and complying with GDPR is not just a regulatory requirement—it's a cornerstone of maintaining trust and integrity in an increasingly data-driven world. The Essentials of GDPR GDPR is a comprehensive data protection law that affects any organization that processes the personal data of individuals within the EU. Its primary goals are to give individuals more control over their personal data and to standardize data protection laws across Europe. Here are some key aspects that financial services providers must understand: Data Subject Rights: Individuals have enhanced rights under GDPR, including the right to access, rectify, and erase their personal data. Financial institutions must be prepared to respond to these requests promptly. Lawful Basis for Processing: Organizations must have a lawful basis for processing personal data. This could be consent, contractual necessity, legal obligation, vital interests, public task, or legitimate interests. Data Protection by Design and Default: GDPR requires that data protection measures are integrated into the design of systems and processes, ensuring privacy is considered at every stage. Data Breach Notification: In the event of a data breach, organizations must notify the relevant authorities within 72 hours and potentially inform the affected individuals. "GDPR is not just about compliance; it's about cultivating trust and transparency in how we handle personal data." - Bart McDonough Challenges and Implications for Financial Services The financial services industry is uniquely positioned in the GDPR landscape due to the volume and sensitivity of the data it handles. Here are some specific challenges and implications: Data Inventory and Mapping: Financial services firms must have a clear understanding of what personal data they hold, where it is stored, and who has access to it. This requires comprehensive data inventory and mapping exercises. Third-Party Management: Many financial services rely on third-party vendors. Ensuring these partners are also GDPR-compliant is crucial, necessitating thorough due diligence and contractual safeguards. Cross-Border Data Transfers: GDPR imposes strict regulations on transferring personal data outside the EU. Financial institutions must carefully evaluate and implement appropriate mechanisms for such transfers. Practical Steps for Compliance Achieving GDPR compliance is a significant undertaking, but it is manageable with a structured approach. Here are some practical steps for financial services providers: Conduct a GDPR Readiness Assessment: Evaluate your current data protection practices against GDPR requirements to identify gaps and areas for improvement. Develop a Compliance Plan: Create a detailed roadmap that outlines the steps needed to achieve compliance, including timelines and responsibilities. Train and Educate Staff: Ensure that all employees are aware of GDPR obligations and understand their role in maintaining compliance. Implement Technical and Organizational Measures: Deploy appropriate security measures, such as encryption and access controls, to protect personal data. Establish a Data Breach Response Plan: Develop a clear and efficient process for identifying, reporting, and mitigating data breaches. Conclusion: Embrace GDPR as an Opportunity While GDPR presents challenges, it also offers significant opportunities for the financial services community to enhance data management practices and strengthen customer trust. By embracing GDPR as more than a compliance obligation, organizations can position themselves as leaders in data protection and privacy. As we continue to navigate the complexities of data regulation, remember that compliance is an ongoing journey. Stay informed, stay proactive, and above all, keep the trust of your clients at the forefront of your efforts. For further insights and guidance, consider engaging with cybersecurity experts to ensure your organization remains at the cutting edge of data protection.